NSE 7 Network Security Architect Certification NSE7_PBC-7.2 Sample Questions Reliable
Prepare for the Actual NSE 7 Network Security Architect NSE7_PBC-7.2 Exam Practice Materials Collection
To prepare for the Fortinet NSE7_PBC-7.2 exam, candidates can take advantage of various training resources provided by Fortinet, such as webinars, online courses, and study guides. Fortinet also offers a certification program for its security solutions, which can help candidates to gain practical experience in working with Fortinet's products and technologies. With proper preparation and dedication, IT professionals can pass the NSE7_PBC-7.2 exam and become certified Fortinet NSE 7 - Public Cloud Security professionals.
NEW QUESTION # 31
Which two Amazon Web Services (AWS) features support east-west traffic inspection within the AWS cloud by the FortiGate VM? (Choose two.)
- A. A transit VPC
- B. A NAT gateway with an EIP
- C. An Internet gateway with an EIP
- D. A transit gateway with an attachment
Answer: A,D
NEW QUESTION # 32
Which two Amazon Web Services (AWS) features support east-west traffic inspection within the AWS cloud by the FortiGate VM? (Choose two.)
- A. A transit VPC
- B. A NAT gateway with an EIP
- C. An Internet gateway with an EIP
- D. A transit gateway with an attachment
Answer: A,D
Explanation:
A transit gateway with an attachment and a transit VPC support east- west traffic inspection within the AWS cloud by the FortiGate VM. According to the Fortinet documentation for Public Cloud Security, a transit gateway is a network transit hub that connects VPCs and on-premises networks. A transit gateway attachment is a resource that connects a VPC or VPN to a transit gateway. By using a transit gateway with an attachment, you can route traffic from your spoke VPCs to your security VPC, where the FortiGate VM can inspect the traffic.
A transit VPC is a VPC that serves as a global network transit center for connecting multiple VPCs, remote networks, and virtual private networks (VPNs). By using a transit VPC, you can deploy the FortiGate VM as a virtual appliance that provides network security and threat prevention for your VPCs.
NEW QUESTION # 33
Refer to the exhibit.
You are configuring a second route table on a Transit Gateway to accommodate east-west traffic inspection between two VPCs_ However, you are getting an error during the transit gateway route table association With the Connect attachment.
Which action Should you take to fulfill your requirement?
- A. Add both Associations and Propagations in the second TGW route table.
- B. In the second route table: create a propagation with the Connect attachment.
- C. Add a static route in the Routes section
- D. Delete the both Connect and Transport attachments from the first TGW route table
Answer: B
Explanation:
The error message indicates that the Connect attachment is already associated with another transit gateway route table. You cannot associate the same attachment with more than one route table. However, you can propagate the same attachment to multiple route tables. Therefore, to fulfill your requirement of configuring a second route table for east-west traffic inspection between two VPCs, you need to create a propagation with the Connect attachment in the second route table. This will allow the second route table to learn the routes from the Connect attachment and forward the traffic to the securityVPC1. You also need to associate the second route table with the Transport attachment, which is the transit gateway attachment for the security VPC1.
References:
* Transit gateway route tables - Amazon VPC | AWS Documentation
* Getting started with transit gateways - Amazon VPC | AWS Documentation
* Configuring TGW route tables | FortiGate Public Cloud 7.4.0 | Fortinet Document Library
NEW QUESTION # 34
You have been asked to secure your organization's salesforce application that is running on Microsoft Azure, and find an effective method for inspecting shadow IT activities in the organization. After an initial investigation, you find that many users access the salesforce application remotely as well as on-premises.
Your goal is to find a way to get more visibility, control over shadow IT-related activities, and identify any data leaks in the salesforce application.
Which three steps should you take to achieve your goal? (Choose three.)
- A. Configure FortiCASB and set up access rights, privileges, and data protection policies.
- B. Deploy and configure FortiCASB with a Fortinet FortiCASB subscription license.
- C. Use FortiGate, FortiGuard, and FortiAnalyzer solutions.
- D. Deploy and configure FortiCWP with a workload guardian license.
