FCP_WCS_AD-7-4 Practice Questions

Scalability:

FortiGate Cloud-Native Firewall (CNF) is designed to scale seamlessly with your cloud infrastructure,

providing the necessary protection without requiring manual intervention for scaling (Option B).

Firewall-as-a-Service:

FortiGate CNF is offered as a Firewall-as-a-Service (FWaaS), which simplifies the deployment and

management of firewall capabilities directly in the cloud environment (Option D).

Management:

FortiGate CNF can be managed using FortiManager and AWS Firewall Manager, providing

comprehensive management capabilities both from Fortinet's platform and AWS's native

management tools (Option E).

Other Considerations:

Option A (carrier-grade protection) is not specifically highlighted as a feature of FortiGate CNF.

Option C (uses AWS Elastic Load Balancing) is incorrect as FortiGate CNF operates independently of

AWS ELB, although it can integrate with various AWS services.

Reference:

FortiGate CNF Documentation: FortiGate CNF

AWS Firewall Manager: AWS Firewall Manager

DNS Configuration:

For FortiWeb Cloud to effectively protect web applications, the DNS records for the application

servers must be configured to point to FortiWeb Cloud. This ensures that all incoming traffic is routed

through FortiWeb Cloud for inspection and protection (Option A).

Traffic Filtering:

FortiWeb Cloud provides robust protection by filtering incoming traffic to block the OWASP Top 10

attacks, zero-day threats, and other application layer attacks. This ensures the security and integrity

of the web applications it protects (Option B).

Other Options Analysis:

Option C is incorrect because FortiWeb Cloud can protect application servers across different VPCs or

regions, not just within the same VPC.

Option D is incorrect because step 2 does not require an AWS S3 bucket; it refers to the inspection

and filtering of incoming traffic.

Reference:

FortiWeb Cloud Overview: FortiWeb Cloud

DNS Configuration for Web Applications: DNS Configuration

Windows Firewall Blocking Traffic:

The firewall on the Windows VM might be configured to block incoming ICMP traffic (ping requests).

By default, Windows Firewall is set to block ICMP traffic, which could be a reason for the connectivity

issue (Option A).

Security Group Configuration:

AWS Security Groups act as virtual firewalls for instances. If there is no rule allowing ICMP traffic in

the security group attached to the Windows server, the ping requests from FortiGate will be blocked.

An inbound allow ICMP rule must be added to the security group to permit this traffic (Option D).

Other Options Analysis:

Option B is incorrect because the default AWS Network Access Control List (NACL) allows all inbound

and outbound traffic.

Option C is incorrect as AWS does allow ICMP traffic between subnets if properly configured with

Security Groups and NACLs.

Reference:

AWS Security Groups: AWS Security Groups

Windows Firewall Configuration: Windows Firewall

Traffic Direction through GWLB Endpoint:

The ingress route table directs inbound traffic to the GWLB through a GWLB endpoint (GWLBe). This

endpoint is responsible for directing traffic to the Gateway Load Balancer for further processing

(Option B).

GENEVE Encapsulation:

The GWLB encapsulates the inbound traffic using the GENEVE protocol. This encapsulated traffic is

then sent to FortiGate instances for security inspection. The use of GENEVE ensures that the original

traffic context is preserved and can be analyzed by FortiGate (Option D).

Other Options Analysis:

Option A is incorrect because GWLB does not forward traffic without encapsulation in its dedicated

subnet.

Option C is incorrect as the inbound traffic is directed to the GWLB endpoint first, not directly to the

application subnet.

Reference:

AWS Gateway Load Balancer Documentation: AWS GWLB

GENEVE Protocol Overview: GENEVE Protocol

VPC-Scoped Protection:

When deploying a FortiWeb VM inside a Virtual Private Cloud (VPC), the security and protection it

offers are limited to the applications and traffic that pass through that specific VPC. This means that

any applications outside this VPC will not benefit from the protection of FortiWeb VM (Option D).

Comparison with FortiWeb Cloud:

FortiWeb Cloud, being a cloud-native WAF-as-a-Service, can protect applications regardless of their

VPC location, offering broader and more flexible protection capabilities.

Other Options Analysis:

Option A is incorrect because both FortiWeb VM and FortiWeb Cloud protect against OWASP Top 10

threats.

Option B is incorrect because FortiWeb VM does support zero-day protection.

Option C is incorrect as the performance of FortiWeb VM in applying advanced WAF protection is not

inherently slower compared to FortiWeb Cloud.

