Updated Aug-2025 Exam NSE7_PBC-7.2 Dumps - Pass Your Certification Exam
Latest Real Fortinet NSE7_PBC-7.2 Exam Dumps Questions
Fortinet NSE7_PBC-7.2 exam is an excellent way for network security professionals to validate their skills and knowledge in public cloud security. It is a rigorous exam that requires a great deal of preparation and study, but passing it can open up new career opportunities and help professionals advance in their careers. With the increasing popularity of public cloud infrastructures, the demand for skilled cloud security professionals is on the rise, making the NSE7_PBC-7.2 exam a valuable credential to have in today's job market.
NEW QUESTION # 38
Refer to the exhibit
In your Amazon Web Services (AWS), you must allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet However, your HTTPS connection to the FortiGate VM in the Customer VPC is not successful.
Also, you must ensure that the Customer VPC FortiGate VM sends all the outbound Internet traffic through the Security VPC How do you correct this Issue with minimal configuration changes?
(Choose three.)
- A. Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC,
- B. Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway
- C. Add a route With your local internet public IP address as the
destination and target transit gateway - D. Add a route With your local internet public IP address as the destination and target internet gateway
- E. Add route destination 0 0.0 0/0 to target the transit gateway
Answer: A,B,E
Explanation:
B . Add route destination 0.0.0.0/0 to target the transit gateway. This will ensure that the Customer VPC FortiGate VM sends all the outbound internet traffic through the Security VPC, where it can be inspected by the Security VPC FortiGate VMs1. The transit gateway is a network device that connects multiple VPCs and on-premises networks in a hub-and-spoke model2. D. Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway. This will allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the private subnet where the FortiGate VM is located3. An internet gateway is a service that enables communication between your VPC and the internet4. An EIP is a public IPv4 address that you can allocate to your AWS account and associate with your resources. E. Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC. This will also allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the public subnet where the FortiGate VM is located3. This is an alternative solution to option D, depending on which subnet you want to use for the FortiGate VM.
The other options are incorrect because:
Adding a route with your local internet public IP address as the destination and target transit gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will only apply to traffic coming from your specific IP address, not from any other source on the internet1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.
Adding a route with your local internet public IP address as the destination and target internet gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will bypass the Security VPC and send the traffic directly to the Customer VPC1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.
NEW QUESTION # 39
Which statement about Transit Gateway (TGW) in Amazon Web Services (AWS) is true?
- A. TGW can have multiple TGW route tables.
- B. The TGW default route table cannot be disabled.
- C. A TGW attachment can be associated with multiple TGW route tables.
- D. Both the TGW attachment and propagation must be in the same TGW route table
Answer: A
Explanation:
Explanation
According to the AWS documentation for Transit Gateway, a transit gateway is a network transit hub that connects VPCs and on-premises networks. A transit gateway route table is a set of rules that determines how traffic is routed among the attachments to the transit gateway1.
A transit gateway can have multiple route tables, and you can associate different attachments with different route tables. This allows you to control how traffic is routed between your VPCs and VPNs based on your network design and security requirements1.
The other options are incorrect because:
Both the TGW attachment and propagation must be in the same TGW route table is not true. You can associate an attachment with one route table and enable propagation from another attachment to a different route table. This allows you to separate the routing domains for your attachments1.
A TGW attachment can be associated with multiple TGW route tables is not true. You can only associate an attachment with one route table at a time. However, you can change the association at any time1.
The TGW default route table cannot be disabled is not true. You can disable the default route table by deleting all associations and propagations from it. However, you cannot delete the default route table itself1.
1: Transit Gateways - Amazon Virtual Private Cloud
NEW QUESTION # 40
Refer to the exhibit
You are tasked with deploying FortiGate using Terraform. When you run the terraform version command during the Terraform installation, you get an error message.
What could be the reason that you are getting the command not found error?
- A. You must reinstall Terraform
- B. You must move the binary file to the bin directory.
- C. You must change the directory location to the root directory
- D. You must assign correct permissions to the ec2-user.
Answer: B
Explanation:
Explanation
According to the Terraform documentation for installing Terraform on Linux1, you need to download a zip archive that contains a single binary file called terraform. You need to unzip the archive and move the binary file to a directory that is included in your system's PATH environment variable, such as /usr/local/bin. This way, you can run the terraform command from any directory without specifying the full path1.
