Free NSE7_PBC-7.2: Fortinet NSE 7 - Public Cloud Security 7.2 Exam Questions and Answers

You are deploying a FortiGate-VM in Microsoft Azure by using a Terraform configuration that you cloned from a Fortinet repository. The Terraform CLI is already installed on your workstation, and the Azure provider uses your Azure CLI session for authentication. Place the following actions in the correct order, from first to last. Actions: - Run terraform apply and confirm the changes - Run az login to authenticate to the Azure subscription - Run terraform init in the configuration directory - Set the resource group, location, and admin password values in terraform.tfvars - Run terraform plan and review the resources to be created Targets: Step 1, Step 2, Step 3, Step 4, Step 5

Put the items in order, then reveal.

Refer to the exhibit. Exhibit: terraform.tf terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } $ terraform plan ... Plan: 14 to add, 0 to change, 0 to destroy. Two engineers each run this FortiGate-VM configuration from their own laptops against the same AWS account. The first engineer already ran terraform apply successfully. The second engineer runs terraform plan and sees that all 14 resources, including the VPC and the FortiGate EC2 instance, would be created again. Which change to the configuration prevents this problem and also stops simultaneous applies from corrupting the state?

• AA. Run terraform refresh on each workstation before every apply so that the local terraform.tfstate files stay current
• BB. Add a depends_on argument to the aws_instance resource so Terraform serializes changes made by different users
• CC. Define an s3 backend block with a dynamodb_table argument so the state is stored remotely and locked during apply
• DD. Create a separate terraform workspace for each engineer while keeping the default local backend on each laptop

An administrator must place a FortiGate next-generation firewall inside an Azure Virtual WAN virtual hub so that the hub itself can inspect branch-to-VNet traffic. Which deployment method should the administrator use?

• AA. Create the FortiGate-VM from an ARM template in a subnet of the address space assigned to the virtual hub
• BB. Deploy the FortiGate-VM in a spoke VNet and connect that VNet to the virtual hub with VNet peering only
• CC. Deploy the FortiGate NVA from the Azure Marketplace as a managed application directly into the virtual hub
• DD. Install the FortiGate-VM in the hub VNet that Azure Virtual WAN creates, by using the Azure portal VM wizard

A team deploys FortiGate-VM instances in AWS with Terraform and stores the configuration in a Git repository. The configuration needs the FortiGate API token for the fortios provider. Which method keeps the token out of the repository while still letting Terraform use it?

• AA. Hard-code the token in the provider block and add main.tf to the .gitignore file
• BB. Declare a variable with sensitive = true and supply its value through a TF_VAR_ environment variable
• CC. Commit terraform.tfstate with the token because the state file is encrypted by default
• DD. Define the token as an output value with a default so that every run reads it from the module

You are building east-west inspection with a Transit Gateway in AWS. Two spoke VPCs and a security VPC with FortiGate-VMs in two Availability Zones are attached to the transit gateway. Match each configuration item to the purpose it serves. Configuration items: - Item A: Appliance mode enabled on the security VPC attachment - Item B: Spoke subnet route table with 0.0.0.0/0 targeting the transit gateway - Item C: Transit gateway route table associated with the spoke attachments, with 0.0.0.0/0 pointing to the security VPC attachment - Item D: Transit gateway route table associated with the security VPC attachment, with spoke routes propagated Targets: - Target 1: Sends traffic leaving a spoke VPC to the transit gateway - Target 2: Steers traffic arriving from spoke attachments to the FortiGate inspection VPC - Target 3: Lets the transit gateway return traffic to the correct spoke VPC after inspection - Target 4: Keeps both directions of a flow on the same FortiGate in one Availability Zone

Drag or tap each item onto its target, then reveal.

A security team has connected three AWS accounts to FortiCNP. The console now shows hundreds of separate findings from vulnerability scans, misconfiguration checks, and data scans. The team has time to fix only a few resources this week and must start with the most exposed ones. What should the team use in FortiCNP?

• AA. The compliance report for the CIS benchmark, sorted by the number of failed controls
• BB. The list of FortiGuard IPS signatures that FortiCNP applies to each connected account
• CC. The inventory of connected accounts, sorted by the date of the most recent scan
• DD. The resource risk insights that correlate the findings of each resource into a prioritized risk score

In a Microsoft Azure hub-and-spoke design, which next hop type must a user-defined route use to send spoke traffic to the internal interface IP address of a FortiGate-VM?

• AA. Internet
• BB. Virtual network
• CC. Virtual appliance
• DD. Virtual network gateway

Refer to the exhibit. Exhibit: Transit gateway attachment: tgw-attach-security Resource type: VPC (security VPC, FortiGate-VMs in AZ a and AZ b) Associated route table: tgw-rtb-spokes Appliance mode support: disable tgw-rtb-spokes 0.0.0.0/0 tgw-attach-security static East-west traffic between spoke VPCs is inspected by two FortiGate-VMs, one in each Availability Zone of the security VPC. Sessions between instances in different Availability Zones fail intermittently, and the FortiGate logs show that only one direction of these sessions reaches each firewall. What is the most likely cause?

• AA. The spoke attachments are not associated with a transit gateway route table
• BB. Appliance mode is not enabled on the security VPC attachment
• CC. The default route in tgw-rtb-spokes is static instead of propagated
• DD. The FortiGate-VMs do not have session synchronization configured between them

A virtual machine in Microsoft Azure has a public IP address and is in a subnet named snet-web. An NSG associated with snet-web has an inbound rule at priority 200 that allows TCP 443 from the Internet service tag. A second NSG is associated with the VM network interface and contains only its default rules. Clients on the internet cannot connect to TCP 443 on the VM. What is the reason?

• AA. The subnet NSG is evaluated for outbound flows only, so its inbound allow rule for TCP 443 has no effect on traffic reaching the VM.
• BB. Azure evaluates NSG rules from the highest priority number to the lowest, so the default DenyAllInbound rule at 65500 matches before the allow rule.
• CC. The NIC NSG has no rule that allows TCP 443 from the internet, so its default DenyAllInbound rule drops traffic that the subnet NSG allowed.
• DD. Azure applies the NIC NSG result and ignores the subnet NSG when both exist, so the subnet allow rule for TCP 443 has no effect.

An administrator uses automation to deploy a FortiGate-VM behind a Standard SKU external Azure load balancer. The frontend uses a Standard SKU public IP address, a load balancing rule forwards TCP 443 to the backend pool, and the health probe shows both pool members as healthy. No NSG is associated with the FortiGate subnet or with its network interfaces. The FortiGate policy allows the traffic, yet connections from the internet to TCP 443 time out. What is the reason?

• AA. A Standard load balancer cannot front a FortiGate unless an outbound rule is added, because inbound rules stay disabled until SNAT is configured.
• BB. The load balancing rule needs session persistence set to Client IP and protocol, because the FortiGate drops connections that change backend members.
• CC. The public IP address must use the Basic SKU, because a Standard SKU address cannot be associated with a frontend that has a FortiGate backend.
• DD. Standard SKU public IP addresses and load balancers are closed to inbound traffic until an NSG on the subnet or NIC explicitly allows the flow.