FCP-PCS-7.4 FCP - Public Cloud Security 7.4 Administrator Practice Questions

Azure Virtual WAN supports deploying select partner Network Virtual Appliances (NVAs) directly into the Virtual Hub. Fortinet is a supported partner, allowing you to deploy a FortiGate NVA inside the hub to provide NGFW capabilities for traffic flowing through the WAN.

To force traffic through the GWLB architecture, the application subnet's route table must point the default route (0.0.0.0/0) to the Gateway Load Balancer Endpoint (GWLBE) located in the same availability zone. The GWLBE encapsulates the traffic and sends it to the GWLB, which distributes it to the FortiGates.

The Fabric Connector (often referred to as SDN Connector in this context) connects to the cloud provider's API to fetch metadata such as VM tags, IDs, and states. This allows administrators to create dynamic address objects that automatically update when cloud resources change, ensuring policies remain current without manual intervention.

To function as a NAT gateway, the FortiGate must have a firewall policy allowing traffic from the internal interface (Port2) to the external interface (Port1) with 'set nat enable'. This performs Source NAT, replacing the private IP of the backend instance with the FortiGate's public-facing interface IP.

Standard IPsec VPN attachments to Transit Gateway are limited to 1.25 Gbps per tunnel. TGW Connect allows you to run GRE tunnels over the native VPC attachment (which has much higher bandwidth, up to 50 Gbps or more), enabling higher throughput for dynamic routing (BGP) integration compared to standard IPsec.

When using a Transit Gateway with a centralized inspection VPC (Security VPC), asymmetric routing often occurs because the TGW might send return traffic to a different availability zone than the source. Enabling 'Appliance Mode' on the TGW attachment for the Security VPC ensures that return traffic is routed to the same availability zone where the inspection took place, maintaining flow symmetry required for stateful firewalls like FortiGate.

The Network Contributor role provides the necessary permissions to manage network resources, including the ability to update route tables (UDRs) and IP configurations on network interfaces. This is required for the FortiGate SDN connector to rewrite route next-hops to the active unit during an HA failover.

FortiGate CNF is a fully managed SaaS offering. The primary benefit is that Fortinet manages the underlying infrastructure, including the provisioning, scaling, and patching of the firewall instances (CNF instances), allowing the customer to focus solely on security policy management via FortiManager or the CNF console.

The SDN connector runs on the management plane of the FortiGate. It must be able to reach the public AWS API endpoints (e.g., ec2.us-east-1.amazonaws.com). If the management interface is in a private subnet without a NAT Gateway or VPC Endpoint, the connection will fail.

The SDN connector requires permissions to query the AWS API. Specifically, 'ec2:DescribeInstances', 'ec2:DescribeTags', and similar 'Describe' permissions are essential for the connector to fetch metadata about resources and populate dynamic address objects.

This is True. In Azure Active-Active HA with an external Load Balancer, the ALB distributes inbound traffic to both nodes. However, when the FortiGate forwards traffic to backend servers, the return traffic from the server must go back to the same FortiGate node that processed the initial packet. Applying Source NAT (SNAT) on the FortiGate ensures the server replies to the FortiGate's interface IP rather than the original client IP, guaranteeing the return path matches the forward path.