Pass Your Fortinet NSE7_CDS_AR-7.6 Exam with Correct 76 Questions and Answers [Q45-Q69]

Rate this post

Pass Your Fortinet NSE7_CDS_AR-7.6 Exam with Correct 76 Questions and Answers

Latest [Mar 13, 2026] 2026 Realistic Verified NSE7_CDS_AR-7.6 Dumps

NEW QUESTION 45
Refer to the exhibit. An administrator is trying to deploy a FortiGate VM in Microsoft Azure using Terraform. However, during the configuration, the Azure client secret is no longer visible in the Azure portal.
How would the administrator obtain the Azure client secret to configure on Terraform?

Create a new Azure account and assign it the Administrator role.

Create a new client secret and take note of it.

Use the Terraform output file values to obtain the client secret.

In Azure, once a client secret is created, its value is only visible at creation time. If it is no longer visible, the administrator cannot recover it. The correct step is to create a new client secret and securely record it for use with Terraform.

NEW QUESTION 46
While working with Terraform files, an administrator notices that some of the variables do not have their type explicitly declared.

What type of variable is vpccidr in the exhibit?

String

Set

Map

Number

NEW QUESTION 47
Refer to the exhibit. You have deployed a Linux EC2 instance in Amazon Web Services (AWS) with the settings shown in the exhibit.
What next step must the administrator take to access this instance from the internet?

Allocate an Elastic IP address and assign it to the instance.

Create a VIP on FortiGate to allow access.

Enable SSH and allocate it to the device.

Configure the user name and password.

In the exhibit, Auto-assign public IP is disabled, meaning the instance has no public IP for internet access. To make the Linux EC2 instance reachable from the internet, the administrator must allocate an Elastic IP address and assign it to the instance.

NEW QUESTION 48
Refer to the exhibit. An administrator has deployed a FortiGate VM in Amazon Web Services (AWS) and is trying to access it using its public IP address from their local computer. However, the connection is not successful, and at the same time FortiGate is not receiving any HTTPS or SSH traffic to its external interface.
What should the administrator check for possible issue?

Check the debug flow for any network ACLs.

Check the inbound rules of the security groups.

Check the FortiGate firewall policies.

Check the FortiGate instance ID.

Since the FortiGate VM is not receiving any HTTPS or SSH traffic at all, the most likely cause is that the inbound rules of the AWS Security Group attached to the FortiGate instance are not permitting traffic on ports 22 (SSH) or 443 (HTTPS). If the Security Group blocks traffic, packets never reach FortiGate, which explains the absence of captured traffic.

NEW QUESTION 49
Refer to the exhibit.

Which FortiCNP policy type generated the finding shown in the exhibit? (Choose one answer)

This finding was generated by a data scan policy.

This finding was generated by a threat detection policy.

This finding was generated by a risk management policy.

This finding was generated by a file collection policy.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
Based on the FortiCNP 22.4/24.4 Administration Guide and the Fortinet Cloud Security Study Guide, findings in FortiCNP are categorized by the specific policy type that triggered the alert.
* Threat Detection Policy (Option B): This policy category is designed to monitor and alert on anomalous User Activity and Network threats. Specifically, “Suspicious Location” is a predefined threat detection rule that triggers when a user performs an action (such as a Download File as seen in the exhibit) from a geographic location or IP address that is not on the organization’s allow list or deviates from established behavioral baselines. The exhibit explicitly shows the “Activity Type” as
“Download File” and the “Policy Name” as “Suspicious Location,” both of which fall under the Threat Detection > User Activity policy tab.
* Policy Hierarchy and Finding Types:
* Threat Detection: Includes User Activity (Suspicious Location, Suspicious Time, Suspicious Movement) and Network findings.
* Data Scan Policy (Option A): These policies are used for content-level inspection, such as searching for Malware or Data Loss Prevention (DLP) patterns like credit card numbers within files.
* Risk Management Policy (Option C): These policies focus on Cloud Security Posture Management (CSPM), alerting on misconfigurations such as unencrypted buckets or disabled logging (e.g., CloudTrail).
* File Collection (Option D): While “File Collection” is a configuration object used to define a group of files for monitoring, it is not the policy type that generates a behavioral alert like
“Suspicious Location”.

