FCP-ZCS-AD-7-4 FCP - Azure Cloud Security 7.4 Administrator Practice Questions

Platform as a Service (PaaS) provides a platform where the cloud provider manages the runtime, middleware, operating system, servers, storage, and networking. The customer is only responsible for their applications and data. This aligns perfectly with the startup's goal of abstracting away the underlying infrastructure management. IaaS would require them to manage the OS and middleware. SaaS would involve using a ready-made application, not deploying their own code.

FortiGate policies are processed in a top-down order. The correct approach is to first create the specific 'allow' policies (like the Apollo-to-Orion rule). Below these, a single, broader 'deny' policy can be created to act as a catch-all. By creating a group containing all the project-specific dynamic address objects (e.g., All-Project-VMs) and setting this group as both the source and destination in a deny policy, any traffic between projects that did not match a preceding allow rule will be blocked. This is scalable and efficient. The other options are either not scalable or would incorrectly block intra-project traffic.

A health probe is a feature of Azure Load Balancer used to check the health of instances in the backend pool. The probe periodically connects to the instances on a specified port and protocol (e.g., TCP, HTTP). If an instance fails to respond correctly to the probe, the Load Balancer stops sending new traffic to it until it becomes healthy again. This is the essential mechanism for ensuring traffic is only sent to operational FortiGate VMs in the scale set.

This statement is false. Azure ExpressRoute provides a private, dedicated connection to Microsoft Azure through a connectivity provider. It does not go over the public internet. While the connection is private, traffic on an ExpressRoute circuit is not encrypted by default. Customers who require encryption over ExpressRoute must implement it themselves, for example, by running an IPsec VPN tunnel over the private peering.

In this specific design where UDRs point to an internal load balancer, the redirection of outbound traffic relies on the LB's health probe. The health probe will detect that the previously active unit (FGTA) is no longer responding. The LB will mark it as unhealthy and stop sending traffic to it. Since FGTB is now active and responding to health probes, the LB will direct all new flows from the workloads (forwarded by the UDR) to FGTB. The Azure API call to move IPs is used in designs without an internal load balancer where the UDR points directly to the active FortiGate's IP. GARP is not effective in a cloud environment like Azure. BGP is not part of this standard HA design.

The Azure SDN connector is designed for this exact purpose. It integrates with Azure APIs to discover resources and their metadata, like tags. By creating a dynamic address object filtered by the env:prod tag, the FortiGate will automatically update the object's members as VMs are added or removed, ensuring the firewall policy remains accurate without manual intervention. Manual updates are inefficient and error-prone. FQDN objects might not be feasible and are less dynamic. Scripting is a possible but more complex solution that reinvents the functionality already provided by the SDN connector.

In an Azure FortiGate HA setup, the Azure Load Balancer directs traffic to the active unit. During a failover, the newly active unit must take over the IP configurations from the failed unit. However, the Azure fabric itself is unaware of this internal FGCP failover. The failover mechanism relies on an API call to Azure to re-associate the secondary IP configurations (including the one in the LB's backend pool) from the old primary's NIC to the new primary's NIC. If this API call fails or is not configured, the LB will continue sending traffic to the NIC of the now-passive (failed) unit. Internal UDRs affect outbound and east-west traffic, not inbound external traffic through the LB. A split-brain would cause more severe issues. A failing health probe would stop traffic to both units, not just the newly active one.

Network Security Groups (NSGs) are the fundamental tool in Azure for filtering network traffic. They contain a list of security rules that allow or deny traffic based on source/destination IP address, port, and protocol. NSGs can be associated with network interfaces or subnets to enforce traffic policies. Azure Firewall is a more advanced, stateful firewall-as-a-service. UDRs are used for routing, not filtering. Azure Application Gateway is a Layer 7 load balancer with WAF capabilities, operating at a higher level than basic network filtering.

Mismatched IPsec/IKE parameters are a primary cause of VPN tunnel failures. Azure VPN Gateways have default policies that specify cryptographic algorithms, including a specific Diffie-Hellman group for the key exchange. If the FortiGate is configured with a different DH group (e.g., Group 14) and the Azure side expects another (e.g., Group 2), the Phase 1 negotiation will fail. An incorrect IP range in the local network gateway would affect routing after the tunnel is up, not the establishment itself. A missing static route is also a post-establishment routing issue. Mismatched DPD might cause stability issues but usually doesn't prevent the initial connection.

This scenario perfectly describes the use case for a FortiGate autoscaling deployment. The core components are: Azure VM Scale Set (VMSS) to manage the pool of FortiGates and handle scaling events; Azure Load Balancers to distribute traffic; a bootstrap configuration (often using a customdata file stored in Azure Storage) to provide initial settings to new instances; and FortiManager to act as the central configuration and licensing server. FortiManager ensures that as new FortiGates are spun up by the VMSS, they automatically register, receive the correct license, and pull the latest unified policy. The other options are incorrect for various reasons related to scalability and automated configuration management.