SSL Inspection Requirement:

FortiWeb Cloud provides comprehensive SSL inspection capabilities, allowing it to decrypt and

inspect HTTPS traffic for threats. This is a crucial feature for many organizations that need to ensure

all traffic, including encrypted traffic, is thoroughly inspected (Option C).

Comparison with AWS WAF:

While AWS WAF with Fortinet managed rules provides robust protection, it might not offer the same

level of SSL inspection capabilities as FortiWeb Cloud.

Other Considerations:

Option A (Manual WAF signature updates) is incorrect because FortiWeb Cloud updates signatures

automatically.

Option B (PCI 6.6 compliance) is a general requirement for any WAF solution, not specific to choosing

FortiWeb Cloud over AWS WAF.

Option D (Traffic inspection for malware) is a feature provided by both FortiWeb Cloud and AWS WAF

with Fortinet managed rules.

Reference:

FortiWeb Cloud Overview: FortiWeb Cloud

AWS WAF Documentation: AWS WAF

Dynamic Address Object Update:

The debug output shows that the IP address of the AWS Windows Server Lab has been updated

automatically, indicating that the dynamic address object feature is working as intended. This allows

FortiGate to adapt to changes in the IP addresses of AWS instances dynamically (Option A).

SDN Connector Configuration:

The messages in the debug output confirm that the SDN connector is able to retrieve instance

information and update the firewall address objects successfully. This implies that the SDN connector

is correctly configured and has the necessary permissions (Option C).

Manual Change and Permissions:

Option B is incorrect because while the address object could theoretically be changed manually, this

is not inferred from the debug output.

Option D is incorrect because the debug output does not indicate that the AWS user account must

have full administrative rights. The required permissions are typically more scoped to specific actions

related to SDN.

Reference:

FortiGate AWS Integration Guide: FortiGate on AWS

AWS IAM Policies for SDN: AWS IAM Policies

Update Software:

As part of the AWS shared responsibility model, it is the customer’s responsibility to update and

maintain the software running on the EC2 instance, including applying security patches and updates

(Option A).

Configure Security Groups:

Security groups act as virtual firewalls for instances to control inbound and outbound traffic.

Configuring them correctly is essential for securing the EC2 instance and ensuring only legitimate

traffic can reach the server (Option C).

Manage Operating System:

Managing the operating system, including user accounts, permissions, and operating system patches,

is the responsibility of the customer under the shared responsibility model (Option D).

Other Options Analysis:

Option B is incorrect as changing the existing ELB to a gateway load balancer is not necessary for

securing the new EC2 instance.

Option E is incorrect because it is not required to move all web servers into the same availability

zone for security purposes.

Reference:

AWS Shared Responsibility Model: AWS Shared Responsibility

EC2 Security Best Practices: AWS EC2 Security

Implicit Deny Rule:

Similar to traditional firewall rule sets, FortiGate Cloud-Native Firewall (CNF) includes an implicit

deny rule at the bottom of each policy set. This means any traffic that does not match an existing rule

in the policy set is automatically denied (Option A).

Policy Set Creation:

When a new CNF instance is deployed, a new policy set is created specifically for that instance. This

ensures that each CNF instance can have a tailored set of security policies based on the specific

needs of the deployment (Option C).

Other Options Analysis:

Option B is incorrect because policy sets do not require manual synchronization; they are applied

automatically once configured.

Option D is incorrect as a single CNF instance operates with a single policy set at a time.

Reference:

FortiGate CNF Documentation: FortiGate CNF

Firewall Policy Best Practices: Fortinet Policies

Internet Gateway Requirement:

For an Elastic IP (EIP) to be assigned to an instance's primary ENI, the VPC must have an Internet

Gateway (IGW) attached. The IGW enables the VPC to communicate with the internet, allowing the

EIP to function properly (Option C).

Process of Assigning EIP:

Once the Internet Gateway is attached to the VPC, the EIP can be successfully assigned to the

primary ENI of the FortiGate VM, providing it with internet access.

Other Options Analysis:

Option A is incorrect because the primary ENI is already in a public subnet.

Option B is not necessary and may not solve the issue without an attached Internet Gateway.

Option D is partially correct about the routing table but does not address the primary issue of

needing an Internet Gateway.

Reference:

AWS Elastic IP Documentation: Elastic IP

AWS Internet Gateway: Internet Gateway

Enhanced Redundancy:

Deploying an active-passive (A-P) FortiGate cluster across two availability zones (AZs) provides

enhanced redundancy by ensuring that if one AZ fails, the other can take over, maintaining high

availability and uptime.