NEW QUESTION 50
An administrator is relying on Azure Bicep linter to find possible issues in Bicep files.
Which problem can the administrator expect to find?

Missing dependencies among resources that could cause failures

Code issues such as unused parameters or variables

Conflicts with the Azure policy for resource configurations

Region-specific SKU availability for objects included in the code

The Azure Bicep linter analyzes the structure and syntax of Bicep files to identify code issues, such as unused parameters, variables, incorrect syntax, or deprecated properties. It does not validate runtime issues like resource dependencies, policy conflicts, or region-specific SKUs.

NEW QUESTION 51
Refer to the exhibit.

Your team notices an unusually high volume of traffic sourced at one of the organizations FortiGate EC2 instances. They create a flow log to obtain and analyze detailed information about this traffic. However, when they checked the log, they found that it included traffic that was not associated with the FortiGate instance in question.
What can they do to obtain the correct logs? (Choose one answer)

Create a new flow log at the interface level.

Change the maximum aggregation time to 1 minute.

Ensure that the flow log data is not mixed with the rest of the traffic.

Send the logs to Amazon Data Firehose instead to get more granular information.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
According to theFortiOS 7.6 AWS Administration Guideand thePublic Cloud Securitydocumentation regarding AWS VPC Flow Logs, the level at which a flow log is created determines the scope of the data collected:
* Flow Log Scope and Hierarchy (Option A):AWS VPC Flow Logs can be created at three different levels:VPC,Subnet, orNetwork Interface (ENI).
* As seen in the exhibit (VPC flow log wizard), the flow log is being created for the resource vpc-
09d6e4631cd49d2b3. When a flow log is created at theVPC level, it captures IP traffic for all network interfaces within that VPC.
* To isolate traffic specifically for a single FortiGate EC2 instance and avoid seeing traffic from other instances in the same VPC or subnet, the administrator must create a flow log at the Network Interface level. This provides the most granular visibility and ensures the logs only contain traffic associated with the specific ENIs of that FortiGate instance.
* Why other options are incorrect:
* Option B:Changing the maximum aggregation interval from 10 minutes to 1 minute increases the frequency of log delivery and captures shorter-lived flows more accurately, but it does not change thescopeof the resources being monitored.
* Option C:This is a general troubleshooting statement and not a configuration action within the AWS Flow Log wizard that would filter the traffic by instance.
* Option D:Changing the destination to Amazon Data Firehose changes how the logs are processed and delivered (e.g., for streaming to a SIEM), but the source data is still determined by the resource level selected (VPC vs. Interface).

NEW QUESTION 52
In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)

From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the FortiGate internal port.

From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the TGW.

From both spoke VPCs, and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway.

From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW.

From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
In an AWS SD-WAN Transit Gateway (TGW) Connect topology, traffic flow must be meticulously orchestrated through VPC route tables to ensure that the FortiGate-VM (Security VPC) can inspect traffic transitioning between spokes.
* Spoke to TGW Redirection (Option E):For traffic to leave a Spoke VPC and reach the inspection hub, theSpoke VPC internal routing tablemust be configured to send all non-local traffic (0.0.0.0/0) to theTransit Gateway (TGW). This is the first step in the traffic chain.
* TGW to FortiGate Redirection (Option A):Once the traffic arrives at the TGW and is forwarded to the Security VPC via a TGW attachment, it lands in theTGW subnet(or attachment subnet). To ensure this traffic is inspected, theSecurity VPC TGW subnet routing tablemust point the default route (
0.0.0.0/0) to theFortiGate’s internal network interface (ENI).
* FortiGate Return/Egress Path (Option D):After the FortiGate processes the packet, it must be sent back to the TGW to reach its final destination in a different spoke or to exit via a different gateway.
Therefore, theSecurity VPC FortiGate internal subnet routing table(the subnet where the FortiGate’s internal leg resides) must have a default route (0.0.0.0/0) pointing back to theTGW.
Why other options are incorrect:
* Option B:If the Security VPC TGW subnet routing table points to the TGW as the next hop, it creates a routing loop where traffic arrives from the TGW and is immediately sent back without being inspected by the FortiGate.
* Option C:Pointing all traffic to an Internet Gateway (IGW) would bypass the Transit Gateway entirely and send traffic to the public internet rather than through the internal security fabric.

