Web Filtering:

FortiGate for AWS offers advanced web filtering capabilities, which allow organizations to control and

monitor web access. This feature complements AWS's native security services by providing granular

control over web traffic (Option B).

OSPF over IPSec:

FortiGate for AWS can establish dynamic routing protocols such as OSPF (Open Shortest Path First)

over IPSec tunnels. This capability enhances network routing flexibility and security, which is not

natively provided by AWS (Option C).

Secure SD-WAN with Application Visibility:

FortiGate for AWS provides Secure SD-WAN functionality, offering enhanced application visibility and

traffic management. This is a significant addition to AWS's networking services, optimizing

application performance and security (Option E).

Comparison with Other Options:

Option A (Higher VPN throughput) is not specifically enhanced by FortiGate as compared to AWS

native services.

Option D (Advanced dynamic routing) is partially covered under OSPF over IPSec but is not as specific

as the other chosen options.

Reference:

FortiGate for AWS Documentation: FortiGate on AWS

AWS Networking and Content Delivery: AWS Networking

Scalability:

FortiGate Cloud-Native Firewall (CNF) is designed to scale seamlessly with your cloud infrastructure,

providing the necessary protection without requiring manual intervention for scaling (Option B).

Firewall-as-a-Service:

FortiGate CNF is offered as a Firewall-as-a-Service (FWaaS), which simplifies the deployment and

management of firewall capabilities directly in the cloud environment (Option D).

Management:

FortiGate CNF can be managed using FortiManager and AWS Firewall Manager, providing

comprehensive management capabilities both from Fortinet's platform and AWS's native

management tools (Option E).

Other Considerations:

Option A (carrier-grade protection) is not specifically highlighted as a feature of FortiGate CNF.

Option C (uses AWS Elastic Load Balancing) is incorrect as FortiGate CNF operates independently of

AWS ELB, although it can integrate with various AWS services.

Reference:

FortiGate CNF Documentation: FortiGate CNF

AWS Firewall Manager: AWS Firewall Manager

Implicit Deny Rule:

Similar to traditional firewall rule sets, FortiGate Cloud-Native Firewall (CNF) includes an implicit

deny rule at the bottom of each policy set. This means any traffic that does not match an existing rule

in the policy set is automatically denied (Option A).

Policy Set Creation:

When a new CNF instance is deployed, a new policy set is created specifically for that instance. This

ensures that each CNF instance can have a tailored set of security policies based on the specific

needs of the deployment (Option C).

Other Options Analysis:

Option B is incorrect because policy sets do not require manual synchronization; they are applied

automatically once configured.

Option D is incorrect as a single CNF instance operates with a single policy set at a time.

Reference:

FortiGate CNF Documentation: FortiGate CNF

Firewall Policy Best Practices: Fortinet Policies

DNS Configuration:

For FortiWeb Cloud to effectively protect web applications, the DNS records for the application

servers must be configured to point to FortiWeb Cloud. This ensures that all incoming traffic is routed

through FortiWeb Cloud for inspection and protection (Option A).

Traffic Filtering:

FortiWeb Cloud provides robust protection by filtering incoming traffic to block the OWASP Top 10

attacks, zero-day threats, and other application layer attacks. This ensures the security and integrity

of the web applications it protects (Option B).

Other Options Analysis:

Option C is incorrect because FortiWeb Cloud can protect application servers across different VPCs or

regions, not just within the same VPC.

Option D is incorrect because step 2 does not require an AWS S3 bucket; it refers to the inspection

and filtering of incoming traffic.

Reference:

FortiWeb Cloud Overview: FortiWeb Cloud

DNS Configuration for Web Applications: DNS Configuration

FortiSandbox Deployment:

FortiSandbox for AWS deploys new EC2 instances to create isolated environments where it can safely

execute and analyze suspicious files. These instances run custom Windows and Linux virtual

machines specifically configured for sandboxing (Option D).

Sandboxing Process:

The process involves sending potential malware to these isolated VMs, executing it, and monitoring

its behavior to detect malicious activities. The results are then captured and analyzed to provide

detailed threat intelligence.

Other Options Analysis:

Option A is incorrect because FortiSandbox for AWS operates entirely within the AWS environment

and does not require an on-premises manager.

Option B is incorrect as the FortiSandbox manager is not installed on the AWS platform for managing

on-premises instances.

Option C is incorrect because FortiSandbox requires sufficient resources to perform the actual

sandboxing and analysis tasks.

