Free NSE7_CDS_AR-7.6 sample questions

Correct answer: An Azure Standard Load Balancer detects the health probe failure of the primary and redirects traffic to the secondary instance.

In Azure Active-Passive HA for FortiGate, the recommended modern approach uses Azure Standard Load Balancers (internal and external) with health probes. When the primary fails the health probe, the Load Balancer immediately directs new flows to the secondary. While API calls to update UDRs (legacy method) is a valid mechanism, it is slower and does not support session preservation as effectively as the Load Balancer sandwich method.

Correct answer: A static route for VPC B's CIDR block pointing to the Security VPC attachment.

To force traffic through the FortiGate (East-West inspection), the TGW route table associated with the source VPC (VPC A) must have a static route for the destination (VPC B) pointing to the Security VPC attachment. If route propagation were used, traffic would go directly to VPC B, bypassing the firewall. graph LR VPC_A[VPC A] -->|TGW Attachment| TGW_RT_A{TGW RT A} TGW_RT_A -->|Static Route: VPC B CIDR -> Sec VPC| Sec_VPC[Security VPC] Sec_VPC -->|Inspection| TGW_RT_Sec{TGW RT Sec} TGW_RT_Sec -->|Propagated Route| VPC_B[VPC B]

Correct answer: Configure a remote backend using an S3 bucket with versioning enabled and a DynamoDB table for state locking.

The best practice for Terraform state management in a team environment is to use a remote backend. An S3 bucket provides durable storage (and versioning allows recovery from corruption), while a DynamoDB table is specifically used by the Terraform AWS backend to handle state locking, preventing race conditions during concurrent `terraform apply` operations.

Correct answer: The ServiceAccount associated with the connector lacks the necessary RBAC permissions (ClusterRole/Role) to list or watch pods.

A 403 Forbidden error indicates that the client is authenticated (the token is valid) but not authorized to perform the action. In the context of a Kubernetes SDN connector, this typically means the ServiceAccount used by FortiGate does not have a ClusterRole or Role binding that allows 'list' and 'watch' verbs on the 'pods' and 'namespaces' resources.

Correct answers: FortiCNP has not yet completed the initial data scan of the S3 buckets.; The CloudFormation stack used for onboarding failed to deploy the EventBridge rule for CloudTrail.

The 'Partially Running' status in FortiCNP often indicates that while the account is connected, not all features are fully operational. This can happen if the data scanning (like S3 Data Security) is still initializing or processing.

Another common cause for 'Partially Running' is missing permissions or failed deployment of specific monitoring components, such as the EventBridge rules required to send CloudTrail events to FortiCNP for real-time threat detection.

Correct answer: existing

In Azure Bicep, the `existing` keyword is used to get a reference to a resource that already exists in the subscription. This allows the template to access properties of that resource (like VNet ID or Subnet ID) without attempting to redeploy or modify it.