NEW QUESTION 53
Refer to the exhibit.

An experienced AWS administrator is creating a new virtual public cloud (VPC) flow log with the settings shown in the exhibit.
What is the purpose of this configuration?

To maximize the number of logs saved

To monitor logs in real time

To retain logs for a long term

To troubleshoot a log flow issue

NEW QUESTION 54
What would be the impact of confirming to delete all the resources in Terraform?

It destroys all the resources tied to the AWS Identity and Access Management (IAM) user.

It destroys all the resources in the resource group.

It destroys all the resources in the .tfstate file.

It destroys all the resources in the .tfvars file.

NEW QUESTION 55
An administrator implements FortiWeb ingress controller to protect containerized web applications in an AWS Elastic Kubernetes Service (EKS) cluster.
What can you conclude about the topology shown in FortiView?

The FortiWeb VM gets the latest cluster information through an SDN connector.

This topology has two services and two ingress controllers deployed.

Both services will be load balanced among the two nodes and the four pods.

Adding a new service will update the FortiWeb configuration automatically.

NEW QUESTION 56
An administrator is looking for a solution that can provide insight into users and data stored in major SaaS applications in the multicloud environment. Which product should the administrator deploy to have secure access to SaaS applications? (Choose one answer)

FortiSandbox

FortiCASB

FortiWeb

FortiSIEM

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
Based on theFortinet Cloud Security 7.4documentation and theFortiCASB Administration Guide, secur5ing a multi6cloud environment requires specialized tools for Software-as-a-Service (SaaS) visibility:
* SaaS Visibility and Protection (Option B):FortiCASB (Cloud Access Security Broker) is a cloud- native service designed specifically to provideinsight into users and datastored within major SaaS applications like Office 365, Google Drive, and Salesforce.
* Key Capabilities:
* Data Discovery:It allows administrators to scan and identify sensitive data (PII, PCI, etc.) stored within SaaS platforms to prevent data leakage.
* User Behavior Monitoring:It tracks user activities and alerts on anomalous behavior, such as logins from suspicious locations or excessive file downloads, to ensuresecure access.
* Threat Protection:It integrates with FortiGuard to scan files within the cloud for malware, providing a layer of security that traditional network firewalls cannot reach once the data is inside the SaaS provider’s infrastructure.
* Why other options are incorrect:
* Option A:FortiSandbox is used for advanced threat detection by executing suspicious files in a safe environment; it does not provide user/data management for SaaS applications.
* Option C:FortiWeb is a Web Application Firewall (WAF) designed to protect web applications and APIs hosted on-premises or in the cloud from attacks like SQL injection; it is not a SaaS security broker.
* Option D:FortiSIEM is a security information and event management solution used for cross- infrastructure logging and correlation; while it can ingest logs from SaaS, it does not provide the native data-level insights or direct access controls that FortiCASB offers.

NEW QUESTION 57
A customer would like to use FortiGate fabric integration with FortiCNP. When adding a FortiGate VM to FortiCNP, which three mandatory configuration steps must you follow on FortiGate? (Choose three answers)

Enable pre-shared key on both sides.

Import the FortiGate certificate into FortiCNP.

Configure FortiGate to send logs to FortiCNP.

Create an IPS sensor and a firewall policy.