Reference:

FortiSandbox for AWS Documentation: FortiSandbox

Sandboxing Concepts: Sandboxing

Network Load Balancer:

Deploying a network load balancer ensures that incoming traffic is distributed across multiple web

servers, providing high availability and redundancy. This setup helps in managing traffic efficiently

and maintaining service uptime even if some servers fail (Option A).

Multiple Availability Zones:

Deploying web servers in multiple availability zones (AZs) enhances fault tolerance and availability. If

one AZ goes down, servers in other AZs can continue to handle the traffic, ensuring the web

application remains accessible (Option D).

Other Options Analysis:

Option B is incorrect because NAT Gateways are used to provide internet access to instances in

private subnets, not to make private addresses reachable from the internet.

Option C is not sufficient on its own for high availability. Adding a route to the default VPC route table

forwarding traffic to the internet gateway makes the VPC internet-accessible but does not ensure

high availability.

Reference:

AWS High Availability and Fault Tolerance: AWS High Availability

AWS Network Load Balancer: Network Load Balancer

Understanding Gateway Load Balancer (GWLB):

GWLB is designed to distribute traffic across multiple appliances for both inbound and outbound

traffic, providing scalability and high availability.

Traffic Load Balancing:

GWLB can send traffic to multiple FortiGate appliances for load balancing purposes, ensuring

efficient use of resources (Option A).

Stateful Processing:

For stateful processing, GWLB ensures that traffic flows (both inbound and outbound) for a given

connection are directed to the same FortiGate appliance. This maintains session integrity (Option B).

Preservation and Hashing of Traffic:

Options C and D are incorrect as they suggest incorrect behavior regarding traffic content

preservation and hashing for data integrity, which are not primary functions of GWLB.

Reference:

AWS Gateway Load Balancer Documentation: AWS Gateway Load Balancer

FortiGate Integration with GWLB: Fortinet Documentation

Symmetric Traffic Flow with SNAT:

In active-active (A-A) clusters, symmetric traffic flow is essential for maintaining session integrity

across multiple instances. Source Network Address Translation (SNAT) is performed inbound to

ensure that return traffic is routed correctly (Option A).

Load Balancer Requirement:

A-A clusters require a load balancer to distribute incoming traffic evenly across the active instances.

This is crucial for balancing the load and providing high availability (Option C).

API Calls and Failovers:

Option B is incorrect because failovers in A-A clusters do not typically rely on API calls but are

managed by the load balancer and the clustering mechanism itself.

Software-Defined Network (SDN) Failover:

Option D is incorrect as SDN is not specifically required for performing failovers in A-A clusters. The

failover mechanism is typically managed by the load balancer and FortiGate's clustering technology.

Reference:

FortiGate High Availability on AWS: FortiGate HA

AWS Elastic Load Balancing: AWS ELB

Internet Gateway Requirement:

For an Elastic IP (EIP) to be assigned to an instance's primary ENI, the VPC must have an Internet

Gateway (IGW) attached. The IGW enables the VPC to communicate with the internet, allowing the

EIP to function properly (Option C).

Process of Assigning EIP:

Once the Internet Gateway is attached to the VPC, the EIP can be successfully assigned to the

primary ENI of the FortiGate VM, providing it with internet access.

Other Options Analysis:

Option A is incorrect because the primary ENI is already in a public subnet.

Option B is not necessary and may not solve the issue without an attached Internet Gateway.

Option D is partially correct about the routing table but does not address the primary issue of

needing an Internet Gateway.

Reference:

AWS Elastic IP Documentation: Elastic IP

AWS Internet Gateway: Internet Gateway

Traffic Direction through GWLB Endpoint:

The ingress route table directs inbound traffic to the GWLB through a GWLB endpoint (GWLBe). This

endpoint is responsible for directing traffic to the Gateway Load Balancer for further processing

(Option B).

GENEVE Encapsulation:

The GWLB encapsulates the inbound traffic using the GENEVE protocol. This encapsulated traffic is

then sent to FortiGate instances for security inspection. The use of GENEVE ensures that the original

traffic context is preserved and can be analyzed by FortiGate (Option D).

Other Options Analysis:

Option A is incorrect because GWLB does not forward traffic without encapsulation in its dedicated

subnet.

Option C is incorrect as the inbound traffic is directed to the GWLB endpoint first, not directly to the

application subnet.

Reference:

AWS Gateway Load Balancer Documentation: AWS GWLB

GENEVE Protocol Overview: GENEVE Protocol