If you do not move the binary file to the bin directory, you will get a command not found error when you try to run the terraform version command, as shown in the screenshot. To fix this error, you need to move the binary file to the bin directory or specify the full path of the binary file when running the command1.
1: Install Terraform | Terraform - HashiCorp Learn
NEW QUESTION # 41
In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)
- A. From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the TGW.
- B. From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW.
- C. From the security VPC TGW subnet routing table, point 0.0.0.0/0 traffic to the FortiGate internal port.
- D. From both spoke VPCs, and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway.
- E. From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW.
Answer: B,C,E
NEW QUESTION # 42
How does an administrator secure container environments from newly emerged security threats?
- A. Use Docker-related application control signatures
- B. Use Amazon AWS-related application control signatures
- C. Use distributed network-related application control signatures.
- D. Use Amazon AWS_S3-related application control signatures
Answer: A
Explanation:
Securing container environments from newly emerged security threats involves employing specific security mechanisms tailored to the technology and structure of containers. In this context, the use of Docker-related application control signatures (Option D) is critical for effectively managing and mitigating threats in containerized environments.
* Docker-Specific Threats:Docker containers, being a prevalent form of container technology, are targeted by various security threats, including those that exploit vulnerabilities specific to the Docker environment and runtime. Using Docker-related application control signatures means implementing security measures that are specifically designed to detect and respond to anomalies and threats that are unique to Docker containers.
* Application Control Signatures:These are sets of definitions that help identify and block potentially malicious activities within application traffic. By focusing on Docker-related signatures, administrators can ensure that the security tools are finely tuned to the operational specifics of Docker containers, thereby providing a robust defense against exploits that target container-specific vulnerabilities.
References:The recommendation to use Docker-related application control signatures is based on best practices for securing container environments, emphasizing the need for specialized security measures that address the unique challenges posed by container technologies.
NEW QUESTION # 43
You are adding more spoke VPCs to an existing hub and spoke topology Your goal is to finish this task in the minimum amount of time without making errors.
Which Amazon AWS services must you subscribe to accomplish your goal?
- A. CloudWatch, S3
- B. GuardDuty, CloudWatch
- C. WAF, DynamoDB
- D. Inspector, S3
Answer: A
Explanation:
The correct answer is D. CloudWatch and S3.
According to the GitHub repository for the Fortinet aws-lambda-tgw script1, this function requires the following AWS services:
* CloudWatch: A monitoring and observability service that collects and processes events from various AWS resources, including Transit Gateway attachments and route tables.
* S3: A scalable object storage service that can store the configuration files and logs generated by the Lambda function.
By using the Fortinet aws-lambda-tgw script, you can automate the creation and configuration of Transit Gateway Connect attachments for your FortiGate devices.This can help you save time and avoid errors when adding more spoke VPCs to an existing hub and spoke topology1.
The other AWS services mentioned in the options are not required for this task. GuardDuty is a threat detection service that monitors for malicious and unauthorized behavior to help protect AWS accounts and workloads. WAF is a web application firewall that helps protect web applications from common web exploits.
Inspector is a security assessment service that helps improve the security and compliance of applications deployed on AWS. DynamoDB is a fast and flexible NoSQL database service that can store various types of data.
1:GitHub - fortinet/aws-lambda-tgw
NEW QUESTION # 44
Refer to the exhibit
You are tasked with deploying a webserver and FortiGate VMS in AWS_ You are using Terraform to automate the process Which two important details should you know about the Terraform files? (Choose two.)
- A. All the output values are available after a successful terraform apply command
- B. The subnet_private 1 value is defined in the variables . tf file
- C. You must specify all the AWS credentials in the output. of file.
- D. After the deployment, Terraform output values are visible only through AWS CloudShell.
Answer: A,B
Explanation:
Explanation
A: All the output values are available after a successful terraform apply command. This means that after the deployment, you can view the output values by running terraform output or terraform show in the same directory where you ran terraform apply1. You can also use the output values in other Terraform configurations or external systems by using the terraform output command with various options2. B. The subnet_private_1 value is defined in the variables.tf file. This means that the subnet_private_1 value is an input variable that can be customized by passing a different value when running terraform apply or by setting an environment variable3. The variables.tf file is where you declare all the input variables for your Terraform configuration4.
