Easy To Download Fortinet NSE7_PBC-7.2 Exam Dumps Updated 91 Questions
New Updated NSE7_PBC-7.2 Exam Questions 2025
NEW QUESTION # 54
You are troubleshooting an Azure SDN connectivity issue with your FortiGate VM Which two queries does that SDN connector use to interact with the Azure management API? (Choose two.)
- A. The first query is targeted to IP address 8.8
- B. The first query is targeted to a special IP address to get a token.
- C. Some queries are made to manage public IP addresses.
- D. There is only one query initiating from FortiGate port1 -
Answer: B,C
Explanation:
Explanation
The Azure SDN connector uses two types of queries to interact with the Azure management API. The first query is targeted to a special IP address to get a token. This token is used to authenticate the subsequent queries. The second type of query is used to retrieve information about the Azure resources, such as virtual machines, network interfaces, network security groups, and public IP addresses. Some queries are made to manage public IP addresses, such as assigning or releasing them from the FortiGate VM. References: Configuring an SDN connector in Azure, Azure SDN connector using service principal, Troubleshooting Azure SDN connector
NEW QUESTION # 55
Refer to the exhibit. Your senior administrator successfully configured a FortiGate fabric connector with the Azure resource manager, and created a dynamic address object on the FortiGate VM to connect with a windows server in Microsoft Azure. However, there is now an error on the dynamic address object, and you must resolve the issue.
How do you resolve this issue?
- A. In the Microsoft Azure portal, set the correct tag values for the windows server.
- B. Run diagnose debug application azd -l on FortiGate.
- C. Delete the address object and recreate a new address object with the type set to FQDN.
- D. In the Microsoft Azure portal, access the windows server, obtain the private IP address, and assign the IP address under the FortiGate-VM AzureLab address object.
Answer: A
NEW QUESTION # 56
Refer to the exhibit.
An administrator has deployed a FortiGate VM in Amazon Web Services (AWS) and is trying to access it using its public IP address from their local computer However, the connection is not successful and at the same time FortiGate is not receiving any HTTPS or SSH traffic to its external interface What should the administrator check for possible issue?
- A. Check the inbound network security group rules
- B. Check the FortiGate firewall policies
- C. Check the FortiGate instance ID
- D. Run a debug flow to check any network ACLs
Answer: A
Explanation:
Considering the situation where the administrator is unable to access the FortiGate VM using its public IP address and no traffic is reaching the FortiGate's external interface, the administrator should check:
D:Check the inbound network security group rules.
* Network Security Group Rules:AWS uses security groups as a virtual firewall that controls inbound and outbound traffic to AWS resources such as EC2 instances. If the FortiGate VM's public interface is not receiving HTTPS or SSH traffic, it's likely because the inbound security group rules associated with that interface are not allowing access on the necessary ports (HTTPS - port 443, SSH - port 22).
* Troubleshooting:The administrator should verify that the security group rules for the FortiGate VM's network interface allow inbound traffic on the specific ports used for management access. If these rules are absent or misconfigured, the intended traffic will be blocked, resulting in the inability to connect.
References:The role of security groups in network traffic management is a core concept in AWS and is outlined in AWS documentation. Checking security group rules is a standard troubleshooting step when dealing with connectivity issues to AWS resources.
NEW QUESTION # 57
Refer to the exhibit
A customer has deployed an environment in Amazon Web Services (AWS) and is now trying to send outbound traffic from the Linux1 and Linux2 instances to the internet through the security VPC (virtual private cloud). The FortiGate policies are configured to allow all outbound traffic; however, the traffic is not reaching the FortiGate internal interface. Assume there are no issues with the Transit Gateway (TGW) configuration Which two settings must the customer add to correct the issue? (Choose two.)
- A. Both landing subnets in the security VPC must have a 0.0.0.0/0 traffic route to the FortiGate port2.
