Fortinet FCP - Azure Cloud Security 7.4 Administrator FCP_ZCS_AD-7.4 Exam Questions

Page: 1 / 14
Total 35 questions
Question 1

Your organization is in the process of optimizing its Azure network architecture and wants to dynamically manage and exchange routing information between its virtual networks and on-premises networks.

Which Azure service would help to provide a centralized point for efficient route management and dynamic routing?



Answer : D

Azure Route Server enables dynamic route exchange using BGP between your Azure virtual network and network virtual appliances (NVAs) or on-premises networks. It provides a centralized and scalable solution for route management, allowing seamless integration of routing updates without manual configuration changes.


Question 2

When you deploy a single FortiGate VM using the available template from the Azure Marketplace, several other resources are also created.

Which two resources, among others, are created during the process? (Choose two.)



Answer : A, B

Two virtual NICs -- The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.

One NSG for each interface -- The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet's best practices.


Question 3

In Microsoft Entra ID, what is the primary administrative unit that represents an organization and its relationship with Microsoft's cloud services?



Answer : A

A Microsoft Entra tenant is the primary administrative unit that represents an organization within Microsoft's identity platform. It defines the boundary for identity management, access control, and resource governance, and serves as the core entity that connects the organization to Microsoft's cloud services such as Azure and Microsoft 365.


Question 4

Which output was taken on a VM running in Azure?

A)

B)

C)

D)



Answer : D

Azure assigns MAC addresses in a specific Organizationally Unique Identifier (OUI) range. The MAC address d8-34-99-c5-0A-BC begins with d8-34-99, which is a Microsoft-assigned OUI used in Azure virtual networks. This strongly indicates the output was taken from a VM running in Azure.


Question 5

Refer to the exhibit.

Your organization is planning the implementation of a complex hub-to-spoke solution to meet automated large-scale branch connectivity with multiple regions, offering a diverse range of connectivity options.

Which Azure networking service can deliver a solution?



Answer : B

Azure Virtual WAN is designed for large-scale, automated, and global branch connectivity, supporting hub-and-spoke architectures across multiple regions. It enables centralized routing, hub-to-hub connectivity, and integrates with VPN, ExpressRoute, and SD-WAN solutions, making it ideal for complex, multi-region deployments as shown in the diagram.


Question 6

Refer to the exhibits.

Two new dynamic firewall addresses have been configured on the FortiGate VM using the external connector to Integrate within the same Azure environment.

The debug output shows that one IP address can be resolved successfully, but the second is empty.

Which steps could you perform to correct the misconfiguration? (Choose all that apply.)



Answer : A, B

The debug output shows that the UbuntuServer address object successfully resolved an IP, while the webServer did not. The most likely cause is a mismatch in the dynamic address filter or missing tags on the target VM.

Verify the filter used for the dynamic firewall address -- The filter category=windows may not match any VM metadata, resulting in no matched addresses.

Verify the tags on the target VM -- Ensure that the VM has the correct tags (e.g., category=windows) that match the dynamic address filter to enable resolution.


Question 7

A Linux server was deployed in a protected subnet with a dynamic IP address. A FortiGate VM in the internal subnet provides traffic filtering to it. and you must implement a firewall policy using the IP address of the Linux server.

Which feature could help integrate FortiGate using Linux server tags?



Answer : C

The Software-defined network (SDN) connector allows FortiGate to dynamically pull metadata such as tags, IP addresses, and resource groups from Azure resources. This enables automatic policy updates based on dynamic IP changes, such as those of a Linux server in a protected subnet.


Page:    1 / 14   
Total 35 questions