The other options are incorrect because:
After the deployment, Terraform output values are not visible only through AWS CloudShell. You can access them from any shell or terminal where you have Terraform installed and configured with your AWS credentials.
You do not need to specify all the AWS credentials in the output.tf file. The output.tf file is where you declare all the output values for your Terraform configuration4. You can specify your AWS credentials in a separate file, such as provider.tf, or use environment variables or shared credentials files. References:
Output Values - Configuration Language | Terraform - HashiCorp Developer Command: output - Terraform by HashiCorp Input Variables - Configuration Language | Terraform - HashiCorp Developer Configuration Language | Terraform - HashiCorp Developer
NEW QUESTION # 45
What is the main advantage of using SD-WAN Transit Gateway Connect over traditional SD-WAN?
- A. You can combine it with IPsec to achieve higher bandwidth
- B. You can use BGP over IPsec for maximum throughput
- C. It eliminates the use of ECMP
- D. You can use GRE-based tunnel attachments
Answer: D
NEW QUESTION # 46
Refer to the exhibit
The exhibit shows the results of a FortiCNP registry scan
Which two statements are correct? (Choose two )
- A. The registry scan is part of the FortiCNP container protection.
- B. The registry scan is part of the FortiCNP cloud protection.
- C. When adding a repository, you can add a minimum number of images to be imported through the CAP section.
- D. When adding a repository, you can leave the Tag section blank to scan all images-
Answer: A,D
Explanation:
Explanation
The exhibit shows the results of a FortiCNP registry scan, which is part of the FortiCNP container protection. FortiCNP's Container Protection provides deep visibility into the security posture of container registries and images1. The registry scan utilizes Common Vulnerabilities and Exposures (CVE) index regularly updated by NVD to detect underlying vulnerabilities, security flaws, and provides security best practices2. The registry scan is performed at the registry level, and it can scan all images in a repository if the Tag section is left blank when adding a repository2. The CAP section stands for Container Assurance Policy, which defines the minimum number of images to be scanned per repository3. Therefore, the correct statements are A and C. References: Container Image Scan | FortiCNP 22.3.a, FortiCNP, Cloud Native Application Protection Platform | FortiCNP
NEW QUESTION # 47
Refer to the exhibit. In your Amazon Web Services (AWS), you must allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet. However, your HTTPS connection to the FortiGate VM in the Customer VPC is not successful.
Also, you must ensure that the Customer VPC FortiGate VM sends all the outbound Internet traffic through the Security VPC. How do you correct this Issue with minimal configuration changes? (Choose three.)
- A. Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC,
- B. Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway
- C. Add a route With your local internet public IP address as the destination and target internet gateway
- D. Add route destination 0 0.0 0/0 to target the transit gateway
- E. Add a route With your local internet public IP address as the destination and target transit gateway
Answer: A,B,D
Explanation:
Add route destination 0.0.0.0/0 to target the transit gateway. This will ensure that the Customer VPC FortiGate VM sends all the outbound internet traffic through the Security VPC, where it can be inspected by the Security VPC FortiGate VMs. The transit gateway is a network device that connects multiple VPCs and on-premises networks in a hub-and-spoke model.
Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway. This will allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the private subnet where the FortiGate VM is located. An internet gateway is a service that enables communication between your VPC and the internet. An EIP is a public IPv4 address that you can allocate to your AWS account and associate with your resources.
Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC. This will also allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the public subnet where the FortiGate VM is located. This is an alternative solution to option D, depending on which subnet you want to use for the FortiGate VM.
NEW QUESTION # 48
What are three important steps required to get Terraform ready using Microsoft Azure Cloud Shell? (Choose three.)
- A. Set up a storage account in Azure.
- B. Use the wget (te=aform vession) command to upload Terraform.
- C. Move the Terraform file to the bin directory.
- D. use the -O command to download Terraform.
- E. Subscribe to Terraform in Azure.
Answer: A,B,C
Explanation:
To get Terraform ready using Microsoft Azure Cloud Shell, you need to perform the following steps:
Set up a storage account in Azure. This is required to store the Terraform state file in a blob container, which enables collaboration and persistence of the infrastructure configuration1.