IP Addressing and Subnetting:

One of the major differences when deploying across different AZs compared to the same AZ is that IP

addressing and subnetting are not shared between the instances. Each AZ operates independently

with its own set of subnets and IP addresses, which must be managed separately (Option D).

Other Options Analysis:

Option A is incorrect because the FortiGate devices in an A-P setup do not act as a single logical

instance; they operate in a failover setup.

Option B is incorrect because secondary IP address configuration is used in both single AZ and multi-

AZ deployments.

Option C is incorrect because the number of subnets required is typically more when deploying

across multiple AZs for redundancy.

Reference:

FortiGate HA Configuration Guide: FortiGate HA

AWS Availability Zones: AWS AZ

Thank you for your visit.

Understanding the Architecture:

The architecture includes an EC2 instance in a private subnet, a Gateway Load Balancer Endpoint

(GWLBe), a NAT Gateway (NAT GW), and an Internet Gateway (IGW).

Route Tables and Routing:

The private route table for the subnet containing the EC2 instance has a route pointing to the GWLBe

for internet-bound traffic.

The public route table for the subnet containing the NAT Gateway has routes to the IGW.

Traffic Flow Analysis:

Traffic initiated from the EC2 instance destined for the internet will first be routed to the GWLBe as

per the private route table.

The GWLBe will forward the traffic to the NAT Gateway.

The NAT Gateway will then route the traffic to the IGW, which finally sends the traffic to the internet.

Comparison with Other Options:

Option A suggests direct routing to the NAT GW from the EC2 instance, which is incorrect.

Option B incorrectly states there is no route to the internet in the private route table.

Option D suggests direct routing from GWLBe to the internet, which is not the case.

Reference:

AWS Documentation on Route Tables: AWS Route Tables

Gateway Load Balancer Overview: AWS Gateway Load Balancer

Symmetric Traffic Flow with SNAT:

In active-active (A-A) clusters, symmetric traffic flow is essential for maintaining session integrity

across multiple instances. Source Network Address Translation (SNAT) is performed inbound to

ensure that return traffic is routed correctly (Option A).

Load Balancer Requirement:

A-A clusters require a load balancer to distribute incoming traffic evenly across the active instances.

This is crucial for balancing the load and providing high availability (Option C).

API Calls and Failovers:

Option B is incorrect because failovers in A-A clusters do not typically rely on API calls but are

managed by the load balancer and the clustering mechanism itself.

Software-Defined Network (SDN) Failover:

Option D is incorrect as SDN is not specifically required for performing failovers in A-A clusters. The

failover mechanism is typically managed by the load balancer and FortiGate's clustering technology.

Reference:

FortiGate High Availability on AWS: FortiGate HA

AWS Elastic Load Balancing: AWS ELB

Cluster Elastic IP Address (EIP) Movement:

During a failover in an active-passive (A-P) cluster, the Elastic IP (EIP) associated with the active

FortiGate instance (FGT-1) needs to be moved to the passive instance (FGT-2), which becomes the

new active instance. This ensures that the traffic directed to the EIP is now handled by FGT-2 (Option

A).

Secondary IP Address Movement:

The secondary IP address on Port2 of the current active instance (FGT-1) is moved to the same port

on the new active instance (FGT-2). This step is crucial to ensure seamless network traffic redirection

and connectivity for the services relying on that IP address (Option B).

Other Options Analysis:

Option C is incorrect because the static route modification mentioned is not directly related to the

failover process described.

Option D is incorrect because no additional route needs to be added to the HA Sync AZ2 subnet route

table to forward traffic to the Internet Gateway during a failover.

Reference:

FortiGate HA Configuration Guide: FortiGate HA

AWS Elastic IP Documentation: Elastic IP

Zero-day Protection:

FortiWeb VM provides robust protection against zero-day vulnerabilities through advanced security

mechanisms and frequent updates from FortiGuard. This ensures that web applications are protected

from newly discovered threats that have not yet been patched or recognized by other security

systems (Option C).

Advanced WAF Functionality:

FortiWeb VM offers a range of advanced WAF features that go beyond what is typically provided by

managed rules for AWS WAF. These include more detailed traffic analysis, customizable rules,

machine learning-based threat detection, and comprehensive logging and reporting capabilities

(Option D).

Other Options Analysis:

Option A is more relevant to a consumption-based pricing model but not a specific benefit unique to

FortiWeb VM over AWS WAF.

Option B is incorrect because both FortiWeb VM and Fortinet Managed Rules for AWS WAF are

powered by FortiGuard updates.

Reference:

FortiWeb Overview: FortiWeb VM

AWS WAF and Fortinet Managed Rules: AWS WAF