Reference:

FortiWeb Overview: FortiWeb

Dynamic Address Object Update:

The debug output shows that the IP address of the AWS Windows Server Lab has been updated

automatically, indicating that the dynamic address object feature is working as intended. This allows

FortiGate to adapt to changes in the IP addresses of AWS instances dynamically (Option A).

SDN Connector Configuration:

The messages in the debug output confirm that the SDN connector is able to retrieve instance

information and update the firewall address objects successfully. This implies that the SDN connector

is correctly configured and has the necessary permissions (Option C).

Manual Change and Permissions:

Option B is incorrect because while the address object could theoretically be changed manually, this

is not inferred from the debug output.

Option D is incorrect because the debug output does not indicate that the AWS user account must

have full administrative rights. The required permissions are typically more scoped to specific actions

related to SDN.

Reference:

FortiGate AWS Integration Guide: FortiGate on AWS

AWS IAM Policies for SDN: AWS IAM Policies

HA Event and Failover:

The debug output indicates that a failover event occurred and the secondary instance (Fgt2) is now

taking over as the master.

Elastic IP Association:

The debug output shows the process of moving the Elastic IP (eipalloc-090425f83f912c8d6) to the

new master instance. This involves associating the Elastic IP with the appropriate network interface

(eni) of the new master.

Specific IP Address Association:

The Elastic IP is specifically associated with port1 of Fgt2. The message "associate elastic ip eipalloc-

090425f83f912c8d6 to 10.0.0.13 of eni eni-0f6b35f8fccd24eb0" indicates that the Elastic IP is now

linked to the primary IP address (10.0.0.13) on port1 of the new master.

Other Options Analysis:

Option A is incorrect because the routing table update details are not explicitly stated.

Option C is incorrect because the IP address association mentioned relates to an Elastic IP, not eni-

0b61d8afc0aefb8a2.

Option D is incorrect because it specifically mentions port2 for the Elastic IP association, which is not

indicated in the debug output.

Reference:

FortiGate HA Configuration Guide: FortiGate HA

AWS Elastic IP Documentation: Elastic IP

Network Load Balancer:

Deploying a network load balancer ensures that incoming traffic is distributed across multiple web

servers, providing high availability and redundancy. This setup helps in managing traffic efficiently

and maintaining service uptime even if some servers fail (Option A).

Multiple Availability Zones:

Deploying web servers in multiple availability zones (AZs) enhances fault tolerance and availability. If

one AZ goes down, servers in other AZs can continue to handle the traffic, ensuring the web

application remains accessible (Option D).

Other Options Analysis:

Option B is incorrect because NAT Gateways are used to provide internet access to instances in

private subnets, not to make private addresses reachable from the internet.

Option C is not sufficient on its own for high availability. Adding a route to the default VPC route table

forwarding traffic to the internet gateway makes the VPC internet-accessible but does not ensure

high availability.

Reference:

AWS High Availability and Fault Tolerance: AWS High Availability

AWS Network Load Balancer: Network Load Balancer

Update Software:

As part of the AWS shared responsibility model, it is the customer’s responsibility to update and

maintain the software running on the EC2 instance, including applying security patches and updates

(Option A).

Configure Security Groups:

Security groups act as virtual firewalls for instances to control inbound and outbound traffic.

Configuring them correctly is essential for securing the EC2 instance and ensuring only legitimate

traffic can reach the server (Option C).

Manage Operating System:

Managing the operating system, including user accounts, permissions, and operating system patches,

is the responsibility of the customer under the shared responsibility model (Option D).

Other Options Analysis:

Option B is incorrect as changing the existing ELB to a gateway load balancer is not necessary for

securing the new EC2 instance.

Option E is incorrect because it is not required to move all web servers into the same availability

zone for security purposes.

Reference:

AWS Shared Responsibility Model: AWS Shared Responsibility

EC2 Security Best Practices: AWS EC2 Security

Regional Deployment:

For a global organization with cloud networks in multiple AWS regions, a separate FortiGate Cloud-

Native Firewall (CNF) instance is required for each AWS region to provide localized protection and

meet compliance requirements. This ensures that each region has its own dedicated NGFW

protection tailored to its specific needs (Option B).

Multi-Account Association:

FortiGate CNF supports associating multiple AWS accounts with a single CNF instance. This feature is

beneficial for organizations that operate in a multi-account setup, allowing centralized management

and security policies across different accounts (Option C).

Other Options Analysis:

Option A is incorrect because AWS Firewall Manager is a different service and is not required to

provision a CNF instance.

Option D is incorrect because a single CNF instance cannot protect multiple AWS regions due to

regional isolation in AWS.

Reference:

FortiGate CNF Documentation: FortiGate CNF

AWS Multi-Account Best Practices: AWS Multi-Account