- B. The four landing subnets in all the VPCs must have a 0.0 0 0/0 traffic route to the TGW
- C. Both landing subnets in the spoke VPCs must have a 0.0 00/0 traffic route to the TGW
- D. Both landing subnets in the spoke VPCs must have a 0.0.0.0/0 traffic route to the Internet Gateway (IOW).
Answer: A,C
Explanation:
Explanation
The correct answer is B and C. Both landing subnets in the spoke VPCs must have a 0.0.0.0/0 traffic route to the TGW. Both landing subnets in the security VPC must have a 0.0.0.0/0 traffic route to the FortiGate port2.
According to the AWS documentation for Transit Gateway, a transit gateway is a network transit hub that connects VPCs and on-premises networks. To send outbound traffic from the Linux instances to the internet through the security VPC, you need to do the following steps:
In the main subnet routing table in the spoke VPCs, add a new route with destination 0.0.0.0/0, next hop TGW. This route directs all traffic from the Linux instances to the TGW, which can then forward it to the appropriate destination based on the TGW route table.
In the main subnet routing table in the security VPC, add a new route with destination 0.0.0.0/0, next hop FortiGate port2. This route directs all traffic from the TGW to the FortiGate internal interface, where it can be inspected and allowed by the FortiGate policies.
The other options are incorrect because:
Adding a 0.0.0.0/0 traffic route to the Internet Gateway (IGW) in the spoke VPCs is not correct, as this would bypass the TGW and the security VPC and send all traffic directly to the internet.
Adding a 0.0.0.0/0 traffic route to the TGW in all the VPCs is not necessary, as only the spoke VPCs need to send traffic to the TGW. The security VPC needs to send traffic to the FortiGate port2.
Transit Gateways - Amazon Virtual Private Cloud:Fortinet Documentation Library - Deploying FortiGate VMs on AWS
NEW QUESTION # 58
You are troubleshooting an Azure SDN connectivity issue with your FortiGate VM Which two queries does that SDN connector use to interact with the Azure management API? (Choose two.)
- A. The first query is targeted to IP address 8.8
- B. The first query is targeted to a special IP address to get a token.
- C. Some queries are made to manage public IP addresses.
- D. There is only one query initiating from FortiGate port1 -
Answer: B,C
Explanation:
The Azure SDN connector uses two types of queries to interact with the Azure management API. The first query is targeted to a special IP address to get a token. This token is used to authenticate the subsequent queries. The second type of query is used to retrieve information about the Azure resources, such as virtual machines, network interfaces, network security groups, and public IP addresses. Some queries are made to manage public IP addresses, such as assigning or releasing them from the FortiGate VM. References: Configuring an SDN connector in Azure, Azure SDN connector using service principal, Troubleshooting Azure SDN connector
NEW QUESTION # 59
Refer to the exhibit.
An administrator has deployed a FortiGate VM in Amazon Web Services (AWS) and is trying to access it using its public IP address from their local computer However, the connection is not successful and at the same time FortiGate is not receiving any HTTPS or SSH traffic to its external interface What should the administrator check for possible issue?
- A. Check the FortiGate firewall policies
- B. Check the FortiGate instance ID
- C. Run a debug flow to check any network ACLs
- D. Check the inbound network security group rules.
Answer: D
Explanation:
Network Security Group Rules: AWS uses security groups as a virtual firewall that controls inbound and outbound traffic to AWS resources such as EC2 instances. If the FortiGate VM's public interface is not receiving HTTPS or SSH traffic, it's likely because the inbound security group rules associated with that interface are not allowing access on the necessary ports (HTTPS - port 443, SSH - port 22).
Troubleshooting: The administrator should verify that the security group rules for the FortiGate VM's network interface allow inbound traffic on the specific ports used for management access. If these rules are absent or misconfigured, the intended traffic will be blocked, resulting in the inability to connect.
Explanation:
Considering the situation where the administrator is unable to access the FortiGate VM using its public IP address and no traffic is reaching the FortiGate's external interface, the administrator should check:
NEW QUESTION # 60
Refer to the exhibit
You are tasked with deploying FortiGate using Terraform. When you run the terraform version command during the Terraform installation, you get an error message.
