FCP_ZCS-AD-7.4合格させる問題集でFortinet24時間で試験合格できます
最新問題を使おうFCP_ZCS-AD-7.4試験問題と解答でPDFで一年間無料更新
質問 # 21
Refer to the exhibits.
A high availability (HA) active-active FortiGate with Elastic Load Balancing (ELB) and Internal Load Balancing (ILB) was deployed with a default setup to filter traffic to a Linux server running Apache server.
Ports 80 and 22 are open on the Linux server, and on FortiGate a VIP and firewall policy are configured to allow traffic through ports 80 and 22. Traffic on port 80 is successful, but traffic on port 22 is not detected by FortiGate.
What configuration changes could you perform to allow SSH traffic?
- A. Add a new Azure load balancing rule
- B. Include the Linux server in the back-end pool options
- C. Add a new Inbound NAT rule
- D. Configure a customized port under the Frontend IP configuration
正解：C
解説：
Sinceport 80 traffic is reaching the FortiGate(as shown in the sniffer output) butport 22 traffic is not, the issue liesbefore the FortiGate, at theAzure Load Balancer level. Azure Load Balancers require anInbound NAT ruleto forward specific ports (like SSH on port 22) to a specific backend VM. Creating a newInbound NAT rule for port 22will allow SSH traffic to be properly routed to the FortiGate VM.
質問 # 22
What are two characteristics of Azure standard public IP addresses? (Choose two.)
- A. They can be dynamic or static
- B. They require the configuration of NSGs for inbound traffic
- C. They can be used with load balancers of any SKU
- D. They support the use of availability zones
正解：A、D
解説：
They support the use of availability zones - Standard public IP addresses are zone-redundant and support availability zone deployments for high availability.
They can be dynamic or static - Azure standard public IPs can be configured as static or dynamic, offering flexibility based on deployment needs.
質問 # 23
What is a requirement when you deploy a FortiGate active-active cluster in Azure?
- A. You must configure all FortiGate VMs with three or more interfaces.
- B. You must use unicast FGCP to synchronize the configurations.
- C. You must configure both load balancers to allow administrative access.
- D. You must assign the public IP address to an Azure load balancer.
正解：D
解説：
In anactive-active FortiGate clusterdeployment in Azure, you must assign thepublic IP address to an Azure load balancer. This is required because Azure does not support multiple VMs sharing a single public IP directly. TheAzure Load Balancerhandles inbound traffic and distributes it to the active FortiGate instances.
質問 # 24
Refer to the exhibit.
Your company runs front-end web servers in Azure. You need to deploy a Linux VM to be used as a web server.
To protect your web servers with a web application firewall (WAF), you deploy FortiWeb to secure applications from web-based attacks.
Which FortiWeb operation mode can you implement for this scenario?
- A. Transparent inspection
- B. Reverse proxy
- C. Passive monitoring
- D. True transparent proxy
正解：B
解説：
TheReverse Proxymode is the most appropriate FortiWeb operation mode for this scenario. In this mode, FortiWeb sits between internet users and the Linux web servers, terminating client connections and then forwarding requests to the backend servers. This enablesdeep inspection, protection from web attacks (like SQL injection and XSS), andfull WAF functionality, making it ideal for securing front-end web servers exposed to the internet.
質問 # 25
Your organization is in the process of optimizing its Azure network architecture and wants to dynamically manage and exchange routing information between its virtual networks and on-premises networks.
Which Azure service would help to provide a centralized point for efficient route management and dynamic routing?
- A. Azure Virtual WAN
- B. Azure Route Server
- C. Azure ExpressRoute
- D. Azure VPN Gateway
正解：B
解説：
Azure Route Serverenables dynamic route exchange using BGP between your Azure virtual network and network virtual appliances (NVAs) or on-premises networks. It provides acentralized and scalable solution for route management, allowing seamless integration of routing updates without manual configuration changes.
質問 # 26
Refer to the exhibit.
An Azure Route Server and an active-passive FortiGate with Elastic Load Balancing (ELB) and Internal Load Balancing (ILB) have been deployed successfully and they are sharing and populating BGP routes in the Protected VNet.
A Linux server has been deployed in a new VNet spoke. It is expected that Azure Route Server should inject the FortiGate BGP routes into the Linux server but that failed.
How can you diagnose the problem?
- A. Monitor effective routes on the Azure network interface (NIC) of the Linux server
- B. Linux server doesn't support BGP negotiation with Azure Route Server
- C. Review FortiGate BGP neighbors
- D. Verify the BGP setup on Azure Route Server
正解：A
解説：
TheLinux server in the spoke VNet cannot directly peer BGP with the Azure Route Server, as it is not a BGP-enabled device. Instead,Azure propagates routes to VMs through the effective route tables associated with theirnetwork interfaces (NICs). Therefore, to diagnose why BGP routes are notreaching the Linux VM, you shouldmonitor the effective routes on the NICto verify if the routes from the FortiGate (via the Route Server) are being injected properly.
質問 # 27
Refer to the exhibit.
Your organization is planning the implementation of a complex hub-to-spoke solution to meet automated large-scale branch connectivity with multiple regions, offering a diverse range of connectivity options.
Which Azure networking service can deliver a solution?
- A. Azure SD-WAN
- B. Azure Firewall Manager
- C. Azure Virtual WAN
- D. Azure VPN Gateway
正解：C
解説：
Azure Virtual WANis designed forlarge-scale, automated, and global branch connectivity, supporting hub-and-spoke architecturesacross multiple regions. It enablescentralized routing,hub-to-hub connectivity, and integrates withVPN, ExpressRoute, and SD-WAN solutions, making it ideal for complex, multi-region deployments as shown in the diagram.
