2025 BraindumpsIT Fortinet NSE6_WCS-7.0 Dumps and Exam Test Engine [Q13-Q37] : IT Certification Exam Braindumps : http://blog.braindumpsit.com

NO.13 Which three statements correctly describe FortiGate Cloud-Native Firewall (CNF)? (Choose three.)

It provides carrier-grade protection.

It scales seamlessly.

It uses AWS Elastic Load Balancing (ELB).

It is considered to be a Firewall-as-a-Service (FWaaS).

It can be managed by FortiManager and AWS firewall manager.

NO.14 An administrator has been asked to deploy an active-passive (A-P) FortiGate cluster in the AWS cloud across two availability zones.
In addition to enhanced redundancy, which other major difference is there compared to deploying A-P high availability in the same availability zone?

The FortiGate devices act as a single, logical instance.

Secondary IP address configuration is used.

The number of subnets required is less.

IP addressing and subnetting are not shared.

NO.15 You are troubleshooting network connectivity issues between two VMs deployed in AWS.
One VM is a FortiGate located on subnet “LAN” that is part of the VPC “Encryption”. The other VM is a Windows server located on the subnet “servers” which is also in the “Encryption” VPC. You are unable to ping the Windows server from FortiGate.
What are two reasons for this? (Choose two.)

The firewall in the Windows VM is blocking the traffic.

The default AWS Network Access Control List (NACL) does not allow this traffic.

By default, AWS does not allow ICMP traffic between subnets.

Add an inbound allow ICMP rule in the security group attached to the windows server.

NO.16 An organization has created a VPC and deployed a FortiGate-VM (VM04 /c4.xlarge) in AWS, FortiGate-VM is initially configured With two Elastic Network Interfaces (ENIs). The primary ENI of FortiGate-VM is configured for a public subnet. and the second ENI is configured for a private subnet. In order to provide internet access. they now want to add an EIP to the primary ENI of FortiGate, but the EIP assignment is failing.
Which action would allow the EIP assignment to be successful?

Shut down the FortiGate VM. if it is running. assign the EIP to the primary ENI. and then power it on.

Create and associate a public subnet With the primary ENI Of FortiGate, and then assign the EIP to the primary ENI.

Create and attach a public routing table to the public subnet, associate the public subnet With the primary ENI Of FortiGate. and then assign the EP to the primary ENI.

Create and attach an Internet gateway to the VPC. and then assign the EIP to the primary ENI Of FortiGate.

NO.17 Your organization is deciding between deploying an active-active (A-A) or active-passive (A-P) FortiGate high availability (HA) cluster in AWS cloud.
Which two statements are true about A-A clusters compared to A-P clusters? (Choose two.)

For A-A clusters, FortiGate must perform SNAT inbound to ensure symmetric traffic flow.

A-A clusters rely on API calls for sfailovers.

A-A clusters always require a load balancer.

A-A clusters can use a software-defined network (SDN) to perform a failover.

NO.18 Refer to the exhibit.

Traffic is initiated from the EC2 instance and is destined for the internet.
Which traffic flow is correct?

EC2 instance > NAT GW > IGW > internet

There is no route to the internet in the Private Route Table. The traffic does not reach the internet.

EC2 instance > GWLBe > NAT GW > IGW > internet

EC2 instance > GWLBe > internet

NO.19 An administrator wants to deploy a solution to automatically create firewall rules on FortiGate to accelerate time-to-protection for threats.
Which AWS service can be integrated with FortiGate to accomplish this?

AWS Firewall Manager

AWS network access control list

SDN Connector for AWS

AWS GuardDuty

NO.20 HOW is traffic failover handled in a FortiGate active-active cluster deployed in AWS?

The elastic load balancer handles traffic failover using FGCP.

The elastic load balancer handles bi-directional traffic failover using a health probe.

All FortiGate cluster members send health probes using a dedicated interface.

