[Q15-Q38] Real Fortinet NSE7_CDS_AR-7.6 Exam Questions [Updated 2025]

Rate this post

Real Fortinet NSE7_CDS_AR-7.6 Exam Questions [Updated 2025]

NSE7_CDS_AR-7.6 Exam Dumps Pass with Updated 2025 Fortinet NSE 7 – Public Cloud Security 7.6 Architect

QUESTION 15
Refer to the exhibit. A team of AWS administrators is in the process of installing a FortiWeb ingress controller to protect containerized web applications in an Amazon Elastic Kubernetes Service (EKS) cluster. While customizing the manifest file in the image, they realize that they do not know the correct value to enter in the fortiweb-loginfield.
How can they determine he correct value for this field?

They can refer to the output of the EKS cluster deployment.

They can find the expected value in the manifest file used to deploy the pods.

They must create a Kubernetes secret with the kubectlcommand.

The correct value is the password of the FortiWeb admin account.

QUESTION 16
Refer to the exhibit. You deployed an HA active-active load balance sandwich with two FortiGate VMs in Microsoft Azure. After the deployment, you prefer to use FGSP to synchronize sessions and allow asymmetric return traffic. In the environment, FortiGate port 1 and port 2 are facing external and internal load balancers respectively.
What IP address must you use in the peering configuration?

The opposite FortiGate port 2 IP address.

The public load balancer port 2 IP address.

The internal load balancer port 1 IP address.

The opposite FortiGate port 1 IP address.

QUESTION 17
An Azure administrator is trying to optimize the Azure Bicep files currently used for cloud deployments.
Which technique can Azure administrators use to improve the code in Azure Bicep files?

Use the what-ifoperation before deploying new resources.

Avoid nesting related resources to improve readability.

Always use parameter files with the .jsonextension.

Limit the allowed parameters with the use of decorators.

QUESTION 18
How does an administrator secure container environments in Amazon AWS from newly emerged security threats?

Using Amazon AWS-related application control signatures.

Using Docker-related application control signatures.

Using distributed network-related application control signatures.

Using Amazon AWS_S3-related application control signatures.

QUESTION 19
You are automating configuration changes on one of the FortiGate VMs using Linux Red Hat Ansible.
How does Linux Red Hat Ansible connect to FortiGate to make the configuration change?

It uses a YAML file.

It uses a FortiGate VIP.

It uses an API.

It uses SSH.

QUESTION 20
Refer to the exhibit. You are managing an active-passive FortiGate HA cluster in AWS that was deployed using CloudFormation. You have created a change set to examine the effects of some proposed changes to the current infrastructure. The exhibit shows some sections of the change set.
What will happen if you apply these changes?

This deployment can be done without any traffic interruption.

Both FortiGate VMs will get a new PhysicalResourceId.

The updated FortiGate VMs will not have the latest configuration changes.

CloudFormation checks if you will surpass your account quota.

QUESTION 21
An Azure administration team is looking for a FortiGate high availability (HA) solution that is able to:
– Filter east-west traffic
– Filter north-south traffic
– Scale up
– Scale out
Which HA deployment meets all of the requirements?

Active-passive with external and internal load balancers

Active-passive with SDN connector

Active-active with external and internal load balancers

Active-active with Azure Gateway load balancer

QUESTION 22
Refer to the exhibit. The exhibit shows an active-passive high availability FortiGate pair with external and internal Azure load balancers.
There is no SDN connector used in this solution.
Which configuration must the administrator implement on each FortiGate?

Single BGP route to Azure probe IP address.

One static route to Azure Lambda IP address.

Two static routes to Azure probe IP address.

Two BGP routes to Azure probe IP address.

QUESTION 23
Your organization has several FortiGate VMs deployed in Azure. You need to implement a solution with Azure native tools that allows you to determine whether packets are being permitted or blocked by the FortiGate VMs.
Which solution can you use to meet these requirements?

Insert the VM traffic logs in Azure Sentinel.

Install the Azure Monitor agent in all VMs.

Use IP flow verify for each of the VMs.

Configure Azure Advisor to analyze the network traffic.

QUESTION 24
You are experiencing intermittent connectivity issues in a FortiGate HA cluster deployed with Azure gateway load balancer. Traffic is being dropped when it passes through the cluster.
What is the cause of the issue?

The Azure gateway load balancer is blocking large packets, causing traffic failures.

The protected VMs are running an application that fragments packets.

The Azure gateway load balancer is configured with an incorrect health probe port.

The FortiGate firewalls are using the default maximum transmission unit (MTU) size supported by Azure.

QUESTION 25
An administrator would like to use FortiCNP to keep track of sensitive data files located in the Amazon Web Services (AWS) S3 bucket and protect it from malware. Which FortiCNP feature should the administrator use?

FortiCNP Threat Detection policies

FortiCNP Risk Management policies

FortiCNP Data Scan policies

FortiCNP Compliance policies

QUESTION 26
An administrator is relying on Azure Bicep linter to find possible issues in Bicep files.
Which problem can the administrator expect to find?

