FCP_ZCS-AD-7.4問題集には練習試験問題解答 [Q20-Q36]

FCP_ZCS-AD-7.4問題集には練習試験問題解答

FCP_ZCS-AD-7.4はFortinet Certified Professional実際の無料試験練習テスト

質問 # 20
You deployed a FortiGate active-active with ELB/ILB solution using the template from Azure Marketplace.
What is the purpose of the inbound NAT rules configured in the external load balancer in this deployment?

A. To load balance the incoming traffic between both FortiGate VMs
B. To allow administrative access to the FortiGate VMs
C. To filter inbound traffic before it reaches the FortiGate instances
D. To forward the health probes to both FortiGate VMs

正解：B

解説：
In anactive-active FortiGate ELB/ILB deployment, theinbound NAT rulesconfigured on theexternal load balancerare used toallow administrative access (e.g., HTTPS, SSH)to the individual FortiGate VMs. Since the public IP is associated with the load balancer, NAT rules are required tomap specific ports to backend FortiGate instancesfor management access.

質問 # 21
In Microsoft Entra ID, what is the primary administrative unit that represents an organization and its relationship with Microsoft's cloud services?

A. Microsoft Entra tenant
B. Microsoft Entra organization
C. Microsoft Entra domain
D. Microsoft Entra subscription

正解：A

解説：
AMicrosoft Entra tenantis theprimary administrative unitthat represents an organization within Microsoft' s identity platform. It defines theboundary for identity management, access control, and resource governance, and serves as the core entity that connects the organization to Microsoft's cloud services such as Azure and Microsoft 365.

質問 # 22
After integrating a FortiGate VM with Azure Route Server, you detect that routes are not propagating successfully.
What initial step could you perform to diagnose the root cause?

A. Examine the Azure Microsoft Entra ID permissions associated with the FortiGate VM to ensure that correct authentication is being used for BGP peering
B. Verify the BGP peering status on both the FortiGate VM and Azure Route Server
C. Monitor the network latency between the FortiGate VM and Azure Route Server to identify potential communication delays affecting route propagation
D. Verify that the FortiGate VM is running the latest firmware version

正解：B

解説：
Thefirst and most direct diagnostic stepis toverify the BGP peering statuson both theFortiGate VM and Azure Route Server. If BGP peering is not established or is in an idle or down state, route propagation will fail. This check confirms whether the two systems are communicating and exchanging routes as expected.

質問 # 23
What characterizes the branch-to-branch topology in an Azure virtual WAN?

A. Increased redundancy through multiple connections to the central hub
B. Simplified network architecture with reduced hub dependencies
C. Enhanced security through centralized traffic management
D. Improved scalability for branch offices connecting to Azure

正解：D

解説：
Thebranch-to-branch topologyin Azure Virtual WAN is characterized bydirect connectivity between branchesthrough the Virtual WAN backbone, whichreduces dependency on centralized hubs. This results in asimplified network architecture, lowering latency and optimizing routing between branch locations.

質問 # 24
What is a key advantage of the branch-to-hub to hub-to-branch topology in an Azure virtual WAN?

A. Increased security through isolated connections between branches and hubs
B. Improved branch-to-branch communication for faster data transfer
C. Enhanced scalability enables communication between branch offices
D. Load balancing enabled by the simultaneous connection of each branch to multiple hubs

正解：B

解説：
Thebranch-to-hub to hub-to-branchtopology in Azure Virtual WAN enablesefficient branch-to-branch communicationby routing traffic through connected hubs. This improvesdata transfer speed and reliability between branches without needing direct connections between all sites, simplifying management while maintaining performance.

質問 # 25
When you deploy a single FortiGate VM using the available template from the Azure Marketplace, several other resources are also created.
Which two resources, among others, are created during the process? (Choose two.)

A. Two virtual NICs
B. One VM Scale set
C. One NSG for each interface
D. One new route table

正解：A、C

解説：
Two virtual NICs - The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.
One NSG for each interface - The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet's best practices.

質問 # 26
What is a key distinction between Azure Firewall and FortiGate VM in terms of their primary functions?

A. Azure Firewall is designed exclusively for application layer filtering, while FortiGate VM is suitable for both on-premises and cloud environments.
B. Azure Firewall is a cloud-native network security service, while FortiGate VM is a network virtual appliance (NVA) that provides comprehensive security functions.
C. Azure Firewall and FortiGate VM have identical primary functions, and no features differentiation.
D. Azure Firewall focuses on network traffic inspection, while FortiGate VM is primarily a web application firewall.

正解：B

解説：
Azure Firewallis acloud-native, fully managednetwork security servicedesigned to control and log network traffic using Azure policies. In contrast, theFortiGate VMis anetwork virtual appliance (NVA)that delivers comprehensive security features, including firewalling, IPS, antivirus, VPN, and application control, suitable forboth on-premises and cloud deployments.

質問 # 27
How are the configurations synchronized between two FortiGate VMs in an active-passive HA with SDN connector failover deployed from the Azure marketplace?

