NSE7_CDS_AR-7.6 Exam Questions & Answers
Fortinet NSE 7 - Public Cloud Security 7.6.4 Architect • Fortinet
100% money-back guarantee
Sample NSE7_CDS_AR-7.6 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
An administrator is trying to implement FortiCNP with Microsoft Azure Security integration. However, FortiCNP is not able to extract any cloud integration data from Azure; therefore, real-time cloud security monitoring is not possible.
What is causing this issue?
Refer to the exhibit.
A FortiCNAPP administrator used the FortiCNAPP Explorer to reveal all hosts exposed to the internet that are running active packages with vulnerabilities of all severity levels. Why do only the first two results have an attack path? (Choose one answer)
Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
Based on the FortiCNAPP (formerly Lacework) Cloud Security documentation regarding Attack Path Analysis and Explorer functionality:
Attack Path Generation (Option A): In FortiCNAPP, an 'Attack Path' is a visualized sequence of potential exploit steps that an external attacker could take to reach a sensitive resource. For the platform to generate and display an attack path, the target resource must be externally reachable.
Evidence in the Exhibit: * The exhibit shows a list of EC2 and GCP instances.
The first two results (Resource IDs i-0d2d... and i-0e29...) have values populated in the Public IP Addresses column (44.197.... and 3.226....). Consequently, these are the only two resources showing a value of 1 in the Attack Paths column.
The remaining resources in the list do not have public IP addresses listed in the exhibit's view, and as a result, their Attack Paths count is 0. This confirms that FortiCNAPP specifically calculates these paths for resources that have a direct entry point from the internet via a public IP.
Contextual Risk Assessment: FortiCNAPP prioritizes attack path analysis for internet-exposed assets because they represent the highest immediate risk. While internal resources may have vulnerabilities, the lack of a public-facing network interface means there is no direct external 'path' to visualize in this specific Explorer view.
An administrator would like to use FortiCNP to keep track of sensitive data files located in the Amazon Web Services (AWS) S3 bucket and protect it from malware. Which FortiCNP feature should the administrator use?
https://docs.fortinet.com/document/forticnp/22.4.a/online-help/359537/anti-virus-scan-policy
Refer to the exhibit.
A senior administrator in a multinational organization needs to include a comment in the template shown in the exhibit to ensure that administrators from other regions change the Amazon Machine Image (AMI) ID to one that is valid in their location.
How can the administrator add the required comment in that section of the file?
According to the FortiOS 7.6 AWS Administration Guide and the Fortinet 7.4 Public Cloud Security study materials regarding infrastructure as code (IaC) for cloud deployments:
JSON Format Limitations (Option B): The exhibit shows an AWS CloudFormation template in JSON (JavaScript Object Notation) format. JSON, by its official specification, does not support comments. There is no native syntax (like // or /* */) to include remarks that are ignored by the CloudFormation parser.
YAML Support: To add descriptive comments---such as instructing other regional administrators to update the AMI ID---the administrator must convert the template into YAML format. YAML is a superset of JSON and specifically supports comments using the # character.
Best Practice for Multinational Deployments: For organizations operating across multiple AWS regions, using YAML is the recommended standard because it allows for inline documentation, making templates more maintainable and easier for different teams to understand regional requirements.
Why other options are incorrect:
Option A: Comments are part of the template file itself, not a parameter or flag within the aws cloudformation update-stack CLI command.
Option C: While # is the correct character for comments in YAML, it is invalid syntax in JSON and would cause the CloudFormation stack creation to fail with a parsing error.
Option D: The AWSTemplateFormatVersion '2010-09-09' is currently the only valid version for CloudFormation templates; updating it does not add JSON comment support.
Refer to the exhibit.
The exhibit shows a customer deployment of two Linux instances and their main routing table in Amazon Web Services (AWS). The customer also created a Transit Gateway (TGW) and two attachments. Which two steps are required to route traffic from Linux instances to the TGW? (Choose two answers)
Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
Based on the FortiOS 7.6 Cloud Security Study Guide regarding AWS Transit Gateway (TGW) integration and VPC routing, the following steps are mandatory to establish connectivity between Spoke VPCs via a TGW:
VPC Route Table Configuration (Option A): For traffic to leave a VPC and reach the Transit Gateway, the VPC's subnet route table must have a specific entry. While the exhibit shows local routes for internal VPC traffic (192.168.50.0/24 and 192.168.100.0/24), any traffic destined for 'outside' the local VPC (such as the other Spoke VPC) must be directed to the TGW. Adding a default route (0.0.0.0/0) with the TGW ID as the next hop ensures that all non-local traffic is forwarded to the Transit Gateway for processing.
TGW Association (Option B): Within the Transit Gateway itself, connectivity is managed through Associations and Propagations. An 'Association' links a specific VPC attachment to a TGW route table. Without associating the two attachments (for Spoke VPC A and Spoke VPC B) to a TGW route table, the TGW will not know which route table to use to make forwarding decisions for packets arriving from those VPCs.
Why Option C is incorrect: Route propagation is used to automatically populate the TGW route table with the CIDR blocks of the attached VPCs. While propagation is a valid step for dynamic routing, Option C specifically mentions propagating a static summary range (192.168.0.0/16) which is not the standard automated mechanism; usually, you propagate the specific VPC CIDRs. Furthermore, without the Association (Option B), propagation alone does not allow the TGW to process incoming traffic from the attachment.
Why Option D is incorrect: Directing traffic to an Internet Gateway (IGW) would send the traffic to the public internet. This would not facilitate internal routing between the two Spoke VPCs via the Transit Gateway.
Get access to all 54 verified questions with detailed answers.
Unlock All NSE7_CDS_AR-7.6 Questions