NSE7-PBC-7.6 sample questions

Question 1

An administrator deploys an on-demand (PAYG) FortiGate-VM into an isolated management subnet in AWS that initially lacks direct outbound Internet connectivity. After updating the route table and security groups to permit outbound HTTPS connections to directregistration.fortinet.com, the instance remains in a temporary license state. Which CLI command must the administrator execute on the FortiGate to immediately contact FortiCloud and activate the official license?

Accepted Answer

execute vm-license

Answer

diagnose test application fgt-as-handler 1

Answer

diagnose system license update

Answer

execute fortiguard-vm update

Question 2

When integrating the FortiWeb Ingress Controller 1.0.1 with an Amazon EKS cluster to protect containerized microservices, which ingressClassName must be defined within the Kubernetes Ingress resource, and which core FortiWeb objects are automatically provisioned upon reconciliation?

Accepted Answer

fwb-ingress-controller; automatically generates virtual server, content routing, and real server pool objects.

Answer

fortiweb-ingress; automatically generates Virtual IP (VIP), Web Protection Profile, and Address Group objects.

Answer

fortinet-waf; automatically generates Server Policy, Target Group, and Ingress Rule objects.

Answer

fgt-ingress-controller; automatically generates Virtual Server, Policy Route, and Health Check objects.

Question 3

True or False: The FortiWeb Ingress Controller version 1.0.0 exclusively manages and provides security inspection for HTTP and HTTPS routes within Kubernetes environments.

Accepted Answer

True

Answer

False

Question 4

A multinational financial services enterprise is modernizing its application tier by migrating containerized microservices to Amazon Elastic Kubernetes Service (EKS). The security architecture mandates a dedicated FortiWeb-VM cluster deployed in a central inspection VPC, managed via Helm and Kubernetes API integrations through the FortiWeb Ingress Controller (version 1.0.1).

The platform engineering team must ensure that the ingress controller pod possesses granular role-based access control (RBAC) permissions across the cluster without granting unrestricted cluster-admin privileges. Additionally, developers deploy ingress manifests that utilize host-based and path-based routing targeting microservices across multiple distinct namespaces.

During initial testing, the controller pod enters a running state, but changes to Kubernetes Ingress definitions fail to register on the FortiWeb appliances. The DevOps team verifies that the API version used for Ingress resources is networking.k8s.io/v1.

Which Kubernetes RBAC configuration and Ingress definition must be validated to ensure the FortiWeb Ingress Controller properly discovers and reconciles ingress events across all target namespaces?

Accepted Answer

Ensure the controller ServiceAccount is bound to a ClusterRole granting watch and list permissions on ingresses and ingressclasses under networking.k8s.io/v1, and verify that Ingress manifests specify ingressClassName: fwb-ingress-controller.

Answer

Bind the controller ServiceAccount to a namespace-scoped Role in default and specify the annotation kubernetes.io/ingress.class: fortiweb-ingress on all Ingress definitions.

Answer

Assign the controller pod host-level network privileges via a privileged PodSecurityPolicy and configure Ingress manifests to point to the rbac.authorization.k8s.io/v1 API group.

Answer

Configure a RoleBinding in the kube-system namespace granting access to extensions/v1beta1 API resources, and configure each Ingress resource with ingressClassName: default.

Question 5

An automation specialist is configuring parameters for an Azure FortiGate autoscale deployment using custom ARM/Bicep templates. The enterprise requires that all dynamic instances in the autoscale group utilize Marketplace Pay-As-You-Go (PAYG) on-demand billing, and that administrative access to the underlying deployment Function App and Cosmos DB backend is restricted to the internal network. How should the BYOL Instance Count and Access Restriction IP Range template parameters be set?

Accepted Answer

Set BYOL Instance Count to 0 and configure Access Restriction IP Range with the corporate CIDR block authorized to access the autoscale infrastructure.

Answer

Set BYOL Instance Count to -1 and leave Access Restriction IP Range blank to inherit Virtual Network security group rules.

Answer

Set BYOL Instance Count to 2 and configure Access Restriction IP Range to 0.0.0.0/0.

Answer

Set BYOL Instance Count to 1 and configure Access Restriction IP Range with 168.63.129.16/32.

Question 6

A cloud engineer is defining a custom FortiGate-VM image definition in the Azure Compute Gallery using Bicep/ARM templates for standardized corporate deployment. Which TWO configuration parameter values are required according to Fortinet standards for Azure Linux-based VM image definitions? (Select TWO)

Accepted Answer

publisher: Fortinet

Accepted Answer

hyper-v-generation: V2

Answer

os-type: windows

Answer

os-state: Specialized

Answer

architecture: x86

Free NSE7-PBC-7.6 sample questions

When integrating the FortiWeb Ingress Controller 1.0.1 with an Amazon EKS cluster to protect containerized microservices, which ingressClassName must be defined within the Kubernetes Ingress resource, and which core FortiWeb objects are automatically provisioned upon reconciliation?

True or False: The FortiWeb Ingress Controller version 1.0.0 exclusively manages and provides security inspection for HTTP and HTTPS routes within Kubernetes environments.

6 more free samples are waiting