Create an SSL/SSH inspection profile.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
According to theFortiCNP 24.x Administration Guideand theFortiOS 7.6 Security Fabric Integration documentation, integrating a FortiGate-VM with FortiCNP requires specific local configurations on the FortiGate to ensure the cloud security platform can ingest and analyze traffic data.
* Configuring Logging (Option C):Before adding the FortiGate VM to FortiCNP, the administrator must Enable Send Logson the FortiGate. This allows the FortiGate to forward the necessary security telemetry and traffic logs to the FortiCNP cloud endpoint for threat correlation and risk analysis.
* Policy and Inspection Setup (Option D):The integration relies on the FortiGate’s ability to identify and block threats at the network layer. Specifically, the administrator mustCreate a FortiGate IPS SensorandCreate a FortiGate Firewall Policy. The IPS sensor detects malicious patterns, while the firewall policy dictates which traffic is subjected to this inspection.
* Deep Packet Inspection (Option E):To provide visibility into encrypted traffic-which is critical for identifying threats hidden in HTTPS flows-the administrator mustCreate an SSL/SSH Inspection Profileon the FortiGate. Without this profile, FortiCNP would lose significant visibility into potential attack vectors utilizing encrypted channels.
Why other options are incorrect:
* Option A:While pre-shared keys are used in VPN and some Fabric setups, they are not listed as one of the specific mandatory steps for the initial FortiGate-to-FortiCNP fabric integration workflow.
* Option B:While certificate exchange is part of the overall trust relationship, the primary “mandatory configuration stepson FortiGate” defined in the official setup guide focus on the logging and security profile components required to generate the data FortiCNP needs.

NEW QUESTION 58
An Azure administrator is trying to optimize the Azure Bicep files currently used for cloud deployments.
Which technique can Azure administrators use to improve the code in Azure Bicep files?

Use the what-ifoperation before deploying new resources.

Avoid nesting related resources to improve readability.

Always use parameter files with the .jsonextension.

Limit the allowed parameters with the use of decorators.

In Azure Bicep, decorators can be used to limit allowed parameter values, enforce constraints, and improve code reliability. This helps optimize and standardize deployments by preventing invalid inputs.

NEW QUESTION 59
A customer would like to use FortiGate fabric integration with FortiCNP.
When adding a FortiGate VM to FortiCNP, which three mandatory configuration steps must you follow on FortiGate? (Choose three.)

Create an SSL/SSH inspection profile.

Configure FortiGate to send logs to FortiCNP.

Import the FortiGate certificate into FortiCNP.

Enable pre-shared key on both sides.

Create and IPS sensor and a firewall policy.

To integrate a FortiGate VM with FortiCNP, you must:
* Configure FortiGate to send logs to FortiCNP so security events are analyzed.
* Import the FortiGate certificate into FortiCNP for secure communication.
* Enable pre-shared key on both sides to authenticate and establish trust between FortiGate and FortiCNP.

NEW QUESTION 60
Refer to the exhibit.

An administrator installed a FortiWeb ingress controller to protect a containerized web application. What is the reason for the status shown in FortiView? (Choose one answer)

The SDN connector is not authenticated correctly.

The FortiWeb VM is missing a route to the node subnet.

The manifest file deployed is configured with the wrong node IP addresses.

The load balancing type is not set to round-robin.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:
According to the FortiWeb 7.4 Administration Guide and the FortiWeb Ingress Controller Installation Guide, the status of backend servers in the FortiView Topology dashboard is a direct reflection of the health check results.
* Interpreting the Status Icon (Orange): In the FortiView Topology view, a green circle indicates that the server is up and responding to health checks, while an orange circle indicates that the server is not running or is unreachable.
* Connectivity and Routing (Option B): For the FortiWeb ingress controller to accurately monitor and protect a containerized application, it must have a valid network path to the Kubernetes (K8s) worker nodes. If the FortiWeb VM is missing a route to the specific subnet where the K8s nodes reside, the health check packets will fail to reach their destination. As a result, FortiWeb identifies the backend servers (192.168.0.1, 192.168.0.2, and 192.168.0.3) as “Down,” leading to the orange status shown in the exhibit.
* Health Check Failures: When the status is orange, it implies that the Server Health Check (configured in the server pool) is detecting that the web servers are not responsive to connections.
While this could be caused by an application-level failure, in a fresh cloud deployment of an ingress controller, the most common underlying cause is a network routing misconfiguration preventing the FortiWeb appliance from reaching the node IPs.12 Why other options are incorrect:34
* Option A: If the SDN connector were not authenticated correctly, FortiWeb would likely fail to discover the containerized resources entirely, rather than discovering them and repor5ting them as
“Down”.6
* Option C: While wron7g IP addresses would cause a failure, the Ingress Controller’s job is to dynamically sync these addresses from the K8s API; a manual configuration error in a manifest file regarding IP addresses is less likely in an automated ingress environment.
* Option D: The load balancing algorithm (Round Robin, Least Connections, etc.) affects how traffic is distributed, but it does not influence the up/down health status of the individual backend servers.

