FCP-WCS-AD-7-4 sample questions

Question 1

A startup is deploying its first web application on AWS and requires basic web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting (XSS). The company has a limited budget and no dedicated security staff to manage a full WAF appliance. Which Fortinet solution is the most cost-effective and simplest to deploy for this requirement?

Accepted Answer

Using AWS WAF with Fortinet Managed Rules.

Answer

Deploying a FortiWeb VM from the AWS Marketplace.

Answer

Subscribing to FortiWeb Cloud.

Answer

Deploying FortiGate CNF with WAF profiles.

Question 2

A DevSecOps team wants to automate security responses for newly discovered vulnerabilities on their EC2 instances. They are using AWS Inspector to scan instances and have configured a FortiGate with an SDN connector. Which two actions can be automated using the AWS SDN connector when AWS Inspector reports a high-severity vulnerability on an EC2 instance? (Select TWO)

Accepted Answer

Dynamically add the EC2 instance's IP address to a 'Quarantine' address group on the FortiGate.

Accepted Answer

Apply a specific IPS profile to traffic originating from the vulnerable EC2 instance.

Answer

Automatically patch the operating system of the vulnerable EC2 instance.

Answer

Terminate the vulnerable EC2 instance automatically.

Answer

Create a snapshot of the EC2 instance's EBS volume for forensic analysis.

Question 3

When configuring a FortiGate Active-Passive cluster in AWS using FGCP, the heartbeat communication must be established. Because AWS environments do not support Layer 2 mechanisms like broadcast or multicast, the FGCP configuration must be set to `________`.

Accepted Answer

unicast

Answer

multicast

Answer

broadcast

Answer

anycast

Question 4

An e-commerce company is using FortiWeb Cloud to protect its primary application, which is hosted behind an AWS Application Load Balancer (ALB). To route traffic through FortiWeb Cloud for inspection, what critical DNS change must be made for their public domain `www.ecom-store.com`?

Accepted Answer

Change the `www` DNS record to be a CNAME pointing to the unique hostname provided by FortiWeb Cloud.

Answer

Change the `www` A record to point to the FortiWeb Cloud IP address.

Answer

Create a new `fortiweb.ecom-store.com` A record pointing to the ALB's IP address.

Answer

Create an MX record for `www.ecom-store.com` that points to the FortiWeb Cloud hostname.

Question 5

A financial services company, FinSecure, is migrating its applications to a multi-VPC architecture in AWS. They have strict compliance requirements to inspect all east-west traffic between their 'Staging' and 'Production' VPCs, and all egress traffic to the internet from both VPCs. The security team must maintain stateful sessions and have centralized logging for audits. They want to avoid complex routing changes within the application VPCs.

The current setup involves a Transit Gateway connecting the VPCs. The security team has experience with FortiGate appliances and wants to leverage them in the cloud. Performance is critical, and the solution must scale horizontally without manual intervention. Centralized policy management is a key requirement from their existing FortiManager.

Which architecture best meets FinSecure's requirements for transparent, scalable, and stateful inspection?
```mermaid
graph TD
subgraph Central_Security_VPC
TGW_Attachment --- GWLB[Gateway Load Balancer]
GWLB --- FG_ASG[FortiGate Auto Scaling Group]
end

subgraph Spoke_VPC_Staging
App_Staging[Staging App] --> TGW_Attachment_Staging
end

subgraph Spoke_VPC_Production
App_Prod[Production App] --> TGW_Attachment_Prod
end

TGW[Transit Gateway] -- routes to --> TGW_Attachment
TGW_Attachment_Staging --> TGW
TGW_Attachment_Prod --> TGW
Internet((Internet)) -- egress --> TGW
```

Accepted Answer

Create a central security VPC attached to the Transit Gateway. Use a Gateway Load Balancer (GWLB) with a target group of auto-scaling FortiGate VMs. Configure the Transit Gateway route table to send all traffic to the security VPC for inspection.

Answer

Deploy a FortiGate VM in each application VPC and use VPC peering. Manage policies individually.

