[Q18-Q42] FCP_WCS_AD-7.4 Certification Exam Dumps Questions in here [Sep-2024]

4.5/5 - (17 votes)

FCP_WCS_AD-7.4 Certification Exam Dumps Questions in here [Sep-2024]

Updated FCP_WCS_AD-7.4 Exam Practice Test Questions

NEW QUESTION 18
Refer to the exhibit.

An administrator configured a FortiGate device to connect to the AWS API to retrieve resource values from the AWS console to create dynamic objects for the FortiGate policies. The administrator is unable to retrieve AWS dynamic objects on FortiGate.
Which two reasons can explain why? (Choose two.)

The AWS API call is not supported on XML version 1.0.

AWS was not able to validate credentials provided by the AWS Lab SDN connector because of a clock skew between FortiGate and AWS.

The AWS Lab SDN connector is configured with an invalid AWS access or secret key.

The AWS Lab SDN connector failed to connect on port 401.

The AWS Lab SDN did not find any instances in the configured VPC.

NEW QUESTION 19
Which three statements correctly describe FortiGate Cloud-Native Firewall (CNF)? (Choose three.)

It provides carrier-grade protection.

It scales seamlessly.

It uses AWS Elastic Load Balancing (ELB).

It is considered to be a Firewall-as-a-Service (FWaaS).

It can be managed by FortiManager and AWS firewall manager.

NEW QUESTION 20
Refer to the exhibit.

Which two statements are correct about traffic flow in FortiWeb Cloud? (Choose two.)

The DNS name for the application servers must point to FortiWeb Cloud.

FortiWeb Cloud filters the incoming traffic from users, blocking the OWASP Top 10 attacks, zero-day threats, and other application layer attacks.

FortiWeb Cloud can protect the application servers only if they are all located in the same virtual public cloud (VPC).

Step 2 requires an AWS S3 bucket to be created.

NEW QUESTION 21
You are troubleshooting network connectivity issues between two VMs deployed in AWS.
One VM is a FortiGate located on subnet “LAN” that is part of the VPC “Encryption”. The other VM is a Windows server located on the subnet “servers” which is also in the “Encryption” VPC. You are unable to ping the Windows server from FortiGate.
What are two reasons for this? (Choose two.)

The firewall in the Windows VM is blocking the traffic.

The default AWS Network Access Control List (NACL) does not allow this traffic.

By default, AWS does not allow ICMP traffic between subnets.

Add an inbound allow ICMP rule in the security group attached to the windows server.

NEW QUESTION 22
An organization has the requirement to connect a data VPC to the on-premises infrastructure of a branch office in a hybrid cloud environment. The connectivity needs the higher bandwidth but the organization does not want to use multiple connections between sites.
Which AWS solution meets the requirement?

Transit VPC with IPSec

Internet Gateway

Transit Gateway multicast

Transit Gateway Connect

NEW QUESTION 23
A cloud administrator is tasked with protecting web applications hosted in AWS cloud.
Which three Fortinet cloud offerings can the administrator choose from to accomplish the task? (Choose three.)

AWS WAF

FortiEDR

FortiGate Cloud-Native Firewall (CNF)

Fortinet Managed Rules for AWS WAF

FortiWeb Cloud

NEW QUESTION 24
A customer is attempting to deploy an active-passive high availability (HA) cluster using the software-defined network (SDN) connector in the AWS cloud.
What is an important consideration to ensure a successful formation of HA, failover, and traffic flow?

Both cluster members must be in the same availability zone.

VDOM exceptions must be configured.

Unicast FortiGate Clustering Protocol (FGCP) must be used.

Both cluster members must show as healthy in the elastic load balancer (ELB) configuration.

NEW QUESTION 25
Refer to the exhibit.

Traffic is initiated from the EC2 instance and is destined for the internet.
Which traffic flow is correct?

EC2 instance > NAT GW > IGW > internet

There is no route to the internet in the Private Route Table. The traffic does not reach the internet.

EC2 instance > GWLBe > NAT GW > IGW > internet

EC2 instance > GWLBe > internet

NEW QUESTION 26
Refer to the exhibit.

You deployed an active-passive FortiGate HA cluster using a CloudFormation template on an existing VPC. Now you want to test active-passive FortiGate HA failover by running a debug so you can see the API calls to change the Elastic and secondary IP addresses.
Which statement is correct about the output of the debug?

The routing table for Fgt2 updated successfully, and port2 will provide internet access to Fgt2.

The Elastic IP is associated with port1 of Fgt2.

IP address 10.0.0.13 is now associated with eni-0b61d8afc0aefb8a2.

The Elastic IP is associated with port2 of Fgt2, and the secondary IP address for port1 and port2 was updated successfully.

NEW QUESTION 27
AWS native network services offer vast functionality and inter-connectivity between the cloud and on-premises networks.
Which three additional functions can FortiGate for AWS offer to complement the native services offered by AWS? (Choose three.)

Higher VPN throughput

Web filtering

OSPF over IPSec

Advanced dynamic routing

Secure SD-WAN with application visibility

NEW QUESTION 28
An administrator has been asked to deploy an active-passive (A-P) FortiGate cluster in the AWS cloud across two availability zones.
In addition to enhanced redundancy, which other major difference is there compared to deploying A-P high availability in the same availability zone?

The FortiGate devices act as a single, logical instance.

Secondary IP address configuration is used.

The number of subnets required is less.

IP addressing and subnetting are not shared.

NEW QUESTION 29
An administrator is adding a web application to be protected by FortiWeb Cloud.
Which two steps are necessary to successfully onboard the application? (Choose two.) An administrator is adding a web application to be protected by FortiWeb Cloud.
Which two steps are necessary to successfully onboard the application? (Choose two.)

Wait for the EC2 instance to be created.

Provide a web application name.

Create DNS records in the domain server that hosts the application.

Enable a content delivery network (CDN) in the same region where your application is located.

NEW QUESTION 30
You need to deploy a new Windows server in AWS to offload web traffic from an existing web server in a different availability zone.
According to the AWS shared responsibility model, what three actions must you take to secure the new EC2 instance? (Choose three.)

Update software on the instance.

Change the existing elastic load balancer (ELB) to a gateway load balancer

Configure security groups.

Manage the operating system on the instance.

Move all web servers into the same availability zone.

NEW QUESTION 31
An administrator needs to attach an Elastic Network Interface (ENI) to an application instance in a VPC with multiple availability zones. An instance runs in availability zone 1.
Which ENI property must the administrator consider when implementing this requirement?

An ENI cannot attach to an instance in availability zone 2.

After the ENI detaches from one instance, it can reattach only to the same instance.

You can detach the primary ENI from an AWS instance.

When you move an ENI, network traffic remains directed to the old instance until you terminate that instance.

NEW QUESTION 32
Which three statements are correct about VPC flow logs? (Choose three.)

Flow logs do not capture traffic to and from 169.254.169.254 for instance metadata.

Flow logs do not capture DHCP traffic.

Flow logs can capture traffic to the reserved IP address for the default VPC router.

Flow logs can be used as a security tool to monitor the traffic that is reaching the instance.

Flow logs can capture real-time log streams for the network interfaces.