Security solutions deployment · Deploy Fortinet solutions to protect IaaS
A cloud infrastructure engineer deploys a FortiGate-VM instance on AWS using a Bring Your Own License (BYOL) VM08 license. Due to specific memory and networking bandwidth requirements, the engineer provisions an Amazon EC2 c5.4xlarge instance type, which provides 16 vCPUs. How does FortiOS handle the compute resources on this instance?
Answer and explanation
Correct answer: A
Under FortiOS licensing rules for FortiGate-VM, if a virtual machine instance is provisioned with more vCPUs than authorized by the installed license (such as assigning 16 vCPUs to a VM08 license), FortiOS caps its compute resource usage to the licensed limit. It actively uses only eight vCPUs for traffic inspection and management tasks while ignoring the surplus compute resources, allowing the firewall to remain fully operational without triggering license violation shutdowns.
Q2Question 2
Beginner
Security solutions deployment · Deploy Fortinet solutions to protect IaaS
An administrator deploys an on-demand (PAYG) FortiGate-VM into an isolated management subnet in AWS that initially lacks direct outbound Internet connectivity. After updating the route table and security groups to permit outbound HTTPS connections to directregistration.fortinet.com, the instance remains in a temporary license state. Which CLI command must the administrator execute on the FortiGate to immediately contact FortiCloud and activate the official license?
Answer and explanation
Correct answer: D
When an on-demand (PAYG) FortiGate-VM is provisioned in an environment without initial access to FortiCloud, it generates a temporary local license to allow bootstrapping. Once routing and security group rules allow connectivity to https://directregistration.fortinet.com/, running 'execute vm-license' manually initiates contact with FortiCloud to retrieve and activate the official cloud marketplace license.
Q3Question 3
Intermediate
Security solutions deployment · Deploy Fortinet solutions to protect CaaS
When integrating the FortiWeb Ingress Controller 1.0.1 with an Amazon EKS cluster to protect containerized microservices, which ingressClassName must be defined within the Kubernetes Ingress resource, and which core FortiWeb objects are automatically provisioned upon reconciliation?
Answer and explanation
Correct answer: B
The FortiWeb Ingress Controller listens specifically for Kubernetes Ingress resources associated with the IngressClass name 'fwb-ingress-controller'. When reconciling these resources, the controller communicates with the FortiWeb appliance via REST API to automatically create and update the virtual server, content routing, and real server pool objects.
Q4Question 4
Beginner
Security solutions deployment · Deploy Fortinet solutions to protect CaaS
True or False: The FortiWeb Ingress Controller version 1.0.0 exclusively manages and provides security inspection for HTTP and HTTPS routes within Kubernetes environments.
Answer and explanation
Correct answer: B
FortiWeb Ingress Controller version 1.0.0 is dedicated strictly to Layer 7 web traffic and exclusively services HTTP and HTTPS ingress routes. Raw TCP/UDP stream proxying or non-HTTP application ingress is not supported by version 1.0.0.
Q5Question 5
Advanced
Security solutions deployment · Deploy Fortinet solutions to protect CaaS
A multinational financial services enterprise is modernizing its application tier by migrating containerized microservices to Amazon Elastic Kubernetes Service (EKS). The security architecture mandates a dedicated FortiWeb-VM cluster deployed in a central inspection VPC, managed via Helm and Kubernetes API integrations through the FortiWeb Ingress Controller (version 1.0.1).
The platform engineering team must ensure that the ingress controller pod possesses granular role-based access control (RBAC) permissions across the cluster without granting unrestricted cluster-admin privileges. Additionally, developers deploy ingress manifests that utilize host-based and path-based routing targeting microservices across multiple distinct namespaces.
During initial testing, the controller pod enters a running state, but changes to Kubernetes Ingress definitions fail to register on the FortiWeb appliances. The DevOps team verifies that the API version used for Ingress resources is networking.k8s.io/v1.
Which Kubernetes RBAC configuration and Ingress definition must be validated to ensure the FortiWeb Ingress Controller properly discovers and reconciles ingress events across all target namespaces?
flowchart LR
Dev[DevOps / Helm] -->|Deploy Ingress| K8sAPI[K8s API Server]
K8sAPI -->|Watch Events| FWIC[FortiWeb Ingress Controller Pod]
FWIC -->|REST API Calls| FWB[FortiWeb-VM Cluster]
FWB -->|WAF Inspection| Pods[Application Pods]
Answer and explanation
Correct answer: A
To discover Ingress resources across multiple namespaces, the FortiWeb Ingress Controller requires a ClusterRole and ClusterRoleBinding targeting the 'networking.k8s.io/v1' API group for 'ingresses' and 'ingressclasses'. Furthermore, FortiWeb Ingress Controller exclusively processes ingress resources that explicitly designate 'fwb-ingress-controller' as their ingressClassName.
Q6Question 6
Intermediate
Automation tools · Deploy Fortinet solutions using Azure Bicep
An automation specialist is configuring parameters for an Azure FortiGate autoscale deployment using custom ARM/Bicep templates. The enterprise requires that all dynamic instances in the autoscale group utilize Marketplace Pay-As-You-Go (PAYG) on-demand billing, and that administrative access to the underlying deployment Function App and Cosmos DB backend is restricted to the internal network. How should the BYOL Instance Count and Access Restriction IP Range template parameters be set?
Answer and explanation
Correct answer: D
In Fortinet Azure autoscale templates, setting 'BYOL Instance Count' to 0 designates the autoscale set as purely PAYG (on-demand), preventing the autoscale handler from provisioning or expecting BYOL license files. Setting 'Access Restriction IP Range' to the corporate management CIDR explicitly restricts inbound access to the Function App and Cosmos DB backend, rather than leaving it open to 0.0.0.0/0.
Register free for 6 more questions
Or unlock all 157 NSE7-PBC-7.6 questions with explanations, timed mode and flashcards.
