Fortinet NSE7_CDS_AR-7.6 Certification Exam Sample Questions and Answers

Public Cloud Security Architect Dumps, NSE7_CDS_AR-7.6 Dumps, Fortinet Public Cloud Security Architect PDF, NSE7_CDS_AR-7.6 PDF, Public Cloud Security Architect VCE, Fortinet Public Cloud Security Architect Questions PDF, Fortinet Exam VCE, Fortinet NSE7_CDS_AR-7.6 VCE, Public Cloud Security Architect Cheat SheetBefore you write the Fortinet Public Cloud Security Architect (NSE7_CDS_AR-7.6) certification exam, you may have certain doubts in your mind regarding the pattern of the test, the types of questions asked in it, the difficulty level of the questions and time required to complete the questions. These Fortinet NSE 7 Certified - Cloud Security (Public Cloud Security Architect) sample questions and demo exam help you in removing these doubts and prepare you to take the test.

The best approach to pass your Fortinet NSE7_CDS_AR-7.6 exam is to challenge and improve your knowledge. To test your learning and identify improvement areas with actual exam format, we suggest you practice with Premium Fortinet NSE7_CDS_AR-7.6 Certification Practice Exam. The practice test is one of the most important elements of your Fortinet NSE 7 - Public Cloud Security 7.6.4 Architect (Public Cloud Security Architect) exam study strategy to discover your strengths and weaknesses, to improve your time management skills and to get an idea of the score you can expect.

Fortinet NSE7_CDS_AR-7.6 (Public Cloud Security Architect) Sample Questions:

01. For the Azure load balancers in front of a FortiGate-VM pair, the team must query platform logs and metrics with KQL next to the FortiGate logs already in Log Analytics. The same data must also stream in near real time to an external SIEM.
Which two diagnostic setting destinations meet these requirements?
(Choose two.)
a) An Azure Monitor action group
b) An event hub
c) An Azure Monitor workbook
d) A Log Analytics workspace
 
02. FortiGate-VM logs are sent to a new CloudWatch Logs log group that was created with default settings. How long does CloudWatch Logs keep the log events?
a) 14 days by default
b) One year, after which the events are moved automatically to Amazon S3 Glacier for archiving
c) Indefinitely, until a retention period is set on the log group
d) 30 days, after which events are deleted
 
03. A public web application is published through FortiWeb and FortiGate-VMs in AWS. The team must learn within minutes when the login page stops responding from the internet, including at night when no users are active.
What should the architect use?
a) VPC flow logs on the FortiWeb interfaces with a metric filter on REJECT records
b) AWS X-Ray traces of the web requests that reach the application tier through FortiWeb
c) AWS Config rules that evaluate the FortiWeb instances and load balancer settings
d) CloudWatch Synthetics canaries that load the login page on a schedule
 
04. Two FortiGate-VMs run active-active in Azure, and their outbound internet traffic is source-NATed by the outbound rule of the Standard external load balancer, which uses one frontend public IP address. During peaks of many short connections to the same SaaS endpoint, some new outbound connections fail. CPU, health probes, and established sessions stay normal.
What is the most likely cause, and what should the architect monitor?
a) The 0.0.0.0/0 user-defined route is missing; check effective routes
b) SNAT port exhaustion on the outbound rule; monitor the load balancer's SNAT port usage metrics and add frontend IP addresses or ports
c) The health probe marks a FortiGate-VM down at peaks; monitor health probe status
d) An NSG rule on the external subnet blocks the SaaS endpoint; review NSG flow logs for denied flows
 
05. An architect compares a VPC flow log on a FortiGate-VM network interface with a packet capture taken on the FortiGate for the same period. Several flows in the capture never appear in the flow log. The FortiGate-VM uses the Amazon-provided DNS resolver.
Which two types of traffic are not recorded by the flow log?
(Choose two.)
a) DNS queries that the FortiGate-VM sends to the Amazon-provided resolver
b) Outbound HTTPS sessions from the FortiGate-VM to FortiGuard servers on the internet
c) Requests from the FortiGate-VM to the instance metadata service at 169.254.169.254
d) Inbound connections that the interface's security group rejects
 
06. VPC flow logs for the subnet that holds the FortiGate-VM external interfaces are delivered to a CloudWatch Logs log group. During a suspected scan, the architect must list, within minutes, the source addresses with the most rejected flows in the last hour.
What should the architect use?
a) A CloudWatch Logs Insights query that filters action REJECT and counts records by srcaddr
b) A Traffic Mirroring session on the interface
c) A CloudTrail Lake query that groups the rejected network connections by source address for the whole account
d) A Reachability Analyzer path analysis from the internet gateway to the FortiGate-VM
 
07. Two FortiGate-VMs run active-active behind an Azure Standard external load balancer. The operations team must be notified whenever the load balancer's health probe marks one of the FortiGate-VMs as unhealthy.
What should the architect configure?
a) A Microsoft Defender for Cloud recommendation that flags backends without a health probe
b) A Service Health alert for Azure incidents that affect load balancers in the region
c) An activity log alert on the load balancer for write and delete operations on its backend pool
d) An Azure Monitor metric alert on the load balancer's health probe status
 
08. Spoke VPCs connect to an AWS Transit Gateway, and a FortiGate security VPC inspects the traffic between them. The architect needs a record of the traffic passing through the transit gateway across all of its attachments.
Which AWS feature provides this?
a) Route Analyzer in AWS Network Manager
b) AWS CloudTrail logging for the transit gateway
c) Transit Gateway Flow Logs, which record the traffic that passes through the transit gateway's attachments
d) VPC flow logs on the security VPC alone
 
09. FortiGate-VMs and workloads in an AWS account use the Amazon-provided DNS resolver. The account has no VPC flow logs configured, and the team plans to enable Amazon GuardDuty.
Which two statements about GuardDuty in this environment are true?
(Choose two.)
a) GuardDuty analyzes the DNS queries that the instances send to the Amazon-provided resolver
b) GuardDuty stores the flow log data it analyzes in a CloudWatch Logs log group that the team can query
c) GuardDuty inspects packet payloads mirrored from the FortiGate-VM network interfaces
d) GuardDuty analyzes VPC flow log data from its own independent stream, so no flow log has to be created first
 
10. An architect writes an Ansible playbook that uses fortinet.fortios modules to configure FortiGate-VMs in Azure. The first run fails because Ansible tries to open an SSH session to each FortiGate and run Python on it.
Which inventory change resolves the problem?
a) Set the connection to httpapi, so the modules call the FortiGate REST API and authenticate with an API token
b) Set the connection to winrm so the modules run over Windows Remote Management
c) Enable become so the modules run as root
d) Install the Ansible agent on each FortiGate-VM and register it with the control node

Solutions:

Question: 01

Answer: b, d

Question: 02

Answer: c

Question: 03

Answer: d

Question: 04

Answer: b

Question: 05

Answer: a, c

Question: 06

Answer: a

Question: 07

Answer: d

Question: 08

Answer: c

Question: 09

Answer: a, d

Question: 10

Answer: a

Note: If you find any error in these Fortinet NSE 7 - Public Cloud Security 7.6.4 Architect (Public Cloud Security Architect) sample questions, you can update us by write an email on feedback@nwexam.com.

Rating: 4.8 / 5 (110 votes)