Fortinet NSE6_WCS-6.4 Exam Practice Test Instant Access

Question 1

You want to deploy FortiGate for AWS to protect your production network in the cloud. but you do not need the 2417 support available in the enterprise bundle.

Which license model do you choose?

Apay as you go (PAYG).

BBring your own device (BYOD)

CBring your own license (BYOL).

DPay as a bundle (PAYB).

Answer : A

Question 2

Refer to the exhibit.

An administrator wants to update the database package from

the Internet to a database server configured with IP address

Which statement is correct about traffic from server IP address

10.0.1.7 to the internet. based on the diagrarm?

ATraffic from server 10.0.1.7 to the internet will hide
behind elastic IP 198.51.100 2.

BTraffic from server 10.0.1.7 to the internet will hide
behind elastic IP 198.51.100.3

CTraffic from server 10.0.1.7 to the internet will hide
behind elastic IP 198.51.100.4

DTraffic from server 10.0.1.7 to the internet will hide
behind elastic IP 198.51.100.1

Answer : C

Question 3

Which two statements are correct about AWS Network Access Control Lists (NACLS)? (Choose two.)

ANACLs are stateless: responses to allowed inbound traffic are subject to the rules for outbound traffic.

BAn NACL has separate inbound and outbound rules, and each rule can either allow or deny traffic.

CBy default. each custom NACL allows all inbound and outbound traffic unless you add new rules,

DVPC automatically comes with a modifiable default NACL, and by default it denies all inbound and outbound IPv4 traffic.

Answer : A, B

Question 4

An MSSP deployed 16 FortiGate VMS With the default AWS security groups and network access lists using an on-demand license from Amazon Web Services (AWS) Marketplace. They are using a third-party configuration backup application to back up and track changes for the FortiGate configurations. It can connect to the FortiGate devices using only the SSH protocol, A customer is using the correct username and password configured on the FortiGate devices. but they are unable to log in using the SSH protocol.

What can be the reason Why this authentication is failing?

AThe default AWS network access list for FortiGate does not allow SSH.

BThe AWS key is required to log in to FortiGate using SSH

CAWS uses non-standard SSH port 1025, and the default AWS security groups and NACL for FortiGate are not configured for the port.

DThe default AWS Security group for FortiGate does not allow SSH.

Answer : B

Question 5

Refer to the exhibit.

An administrator configured a FortiGate device to connect to me AWS API to retrieve resource values from the AWS console to create dynamic objects tor the FortiGate policies. The administrator is unable to retrieve AWS dynamic objects on FortiGate.

Which three reasons can explain btw? (Choose three.)

AAWS was not able to validate credentials provided by the AWS Lab SON connector.

BThe AWS Lab SON connector failed to connect on port 401.

CThe AWS Lab SON connector failed to retrieve the instance list.

DThe AWS API call is not supported on XML version I . O.

EThe AWS Lab SON connector is configured with an invalid AWS access or secret key

Answer : A, C, E

Question 6

Your company deployed a FortiSandb0X for AWS.

Which statement is correct about FortiSandbox for AWS?

AFortiSandbox for AWS does not need more resources because it performs only management and analysis tasks.

BThe FortiSandbox manager is installed on AWS platform and analyzes the results of the sandboxing process received from on-premises Windows instances.

CFortiSandbox for AWS comes as hybrid solution. The FortiSandb0X manager is installed on-premises and analyzes the results Of the sandboxing process received from AWS EC2 instances

DFortiSandbox deploys new EC2 instances with the custom Windows and Linux VMS, then it sends malware, runs it, and captures the results for analysis.

Answer : A

Question 7

HOW is traffic failover handled in a FortiGate active-active cluster deployed in AWS?

AThe elastic load balancer handles traffic failover using FGCP.

BThe elastic load balancer handles bi-directional traffic failover using a health probe.

CAll FortiGate cluster members send health probes using a dedicated interface.

DAll FortiGate cluster members use unicast FGCP_

Answer : B

Fortinet NSE6_WCS-6.4 Fortinet NSE 6 - Securing AWS With Fortinet Cloud Security 6.4 Exam Practice Test