What could be the reason that you are getting the command not found error?
- A. You must assign correct permissions to the ec2-user.
- B. You must change the directory location to the root directory
- C. You must reinstall Terraform
- D. You must move the binary file to the bin directory.
Answer: D
Explanation:
According to the Terraform documentation for installing Terraform on Linux1, you need to download a zip archive that contains a single binary file called terraform. You need to unzip the archive and move the binary file to a directory that is included in your system's PATH environment variable, such as /usr/local/bin. This way, you can run the terraform command from any directory without specifying the full path1.
If you do not move the binary file to the bin directory, you will get a command not found error when you try to run the terraform version command, as shown in the screenshot. To fix this error, you need to move the binary file to the bin directory or specify the full path of the binary file when running the command1.
1: Install Terraform | Terraform - HashiCorp Learn
NEW QUESTION # 61
In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)
- A. From both spoke VPCs, and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway.
- B. From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW.
- C. From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW.
- D. From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the FortiGate internal port.
- E. From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the TGW.
Answer: B,C,D
NEW QUESTION # 62
You are automating configuration changes on one of the FortiGate VMS using Linux Red Hat Ansible.
How does Linux Red Hat Ansible connect to FortiGate to make the configuration change?
- A. It uses YAML
- B. It uses an API.
- C. It uses a FortiGate internal or external IP address with TCP port 21
- D. It uses SSH as a connection method to FortiOS.
Answer: B
Explanation:
Explanation
Ansible connects to FortiGate using an API, which is a method of communication between different software components. Ansible uses the fortios_* modules to interact with the FortiOS API, which is a RESTful API that allows configuration and monitoring of FortiGate devices12. Ansible can use either HTTP or HTTPS as the transport protocol, and can authenticate with either a username and password or an API token3.
The other options are incorrect because:
Ansible does not use TCP port 21 to connect to FortiGate. Port 21 is typically used for FTP, which is not supported by FortiOS4.
Ansible does not use SSH as a connection method to FortiOS. SSH is a secure shell protocol that allows remote command execution and file transfer, but it is not the preferred way of automating configuration changes on FortiGate devices.
Ansible does not use YAML to connect to FortiGate. YAML is a data serialization language that Ansible uses to write playbooks and inventory files, but it is not a connection method. References:
Fortinet.Fortios - Ansible Documentation
FortiOS REST API Reference
FortiOS Module Guide - Ansible Documentation
FortiOS 7.0 CLI Reference
[Connection methods and details - Ansible Documentation]
[YAML Syntax - Ansible Documentation]
NEW QUESTION # 63
Refer to the exhibit
Consider the active-active load balance sandwich scenario in Microsoft Azure.
What are two important facts in the active-active load balance sandwich scenario? (Choose two )
- A. It supports session synchronization for handling asynchronous traffic.
- B. It uses the vdom-exception command to exclude the configuration from being synced
- C. It is recommended to enable NAT on FortiGate policies.
- D. It uses the FGCP protocol
Answer: A,C
Explanation:
B: It is recommended to enable NAT on FortiGate policies. This is because the Azure load balancer uses a hash-based algorithm to distribute traffic to the FortiGate instances, and it relies on the source and destination IP addresses and ports of the packets1. If NAT is not enabled, the source IP address of the packets will be the same as the load balancer's frontend IP address, which will result in uneven distribution of traffic and possible asymmetric routing issues1. Therefore, it is recommended to enable NAT on the FortiGate policies to preserve the original source IP address of the packets and ensure optimal load balancing and routing1. D. It supports session synchronization for handling asynchronous traffic. This means that the FortiGate instances can synchronize their session tables with each other, so that they can handle traffic that does not follow the same path as the initial packet of a session2. For example, if a TCP SYN packet is sent to FortiGate A, but the TCP SYN-ACK packet is sent to FortiGate B, FortiGate B can forward the packet to FortiGate A by looking up the session table2. This feature allows the FortiGate instances to handle asymmetric traffic that may occur due to the Azure load balancer's hash-based algorithm or other factors.