質問 # 28
Refer to the exhibits.
You are configuring an SDN connector for Azure on a FortiGate device You completed all the required steps on the Azure side. While configuring the FortiGate side, you notice that you did not save the client secret used in the Azure App Registration.
What is the quickest way to obtain the value of the client secret?
- A. Create a new resource group
- B. Create a new appregistration
- C. Create a new client secret
- D. Create a new external connector for Azure
正解：C
解説：
Azuredoes not allow you to view an existing client secret's value after creationfor security reasons. If you did not save the client secret when it was first generated, thequickest and only optionis tocreate a new client secretunder the existing app registration and use the new value in your FortiGate configuration.
質問 # 29
How does Azure ExpressRoute contribute to achieving predictable latency for network traffic?
- A. By using public internet connections for enhanced routing flexibility
- B. By establishing dedicated private connections to Azure data centers
- C. By prioritizing Azure ExpressRoute traffic over other network traffic
- D. By relying on load balancing to dynamically optimize latency
正解：B
解説：
Azure ExpressRouteprovidesdedicated private connectionsbetween on-premises infrastructure and Azure data centers, bypassing the public internet. This results inmore predictable latency, higher reliability, and better security, making it ideal for mission-critical workloads.
質問 # 30
Why would you use a user-defined route in Azure?
- A. To allow inbound management access to FortiGate VMs
- B. To allow communication between FortiGate VMs on two subnets in the same VNET
- C. To manage user authentication and access control
- D. To have the traffic from the other VMs inspected by FortiGate
正解：D
解説：
Auser-defined route (UDR)in Azure is used toredirect trafficfrom other VMsthrough a FortiGate VM for inspection. By modifying the routing table, you ensure that outbound or inter-subnet traffic issent to the FortiGate as the next hop, enablingtraffic filtering, logging, and security enforcement.
質問 # 31
Refer to the exhibits.
Two new dynamic firewall addresses have been configured on the FortiGate VM using the external connector to Integrate within the same Azure environment.
The debug output shows that one IP address can be resolved successfully, but the second is empty.
Which steps could you perform to correct the misconfiguration? (Choose all that apply.)
- A. Verify the Microsoft Entra ID role assignment access rights
- B. Verify the filter used for the dynamic firewall address
- C. Verify the tags on the target VM
- D. Check for a mistyped Microsof Entra ID subscription
- E. Verify the NSG for the target VM
正解：B、C
解説：
The debug output shows that the UbuntuServer address object successfully resolved an IP, while the webServer did not. The most likely cause is a mismatch in the dynamic address filter or missing tags on the target VM.
Verify the filter used for the dynamic firewall address - The filter category=windows may not match any VM metadata, resulting in no matched addresses.
Verify the tags on the target VM - Ensure that the VM has the correct tags (e.g., category=windows) that match the dynamic address filter to enable resolution.
質問 # 32
What characterizes the branch-to-branch topology in an Azure virtual WAN?
- A. Improved scalability for branch offices connecting to Azure
- B. Enhanced security through centralized traffic management
- C. Simplified network architecture with reduced hub dependencies
- D. Increased redundancy through multiple connections to the central hub
正解：A
解説：
Thebranch-to-branch topologyin Azure Virtual WAN is characterized bydirect connectivity between branchesthrough the Virtual WAN backbone, whichreduces dependency on centralized hubs. This results in asimplified network architecture, lowering latency and optimizing routing between branch locations.
質問 # 33
What characterizes the branch-to-branch topology in an Azure virtual WAN?
- A. Improved scalability for branch offices connecting to Azure
- B. Enhanced security through centralized traffic management
- C. Simplified network architecture with reduced hub dependencies
- D. Increased redundancy through multiple connections to the central hub
正解：A
解説：
Thebranch-to-branch topologyin Azure Virtual WAN is characterized bydirect connectivity between branchesthrough the Virtual WAN backbone, whichreduces dependency on centralized hubs. This results in asimplified network architecture, lowering latency and optimizing routing between branch locations.
質問 # 34
Your organization is planning to deploy FortiWeb in Azure to provide a web application security solution to its web servers. One of the requirements is to have granular control of the number of vCPUs and memory assigned to this resource.
Which cloud model could meet this requirement?
- A. Software-as-a-Service (SaaS)
- B. Infrastructure-as-a-Service (IaaS)
- C. Platform-as-a-Service (PaaS)
- D. Function-as-a-Service (FaaS)
正解：B
解説：
Infrastructure-as-a-Service (IaaS)allows you to deploy FortiWeb as a virtual machine in Azure, giving you granular control over vCPU and memory allocation. This model provides full flexibility over the compute resources and network configuration, which is essential for deploying and scaling security appliances like FortiWeb.
質問 # 35
Which statement about deploying VMs in a gateway subnet is true?
- A. VMs are not allowed in a gateway subnet
- B. VMs can be deployed in a gateway subnet only after you deploy the VPN Gateway
- C. VMs are automatically deployed in a gateway subnet
- D. VMs are required in a gateway subnet
正解：A
解説：
Azure does not allow the deployment of virtual machines (VMs) in a gateway subnet.The gateway subnet is specifically reserved forAzure VPN Gateway or ExpressRoute Gateway instances, and deploying other resources in it can causegateway deployment or operation failures.
質問 # 36
......
最新問題をダウンロードFCP_ZCS-AD-7.4問題集で2025年最新のFCP_ZCS-AD-7.4試験問題集：https://jp.fast2test.com/FCP_ZCS-AD-7.4-premium-file.html
最新のFortinet FCP_ZCS-AD-7.4認定練習テスト問題：https://drive.google.com/open?id=1byr_M2gIStd2rDCDwPVxamMAWmYcnPUV