Fortinet FCP_GCS_AD-7.6 Exam Questions Instant Access

Question 1

Refer to the exhibit.

An administrator configured GoogleCloud as an external fabric connector on FortiGate.

Which conclusion can you draw from the output?

AThe external fabric connector is unable to find a valid Google Cloud project.

BThe external fabric connector shows that an administrator created three dynamic firewall addresses.

CThe external fabric connector is misconfigured.

DThe external fabric connector found multiple IP addresses assigned to Google Cloud instances.

Answer : D

The output shows the connector successfully retrieved project information and instance IP addresses (GCP Lab got 3 addresses), indicating it found multiple IPs assigned to Google Cloud instances.

Question 2

Refer to the exhibit.

Which three things happen during a failover in which the passive FortiGate VM becomes the master cluster member in an active-passive high-availability (HA) environment? (Choose three.)

AThe health check for the passthrough load balancers forces internal traffic to route to port2 of the new active cluster member.

BThe health check ensures that incoming traffic to the ephemeral external IP address of the load balancer is forwarded to the new active cluster member.

CThe health check status will indicate that the old active cluster member is unhealthy.

DThe Management IP address moves from port3 of the current active member to port3 of the new active cluster member.

EThe custom route is updated using API calls to forward all traffic to port2 of the new active cluster member device.

Answer : B, C, E

The load balancer health check detects the failure of the old active member and forwards traffic to the new active member.

The health check reflects the status change, marking the previous active as unhealthy.

API calls update custom routes to redirect traffic to the new active cluster member's internal interface (port2).

Question 3

Your organization is deciding between deploying FortiGate active-passive high-availability (HA) in Google Cloud using either the software-defined network (SDN) connector or load balancers.

What two reasons should your organization choose the SDN connector over the load balancer deployment? (Choose two.)

ACost is lower.

BFailovers are faster because of to API calls.

CThe SDN connector supports multizone failover.

DThere isess administrative overhead.

Answer : A, D

Using the SDN connector avoids additional load balancer costs, making it more cost-effective.

The SDN connector enables multizone failover by directly managing network routing, which load balancers do not inherently support.

Question 4

An administrator has been tasked with modifying their organization's existing active-passive high-availability (HA) FortiGate cluster and turn it into an active-active HA cluster.

Which two behavior changes will the administrator see in the cluster after the change? (Choose two.)

AThere is no longer a need to reserve a dedicated port for HA communications.

BThe sessions will no longer be synchronized between cluster members.

CThe cluster no longer act as a single logical instance.

DThe configuration will no longer be synchronized between cluster members.

Answer : A, C

Active-active HA does not require a dedicated HA communication port as each member handles traffic independently.

In active-active mode, cluster members operate more independently and do not present as a single logical device like in active-passive mode.

Question 5

Refer to the exhibit.

An organization has four virtual private cloud networks and deployed a FortiGate to protect the VPCs. FortiGate is configured with four network interfaces and each network interface is assigned one of the four VPCs.

The organization is expanding and plans to add two more VPCs.

Which two options can the organization use to support the two new VPCs? (Choose two.)

AModifying the FortiGate configuration to add two more network interfaces

BUtilizing VPC peering

CDeleting FortiGate and replacing it with a Google Cloud machine type that supports six network interfaces

DAdding a second FortiGate and configuring both FortiGate devices as an active-active high-availability cluster.

Answer : B, D

VPC peering allows connectivity between multiple VPCs without needing additional interfaces on FortiGate, enabling the existing FortiGate to protect multiple VPCs beyond its physical interface limits.

Adding a second FortiGate and configuring active-active HA enables scaling network protection for more VPCs by distributing traffic across multiple FortiGate instances, overcoming the network interface limit per VM.

Question 6

An organization has decided to deploy an active-active high-availability cluster in Google Cloud.

Which three load balancing features are critical to the successful deployment of the cluster? (Choose three.)

AThe health check used by the internal and the external passthrough network load balancer

BThe forwarding rule for the internal passthrough network load balancer as the next hot for custom routes

CThe L3_DEFAULT protocol in the forwarding rule of the internal passthrough network load balancer

DThe session termination of the external passthrough network load balancer

EThe symmetric hashing of the internal passthrough network load balancer

Answer : A, B, E

Health checks ensure load balancers route traffic only to healthy cluster members.

Forwarding rules act as next hops in routing, directing traffic appropriately within the HA cluster.

Symmetric hashing ensures consistent and balanced traffic distribution across cluster members, critical for active-active deployments.

Question 7

Refer to the exhibit.

In this hybrid environment, in which two ways does the traffic flow from a network node in the on-premises network to Workload B in Google Cloud? (Choose two.)

ATraffic will not reach the FortiGate devices because both load balancers are internal.

BOnce the traffic has been inspected, the active FortiGate uses VPC peering to forward the traffic to the Server project A VPC.

CWhen the packet reaches the external VPC, it is forwarded to the active FortiGate cluster member using a custom static route.

DTraffic will be routed using VPC peering from the Internal VPC to the destination subnet.

Answer : C, D

Traffic from on-premises enters the external VPC and is routed to the active FortiGate VM via custom routes for inspection.

After inspection, traffic is routed through VPC peering from the internal VPC to the service project subnet where Workload B resides.

Fortinet FCP - Google Cloud Security 7.6 Administrator FCP_GCS_AD-7.6 Exam Questions