Which two statements are correct about AWS Network Access Control Lists (NACLS)? (Choose two.)

• A.An NACL has separate inbound and outbound rules, and each rule can either allow or deny traffic.
• B.By default. each custom NACL allows all inbound and outbound traffic unless you add new rules,
• C.NACLs are stateless: responses to allowed inbound traffic are subject to the rules for outbound traffic.
• D.VPC automatically comes with a modifiable default NACL, and by default it denies all inbound and outbound IPv4 traffic.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Traffic is initiated from the EC2 instance and is destined for the internet.
Which traffic flow is correct?

• A.EC2 instance > NAT GW > IGW > internet
• B.There is no route to the internet in the Private Route Table. The traffic does not reach the internet.
• C.EC2 instance > GWLBe > NAT GW > IGW > internet
• D.EC2 instance > GWLBe > internet

Comment: *

Name: *

Email: *

Verification: *

A customer is attempting to deploy an active-passive high availability (HA) cluster using the software-defined network (SDN) connector in the AWS cloud.
What is an important consideration to ensure a successful formation of HA, failover, and traffic flow?

• A.Both cluster members must be in the same availability zone.
• B.VDOM exceptions must be configured.
• C.Unicast FortiGate Clustering Protocol (FGCP) must be used.
• D.Both cluster members must show as healthy in the elastic load balancer (ELB) configuration.

Comment: *

Name: *

Email: *

Verification: *

An administrator has deployed an environment in AWS and is now trying to send outbound traffic from the web servers to the internet through FortiGate. The FortiGate policies are configured to allow all outbound traffic. however. the traffic is not reaching the FortiGate internal interface.
Which two statements Can be the reasons for this behavior? (Choose two)

• A.Internet Gateway (IGW) is not configured for VPC.
• B.AWS security groups are blocking the traffic.
• C.FortiGate is not configured as a default gateway tor web servers.
• D.AWS source destination checks are enabled on the FortiGate internal interfaces.

Comment: *

Name: *

Email: *

Verification: *

A global organization with cloud networks deployed in several AWS regions wants to set up next-generation firewall (NGFW) protection using FortiGate Cloud-Native Firewall (CNF).
What are two deployment considerations for the organization? (Choose two.)

• A.More than one AWS account can be associated with a CNF instance.
• B.A CNF instance is required for each AWS region that must be protected.
• C.They must choose AWS Firewall Manager to provision a CNF instance.
• D.Only one CNF instance is required to protect all AWS regions.

Comment: *

Name: *

Email: *

Verification: *