The exhibit shows the results of a FortiCNP registry scan, which is part of the FortiCNP container protection.  FortiCNP’s Container Protection provides deep visibility into the security posture of container registries and images 1 .  The registry scan utilizes Common Vulnerabilities and Exposures (CVE) index regularly updated by NVD to detect underlying vulnerabilities, security flaws, and provides security best practices 2 .  The registry scan is performed at the registry level, and it can scan all images in a repository if the Tag section is left blank when adding a repository 2 .  The CAP section stands for Container Assurance Policy, which defines the minimum number of images to be scanned per repository 3 . Therefore, the correct statements are A and C.  References :  Container Image Scan | FortiCNP 22.3.a ,  FortiCNP ,  Cloud Native Application Protection Platform | FortiCNP

The next step the administrator must take to access the Linux EC2 instance from the internet is:

D. Allocate an Elastic IP address and assign it to the instance.

Elastic IP (EIP) Requirement: By default, when an EC2 instance is launched in AWS, it receives a public IP address from Amazon ' s pool, which is not static. This IP address can change, for example, if the instance is stopped and started again. To have a static IP address, you need to allocate an Elastic IP (EIP), which is a persistent public IP address, and then associate it with the instance.

Public Accessibility: Without an Elastic IP, the instance may not be accessible over the internet after a reboot or stop/start sequence. Assigning an Elastic IP ensures the instance can be accessed consistently using the same IP address.

References: The AWS documentation on EC2 instances details the process and need for Elastic IPs to ensure consistent internet access to instances.

A is incorrect because the terraform plan command will not deploy any resources at all. It will only show the changes that would be made if the terraform apply command was run.  The error message in the exhibit indicates that the service principal details are invalid, which means that Terraform cannot authenticate to Azure and cannot create any resources 1 .

B is incorrect because you can run the terraform apply command without running the terraform plan command first.  The terraform apply command will automatically generate a new plan and prompt you to approve it before applying it 2 . However, running the terraform plan command first can help you preview the changes and avoid any unwanted or unexpected actions.

C is correct because you must run the terraform init command once before the terraform plan command. The terraform init command initializes a working directory containing Terraform configuration files.  It downloads and installs the provider plugins required for your configuration, such as the Azure provider 2 .  It also creates a hidden directory called .terraform to store the plugin binaries and other metadata 1 . Without running the terraform init command, the terraform plan command will fail because it cannot find the required plugins or modules.

D is correct because the terraform plan command makes Terraform do a dry run. A dry run is a simulation of what would happen if you executed a certain action, without actually performing it.  The terraform plan command creates an execution plan, which is a description of the actions that Terraform would take to make your infrastructure match your configuration 2 . The execution plan shows you what resources will be created, modified, or destroyed, and what attributes will be changed.  The execution plan does not affect your infrastructure or state file until you apply it with the terraform apply command 1 .

The error message indicates that the Connect attachment is already associated with another transit gateway route table. You cannot associate the same attachment with more than one route table. However, you can propagate the same attachment to multiple route tables. Therefore, to fulfill your requirement of configuring a second route table for east-west traffic inspection between two VPCs, you need to create a propagation with the Connect attachment in the second route table.  This will allow the second route table to learn the routes from the Connect attachment and forward the traffic to the security VPC 1 .  You also need to associate the second route table with the Transport attachment, which is the transit gateway attachment for the security VPC 1 .

References :

Transit gateway route tables - Amazon VPC | AWS Documentation

Getting started with transit gateways - Amazon VPC | AWS Documentation

Configuring TGW route tables | FortiGate Public Cloud 7.4.0 | Fortinet Document Library

Considering the situation where the administrator is unable to access the FortiGate VM using its public IP address and no traffic is reaching the FortiGate ' s external interface, the administrator should check:

D. Check the inbound network security group rules.

Network Security Group Rules: AWS uses security groups as a virtual firewall that controls inbound and outbound traffic to AWS resources such as EC2 instances. If the FortiGate VM’s public interface is not receiving HTTPS or SSH traffic, it ' s likely because the inbound security group rules associated with that interface are not allowing access on the necessary ports (HTTPS - port 443, SSH - port 22).

Troubleshooting: The administrator should verify that the security group rules for the FortiGate VM’s network interface allow inbound traffic on the specific ports used for management access. If these rules are absent or misconfigured, the intended traffic will be blocked, resulting in the inability to connect.

References: The role of security groups in network traffic management is a core concept in AWS and is outlined in AWS documentation. Checking security group rules is a standard troubleshooting step when dealing with connectivity issues to AWS resources.

The statement that best describes the concept of immutable infrastructure in the context of automation is:

A. It is the practice of deploying a new server for every configuration change.

Immutable Infrastructure Concept: This approach to infrastructure management involves replacing servers or components entirely rather than making changes to existing configurations once they are deployed. When a change is needed, a new server instance is provisioned with the desired configuration and the old one is decommissioned after the new one is successfully deployed and tested.

Benefits: Immutable infrastructure minimizes the risks associated with in-place updates, such as inconsistencies or failures due to configuration drift. It enhances reliability and predictability by ensuring that the deployed environment matches exactly what was tested in staging. This practice is particularly aligned with modern deployment strategies like blue/green or canary deployments.

References: The concept of immutable infrastructure is widely discussed in DevOps and cloud computing literature as a method to increase consistency and fault tolerance in automated environments.

For deploying a FortiGate VM using Terraform in AWS, the administrator must use:

B. Use the Name of the key pair.

Terraform and AWS SSH Keys: When deploying instances in AWS using Terraform, it is required to specify the name of the SSH key pair to enable key-based authentication to the instance post-deployment.

Configuration Syntax: The variable keyname within the Terraform configuration should match the exact name of the SSH key pair as it is stored in AWS. This ensures that Terraform can reference the correct key during the deployment process to set up SSH access to the FortiGate VM.

Terraform Variables: The variable " keyname " block in the Terraform configuration will look for the key pair name as it should be declared in the terraform.tfvars file or passed as a variable during execution. This does not require the key pair ' s ID or fingerprint, just its name.

References: The need for the SSH key pair ' s name in Terraform configurations for AWS deployments is outlined in the Terraform AWS Provider documentation, which specifies how resources should be provisioned using Terraform.