Fortinet NSE7_CDS_AR-7.6 - Fortinet NSE 7 - Public Cloud Security 7.6.4 Architect

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:

According to the FortiWeb 7.4 Administration Guide and the FortiWeb Ingress Controller Installation Guide , the status of backend servers in the FortiView Topology dashboard is a direct reflection of the health check results.

Interpreting the Status Icon (Orange): In the FortiView Topology view, a green circle indicates that the server is up and responding to health checks, while an orange circle indicates that the server is not running or is unreachable.

Connectivity and Routing (Option B): For the FortiWeb ingress controller to accurately monitor and protect a containerized application, it must have a valid network path to the Kubernetes (K8s) worker nodes. If the FortiWeb VM is missing a route to the specific subnet where the K8s nodes reside, the health check packets will fail to reach their destination. As a result, FortiWeb identifies the backend servers (192.168.0.1, 192.168.0.2, and 192.168.0.3) as " Down, " leading to the orange status shown in the exhibit.

Health Check Failures: When the status is orange, it implies that the Server Health Check (configured in the server pool) is detecting that the web servers are not responsive to connections. While this could be caused by an application-level failure, in a fresh cloud deployment of an ingress controller, the most common underlying cause is a network routing misconfiguration preventing the FortiWeb appliance from reaching the node IPs. 12

Why other options are incorrect: 34

Option A: If the SDN connector were not authenticated correctly, FortiWeb would likely fail to discover the containerized resources entirely, rather than discovering them and repor 5 ting them as " Down " . 6

Option C: While wron 7 g IP addresses would cause a failure, the Ingress Controller ' s job is to dynamically sync these addresses from the K8s API; a manual configuration error in a manifest file regarding IP addresses is less likely in an automated ingress environment.

Option D: The load balancing algorithm (Round Robin, Least Connections, etc.) affects how traffic is distributed, but it does not influence the up/down health status of the individual backend servers.

The Fortinet documentation states: " An IGW in AWS is a VPC component that allows communication between instances in your VPC and the internet... AWS users with less experience may face connectivity issues if they create a new VPC, add EC2 instances to it, but forget that they need an IGW for internet connectivity. "

The Public Cloud Security Architect study guide explains that Ansible uses the APIs provided by Fortinet products when performing configuration tasks. Specifically, the httpapi plugin allows Ansible to interact with FortiGate through API calls. The inventory file identifies the FortiGate managed node and connection information, while the YAML playbook defines the configuration tasks that Ansible must execute. YAML is therefore the playbook format rather than the network connection mechanism. The guide also distinguishes FortiGate management from many traditional servers and devices, for which Ansible commonly uses SSH. In the FortiOS workflow demonstrated in the course, HTTPAPI is used to connect to the FortiGate. A FortiGate VIP is a virtual IP/NAT configuration object and is unrelated to Ansible management connectivity. Therefore, the correct answer is API.

Terraform maintains the terraform.tfstate file to track the resources that it manages and their current state. Therefore, the FortiGate HA infrastructure deployed through Terraform can be completely decommissioned by running the terraform destroy command. The study guide explicitly identifies terraform destroy as the command used to remove Terraform-managed infrastructure. Because the Linux server was deployed separately through AWS Marketplace, it is not part of Terraform’s managed state and must be deleted separately by the administrator. terraform destroy all is not a valid Terraform command, while terraform validate checks configuration syntax and consistency and does not remove resources. Therefore, the correct answers are A and C.

According to the FortiOS 7.6 AWS Administration Guide and the Fortinet Public Cloud Security 7.4 training materials regarding centralized security inspection:

Multiple Route Tables (Option B): A single AWS Transit Gateway is designed to support multiple TGW route tables. By default, there is a soft limit of 20 route tables per Transit Gateway, which allows administrators to implement sophisticated network segmentation and granular routing policies. In a FortiGate-centric " Security Hub " or " Transit VPC " architecture, multiple route tables are used to separate " Spoke " traffic from " Security " traffic, ensuring all inter-VPC traffic is forced through the FortiGate-VM for inspection.

Associations and Propagations: * Association: Each individual TGW attachment (VPC, VPN, or Direct Connect) can be associated with exactly one TGW route table at any given time. This table dictates where packets coming from that attachment will be sent. Because of this 1:1 relationship, Option C is incorrect.

Propagation: An attachment can propagate its routes to one or many TGW route tables. This flexibility allows a VPC ' s prefix to be known in multiple routing domains, meaning that association and propagation do not need to occur in the same table, making Option A incorrect.

Default Route Table Management: When creating an AWS Transit Gateway, the options for " Default route table association " and " Default route table propagation " are enabled by default, but they can be disabled during or after creation. Disabling these is a security best practice when deploying FortiGate-VMs to prevent the TGW from automatically creating a " full-mesh " connectivity that bypasses the firewall, making Option D incorrect.

https://github.com/fortinet/fortigate-terraform-deploy

According to the Terraform documentation for installing Terraform on Linux, you need to download a zip archive that contains a single binary file called terraform. You need to unzip the archive and move the binary file to a directory that is included in your system ' s PATH environment variable, such as /usr/local/bin. This way, you can run the terraform command from any directory without specifying the full path.

If you do not move the binary file to the bin directory, you will get a command not found error when you try to run the terraform version command, as shown in the screenshot. To fix this error, you need to move the binary file to the bin directory or specify the full path of the binary file when running the command.