All FortiGate cluster members use unicast FGCP_

NO.21 Your organization is deciding between deploying FortiWeb VM or Fortinet Managed Rules for AWS WAF.
What are two benefits of choosing FortiWeb VM? (Choose two.)

Only pay for what is used.

Up-to-date WAF signatures powered by FortiGuard.

Zero-day protection.

Advanced WAF functionality.

NO.22 You want to deploy the Fortinet HA cloud formation template to stage and bootstrap the FortiGate configuration in the same that you created your VPC, Which is Ohio US-East-2.
Based on this information, which statement is correct?

You must create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration in the Ohio US-East-2 region.

You must create an S3 bucket to stage and bootstrap FortiGate with an FGCP multicast configuration in the Ohio US-East-2 region.

You must create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration in any region.

The Fortinet HA cloud formation template automatically creates an S3 bucket.

NO.23 Which three statements are correct about VPC flow logs? (Choose three.)

Flow logs do not capture traffic to and from 169.254.169.254 for instance metadata.

Flow logs can capture traffic to the reserved IP address for the default VPC router.

Flow logs do not capture DHCP traffic.

Flow logs can capture real-time log streams for the network interfaces.

Flow logs can be used as a security tool to monitor the traffic that is reaching the instance.

NO.24 You want to deploy the Fortinet HA CloudFormation template to stage and bootstrap the FortiGate configuration in the same region in which you created your VPC, which is Ohio US-East-2.
Based on this information, which statement is correct?

You create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration. The S3 bucket can be hosted in any region.

The Fortinet HA cloud formation template automatically creates an S3 bucket.

You create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration. The S3 bucket needs to be hosted in the Ohio US-East-2 region.

You create a DynamoDB to stage and bootstrap FortiGate with an FGCP unicast configuration. It needs to be hosted in the Ohio US-East-2 region.

NO.25 Refer to the exhibit.

A customer is using the AWS Elastic Load Balancer (ELB).
Which two statements are correct about the ELB configuration? (Choose two.)

The load balancer is configured to load balance traffic among multiple availability zones.

The Amazon Resource Name is used to access the load balancer node and targets.

You can use the DNS name to reach the targets behind the ELB.

The load balancer is configured for the internal traffic of the virtual public cloud (VPC).

NO.26 An organization has created a VPC with two subnets and deployed a FortiGate-VM (VM04/c4.xlarge) in AWS.
The EC2 instance is initially configured with two Elastic Network Interfaces (ENIs). The primary ENI is configured on the public subnet, and the secondary ENI is configured on the private subnet. To provide internet access for the FortiGate-VM, they now want to associate an EIP to its primary ENI, but the assignment is failing.
Which action would allow the EIP assignment to be successful?

Create and associate a public subnet with the primary ENI of the FortiGate VM, and then assign the EIP to the primary ENI.

Shut down the FortiGate VM, if it is running, assign the EIP to the primary ENI, and then power it on.

Create and attach an internet gateway to the VPC, and then assign the EIP to the primary ENI of the FortiGate VM.

Create and attach a public routing table to the public subnet, associate the public subnet with the primary ENI of the FortiGate VM, and then assign the EIP to the primary ENI.

NO.27 An administrator is adding a web application to be protected by FortiWeb Cloud.
Which two steps are necessary to successfully onboard the application? (Choose two.) An administrator is adding a web application to be protected by FortiWeb Cloud.
Which two steps are necessary to successfully onboard the application? (Choose two.)

Wait for the EC2 instance to be created.

Provide a web application name.

Create DNS records in the domain server that hosts the application.

Enable a content delivery network (CDN) in the same region where your application is located.

NO.28 Which statement is true about an Elastic Network Interface (ENI)?

Once ENI detaches from one instance. it cannot reattach to another instance.

You can detach primary ENI from an AWS instance.

An ENI cannot move between AZs.

When youmove an ENI, network traffic is not redirected to the new instance.