The other options are incorrect because:
* It does not use the vdom-exception command to exclude the configuration from being synced. The vdom-exception command is used to exclude certain configuration settings from being synchronized between FortiGate devices in a cluster or a high availability group3. However, in this scenario, the FortiGate devices are not in a cluster or a high availability group, but they are standalone devices with standalone configuration synchronization enabled. This feature allows them to synchronize most of their configuration settings with each other, except for some settings that identify the FortiGate to the network, such as the hostname.
* It does not use the FGCP protocol. FGCP stands for FortiGate Clustering Protocol, which is used to synchronize configuration and state information between FortiGate devices in a cluster or a high availability group. However, in this scenario, the FortiGate devices are not in a cluster or a high availability group, and they use standalone configuration synchronization instead of FGCP.
NEW QUESTION # 64
An administrator decides to use the Use managed identity option on the FortiGate SDN connector with Microsoft Azure However, the SDN connector is failing on the connection What must the administrator do to correct this issue?
- A. Make sure to add the Tenant ID on FortiGate side of the configuration
- B. Make sure to add the Client secret on FortiGate side of the configuration
- C. Make sure to enable the system assigned managed identity on Azure
- D. Make sure to set the type to system managed identity on FortiGate SDN connectorsettings
Answer: C
Explanation:
When an administrator decides to use the 'Use managed identity' option for the FortiGate SDN connector with Microsoft Azure and faces a connection failure, the correct action to take is:
C:Make sure to enable the system assigned managed identity on Azure.
* Managed Identity Configuration:The system assigned managed identity is a feature in Azure that provides an identity for the Azure service instance (in this case, the FortiGate SDN connector) within Azure Active Directory and eliminates the need for credentials to be stored in the configuration.
* Troubleshooting Connection Issues:If the SDN connector is failing to connect, it could be because the system assigned managed identity has not been enabled or configured properly in Azure for the FortiGate service.
References:Azure documentation on managed identities explains the need to enable and configure this feature for services to authenticate and interact securely with Azure resources.
NEW QUESTION # 65
A customer would like to use FortiGate fabric integration With FortiCNP When configuring a FortiGate VM to add to FortiCNP, which three mandatory configuration steps must you follow on FortiGate? (Choose three.)
- A. Create an SSL]SSH inspection profile.
- B. Create and IPS sensor and a firewall policy
- C. Enable send logs-
- D. Create an IPsec tunnel.
- E. Enable two-factor authentication.
Answer: A,B,C
Explanation:
To configure a FortiGate VM to add to FortiCNP, you need to perform three steps on FortiGate:
Enable send logs in FortiGate to allow FortiCNP to receive the IPS logs from FortiGate.
Create an SSL/SSH inspection profile on FortiGate to inspect the encrypted traffic and apply IPS protection.
Create an IPS sensor and a firewall policy on FortiGate to enable IPS detection and prevention for the traffic.
Reference:
FortiCNP 22.4.a Administration Guide, page 22-24
FortiGate IPS Administration Guide, page 9-10
NEW QUESTION # 66
When configuring the FortiCASB policy, which three configuration options are available? (Choose three.)
- A. Intrusion prevention policies
- B. Compliance policies
- C. Antivirus policies
- D. Data loss prevention policies
- E. Threat protection policies
Answer: B,D,E
Explanation:
Policy setting allows you to configure each policy to fit the need of your usage. You can select any type of Policy (Data Analysis, Threat Protection or Compliance)
NEW QUESTION # 67
In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)
- A. From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW
- B. From the security VPC TGW subnet routing table: point 0.0.0.0/0 traffic to the TGW
- C. From both spoke VPCs and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway
- D. From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW
- E. From the security VPC TGW subnet routing table: point 0.0.0.0/0 traffic to theFortiGate internal port
Answer: A,D,E
Explanation:
* Spoke VPC Routing: The 0.0.0.0/0 (default) route in the spoke VPC must point to the Transit Gateway attachment for traffic to reach other VPCs or external destinations.
