FCP - Public Cloud Security 7.4 Administrator Free Sample Questions

When using a Transit Gateway with a centralized inspection VPC (Security VPC), asymmetric routing often occurs because the TGW might send return traffic to a different availability zone than the source. Enabling 'Appliance Mode' on the TGW attachment for the Security VPC ensures that return traffic is routed to the same availability zone where the inspection took place, maintaining flow symmetry required for stateful firewalls like FortiGate.

The Network Contributor role provides the necessary permissions to manage network resources, including the ability to update route tables (UDRs) and IP configurations on network interfaces. This is required for the FortiGate SDN connector to rewrite route next-hops to the active unit during an HA failover.

FortiGate CNF is a fully managed SaaS offering. The primary benefit is that Fortinet manages the underlying infrastructure, including the provisioning, scaling, and patching of the firewall instances (CNF instances), allowing the customer to focus solely on security policy management via FortiManager or the CNF console.

The SDN connector requires permissions to query the AWS API. Specifically, 'ec2:DescribeInstances', 'ec2:DescribeTags', and similar 'Describe' permissions are essential for the connector to fetch metadata about resources and populate dynamic address objects.

The SDN connector runs on the management plane of the FortiGate. It must be able to reach the public AWS API endpoints (e.g., ec2.us-east-1.amazonaws.com). If the management interface is in a private subnet without a NAT Gateway or VPC Endpoint, the connection will fail.

This is True. In Azure Active-Active HA with an external Load Balancer, the ALB distributes inbound traffic to both nodes. However, when the FortiGate forwards traffic to backend servers, the return traffic from the server must go back to the same FortiGate node that processed the initial packet. Applying Source NAT (SNAT) on the FortiGate ensures the server replies to the FortiGate's interface IP rather than the original client IP, guaranteeing the return path matches the forward path.

The standard 'Azure' type SDN connector (configured with a Service Principal or Managed Identity) allows the FortiGate to query the Azure API for resource tags and properties. This enables the creation of dynamic address objects that filter based on tags like 'Environment=Production' and automatically update as VMs are added or removed.

To inspect East-West traffic via a TGW, you must segment the routing domains. A common pattern is to have a 'Spoke Route Table' where the default route (0.0.0.0/0) or specific inter-VPC CIDRs point to the Security VPC attachment. The Security VPC attachment is associated with a separate 'Security Route Table' that propagates routes from the spokes, allowing the FortiGate to send traffic back to the correct destination.

In True Transparent Proxy mode, FortiWeb is deployed inline (layer 2 bridge) and inspects traffic without modifying the source or destination IP addresses. This makes the WAF invisible to the client and server. Note: In many public cloud environments (Layer 3 only), True Transparent is difficult to implement without specific overlay networking; however, conceptually, this is the mode for 'transparent inspection'. In Cloud native contexts, Reverse Proxy is more common, but the question asks for the mode definition.

In an API-based HA architecture (often used when Load Balancers are not preferred for internal routing), the FortiGate SDN Connector on the unit becoming 'Primary' triggers an API call to Azure Resource Manager to update the Next Hop IP in the UDRs to its own interface IP.

The issue is likely asymmetric routing caused by the Transit Gateway crossing Availability Zones. When traffic leaves the Hub VPC (after inspection), TGW might send it to an AZ in the destination VPC different from the source. However, the return traffic might enter the TGW in a different AZ and be routed to the passive FortiGate or the wrong interface in the Hub VPC if Appliance Mode is not on. Enabling Appliance Mode forces the TGW to use the same AZ attachment for the return traffic flow, ensuring it hits the active FortiGate processing the session.