FCSS - Public Cloud Security 7.6 Architect (FCSS_CDS_AR-7.6) Free Practice Test

Question 1

Which statement about Amazon Web Services (AWS) Transit Gateway is true for SD-WAN transit gateway (TGW) Connect with FortiGate?

A. The Generic Routing Encapsulation (GRE)-based tunnel attachments are slower than IPsec tunnels.

B. The TGW plugin must be used with a VPN to achieve higher bandwidth.

C. Attaching a virtual private cloud (VPC) to the TGW automatically adds new routes to the subnet route table.

D. TGW supports BGP to share routes with FortiGate.

Correct Answer: C

Question 2

Refer to the exhibit. A Managed Security Service Provider (MSSP) administration team is trying to deploy a new HA cluster in Azure to filter traffic to and from a client that is also using Azure.
However, every deployment attempt fails, and only some of the resources are deployed successfully. While troubleshooting this issue, the team runs the command shown in the exhibit.
What are the implications of the output of the command?

A. The team will not be able to deploy an active-active (A-A) FortiGate HA cluster with Azure Load Balancer.

B. The team will not be able to deploy an active-passive (A-P) FortiGate high availability (HA) cluster with SDN connector.

C. The team will not be able to deploy an A-P FortiGate HA cluster with Azure Load Balancer.

D. The team will not be able to deploy an A-P FortiGate HA cluster with Azure Gateway Load Balancer.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit. In which type of FortiCNP insights can an administrator examine the findings triggered by this policy?

A. Data

B. Risk

C. User activity

D. Threat

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Refer to the exhibit. After the initial Terraform configuration in Microsoft Azure, the terraform plan command is run. Which two statements about running the terraform plan command are true?
(Choose two.)

A. You cannot run the terraform apply command before the terraform plan command.

B. The terraform plan command makes Terraform do a dry run.

C. The terraform plan command will deploy the rest of the resources except the service principal details.

D. You must run the terraform init command once, before the terraform plan command.

Correct Answer: B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit. A team of AWS administrators is in the process of installing a FortiWeb ingress controller to protect containerized web applications in an Amazon Elastic Kubernetes Service (EKS) cluster. While customizing the manifest file in the image, they realize that they do not know the correct value to enter in the fortiweb-loginfield.
How can they determine he correct value for this field?

A. They can find the expected value in the manifest file used to deploy the pods.

B. The correct value is the password of the FortiWeb admin account.

C. They can refer to the output of the EKS cluster deployment.

D. They must create a Kubernetes secret with the kubectlcommand.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit. In your Amazon Web Services (AWS), you must allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet. However, your HTTPS connection to the FortiGate VM in the Customer VPC is not successful.
Also, you must ensure that the Customer VPC FortiGate VM sends all the outbound internet traffic through the Security VPC.
How do you correct this issue with minimal configuration changes? (Choose three.)

A. Deploy an internet gateway, attach it to the Customer VPC, and then associate an EIP with port1 of the FortiGate in the Customer VPC.

B. Add a route with your local internet public IP address as the destination and the transit gateway as the target.

C. Add a route to the destination 0.0.0.0/0 with the transit gateway as the target.

D. Add a route with your local internet public IP address as the destination and the internet gateway as the target.

E. Deploy an internet gateway, associate an EIP with the Customer VPC private subnet, and then add a new route with destination 0.0.0.0/0 with the internet gateway as the target.

Correct Answer: A,C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

An administrator would like to use FortiCNP to keep track of sensitive data files located in the Amazon Web Services (AWS) S3 bucket and protect it from malware. Which FortiCNP feature should the administrator use?

A. FortiCNP Threat Detection policies

B. FortiCNP Data Scan policies

C. FortiCNP Risk Management policies

D. FortiCNP Compliance policies

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Refer to the exhibit. An administrator deployed an HA active-active load balance sandwich in Microsoft Azure. The setup requires configuration synchronization between devices.
What can you conclude from the configured settings shown in the exhibit? (Choose two.)

A. FortiGate-VM instances are scaled out automatically according to predefined workload levels.

B. FortiGate A and FortiGate B are two independent devices.

C. It does not synchronize the FortiGate hostname.

D. By default, FortiGate uses FGCP.

Correct Answer: C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Fortinet FCSS - Public Cloud Security 7.6 Architect (FCSS_CDS_AR-7.6) Free Practice Test