Use the wget (terraform_version) command to upload Terraform. This command downloads the latest version of Terraform from the official website and saves it as a zip file in the current directory2.
Move the Terraform file to the bin directory. This step extracts the Terraform executable from the zip file and moves it to the bin directory, which is part of the PATH environment variable. This allows you to run Terraform commands from any directory in Cloud Shell2.
The other options are incorrect because:
You do not need to use the -O command to download Terraform. This command is used to specify a different output file name for the downloaded file, but it is not necessary for this task3.
You do not need to subscribe to Terraform in Azure. Terraform is an open-source tool that can be used with any cloud provider, and there is no subscription or registration required to use it with Azure4. Reference:
Updating the route table and adding an IAM policy
Configure Terraform in Azure Cloud Shell with Bash
wget(1) - Linux man page
Terraform by HashiCorp
NEW QUESTION # 49
What kind of underlying mechanism does Transit Gateway Connect use to send traffic from the virtual private cloud (VPC) to the transit gateway?
- A. A GRE attachment
- B. A transport attachment
- C. Transit Gateway Connect attachment
- D. A BGP attachment
Answer: C
Explanation:
Transit Gateway Connect Specificity: AWS Transit Gateway Connect is a specific feature designed to streamline the integration of SD-WAN appliances and third-party virtual appliances into your Transit Gateway.expand_more It utilizes a specialized attachment type.exclamation BGP's Role: While Transit Gateway Connect attachments leverage BGP for dynamic routing, BGP itself is a routing protocol and not the core connectivity mechanism in this context. GRE Tunneling: GRE is a tunneling protocol commonly used with Transit Gateway Connect attachments to encapsulate traffic.
NEW QUESTION # 50
When adding the Amazon Web Services (AWS) account to the FortiCNP, which three mandatory configuration steps must you follow? (Choose three.)
- A. Add AWS accounts through FortiCNP.
- B. Enable cloud protection through AWS Guard Duty and AWS Inspector
- C. Accept FortiCNP to create CloudTrail for the account
- D. Launch the CloudFormation template.
- E. Enable cross-reg Ion aggregation
Answer: A,C,D
Explanation:
Explanation
When adding the Amazon Web Services (AWS) account to the FortiCNP, you must follow these three mandatory configuration steps:
Add AWS accounts through FortiCNP. This is the first step to enable cloud protection for your AWS account. You can add one or multiple accounts automatically or manually. You need to provide the AWS account ID and a name for the account. You also need to select the optional permissions to be granted to FortiCNP as needed1.
Accept FortiCNP to create CloudTrail for the account. This is required for FortiCNP to collect and analyze the AWS API calls and events. You can choose to let FortiCNP create a CloudTrail for the account or use an existing one. You also need to specify the aggregation region for the CloudTrail1.
Launch the CloudFormation template. This is required for FortiCNP to create a stack and a role in your AWS account. The stack contains the resources that FortiCNP needs to access and monitor your AWS account. The role allows FortiCNP to assume it and perform actions on your behalf. You need to enter a custom or default role name and a unique UUID that is designated for your company on FortiCNP1.
References: Add AWS Account Automatically
https://docs.fortinet.com/document/forticnp/22.4.a/online-help/246021/add-aws-account-automatically
NEW QUESTION # 51
Refer to the exhibit
You attempted to access the Linux1 EC2 instance directly from the internet using its public IP address in AWS.
However, your connection is not successful.
Given the network topology, what can be the issue?
- A. There is no elastic IP address attached to FortiGate in the Security VPC.
- B. There is no internet gateway attached to the Spoke VPC A.
- C. There is no connection between VPC A and VPC B.
- D. The Transit Gateway BGP IP address is incorrect.
Answer: B
Explanation:
This is because the Linux1 EC2 instance is not accessible directly from the internet using its public IP address in AWS.
An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet. Without an internet gateway, the Linux1 EC2 instance cannot receive or send traffic to or from the internet, even if it has a public IP address assigned to it.
