Free Fortinet NSE 7 NSE7_CDS_AR-7.6 Ultimate Study Guide (Updated 76 Questions) [Q37-Q57]

5/5 - (1 vote)

Free Fortinet NSE 7 NSE7_CDS_AR-7.6 Ultimate Study Guide (Updated 76 Questions)

Get to the Top with NSE7_CDS_AR-7.6 Practice Exam Questions

Q37. Refer to the exhibit. An AWS administrator created a change set to examine the effects of proposed changes to the current infrastructure.
Based on only the output shown in the exhibit, what will happen if the administrator applies these changes?

The resulting FortiGate instance will lose its current local users.

CloudFormation will roll back the current stack before updating it.

The deployment will take place without any service interruption.

The PhysicalResourceIdwill remain the same.

Q38. You are troubleshooting a FortiGate active-passive SDN connector solution in Microsoft Azure.
Which two mandatory SDN connector settings are required for a successful deployment?
(Choose two.)

FortiGate license file

Client secret

Active FortiGate serial number

Directory ID

Q39. Refer to the exhibit. An administrator deployed an HA active-active load balance sandwich in Microsoft Azure. The setup requires configuration synchronization between devices.
What can you conclude from the configured settings shown in the exhibit? (Choose two.)

FortiGate A and FortiGate B are two independent devices.

By default, FortiGate uses FGCP.

It does not synchronize the FortiGate hostname.

FortiGate-VM instances are scaled out automatically according to predefined workload levels.

Q40. In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)

From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the FortiGate internal port.

From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the TGW.

From both spoke VPCs and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway.

From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW.

From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW.

Q41. A VM in Azure is failing to communicate with other VMs in the same subnet.
What is the most likely cause?

Some of the VMs are beyond your allowed quota for the Azure region.

There is at least one user-defined route blocking traffic within the subnet.

The VMs do not have a public IP address configured.

A network security group (NSG) has overridden the default intrasubnet communication rule.

Q42. An administrator is relying on an Azure Bicep linter to find possible issues in Bicep files.
Which problem can the administrator expect to find?

The resources to be deployed exceed the quota for a region.

Some resources are missing dependsOn statements.

There are output statements that contain passwords.

One or more modules are not using runtime values as parameters.

Q43. Refer to the exhibit. You deployed an HA active-active load balance sandwich with two FortiGate VMs in Microsoft Azure. After the deployment, you prefer to use FGSP to synchronize sessions and allow asymmetric return traffic. In the environment, FortiGate port 1 and port 2 are facing external and internal load balancers respectively.
What IP address must you use in the peering configuration?

The opposite FortiGate port 2 IP address.

The public load balancer port 2 IP address.

The internal load balancer port 1 IP address.

The opposite FortiGate port 1 IP address.

Q44. Which statement about immutable infrastructure in automation is true?

It is the practice of deploying a new server for every configuration change.

It is the practice of deploying two parallel servers for high availability.

It is the practice of modifying the existing server configuration after it is deployed.

It is the practice of applying hotfixes and OS patches after deployment.

Q45. Refer to the exhibit. You have deployed a Linux EC2 instance in Amazon Web Services (AWS) with the settings shown in the exhibit.
What next step must the administrator take to access this instance from the internet?

Allocate an Elastic IP address and assign it to the instance.

Create a VIP on FortiGate to allow access.

Enable SSH and allocate it to the device.

Configure the user name and password.

Q46. Refer to the exhibit. An administrator used the what-if tool to preview changes to an Azure Bicep file. What will happen if the administrator decides to apply these changes in Azure?

Subnet 10.0.1.0/24 will replace subnet 10.0.2.0/24.

This deployment will fail and no changes will be applied.

A new subnet will be added to ServerApps.

The ServerApps VNet will be renamed.

Q47. How does an administrator secure container environments in Amazon AWS from newly emerged security threats?

Using Amazon AWS-related application control signatures.

Using Docker-related application control signatures.

Using distributed network-related application control signatures.

Using Amazon AWS_S3-related application control signatures.

Q48. Refer to the exhibit. An administrator installed a FortiWeb ingress controller to protect a containerized web application.
What is the reason for the status shown in FortiView?

The manifest file deployed is configured with the wrong node IP addresses.

The FortiWeb VM is missing a route to the node subnet.

The load balancing type is not set to round-robin.

The SDN connector is not authenticated correctly.

Q49. Refer to the exhibit. The exhibit shows partial output of changes that AWS found after you created a new change set.
What can you conclude from this output if you decide to execute this change set?

CloudFormation will check your account quota before executing the change set, to prevent errors.

Resources deployed successfully will remain, even if other resources fail during execution.

You should refer to the AWS documentation to prevent unplanned service interruptions.

Executing this change set will create a new VM, unless you do not have proper permissions.

Q50. Refer to the exhibit. An administrator is trying to deploy a FortiGate VM in Microsoft Azure using Terraform. However, during the configuration, the Azure client secret is no longer visible in the Azure portal.
How would the administrator obtain the Azure client secret to configure on Terraform?

Create a new Azure account and assign it the Administrator role.

Create a new client secret and take note of it.

Use the Terraform output file values to obtain the client secret.

Q51. Which two statements about the Amazon Web Services (AWS) security groups are true?
(Choose two.)

Security groups are applicable at the instance level.

EC2 instances, elastic network interfaces (ENIs), and subnets may have security groups configured on them.

A security group is a stateful list of ingress and egress traffic rules.

Configured traffic rules may have an action of allow or deny.

Q52. A DevOps team is using Terraform to manage their infrastructure across multiple environments.
Currently, the Terraform state file is stored locally on a developer’s machine. The team decides to migrate the state file to a remote back-end machine.
Why is storing the Terraform state file in a remote location considered a best practice in this scenario?

It eliminates the need to define provider configurations in the state file.

It ensures that the state file is encrypted.

It prevents the accidental deletion of the state file.

It enables collaboration among multiple team members.

Q53. An Azure administration team is looking for a FortiGate high availability (HA) solution that is able to:
– Filter east-west traffic
– Filter north-south traffic
– Scale up
– Scale out
Which HA deployment meets all of the requirements?

Active-passive with external and internal load balancers

Active-passive with SDN connector

Active-active with external and internal load balancers

Active-active with Azure Gateway load balancer

Q54. Refer to the exhibit. An administrator has deployed a FortiGate VM in Amazon Web Services (AWS) and is trying to access it using its public IP address from their local computer. However, the connection is not successful, and at the same time FortiGate is not receiving any HTTPS or SSH traffic to its external interface.
What should the administrator check for possible issue?

Check the debug flow for any network ACLs.

Check the inbound rules of the security groups.

Check the FortiGate firewall policies.

Check the FortiGate instance ID.

Q55. Refer to the exhibit. An experienced AWS administrator is creating a new virtual public cloud (VPC) flow log with the settings shown in the exhibit. What is the purpose of this configuration?

To maximize the number of logs saved

To store the logs for further analysis

To monitor the logs in real time

To troubleshoot a log flow issue

Q56. Refer to the exhibit. An administrator used the what-iftool to preview the changes to an Azure Bicep file.
What will happen if the administrator applies these changes in Azure?

The VNet address space will be updated.

The resulting VNet will have a single subnet.

The vnet-002 VNet will be renamed Production.

A new subnet will be added to vnet-002.

Q57. Your administrator instructed you to deploy an Azure vWAN solution to create a connection between the main company site and branch sites to the other company VNETs.
What is the best connection solution available between your company headquarters, branch sites, and the Azure vWAN hub?

ExpressRoute

GRE tunnels

An L2TP connection

SSL VPN connections