- E. Deploy and configure FortiGate with Security Fabric solutions, and FortiCWP with a storage guardian advance license.
Answer: A,B,C
NEW QUESTION # 35
You are configuring the failover settings on a FortiGate active-passive SDN connector solution in Microsoft Azure. Which two mandatory settings are required after the initial deployment? (Choose two)
- A. Active FortiGate serial number
- B. Subscription-id
- C. FortiGate license file
- D. Resource group name
Answer: B,D
Explanation:
For configuring the failover settings on a FortiGate active-passive SDN connector solution in Microsoft Azure, the two mandatory settings required after the initial deployment are:
A: Subscription-id
D: Resource group name
Subscription ID: This is a unique identifier for your Azure subscription under which all resources are created and billed. FortiGate needs this to interact with the Azure resources associated with that subscription.
Resource Group Name: A resource group in Azure is a container that holds related resources for an Azure solution. The SDN connector requires the resource group name to correctly identify and manage the resources it should control, especially in a failover scenario.
NEW QUESTION # 36
Refer to the exhibit
A customer has deployed an environment in Amazon Web Services (AWS) and is now trying to send outbound traffic from the Linux1 and Linux2 instances to the internet through the security VPC (virtual private cloud). The FortiGate policies are configured to allow all outbound traffic; however, the traffic is not reaching the FortiGate internal interface. Assume there are no issues with the Transit Gateway (TGW) configuration Which two settings must the customer add to correct the issue? (Choose two.)
- A. Both landing subnets in the spoke VPCs must have a 0.0 00/0 traffic route to the TGW
- B. The four landing subnets in all the VPCs must have a 0.0 0 0/0 traffic route to the TGW
- C. Both landing subnets in the spoke VPCs must have a 0.0.0.0/0 traffic route to the Internet Gateway (IOW).
- D. Both landing subnets in the security VPC must have a 0.0.0.0/0 traffic route to the FortiGate port2.
Answer: A,D
Explanation:
The correct answer is B and C. Both landing subnets in the spoke VPCs must have a 0.0.0.0/0 traffic route to the TGW. Both landing subnets in the security VPC must have a 0.0.0.0/0 traffic route to the FortiGate port2.
According to the AWS documentation for Transit Gateway, a transit gateway is a network transit hub that connects VPCs and on-premises networks. To send outbound traffic from the Linux instances to the internet through the security VPC, you need to do the following steps:
* In the main subnet routing table in the spoke VPCs, add a new route with destination 0.0.0.0/0, next hop TGW. This route directs all traffic from the Linux instances to the TGW, which can then forward it to the appropriate destination based on the TGW route table.
* In the main subnet routing table in the security VPC, add a new route with destination 0.0.0.0/0, next hop FortiGate port2. This route directs all traffic from the TGW to the FortiGate internal interface, where it can be inspected and allowed by the FortiGate policies.
The other options are incorrect because:
* Adding a 0.0.0.0/0 traffic route to the Internet Gateway (IGW) in the spoke VPCs is not correct, as this would bypass the TGW and the security VPC and send all traffic directly to the internet.
* Adding a 0.0.0.0/0 traffic route to the TGW in all the VPCs is not necessary, as only the spoke VPCs need to send traffic to the TGW. The security VPC needs to send traffic to the FortiGate port2.
Transit Gateways - Amazon Virtual Private Cloud:Fortinet Documentation Library - Deploying FortiGate VMs on AWS
NEW QUESTION # 37
An administrator would like to keep track of sensitive data files located in the Amazon Web Services (AWS) S3 bucket and protect it from malware. Which Fortinet product or feature should the administrator use?
- A. FortiCNP web sensitive polices
- B. FortiCNP application control policies
- C. FortiCNP compliance scanning policies
- D. FortiCNP DLP policies
Answer: D
Explanation:
To keep track of sensitive data files located in AWS S3 buckets and protect them from malware, the administrator should use:
C:FortiCNP DLP policies.
* Data Loss Prevention (DLP):DLP policies are designed to detect and prevent unauthorized access or sharing of sensitive data. In the context of AWS S3, DLP policies can be used to scan for sensitive information stored in S3 objects and enforce protective measures to prevent data exfiltration or compromise.