Answer

Deploy an Active-Passive FortiGate HA pair in a central security VPC and route all traffic from the Transit Gateway through it using static routes.

Answer

Deploy FortiGate CNF in the same region and associate it with the application VPCs. Use AWS Firewall Manager for policy enforcement.

Question 6

True or False: In a FortiGate Active-Passive HA cluster deployed across two different AWS Availability Zones, both the primary and secondary FortiGate instances require a public IP address to be active simultaneously for failover to function correctly.

Accepted Answer

False

Answer

True

Question 7

A large enterprise with hundreds of FortiGate VMs deployed across multiple AWS regions wants to enforce a consistent security policy baseline. They need to ensure that specific compliance rules, such as blocking outbound traffic to known malicious IPs, are applied to all FortiGates, while still allowing regional teams to add their own specific policies. How can this be achieved most efficiently using FortiManager?

Accepted Answer

In the Global ADOM, create a policy package with the baseline compliance rules and apply it to all subordinate ADOMs.

Answer

Create a separate ADOM for each region and manually copy the baseline policies to each one.

Answer

Use a script to push a baseline configuration file directly to each FortiGate VM, bypassing FortiManager for baseline rules.

Answer

Create a single ADOM for all FortiGates and give regional teams read-only access to the baseline policies.

Question 8

A network administrator is setting up a new VPC in AWS for a three-tier application. They need to ensure that the database servers in the private subnet can download security patches from the internet without being directly accessible from the internet. Which AWS component is required in the public subnet to facilitate this one-way internet access?

Accepted Answer

NAT Gateway

Answer

Internet Gateway (IGW)

Answer

Virtual Private Gateway (VGW)

Answer

Application Load Balancer (ALB)

Question 9

An organization has deployed FortiGate CNF. A central security team uses FortiManager for global policy management, and a separate cloud operations team prefers using native AWS tools. How can both teams manage the FortiGate CNF rule sets without creating conflicts?

Accepted Answer

By integrating FortiManager with AWS Firewall Manager, allowing policies from both to be enforced hierarchically.

Answer

It is not possible; only one management platform can be used at a time.

Answer

By using FortiManager for all rule sets and providing the cloud team with read-only access to the AWS console.

Answer

By configuring AWS Firewall Manager to periodically import rules from a FortiManager API endpoint.

Question 10

In an AWS environment, what is the primary mechanism that a secondary FortiGate unit in an A-P cluster uses to redirect traffic to itself after detecting a failure of the primary unit?

Accepted Answer

It makes an API call to AWS to update VPC route tables to point to its own Elastic Network Interface (ENI).

Answer

It sends a gratuitous ARP packet to update the MAC address tables of AWS routers.

Answer

It uses the Border Gateway Protocol (BGP) to advertise new routes to the Virtual Private Gateway.

Answer

It assumes the same private IP address as the failed primary unit, causing traffic to be routed automatically.

Free FCP-WCS-AD-7-4 sample questions

When configuring a FortiGate Active-Passive cluster in AWS using FGCP, the heartbeat communication must be established. Because AWS environments do not support Layer 2 mechanisms like broadcast or multicast, the FGCP configuration must be set to `________`.

An e-commerce company is using FortiWeb Cloud to protect its primary application, which is hosted behind an AWS Application Load Balancer (ALB). To route traffic through FortiWeb Cloud for inspection, what critical DNS change must be made for their public domain `www.ecom-store.com`?

True or False: In a FortiGate Active-Passive HA cluster deployed across two different AWS Availability Zones, both the primary and secondary FortiGate instances require a public IP address to be active simultaneously for failover to function correctly.

An organization has deployed FortiGate CNF. A central security team uses FortiManager for global policy management, and a separate cloud operations team prefers using native AWS tools. How can both teams manage the FortiGate CNF rule sets without creating conflicts?

In an AWS environment, what is the primary mechanism that a secondary FortiGate unit in an A-P cluster uses to redirect traffic to itself after detecting a failure of the primary unit?

10 more free samples are waiting