Fortinet NSE 7 - Public Cloud Security 7.2 Free Sample Questions

The azurerm_lb_probe Terraform resource is specifically designed to define the health probe used by an Azure Load Balancer. The port attribute within this resource allows the administrator to specify the exact TCP or HTTP port that the probe will use to check the health of backend instances, such as the FortiGate-VMs. This is the correct way to configure a custom port for health monitoring in an Azure HA setup.

The most secure and scalable method for auto-scaling groups is to use an aws_launch_template. The user_data script within the launch template can be configured to run at boot. This script should securely fetch the FortiManager IP and registration credentials from a service like AWS Secrets Manager, then use the FortiGate CLI command execute fgfm-reg to initiate registration. This avoids hardcoding secrets and allows for dynamic, secure bootstrapping of new instances.

The fortios_firewall_address module is the correct tool for managing firewall address objects. Using state: present ensures idempotency. If the named address object does not exist, Ansible will create it. If it already exists with the specified parameters, Ansible will report 'ok' and make no changes. If it exists but has different parameters, Ansible will update it to match the playbook definition and report 'changed'.

Since the packet capture shows traffic arriving but not leaving the FortiGate, the issue is likely within the FortiGate's configuration. For the FortiGate to route traffic to the spoke VPC, it must have a route in its routing table for that destination. In a TGW environment, this route should point to the TGW as the next hop. A missing static route for 192.168.1.0/24 would cause the FortiGate to drop the packets, as it wouldn't know where to send them.

FortiCNP provides actionable remediation guidance, often including specific CLI commands or console steps to fix misconfigurations. This is a primary feature for mitigating identified risks.

A key benefit of FortiCNP is its ability to automate remediation. Setting up a workflow to automatically correct common, high-risk misconfigurations like public S3 buckets is a best practice for immediate risk mitigation.

While using a Managed Identity is the recommended and most secure method, the Azure SDN Connector also supports authentication using a Service Principal with a client ID and secret. Therefore, it is not mandatory to use a Managed Identity, although it is a best practice.

Multiple TGW route tables are fundamental to creating separate routing domains. Each business unit's VPC attachments can be associated with a specific route table, and propagation can be controlled to ensure traffic is isolated and only routed where intended (e.g., to the security VPC).

Controlling route table association (which route table an attachment uses) and propagation (which attachments dynamically propagate their routes into a route table) is the core mechanism for enforcing traffic isolation and directing traffic flows within the TGW.

FortiGate CNF integrates with the Kubernetes API to understand its objects. The correct way to enforce this policy is to create a firewall policy within FortiGate CNF that uses Kubernetes labels or service objects to define the 'frontend' namespace as the source and the 'database' namespace as the destination. Applying an Intrusion Prevention System (IPS) profile to this policy will enable the inspection for SQL injection attacks.

The GRE (Generic Routing Encapsulation) tunnel in a TGW Connect setup serves as a transport layer. Its primary function is to encapsulate and carry the packets of a dynamic routing protocol, specifically BGP, between the customer's SD-WAN appliance (FortiGate) and the Transit Gateway. This allows for dynamic exchange of routes, which is a core benefit of TGW Connect over static TGW attachments. GRE itself does not provide encryption.

In an Azure Virtual WAN architecture, routing for spoke VNets is controlled by the hub's route tables. To force internet-bound traffic through the NVA, you must edit the effective route table associated with the spoke VNet connection (often the 'default' route table). You would add a static route for 0.0.0.0/0 and set the next hop to the specific vWAN connection corresponding to the FortiGate NVA. UDRs in the spoke VNet are not the primary mechanism for this in a vWAN hub scenario.