To fix this issue, you need to attach an internet gateway to the Spoke VPC A and configure a route table that directs internet-bound traffic to the internet gateway. You also need to ensure that the Linux1 EC2 instance has a security group that allows inbound and outbound traffic on the desired ports.
: [Internet Gateways - Amazon Virtual Private Cloud] : [Attach an Internet Gateway to Your VPC - Amazon Virtual Private Cloud] : [Security Groups for Your VPC - Amazon Virtual Private Cloud]
NEW QUESTION # 52
What are three important steps required to get Terraform ready using Microsoft Azure Cloud Shell? (Choose three.)
- A. Set up a storage account in Azure.
- B. Use the wget (te=aform vession) command to upload Terraform.
- C. Move the Terraform file to the bin directory.
- D. use the -O command to download Terraform.
- E. Subscribe to Terraform in Azure.
Answer: A,B,C
Explanation:
To get Terraform ready using Microsoft Azure Cloud Shell, you need to perform the following steps:
* Set up a storage account in Azure. This is required to store the Terraform state file in a blob container, which enables collaboration and persistence of the infrastructure configuration1.
* Use the wget (terraform_version) command to upload Terraform. This command downloads the latest version of Terraform from the official website and saves it as a zip file in the current directory2.
* Move the Terraform file to the bin directory. This step extracts the Terraform executable from the zip file and moves it to the bin directory, which is part of the PATH environment variable. This allows you to run Terraform commands from any directory in Cloud Shell2.
The other options are incorrect because:
* You do not need to use the -O command to download Terraform. This command is used to specify a different output file name for the downloaded file, but it is not necessary for this task3.
* You do not need to subscribe to Terraform in Azure. Terraform is an open-source tool that can be used with any cloud provider, and there is no subscription or registration required to use it with Azure4. References:
* Updating the route table and adding an IAM policy
* Configure Terraform in Azure Cloud Shell with Bash
* wget(1) - Linux man page
* Terraform by HashiCorp
NEW QUESTION # 53
Refer to the exhibit.
You deployed an HA active-active load balance sandwich with two FortiGate VMs in Microsoft Azure.
After the deployment, you prefer to use FGSP to synchronize sessions, and allowasymmetric return traffic In the environment, FortiGate port 1 and port 2 are facing external and internal load balancers respectively What IP address must you use in the peerip configuration?
- A. The opposite FortiGate port 2 IP address.
- B. The internal load balancer port 1 IP address.
- C. The opposite FortiGate port 1 IP address.
- D. The public load balancer port 2 IP address
Answer: A
Explanation:
In an HA active-active load balance configuration with FortiGate VMs, especially in Microsoft Azure where FGSP (FortiGate Session Life Support Protocol) is used for session synchronization, the correct configuration for thepeeripis:
D:The opposite FortiGate port 2 IP address.
* HA Synchronization Requirements:FGSP requires direct communication between the FortiGates to synchronize the session table. This synchronization typically occurs over a dedicated HA link that connects the HA pair.
* Asymmetric Traffic Considerations:FGSP allows asymmetric traffic to rejoin the correct session by synchronizing session information, including NAT and TCP sequence tracking between the FortiGate units in a cluster.
* Configuration Specifics:For port 2, which is facing the internal load balancer, thepeeripshould be set to the corresponding port 2 IP address of the opposite FortiGate. This allows the internal interfaces to communicate directly with each other for session synchronization purposes, which is crucial in an active-active deployment to ensure sessions persist during failover scenarios.
References:The choice of using port 2's IP address for FGSP is supported by the Fortinet documentation, which explains how FortiGates should be configured for HA, especially in cloud environments where traditional HA links may not be available.
NEW QUESTION # 54
Which statement about Transit Gateway (TGW) in Amazon Web Services (AWS) is true?
- A. TGW can have multiple TGW route tables.
- B. The TGW default route table cannot be disabled.
- C. A TGW attachment can be associated with multiple TGW route tables.
- D. Both the TGW attachment and propagation must be in the same TGW route table
Answer: A
Explanation:
A transit gateway is a network transit hub that connects VPCs and on-premises networks. A transit gateway route table is a set of rules that determines how traffic is routed among the attachments to the transit gateway. A transit gateway can have multiple route tables, and you can associate different attachments with different route tables. This allows you to control how traffic is routed between your VPCs and VPNs based on your network design and security requirements.