NEW QUESTION 61
An Azure administration team is looking for a FortiGate high availability (HA) solution that is able to:
– Filter east-west traffic
– Filter north-south traffic
– Scale up
– Scale out
Which HA deployment meets all of the requirements?

Active-passive with external and internal load balancers

Active-passive with SDN connector

Active-active with external and internal load balancers

Active-active with Azure Gateway load balancer

NEW QUESTION 62
Which statement about Transit Gateway (TGW) in Amazon Web Services (AWS) is true?

Both the TGW attachment and propagation must be in the same TGW route table.

TGW can have multiple TGW route tables.

A TGW attachment can be associated with multiple TGW route tables.

The TGW default route table cannot be disabled.

According to the FortiOS 7.6 AWS Administration Guide and the Fortinet Public Cloud Security 7.4 training materials regarding centralized security inspection:
Multiple Route Tables (Option B): A single AWS Transit Gateway is designed to support multiple TGW route tables. By default, there is a soft limit of 20 route tables per Transit Gateway, which allows administrators to implement sophisticated network segmentation and granular routing policies. In a FortiGate- centric “Security Hub” or “Transit VPC” architecture, multiple route tables are used to separate “Spoke” traffic from “Security” traffic, ensuring all inter-VPC traffic is forced through the FortiGate-VM for inspection.
Associations and Propagations: * Association: Each individual TGW attachment (VPC, VPN, or Direct Connect) can be associated with exactly one TGW route table at any given time. This table dictates where packets coming from that attachment will be sent. Because of this 1:1 relationship, Option C is incorrect.
Propagation: An attachment can propagate its routes to one or many TGW route tables. This flexibility allows a VPC’s prefix to be known in multiple routing domains, meaning that association and propagation do not need to occur in the same table, making Option A incorrect.
Default Route Table Management: When creating an AWS Transit Gateway, the options for “Default route table association” and “Default route table propagation” are enabled by default, but they can be disabled during or after creation. Disabling these is a security best practice when deploying FortiGate-VMs to prevent the TGW from automatically creating a “full-mesh” connectivity that bypasses the firewall, making Option D incorrect.

NEW QUESTION 63
Refer to the exhibit. An administrator used the what-iftool to preview the changes to an Azure Bicep file.
What will happen if the administrator applies these changes in Azure?

The VNet address space will be updated.

The resulting VNet will have a single subnet.

The vnet-002 VNet will be renamed Production.

A new subnet will be added to vnet-002.

The what-if output shows a modification (~) to the VNet vnet-002 where a new subnet (+ subnet001 with address prefix 10.0.0.0/25) will be created. Applying the changes will therefore add a new subnet to the existing VNet.

NEW QUESTION 64
Exhibit.

In which type of FortiCNP insights can an administrator examine the findings triggered by this policy?

Data

Threat

Risk

User activity

NEW QUESTION 65
Refer to the exhibit.
What is the purpose of this section of an Azure Bicep file?

To restrict which FortiOS versions are accepted for deployment

To indicate the correct FortiOS upgrade path after deployment

To add a comment with the permitted FortiOS versions that can be deployed

To document the FortiOS versions in the resulting topology

NEW QUESTION 66
Refer to the exhibit. A team of AWS administrators is in the process of installing a FortiWeb ingress controller to protect containerized web applications in an Amazon Elastic Kubernetes Service (EKS) cluster. While customizing the manifest file in the image, they realize that they do not know the correct value to enter in the fortiweb-loginfield.
How can they determine he correct value for this field?

