Fortinet FCP_GCS_AD-7.6 시험

Question No : 1

Your organization is deciding between deploying FortiGate active-passive high-availability (HA) in Google Cloud using either the software-defined network (SDN) connector or load balancers.
What two reasons should your organization choose the SDN connector over the load balancer deployment? (Choose two.)

• A.Cost is lower.
• B.Failovers are faster because of to API calls.
• C.The SDN connector supports multizone failover.
• D.There isess administrative overhead.

답을 확인하기

정답:
Explanation:
Using the SDN connector avoids additional load balancer costs, making it more cost-effective.
The SDN connector enables multizone failover by directly managing network routing, which load balancers do not inherently support.

Question No : 2

You have been tasked with destroying all resources relating to a recent active-active high-availability (HA) FGSP Terraform deployment in Google Cloud.
What steps do you have to take to ensure a successful deletion? (Choose two.)

• A.Delete all dependencies to resources relating to the Terraform template.
• B.Use the command terraform plan before destroying the Terraform template.
• C.Use the command terraform destroy to delete all resources deployed by the Terraform template.
• D.Delete all resources manually because active-active HA clusters cannot be destroyed using Terraform.

답을 확인하기

정답:
Explanation:
Removing dependencies prevents resource conflicts during deletion.
terraform destroy is the correct command to cleanly and completely remove all resources created by the Terraform deployment.

Question No : 3

Refer to the exhibit.



Which two statements about FortiWeb instances deployed in Google Cloud are true?

• A.You can change the operation mode of FortiWeb.
• B.You can deploy FortiWeb using pay-as-you-go or bring-your-own-license.
• C.By default, you can access FortiWeb using HTTPS on port 443.
• D.You can configure the FortiWeb instance with only one network interface.

답을 확인하기

정답:
Explanation:
FortiWeb’s operation mode can be changed, such as between reverse proxy and transparent modes, to suit different deployment scenarios.
FortiWeb in Google Cloud supports flexible licensing models, including pay-as-you-go and bring-your-own-license (BYOL).

Question No : 4

Your organization has deployed an active-active high-availability (HA) FortiGate cluster in Google Cloud. You have noticed a significant increase in asymmetrical traffic flow.
Which two actions can you take to mitigate the issue? (Choose two.)

• A.Enable source NAT for ingress traffic.
• B.Enable symmetric hashing on the external load balancer.
• C.Enable the layer 3 unified threat management (UTM) scanning feature if the FortiGate devices are on ForiOS 6.4 or later.
• D.Enable destination NAT for ingress traffic.

답을 확인하기

정답:
Explanation:
Enabling source NAT ensures consistent source IPs, promoting symmetric traffic flow.
Symmetric hashing on the load balancer helps distribute traffic flows evenly and consistently across cluster members, reducing asymmetric routing.

Question No : 5

An organization is planning to deploy two FortiGate VMs in two different regions.
Which two Google Cloud core components can span both FortiGate VMs in both regions? (Choose two.)

• A.Google Cloud virtual private cloud
• B.Google Cloud zone
• C.Google Cloud project
• D.Google Cloud subnet

답을 확인하기

정답:
Explanation:
A Google Cloud VPC can span multiple regions, allowing FortiGate VMs in different regions to be part of the same network.
A Google Cloud project provides the administrative boundary that can include resources across multiple regions and VPCs, enabling centralized management of both FortiGate VMs.

Question No : 6

Refer to the exhibit.



An administrator is troubleshooting an issue when a high-availability (HA) failover occurs.
Which conclusion can you draw from the debug output?

• A.The HA cluster is accessible using HTTPS on 34.68.13.24 and 34.66.4.139.
• B.The health check has successfully updated the internal custom route to forward all internal traffic to 172.16.1.3.
• C.Both cluster members are located in the same zone.
• D.The HA cluster is deployed using the software-defined network (SDN) connector.

답을 확인하기

정답:
Explanation:
The debug output shows the internal route being updated and moved to the new next hop (172.16.1.3), indicating the health check and failover process successfully redirected internal traffic to the active HA node.

Question No : 7

An organization is deploying an active-passive high availability (HA) cluster using passthrough load balancers in Google Cloud.
What is a critical factor for ensuring successful HA formation, failover, and traffic flow?

• A.Unicast FortiGate Clustering Protocol (FGCP) must be used.
• B.VDOM exceptions must be configured.
• C.Incoming traffic must be source NATed to ensure traffic flow symmetry.
• D.There can be more than two cluster members.

답을 확인하기

정답:
Explanation:
Source NAT ensures that traffic is symmetric by keeping the source IP consistent, which is critical for proper failover and session synchronization in an active-passive HA cluster using passthrough load balancers.

Question No : 8

Refer to the exhibit.



An organization has four virtual private cloud networks and deployed a FortiGate to protect the VPCs. FortiGate is configured with four network interfaces and each network interface is assigned one of the four VPCs.
The organization is expanding and plans to add two more VPCs.
Which two options can the organization use to support the two new VPCs? (Choose two.)

• A.Modifying the FortiGate configuration to add two more network interfaces
• B.Utilizing VPC peering
• C.Deleting FortiGate and replacing it with a Google Cloud machine type that supports six network interfaces
• D.Adding a second FortiGate and configuring both FortiGate devices as an active-active high-availability cluster.

답을 확인하기

정답:
Explanation:
VPC peering allows connectivity between multiple VPCs without needing additional interfaces on FortiGate, enabling the existing FortiGate to protect multiple VPCs beyond its physical interface limits.
Adding a second FortiGate and configuring active-active HA enables scaling network protection for more VPCs by distributing traffic across multiple FortiGate instances, overcoming the network interface limit per VM.

Question No : 9

You have been tasked with deploying an active-active FortiGate high-availability cluster in Google Cloud.
How can you ensure that traffic will flow symmetrically?

• A.Enable the layer 3 unified threat management scanning feature on FortiGate.
• B.Google Cloud performs NAT on incoming traffic for external passthrough network load balancers. No action is needed.
• C.There is no need to ensure traffic symmetry because FortiGate can effectively inspect asymmetric traffic.
• D.Deploy internal passthrough network load balancers on both sides of the cluster they support symmetric hashing.

답을 확인하기

정답:

Question No : 10

An administrator wants to use the FortiGate automation stitch feature to quarantine compromised hosts.
Which native Google Cloud service should the administrator integrate with FortiGate to achieve this?

• A.Google Cloud Interconnect
• B.Google Cloud Run functions
• C.Google Cloud App_ Engine
• D.Google Cloud IAM

답을 확인하기

정답:
Explanation:
Google Cloud Run allows you to run serverless containerized functions that can be triggered by FortiGate automation stitches to perform actions such as quarantining compromised hosts. It is the native service best suited for automating responses in cloud environments