* FortiCNP Integration:FortiCNP is Fortinet's cloud-native protection platform that offers security and compliance solutions across cloud environments. By applying DLP policies within FortiCNP, the administrator can ensure sensitive data within S3 is monitored and protected consistently.
References:Fortinet's FortiCNP documentation provides information on implementing DLP policies within cloud environments, highlighting the capabilities for protecting sensitive data within cloud storage services like AWS S3.
NEW QUESTION # 38
Which statement about Transit Gateway (TGW) in Amazon Web Services (AWS) is true?
- A. The TGW default route table cannot be disabled.
- B. A TGW attachment can be associated with multiple TGW route tables.
- C. Both the TGW attachment and propagation must be in the same TGW route table
- D. TGW can have multiple TGW route tables.
Answer: D
Explanation:
Explanation
According to the AWS documentation for Transit Gateway, a transit gateway is a network transit hub that connects VPCs and on-premises networks. A transit gateway route table is a set of rules that determines how traffic is routed among the attachments to the transit gateway1.
A transit gateway can have multiple route tables, and you can associate different attachments with different route tables. This allows you to control how traffic is routed between your VPCs and VPNs based on your network design and security requirements1.
The other options are incorrect because:
Both the TGW attachment and propagation must be in the same TGW route table is not true. You can associate an attachment with one route table and enable propagation from another attachment to a different route table. This allows you to separate the routing domains for your attachments1.
A TGW attachment can be associated with multiple TGW route tables is not true. You can only associate an attachment with one route table at a time. However, you can change the association at any time1.
The TGW default route table cannot be disabled is not true. You can disable the default route table by deleting all associations and propagations from it. However, you cannot delete the default route table itself1.
1: Transit Gateways - Amazon Virtual Private Cloud
NEW QUESTION # 39
Refer to the exhibit
The exhibit shows the results of a FortiCNP registry scan
Which two statements are correct? (Choose two )
- A. The registry scan is part of the FortiCNP cloud protection.
- B. When adding a repository, you can add a minimum number of images to be imported through the CAP section.
- C. When adding a repository, you can leave the Tag section blank to scan all images-
- D. The registry scan is part of the FortiCNP container protection.
Answer: C,D
Explanation:
The exhibit shows the results of a FortiCNP registry scan, which is part of the FortiCNP container protection. FortiCNP's Container Protection provides deep visibility into the security posture of container registries and images1. The registry scan utilizes Common Vulnerabilities and Exposures (CVE) index regularly updated by NVD to detect underlying vulnerabilities, security flaws, and provides security best practices2. The registry scan is performed at the registry level, and it can scan all images in a repository if the Tag section is left blank when adding a repository2. The CAP section stands for Container Assurance Policy, which defines the minimum number of images to be scanned per repository3. Therefore, the correct statements are A and C. Reference: Container Image Scan | FortiCNP 22.3.a, FortiCNP, Cloud Native Application Protection Platform | FortiCNP
NEW QUESTION # 40
Refer to Exhibit:
You are troubleshooting a Microsoft Azure SDN connector issue on your FortiGate VM in Azure Which three settings should you check while troubleshooting this problem? (Choose three.)
- A. Use the show vdom command to see hidden VDOMs.
- B. Ensure IP address 169.254.169_254 is not blocked
- C. use the diag sys va command.
- D. Ensure FortiGate portl has internet access
- E. Ensure FortiGate port4 can resolve DNS.
Answer: B,D,E
Explanation:
Explanation
The three settings that should be checked while troubleshooting this problem are:
Ensure FortiGate port4 can resolve DNS. This is because the Azure SDN connector requires DNS resolution to communicate with the Azure API1. If the FortiGate port4 cannot resolve DNS, the SDN connector will not be able to retrieve the Azure resources and display them in the GUI.
Ensure FortiGate portl has internet access. This is because the Azure SDN connector requires internet access to communicate with the Azure API1. If the FortiGate portl does not have internet access, the SDNconnector will not be able to connect to the Azure cloud and display an error in the CLI.