They can refer to the output of the EKS cluster deployment.

They can find the expected value in the manifest file used to deploy the pods.

They must create a Kubernetes secret with the kubectlcommand.

The correct value is the password of the FortiWeb admin account.

The fortiweb-login field in the manifest requires credentials for the FortiWeb ingress controller to authenticate. This is not set directly in plain text; instead, administrators must create a Kubernetes secret using the kubectl command (containing the FortiWeb admin username and password), and reference it in the manifest. This ensures secure handling of authentication data.

NEW QUESTION 67
Refer to the exhibit. An administrator installed a FortiWeb ingress controller to protect a containerized web application.
What is the reason for the status shown in FortiView?

The manifest file deployed is configured with the wrong node IP addresses.

The FortiWeb VM is missing a route to the node subnet.

The load balancing type is not set to round-robin.

The SDN connector is not authenticated correctly.

The FortiView dashboard shows the backend pods (192.168.0.x:80) as unreachable (orange indicators). This happens when the FortiWeb VM does not have a proper route to the node subnet, preventing it from forwarding traffic to the containerized application endpoints.

NEW QUESTION 68
Refer to the exhibit.

You are troubleshooting a Microsoft Azure SDN connector issue on your FortiGate VM in Azure.
Which command can you use to examine details about API calls sent by the connector?

diag debug application cloud-connector -1

diag test application azd 1

diag debug application azd -1

get system sdn-connector

NEW QUESTION 69
Refer to the exhibit.
A senior administrator in a multinational organization needs to include a comment in the template shown in the exhibit to ensure that administrators from other regions change the Amazon Machine Image (AMI) ID to one that is valid in their location.
How can the administrator add the required comment in that section of the file?

The administrator can include the comment with the aws cloudformation update-stack command.

The administrator must convert the template file to YAML format to add a comment.

The administrator can add the comment starting with the # character next to the “Resources” section.

The administrator must update the AWSTemplateFormatVersion to the latest version.

According to theFortiOS 7.6 AWS Administration Guideand theFortinet 7.4 Public Cloud Securitystudy materials regarding infrastructure as code (IaC) for cloud deployments:
* JSON Format Limitations (Option B):The exhibit shows an AWS CloudFormation template inJSON (JavaScript Object Notation) format. JSON, by its official specification,does not support comments.
There is no native syntax (like // or /* */) to include remarks that are ignored by the CloudFormation parser.
* YAML Support:To add descriptive comments-such as instructing other regional administrators to update the AMI ID-the administrator must convert the template intoYAMLformat. YAML is a superset of JSON and specifically supports comments using the#character.
* Best Practice for Multinational Deployments:For organizations operating across multiple AWS regions, using YAML is the recommended standard because it allows for inline documentation, making templates more maintainable and easier for different teams to understand regional requirements.
Why other options are incorrect:
* Option A:Comments are part of the template file itself, not a parameter or flag within the aws cloudformation update-stack CLI command.
* Option C:While # is the correct character for comments in YAML, it isinvalid syntax in JSONand would cause the CloudFormation stack creation to fail with a parsing error.
* Option D:The AWSTemplateFormatVersion “2010-09-09” is currently the only valid version for CloudFormation templates; updating it does not add JSON comment support.

Loading …

Fortinet NSE7_CDS_AR-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Cloud Infrastructure Monitoring: This domain addresses monitoring AWS and Azure networks using Fortinet monitoring tools designed for cloud workload visibility and management.
Topic 2	Security Solutions Deployment: This domain covers deploying Fortinet solutions to protect IaaS and CaaS environments, and integrating them with cloud native security tools.
Topic 3	Troubleshooting: This domain involves resolving connectivity issues in AWS and Azure environments, including diagnosing problems with SDN connectors.
Topic 4	Automation Tools: This domain focuses on using infrastructure-as-code tools like Terraform, Ansible, Azure Bicep, and AWS CloudFormation to automate cloud infrastructure and Fortinet solution deployments.