Missing dependencies among resources that could cause failures

Code issues such as unused parameters or variables

Conflicts with the Azure policy for resource configurations

Region-specific SKU availability for objects included in the code

QUESTION 27
Which statement about Amazon Web Services (AWS) Transit Gateway is true for SD-WAN transit gateway (TGW) Connect with FortiGate?

The TGW plugin must be used with a VPN to achieve higher bandwidth.

TGW supports BGP to share routes with FortiGate.

Attaching a virtual private cloud (VPC) to the TGW automatically adds new routes to the subnet route table.

The Generic Routing Encapsulation (GRE)-based tunnel attachments are slower than IPsec tunnels.

QUESTION 28
Refer to the exhibit. You are deploying two FortiGate VMs in HA active-passive mode with load balancers in Microsoft Azure.
Which two statements are true in this load balancing scenario? (Choose two.)

The public IP of the active FortiGate is the next-hop for all the incoming traffic.

A dedicated management interface can be used for load balancing.

The internal load balancer is the next-hop for outgoing traffic.

You must add routes to the IP address used by the load balancers to send probes.

QUESTION 29
You must add an Amazon Web Services (AWS) network access list (NACL) rule to allow SSH traffic to a subnet for temporary testing purposes. When you review the current inbound and outbound NACL rules, you notice that the rules with number 5 deny SSH and Telnet traffic to the subnet.
What can you do to allow SSH traffic?

You do not have to create any NACL rules because the default security group rule automatically allows SSH traffic to the subnet.

You must create a new allow SSH rule anywhere in the network ACL rule base to allow SSH traffic.

You must create two new allow SSH rules, each with a number bigger than 5.

You must create two new allow SSH rules, each with a number smaller than 5.

QUESTION 30
What is the main advantage of using SD-WAN Transit Gateway Connect over traditional SD- WAN?

You can use BGP over IPsec for maximum throughput.

You can combine it with IPsec to achieve higher bandwidth.

It eliminates the use of ECMP.

You can use GRE-based tunnel attachments.

QUESTION 31
An administrator is configuring a software-defined network (SDN) connector in FortiWeb to dynamically obtain information about existing objects in an Amazon Elastic Kubernetes Service (EKS) cluster.
Which AWS policy should the administrator attach to a user to achieve this goal?

AmazonEKSConnectorServiceRolePolicy

AmazonEKSComputePolicy

AmazonEKSServicePolicy

AmazonEKSClusterPolicy

QUESTION 32
Which statement about immutable infrastructure in automation is true?

It is the practice of modifying the existing server configuration after it is deployed.

It is the practice of deploying two parallel servers for high availability.

It is the practice of deploying a new server for every configuration change.

It is the practice of applying hotfixes and OS patches after deployment.

QUESTION 33
Your monitoring team reports performance issues with a web application hosted in Azure. You suspect that the bottleneck might be due to unexpected inbound traffic spikes. Which method should you use to identify and analyze the traffic pattern?

Deploy Azure Firewall to log traffic by IP address.

Enable Azure DDoS protection to prevent inbound traffic spikes.

Use Azure Traffic Manager to visualize all traffic to the application.

Enable NSG Flow Logs and analyze logs with Azure Monitor.

QUESTION 34
Your administrator instructed you to deploy an Azure vWAN solution to create a connection between the main company site and branch sites to the other company VNETs.
What is the best connection solution available between your company headquarters, branch sites, and the Azure vWAN hub?

ExpressRoute

GRE tunnels

An L2TP connection

SSL VPN connections

QUESTION 35
An AWS administrator must ensure that each member of the cloud deployment team has the correct permissions to deploy and manage resources using CloudFormation. The administrator is researching which tasks must be executed with CloudFormation and therefore require CloudFormation permissions.
Which task is run using CloudFormation?

Deploying a new pod with a service in an Elastic Kubernetes Service (EKS) cluster using the kubectl command

Installing a Helm chart to deploy a FortiWeb ingress controller in an EKS cluster

Creating an EKS cluster with the eksctl create clustercommand

Changing the number of nodes in an EKS cluster from AWS CloudShell

QUESTION 36
Refer to the exhibit. An experienced AWS administrator is creating a new Virtual Private Cloud (VPC) flow log with the settings shown in the exhibit.
What is the purpose of this configuration?

To maximize the number of logs saved

To monitor logs in real time

To retain logs for a long term

To troubleshoot a log flow issue

QUESTION 37
Refer to the exhibit. In which type of FortiCNP insights can an administrator examine the findings triggered by this policy?

Data

Threat

Risk

User activity

QUESTION 38
An administrator is relying on an Azure Bicep linter to find possible issues in Bicep files.
Which problem can the administrator expect to find?

The resources to be deployed exceed the quota for a region.

Some resources are missing dependsOn statements.

There are output statements that contain passwords.

One or more modules are not using runtime values as parameters.