NEW QUESTION # 55
You are tasked with deploying a FortiGate HA solution in Amazon Web Services (AWS) using Terraform What are two steps you must take to complete this deployment? (Choose two.)
- A. Create an AWS Active Directory user with permissions.
- B. Enable automation on the AWS portal.
- C. Use CloudSheIl to install Terraform.
- D. Create an AWS Identity and Access Management (IAM) user With permissions.
Answer: C,D
Explanation:
Explanation
To deploy a FortiGate HA solution in AWS using Terraform, you need to create an AWS IAM user with permissions to access the AWS resources and services required by the FortiGate-VM. You also need to use CloudShell to install Terraform, which is a tool for building, changing, and versioning infrastructure as code.
References:
Deploying FortiGate-VM using Terraform | AWS Administration Guide
Setting up IAM roles | AWS Administration Guide
Launching the instance using roles and user data | AWS Administration Guide Terraform by HashiCorp
NEW QUESTION # 56
What are two main features in Amazon Web Services (AWS) network access control lists (ACLs)? (Choose two.)
- A. Network ACLs are tied to an instance
- B. The default network ACL is configured to allow all traffic
- C. NetworkACLs are stateless, and inbound and outbound rules are used for traffic filtering
- D. You cannot use Network ACL and Security Group at the same time.
Answer: B,C
Explanation:
Explanation
B: The default network ACL is configured to allow all traffic. This means that when you create a VPC, AWS automatically creates a default network ACL for that VPC, and associates it with all the subnets in the VPC1. By default, the default network ACL allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic1. You can modify the default network ACL, but you cannot delete it1. C. Network ACLs are stateless, and inbound and outbound rules are used for traffic filtering. This means that network ACLs do not keep track of the traffic that they allow or deny, and they evaluate each packet separately1. Therefore, you need to create both inbound and outbound rules for each type of traffic that you want to allow or deny1. For example, if you want to allow SSH traffic from a specific IP address to your subnet, you need to create an inbound rule to allow TCP port 22 from that IP address, and an outbound rule to allow TCP port 1024-65535 (the ephemeral ports) to that IP address2.
The other options are incorrect because:
You can use network ACL and security group at the same time. Network ACL and security group are two different types of security layers for your VPC that can work together to control traffic3. Network ACLacts as a firewall for your subnets, while security group acts as a firewall for your instances3. You can use both of them to create a more granular and effective security policy for your VPC.
Network ACLs are not tied to an instance. Network ACLs are associated with subnets, not instances1. This means that network ACLs apply to all the instances in the subnets that they are associated with1. You cannot associate a network ACL with a specific instance. However, you can associate a security group with a specific instance or multiple instances3.
NEW QUESTION # 57
Refer to the exhibit. You are configuring a second route table on a Transit Gateway to accommodate east-west traffic inspection between two VPCs. However, you are getting an error during the transit gateway route table association with the Connect attachment.
Which action Should you take to fulfill your requirement?
- A. Add both Associations and Propagations in the second TGW route table.
- B. In the second route table: create a propagation with the Connect attachment.
- C. Add a static route in the Routes section
- D. Delete the both Connect and Transport attachments from the first TGW route table
Answer: B
Explanation:
The error message indicates that the Connect attachment is already associated with another transit gateway route table. You cannot associate the same attachment with more than one route table. However, you can propagate the same attachment to multiple route tables. Therefore, to fulfill your requirement of configuring a second route table for east-west traffic inspection between two VPCs, you need to create a propagation with the Connect attachment in the second route table. This will allow the second route table to learn the routes from the Connect attachment and forward the traffic to the security VPC. You also need to associate the second route table with the Transport attachment, which is the transit gateway attachment for the security VPC.
NEW QUESTION # 58
......
NSE7_PBC-7.2 Dumps To Pass NSE 7 Network Security Architect Exam in One Day: https://www.ipassleader.com/Fortinet/NSE7_PBC-7.2-practice-exam-dumps.html
100% Guaranteed Results NSE7_PBC-7.2 Unlimited 91 Questions: https://drive.google.com/open?id=10bgvLvvNcmsz5Tb9GbMeNFibmUel-1KS