Ensure IP address 169.254.169_254 is not blocked. This is because the Azure SDN connector uses this IP address to obtain metadata information from the Azure instance2. If this IP address is blocked by a firewall policy or a network ACL, the SDN connector will not be able to get the required information and display an error in the CLI.
NEW QUESTION # 41
Refer to the exhibit. The exhibit shows a topology where multiple connections from clients to the same FortiGate-VM instance, regardless of the protocol being used, are required.
Which two statements are correct? (Choose two.)
- A. The design shows an active-active FortiGate-VM architecture.
- B. The Cloud Load Balancer Session Affinity setting should be changed to CLIENT_IP.
- C. The design shows an active-passive FortiGate-VM architecture.
- D. The Cloud Load Balancer Session Affinity setting should use the default value.
Answer: A,B
NEW QUESTION # 42
Refer to the exhibit
An administrator is trying to deploy a FortiGate VM in Microsoft Azure using Terraform However, during the configuration, the Azure client secret is no longer visible in the Azure portal.
How would the administrator obtain the Azure
client secret to configure on Terratorm?
- A. The administrator must create a new Azure account
- B. The administrator must obtain the client secret through Azure Cloud Shell.
- C. Log in to the Azure CLI with power user to obtain the client secret
- D. The administrator can create a new client secret
Answer: D
Explanation:
Explanation
The Azure client secret is a one-time value that is only visible when it is created. If the administrator loses or forgets the client secret, they cannot retrieve it from the Azure portal. However, they can create a new client secret and use it to configure Terraform. To create a new client secret, they need to follow these steps12:
Sign in to the Azure portal and navigate to the Azure Active Directory service.
Select the application name under the App Registrations.
Select Certificates & Secrets > New client secret to create a new client secret.
Add a description and an expiration date for the client secret and select Add.
Copy the value of the new client secret immediately as it will not be shown again.
References:
Generate new Client Secret and link to key-vault | Microsoft Learn
Azure Quickstart - Set and retrieve a secret from Key Vault using Azure portal | Microsoft Learn
NEW QUESTION # 43
Refer to the exhibit.
What would be the impact of confirming to delete all the resources in Terraform?
- A. It destroys all the resources in the resource group
- B. It destroys all the resources tied to the AWS Identity and Access Management (1AM) user.
- C. It destroys all the resources in the . tfvars file
- D. It destroys all the resources in the state file.
Answer: D
Explanation:
Terraform State File Role: The terraform.tfstate file contains a real-time mapping of the resources that Terraform manages, including their current configuration and relationships. This file tracks the actual state of resources provisioned by Terraform.
Impact of Destruction: When Terraform prompts for confirmation to destroy resources, and 'yes' is entered, Terraform reads the state file and systematically removes all the resources that are managed as part of that state. This is not limited to a specific .tfvars file, IAM user, or resource group-it is a global action that affects all resources tracked by the state file associated with the current Terraform workspace and configuration.
Explanation:
Confirming to delete all the resources in Terraform will have the following impact:
NEW QUESTION # 44
You are automating configuration changes on one of the FortiGate VMS using Linux Red Hat Ansible.
How does Linux Red Hat Ansible connect to FortiGate to make the configuration change?
- A. It uses SSH as a connection method to FortiOS.
- B. It uses an API.
- C. It uses YAML
- D. It uses a FortiGate internal or external IP address with TCP port 21
Answer: B
Explanation:
Ansible connects to FortiGate using an API, which is a method of communication between different software components. Ansible uses the fortios_* modules to interact with the FortiOS API, which is a RESTful API that allows configuration and monitoring of FortiGate devices.
Ansible can use either HTTP or HTTPS as the transport protocol, and can authenticate with either a username and password or an API token.
NEW QUESTION # 45
You have been tasked with deploying FortiGate VMs in a highly available topology on the Amazon Web Services (AWS) cloud. The requirements for your deployment are as follows:
- You must deploy two FortiGate VMs in a single virtual private cloud (VPC), with an external elastic load balancer which will distribute ingress traffic from the internet to both FortiGate VMs in an active-active topology.