A. Using unicast FGCP
B. Using system autoscaling during a failover
C. An Azure function distributes the configuration files
D. By configuring FGSP on the primary

正解：A

解説：
In anactive-passive HA deploymentof FortiGate VMs in Azure using the Marketplace template, configuration synchronization is handled viaunicast FortiGate Clustering Protocol (FGCP). FGCP allows the primary unit to replicate its configuration and session information to the secondary unit, ensuring seamless failover.

質問 # 28
Refer to the exhibit.

Your company runs front-end web servers in Azure. You need to deploy a Linux VM to be used as a web server.
To protect your web servers with a web application firewall (WAF), you deploy FortiWeb to secure applications from web-based attacks.
Which FortiWeb operation mode can you implement for this scenario?

A. True transparent proxy
B. Transparent inspection
C. Reverse proxy
D. Passive monitoring

正解：C

解説：
TheReverse Proxymode is the most appropriate FortiWeb operation mode for this scenario. In this mode, FortiWeb sits between internet users and the Linux web servers, terminating client connections and then forwarding requests to the backend servers. This enablesdeep inspection, protection from web attacks (like SQL injection and XSS), andfull WAF functionality, making it ideal for securing front-end web servers exposed to the internet.

質問 # 29
Why would you use a user-defined route in Azure?

A. To manage user authentication and access control
B. To have the traffic from the other VMs inspected by FortiGate
C. To allow communication between FortiGate VMs on two subnets in the same VNET
D. To allow inbound management access to FortiGate VMs

正解：B

解説：
Auser-defined route (UDR)in Azure is used toredirect trafficfrom other VMsthrough a FortiGate VM for inspection. By modifying the routing table, you ensure that outbound or inter-subnet traffic issent to the FortiGate as the next hop, enablingtraffic filtering, logging, and security enforcement.

質問 # 30
What characterizes the branch-to-branch topology in an Azure virtual WAN?

A. Increased redundancy through multiple connections to the central hub
B. Simplified network architecture with reduced hub dependencies
C. Enhanced security through centralized traffic management
D. Improved scalability for branch offices connecting to Azure

正解：D

質問 # 31
Refer to the exhibit.

The exhibit shows some of the properties of a virtual NIC that is used by a FortiGate VM deployed in Azure.
The virtual NIC shown is connected to a subnet (10.0.1.0/26) with several VMs that will be accessing the internet through the FortiGate VM.
Which statement is true for this scenario?

A. The VMs in the 10.0.1.0/26 subnet can access the internet through FortiGate.
B. You must change the default gateway on the VMs in the Internal Subnet for this to work.
C. The NIC in the exhibit needs to be assigned a public IP address.
D. The parameters of the virtual NIC are not configured correctly.

正解：B

解説：
For VMs in the10.0.1.0/26subnet to access the internetthrough the FortiGate VM, theirdefault gateway must be changedto the internal IP address of the FortiGate's NIC in that subnet (e.g.,LAB1-FGT-A-Nic2).
This ensures traffic is routedthrough FortiGate for inspection and NAT, rather than directly using Azure's default system routes.

質問 # 32
How does Azure ExpressRoute contribute to achieving predictable latency for network traffic?

A. By prioritizing Azure ExpressRoute traffic over other network traffic
B. By establishing dedicated private connections to Azure data centers
C. By using public internet connections for enhanced routing flexibility
D. By relying on load balancing to dynamically optimize latency

正解：B

解説：
Azure ExpressRouteprovidesdedicated private connectionsbetween on-premises infrastructure and Azure data centers, bypassing the public internet. This results inmore predictable latency, higher reliability, and better security, making it ideal for mission-critical workloads.

質問 # 33
Refer to the exhibits, which show the outputs of two commands taken on a Windows VM running in Azure.

Which statement is true about the device with the IP address 10.0.2.4?

A. It is on the same VNET as the Windows VM
B. It is reachable through FortiGate in transparent mode
C. It is provided by Azure for routing traffic among subnets
D. It is on the same subnet as the Windows VM

正解：A

解説：
Thetrace output shows only one hopto reach10.0.2.4, indicating that the destination isin the same Azure virtual network (VNet)as the Windows VM. Since the VM's IP is10.0.1.4and the destination is10.0.2.4, they are indifferent subnets, but Azure allowsdirect routing between subnets within the same VNetwithout additional hops.

質問 # 34
Refer to the exhibit.

A high availability, active-active FortiGate with Elastic Load Balancing (ELB) and Internal Load Balancing (ILB) was deployed in your Azure environment.
Which tools can you use to configure synchronization? (Choose two.)

A. Autoscale
B. FortiManager
C. FortiGate Clustering Protocol (FGCP)
D. Software-defined network (SDN) Fabric Connector
E. Heartbeat interfaces

正解：C、E

解説：
In aFortiGate active-active HA deployment in Azure, synchronization between instances is achieved using:
FortiGate Clustering Protocol (FGCP)- This is the primary protocol used to synchronize configuration and session information between HA peers.

Heartbeat interfaces- These interfaces are specifically configured to exchange HA state and sync data between the FortiGate VMs, ensuring cluster consistency.