* Security VPC Routing: Traffic from the security VPC needs to pass through the FortiGate for inspection and security controls. Therefore, the 0.0.0.0/0 route in the security VPC's TGW subnet routing table must point to the FortiGate's internal port.
* FortiGate Routing: The FortiGate's internal subnet must have its 0.0.0.0/0 route configured to point to the Transit Gateway attachment, allowing traffic to be returned to other VPCs or reach the internet.
In an SD-WAN TGW Connect topology, when routing traffic from a spoke VPC to a security VPC through a Transit Gateway, the mandatory initial steps include:
* From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW (Option A):This step is crucial for ensuring that all traffic from the spoke VPC destined for external networks is directed through the Transit Gateway, allowing for centralized management and security inspection.
* From the security VPC TGW subnet routing table: point 0.0.0.0/0 traffic to the FortiGate internal port (Option B):Routing all traffic from the TGW subnet in the security VPC to the FortiGate's internal port ensures that traffic is subjected to the necessary security policies and inspections provided by the FortiGate appliance before it proceeds to other destinations or returns to the spoke VPCs.
* From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW (Option D):This configuration ensures that traffic returning from the security processes handled by the FortiGate is routed back through the Transit Gateway, maintaining the integrity of the secure transit path and ensuring proper routing back to the originating spoke or onward to the internet.
References:These steps align with best practices for implementing SD-WAN solutions in a cloud environment, ensuring that all traffic is appropriately routed through security appliances for necessary controls and monitoring, asdetailed in the Fortinet SD-WAN documentation and AWS Transit Gateway connectivity guidelines.
NEW QUESTION # 68
A Network security administrator is searching for a solution to secure traffic going in and out of the container infrastructure.
In which two ways can Fortinet container security help secure container infrastructure? (Choose two.)
- A. FortiGate NGFW can connect to the worker node and protects the container-
- B. FortiGate NGFW can inspect north-south container traffic with label aware policies
- C. FortiGate NGFW and FortiSandbox can be used to secure container traffic
- D. FortiGate NGFW can be placed between each application container for north-south traffic inspection
Answer: B,C
Explanation:
FortiGate NGFW can inspect north-south container traffic with label aware policies and FortiGate NGFW and FortiSandbox can be used to secure container traffic.
According to the Fortinet documentation for container security, FortiGate NGFW can provide the following benefits for securing container infrastructure:
- It can inspect north-south traffic between containers and external networks using label aware policies, which allow for dynamic policy enforcement based on Kubernetes labels and metadata.
- It can integrate with FortiSandbox to provide advanced threat protection for container traffic, by sending suspicious files or URLs to a cloud-based sandbox for analysis and detection.
- It can leverage FortiGuard Security Services to provide real-time threat intelligence and updates for container traffic, such as antivirus, web filtering, IPS, and application control.
NEW QUESTION # 69
Refer to the exhibit. What would be the impact of confirming to delete all the resources in Terraform?
- A. It destroys all the resources in the . tfvars file
- B. It destroys all the resources in the state file.
- C. It destroys all the resources tied to the AWS Identity and Access Management (1AM) user.
- D. It destroys all the resources in the resource group
Answer: B
Explanation:
Confirming to delete all the resources in Terraform will have the following impact: D. It destroys all the resources in the state file.
Terraform State File Role: The terraform.tfstate file contains a real-time mapping of the resources that Terraform manages, including their current configuration and relationships. This file tracks the actual state of resources provisioned by Terraform.
Impact of Destruction: When Terraform prompts for confirmation to destroy resources, and 'yes' is entered, Terraform reads the state file and systematically removes all the resources that are managed as part of that state. This is not limited to a specific .tfvars file, IAM user, or resource group--it is a global action that affects all resources tracked by the state file associated with the current Terraform workspace and configuration.