- Each FortiGate VM must have two elastic network interfaces: one will connect to a public subnet and other will connect to a private subnet.
- To maintain high availability, you must deploy the FortiGate VMs in two different availability zones.
How many public and private subnets will you need to configure within the VPC?
- A. Two public subnets and one private subnet
- B. One public subnet and two private subnets
- C. One public subnet and one private subnet
- D. Two public subnets and two private subnets
Answer: D
NEW QUESTION # 46
You have created a TGW route table to route traffic from your spoke VPC to the security VPC where two FortiGate devices are inspecting traffic. Your spoke VPC CIDR block is already propagated to the Transit Gateway (TGW) route table.
Which type of attachment should you use to advertise routes through BGP from the spoke VPC to the security VPC?
- A. GRE attachment
- B. VPC attachment
- C. Route attachment
- D. Connect attachment
Answer: B
Explanation:
A VPC attachment is the type of attachment that allows you to connect a VPC to a TGW and advertise routes through BGP. A VPC attachment creates a VPN connection between the VPC and the TGW, and enables dynamic routing with BGP. A connect attachment is used to connect a VPN or Direct Connect gateway to a TGW. A route attachment is not a valid type of attachment for TGW. A GRE attachment is used to connect a FortiGate device to a TGW using GRE tunnels. Reference:
Creating the TGW and related resources
Configuring TGW route tables
FortiGate Public Cloud 7.2.0 - Fortinet Documentation
Updating the route table and adding an IAM policy
NEW QUESTION # 47
Refer to the exhibit.
What value or values must the administrator use in the SSH Key section to deploy a FortiGate VM using Terraform in Amazon Web Services (AWS)?
- A. Use the Fingerprint value of the key pair
- B. Use the ID value of the key pair.
- C. Use the Name and ID values of the key pair
- D. Use the Name of the key pair
Answer: D
Explanation:
For deploying a FortiGate VM using Terraform in AWS, the administrator must use:
B:Use the Name of the key pair.
* Terraform and AWS SSH Keys:When deploying instances in AWS using Terraform, it is required to specify the name of the SSH key pair to enable key-based authentication to the instance post-deployment.
* Configuration Syntax:The variablekeynamewithin the Terraform configuration should match the exact name of the SSH key pair as it is stored in AWS. This ensures that Terraform can reference the correct
* key during the deployment process to set up SSH access to the FortiGate VM.
* Terraform Variables:Thevariable "keyname"block in the Terraform configuration will look for the key pair name as it should be declared in theterraform.tfvarsfile or passed as a variable during execution. This does not require the key pair's ID or fingerprint, just its name.
References:The need for the SSH key pair's name in Terraform configurations for AWS deployments is outlined in the Terraform AWS Provider documentation, which specifies how resources should be provisioned using Terraform.
NEW QUESTION # 48
Refer to the exhibit.
You are troubleshooting a FortiGate HA floating IP issue with Microsoft Azure. After the failover, the new primary device does not have the previous primary device floating IP address.
- A. The error is caused by credential time expiration.
- B. A wrong client secret credential is used
- C. The Azure service principle account must have a contributor role.
- D. FortiGate port4 does not have internet access.
- E. What could be the possible issue With this scenario?
Answer: A
Explanation:
In this scenario, the issue is caused by the Azure service principle account not having a contributor role. This is required for the FortiGate HA floating IP to work properly. Without this role, the new primary device will not have the previous primary device floating IP address after failover. Reference: Fortinet Public Cloud Security knowledge source documents or study guide.
https://docs.fortinet.com/product/fortigate-public-cloud/7.2
NEW QUESTION # 49
......
Ace Fortinet NSE7_PBC-7.2 Certification with Actual Questions Apr 04, 2025 Updated: https://www.ipassleader.com/Fortinet/NSE7_PBC-7.2-practice-exam-dumps.html
NSE 7 Network Security Architect Certified Official Practice Test NSE7_PBC-7.2: https://drive.google.com/open?id=10bgvLvvNcmsz5Tb9GbMeNFibmUel-1KS