NSE7_CDS_AR-7.6 Fortinet NSE 7 - Public Cloud Security 7.6.4 Architect Questions and Answers

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:

Based on the FortiCNAPP 24.x Administration Guide regarding Microsoft Azure onboarding and feature activation:

Separation of Integration Types (Option D): In FortiCNAPP, onboarding a cloud account via the automated configuration approach often initializes the Cloud Security Posture Management (CSPM) and Cloud Infrastructure Entitlement Management (CIEM) features. However, Workload Scanning (specifically Agentless Scanning) is treated as a distinct integration type within the platform.

Guided Configuration Requirement: Even after the account is onboarded, the administrator must navigate to the Integrations or Onboarding section and specifically add the Workload Scanning integration for that Azure account. This "Guided Configuration" ensures that the necessary additional permissions (such as those required to create snapshots of disks and scan them) and resources (like the scanner VNet or regional scanners) are properly deployed within the Azure environment.

Why other options are incorrect:

Option A & B: Automated onboarding already handles the creation of necessary App Registrations and Service Principals. Manually adding more without following the specific integration workflow will not activate the workload scanning engine.

Option C: Threat policies are used to generate alerts based on existing data. If the raw workload scanning data is not being received from Azure, a policy will have no data to analyze; the issue is at the ingestion/integration layer, not the policy layer.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:

In an AWS SD-WAN Transit Gateway (TGW) Connect topology, traffic flow must be meticulously orchestrated through VPC route tables to ensure that the FortiGate-VM (Security VPC) can inspect traffic transitioning between spokes.

Spoke to TGW Redirection (Option E): For traffic to leave a Spoke VPC and reach the inspection hub, the Spoke VPC internal routing table must be configured to send all non-local traffic (0.0.0.0/0) to the Transit Gateway (TGW). This is the first step in the traffic chain.

TGW to FortiGate Redirection (Option A): Once the traffic arrives at the TGW and is forwarded to the Security VPC via a TGW attachment, it lands in the TGW subnet (or attachment subnet). To ensure this traffic is inspected, the Security VPC TGW subnet routing table must point the default route (0.0.0.0/0) to the FortiGate's internal network interface (ENI).

FortiGate Return/Egress Path (Option D): After the FortiGate processes the packet, it must be sent back to the TGW to reach its final destination in a different spoke or to exit via a different gateway. Therefore, the Security VPC FortiGate internal subnet routing table (the subnet where the FortiGate's internal leg resides) must have a default route (0.0.0.0/0) pointing back to the TGW.

Why other options are incorrect:

Option B: If the Security VPC TGW subnet routing table points to the TGW as the next hop, it creates a routing loop where traffic arrives from the TGW and is immediately sent back without being inspected by the FortiGate.

Option C: Pointing all traffic to an Internet Gateway (IGW) would bypass the Transit Gateway entirely and send traffic to the public internet rather than through the internal security fabric.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:

Based on the FortiCNAPP (formerly Lacework) Cloud Security documentation regarding Attack Path Analysis and Explorer functionality:

Attack Path Generation (Option A): In FortiCNAPP, an "Attack Path" is a visualized sequence of potential exploit steps that an external attacker could take to reach a sensitive resource. For the platform to generate and display an attack path, the target resource must be externally reachable.

Evidence in the Exhibit: * The exhibit shows a list of EC2 and GCP instances.

The first two results (Resource IDs i-0d2d... and i-0e29...) have values populated in the Public IP Addresses column (44.197.... and 3.226....). Consequently, these are the only two resources showing a value of 1 in the Attack Paths column.

The remaining resources in the list do not have public IP addresses listed in the exhibit's view, and as a result, their Attack Paths count is 0. This confirms that FortiCNAPP specifically calculates these paths for resources that have a direct entry point from the internet via a public IP.

Contextual Risk Assessment: FortiCNAPP prioritizes attack path analysis for internet-exposed assets because they represent the highest immediate risk. While internal resources may have vulnerabilities, the lack of a public-facing network interface means there is no direct external "path" to visualize in this specific Explorer view.

According to the FortiOS 7.6 AWS Administration Guide and the Fortinet 7.4 Public Cloud Security study materials regarding infrastructure as code (IaC) for cloud deployments:

JSON Format Limitations (Option B): The exhibit shows an AWS CloudFormation template in JSON (JavaScript Object Notation) format. JSON, by its official specification, does not support comments. There is no native syntax (like // or /* */) to include remarks that are ignored by the CloudFormation parser.

YAML Support: To add descriptive comments—such as instructing other regional administrators to update the AMI ID—the administrator must convert the template into YAML format. YAML is a superset of JSON and specifically supports comments using the # character.

Best Practice for Multinational Deployments: For organizations operating across multiple AWS regions, using YAML is the recommended standard because it allows for inline documentation, making templates more maintainable and easier for different teams to understand regional requirements.

Why other options are incorrect:

Option A: Comments are part of the template file itself, not a parameter or flag within the aws cloudformation update-stack CLI command.

Option C: While # is the correct character for comments in YAML, it is invalid syntax in JSON and would cause the CloudFormation stack creation to fail with a parsing error.

Option D: The AWSTemplateFormatVersion "2010-09-09" is currently the only valid version for CloudFormation templates; updating it does not add JSON comment support.