NEW QUESTION # 70
You are adding more spoke VPCs to an existing hub and spoke topology Your goal is to finish this task in the minimum amount of time without making errors.
Which Amazon AWS services must you subscribe to accomplish your goal?
- A. CloudWatch, S3
- B. GuardDuty, CloudWatch
- C. Inspector, S3
- D. WAF, DynamoDB
Answer: A
Explanation:
Explanation
The correct answer is D. CloudWatch and S3.
According to the GitHub repository for the Fortinet aws-lambda-tgw script1, this function requires the following AWS services:
CloudWatch: A monitoring and observability service that collects and processes events from various AWS resources, including Transit Gateway attachments and route tables.
S3: A scalable object storage service that can store the configuration files and logs generated by the Lambda function.
By using the Fortinet aws-lambda-tgw script, you can automate the creation and configuration of Transit Gateway Connect attachments for your FortiGate devices.This can help you save time and avoid errors when adding more spoke VPCs to an existing hub and spoke topology1.
The other AWS services mentioned in the options are not required for this task. GuardDuty is a threat detection service that monitors for malicious and unauthorized behavior to help protect AWS accounts and workloads. WAF is a web application firewall that helps protect web applications from common web exploits.
Inspector is a security assessment service that helps improve the security and compliance of applications deployed on AWS. DynamoDB is a fast and flexible NoSQL database service that can store various types of data.
1:GitHub - fortinet/aws-lambda-tgw
NEW QUESTION # 71
Refer to the exhibit. You are tasked with deploying a webserver and FortiGate VMS in AWS. You are using Terraform to automate the process.
Which two important details should you know about the Terraform files? (Choose two.)
- A. After the deployment, Terraform output values are visible only through AWS CloudShell.
- B. You must specify all the AWS credentials in the output. of file.
- C. The subnet_private 1 value is defined in the variables . tf file
- D. All the output values are available after a successful terraform apply command
Answer: C,D
Explanation:
All the output values are available after a successful terraform apply command. This means that after the deployment, you can view the output values by running terraform output or terraform show in the same directory where you ran terraform apply. You can also use the output values in other Terraform configurations or external systems by using the terraform output command with various options.
The subnet_private_1 value is defined in the variables.tf file. This means that the subnet_private_1 value is an input variable that can be customized by passing a different value when running terraform apply or by setting an environment variable. The variables.tf file is where you declare all the input variables for your Terraform configuration.
NEW QUESTION # 72
You are automating configuration changes on one of the FortiGate VMS using Linux Red Hat Ansible.
How does Linux Red Hat Ansible connect to FortiGate to make the configuration change?
- A. It uses YAML
- B. It uses an API.
- C. It uses a FortiGate internal or external IP address with TCP port 21
- D. It uses SSH as a connection method to FortiOS.
Answer: B
Explanation:
Ansible connects to FortiGate using an API, which is a method of communication between different software components. Ansible uses the fortios_* modules to interact with the FortiOS API, which is a RESTful API that allows configuration and monitoring of FortiGate devices12. Ansible can use either HTTP or HTTPS as the transport protocol, and can authenticate with either a username and password or an API token3.
The other options are incorrect because:
Ansible does not use TCP port 21 to connect to FortiGate. Port 21 is typically used for FTP, which is not supported by FortiOS4.
Ansible does not use SSH as a connection method to FortiOS. SSH is a secure shell protocol that allows remote command execution and file transfer, but it is not the preferred way of automating configuration changes on FortiGate devices.
Ansible does not use YAML to connect to FortiGate. YAML is a data serialization language that Ansible uses to write playbooks and inventory files, but it is not a connection method. Reference:
Fortinet.Fortios - Ansible Documentation
FortiOS REST API Reference
FortiOS Module Guide - Ansible Documentation
FortiOS 7.0 CLI Reference
[Connection methods and details - Ansible Documentation]
[YAML Syntax - Ansible Documentation]
NEW QUESTION # 73
Refer to Exhibit:
The exhibit shows the Connect Peers settings on Amazon Web Services (AWS) transit gateway attachments With two FortiGate VMS in a security VPC.