NO.29 Refer to the exhibit.

An administrator configured two auto-scaling polices that they now want to test.
What Will be the impact on payg-auto-scaling-group for the FortiGate devices if the administrator executes a scale-in policy?

The scale-in policy will decrease instances from two to one.

The scale-in policy will decrease the desired capacity from two to one

The scale-in policy will decrease the number of maximum instances from four to three.

NO.30 An administrator has deployed an environment in AWS and is now trying to send outbound traffic from the web servers to the internet through FortiGate. The FortiGate policies are configured to allow all outbound traffic. however. the traffic is not reaching the FortiGate internal interface.
Which two statements Can be the reasons for this behavior? (Choose two)

FortiGate is not configured as a default gateway tor web servers.

Internet Gateway (IGW) is not configured for VPC.

AWS security groups are blocking the traffic.

AWS source destination checks are enabled on the FortiGate internal interfaces.

NO.31 Your company deployed a FortiSandbox for AWS.
Which statement is correct about FortiSandbox for AWS?

FortiSandbox for AWS comes as a hybrid solution. The FortiSandbox manager is installed on-premises and analyzes the results of the sandboxing process received from AWS EC2 instances.

The FortiSandbox manager is installed on the AWS platform and analyzes the results of the sandboxing process received from on-premises Windows instances.

FortiSandbox for AWS does not need more resources because it performs only management and analysis tasks.

FortiSandbox deploys new EC2 instances with the custom Windows and Linux VMs, then it sends malware, runs it, and captures the results for analysis.

NO.32 Refer to the exhibit.

You have created an autoscale configuration using a FortiGate HA Cloud Formation template. You want to examine the autoscale FortiOS configuration to confirm that FortiGate autoscale is configured to synchronize primary and secondary devices. On one of the FortiGate devices, you execute the command shown in the exhibit.
Which statement is correct about the output of the command?

The device is the primary in the HA configuration. with the IP address 10.0.0.173.

The device is the secondary in the HA configuration, and the IP address Of the primary device is
10.0.0.173.

The device is the primary in the HA configuration and the IP address of the secondary device is10.0.0.173.

The device is the secondary in the HA configuration. with the IP address 10.0.0.173.

NO.33 An administrator must deploy a web application firewall (WAF) solution to protect the web applications of their organization.
Why would the administrator choose FortiWeb Cloud over AWS WAF with Fortinet managed rules?

WAF signatures must be manually updated by FortiGuard.

The solution must meet PCI 6.6 compliance.

SSL inspection is a requirement.

Traffic must be inspected for malware.

NO.34 Refer to the exhibit.

A customer is using the AWS Elastic Load Balancer.
Which two statements are correct about the Elastic LoadBalancer configuration? (Choose two.)

The Amazon resource name is used to access the load balancer node and targets.

The DNS name is used to access devices.

The load balancer is configured to load balance traffic between devices in two AZS.

The load balancer is configuredfor the internal traffic oftheVPC

NO.35 A customer deployed an HA Cloud formation to Stage and bootstrap the FortiGate configuration.
Which AWS functions are used by FortiGate HA to call the HA failover?

AWS Lambda functions

AWS Mapping functions

AWS S3 functions

AWS DynamoDB functions

NO.36 A cloud administrator is tasked with protecting web applications hosted in AWS cloud.
Which three Fortinet cloud offerings can the administrator choose from to accomplish the task? (Choose three.)

AWS WAF

FortiEDR

FortiGate Cloud-Native Firewall (CNF)

Fortinet Managed Rules for AWS WAF

FortiWeb Cloud

NO.37 Refer to the exhibit.

What two conclusions can you draw from the FortiGate debug output? (Choose two.)

The dynamic address object is automatically updated if the IP changes.

The address object AWS Windows Server Lab can be manually changed on FortiGate.

The SDN connector is correctly configured and authorized.

The AWS user account used for software-defined network (SDN) integration must have full administrative rights.