Which two statements are correct? (Choose two.)
- A. The BGP inside CIDR blocks can be any CIDR block with /29
- B. The Peer GRE address is the FortiGate internal interface IP address
- C. The peer GRE address is the FortiGate external interface IP address.
- D. The Transit Gateway GRE address is auto-generated
Answer: C,D
Explanation:
A . The peer GRE address is the FortiGate external interface IP address. This is the IP address of the FortiGate interface that is connected to the transit gateway attachment subnet1. This IP address is used to establish the GRE tunnel between the FortiGate and the transit gateway2. B . The Transit Gateway GRE address is auto-generated. This is the IP address of the transit gateway that is used to establish the GRE tunnel with the FortiGate2. This IP address is automatically assigned by AWS from the Transit Gateway CIDR range that you specify when you create the Connect attachment3.
The other options are incorrect because:
The BGP inside CIDR blocks cannot be any CIDR block with /29. They must be a /29 CIDR block from the 169.254.0.0/16 range for IPv4, or a /125 CIDR block from the fd00::/8 range for IPv64. These are the inside IP addresses that are used for BGP peering over the GRE tunnel4.
The Peer GRE address is not the FortiGate internal interface IP address. The internal interface IP address is used to route traffic from the FortiGate to the VPC subnet where the third-party appliance (such as SD-WAN) is located1. The Peer GRE address is used to route traffic from the FortiGate to the transit gateway over the GRE tunnel2.
NEW QUESTION # 74
Refer to the exhibit. You are configuring an active-passive FortiGate clustering protocol (FGCP) HA configuration in a single availability zone in Amazon Web Services (AWS), using a cloud formation template.
After deploying the template, you notice that the AWS console has IP information listed in the FortiGate VM firewalls in the HA configuration. However, within the configuration of FortiOS, you notice that port1 is using an IP of 10.0.0.13, and port2 is using an IP of 10.0.1.13.
What should you do to correct this issue?
- A. Delete the deployment and start again. You have in put the wrong parameters during the cloud formation template deployment.
- B. Configure FortiOS to use DHCP so that it will get the correct IP addresses on the ports.
- C. Nothing, in AWS cloud, it is normal for a FortiGate ENI primary IP address to be different than the FortiOS IP address configuration.
- D. Configure FortiOS to use static IP addresses with the IP addresses reflected in the ENI primary IP address configuration (as per the exhibit).
Answer: C
NEW QUESTION # 75
Which two Amazon Web Services (AWS) topologies support east-west traffic inspection within the AWS cloud by the FortiGate VM? (Choose two.)
- A. A multiple VPC deployment utilizing a transit gateway
- B. A multiple VPC deployment utilizing a transit VPC topology
- C. A single VPC deployment with multiple subnets
- D. A single VPC deployment with multiple subnets and a NAT gateway
Answer: A,B
Explanation:
Multi-VPC design. AWS recommends segmenting networks at the VPC level. In this approach, workloads are grouped together at the VPC level instead of the subnet level. All traffic between VPCs will be inspected by network security virtual firewalls at each VPC or at a shared VPC.
Design patterns such as Transit VPC or AWS Transit Gateway can be used to achieve this in an automated and scalable fashion.
NEW QUESTION # 76
......
Fortinet NSE7_PBC-7.2 certification exam is a vendor-neutral certification that is recognized by many organizations around the world. Fortinet NSE 7 - Public Cloud Security 7.2 certification is highly respected in the IT industry and can help IT professionals advance their careers and increase their earning potential.
Updated Free Fortinet NSE7_PBC-7.2 Test Engine Questions with 91 Q&As: https://www.actual4labs.com/Fortinet/NSE7_PBC-7.2-actual-exam-dumps.html
The Best NSE 7 Network Security Architect NSE7_PBC-7.2 Professional Exam Questions: https://drive.google.com/open?id=1k_pyAqKNcmvAguzGLNEIf2OdjtA33ctw