NSE7-PBC-7-2 Sample Questions & Answers

While using a Managed Identity is the recommended and most secure method, the Azure SDN Connector also supports authentication using a Service Principal with a client ID and secret. Therefore, it is not mandatory to use a Managed Identity, although it is a best practice.

Multiple TGW route tables are fundamental to creating separate routing domains. Each business unit's VPC attachments can be associated with a specific route table, and propagation can be controlled to ensure traffic is isolated and only routed where intended (e.g., to the security VPC).

Controlling route table association (which route table an attachment uses) and propagation (which attachments dynamically propagate their routes into a route table) is the core mechanism for enforcing traffic isolation and directing traffic flows within the TGW.

FortiGate CNF integrates with the Kubernetes API to understand its objects. The correct way to enforce this policy is to create a firewall policy within FortiGate CNF that uses Kubernetes labels or service objects to define the 'frontend' namespace as the source and the 'database' namespace as the destination. Applying an Intrusion Prevention System (IPS) profile to this policy will enable the inspection for SQL injection attacks.

The GRE (Generic Routing Encapsulation) tunnel in a TGW Connect setup serves as a transport layer. Its primary function is to encapsulate and carry the packets of a dynamic routing protocol, specifically BGP, between the customer's SD-WAN appliance (FortiGate) and the Transit Gateway. This allows for dynamic exchange of routes, which is a core benefit of TGW Connect over static TGW attachments. GRE itself does not provide encryption.

In an Azure Virtual WAN architecture, routing for spoke VNets is controlled by the hub's route tables. To force internet-bound traffic through the NVA, you must edit the effective route table associated with the spoke VNet connection (often the 'default' route table). You would add a static route for 0.0.0.0/0 and set the next hop to the specific vWAN connection corresponding to the FortiGate NVA. UDRs in the spoke VNet are not the primary mechanism for this in a vWAN hub scenario.

This is a widely-accepted best practice. Terraform excels at declarative infrastructure provisioning and managing the state of cloud resources (the 'what'). Ansible is a procedural configuration management tool that excels at configuring software and devices once they are running (the 'how'). Using Terraform for the initial build-out and Ansible for the detailed configuration of the FortiGates leverages the core strengths of each tool.

Azure NSGs are stateful firewalls that filter traffic at the network interface or subnet level. An inbound_rule defines the permissions for traffic arriving at the network interface from external sources. An outbound_rule defines permissions for traffic leaving the network interface, initiated from the VM itself. Both are crucial for controlling access to and from the FortiGate.

This statement is true. Both AWS VPC route tables and Azure VNet route tables use the principle of longest prefix match. When a packet's destination IP address matches multiple route entries, the cloud platform will always choose the route with the most specific (longest) CIDR prefix. For example, a route to 10.0.1.0/24 will be preferred over a route to 10.0.0.0/16 for a packet destined to 10.0.1.5.

Since SSH (port 22) is working, basic connectivity to the instance exists. The issue is specific to the HTTPS protocol (port 443). The most common cause for this is a missing inbound rule in the instance's security group. Security groups are stateful firewalls that control traffic at the ENI level, and by default, they deny all inbound traffic unless explicitly allowed.

In AWS, secondary private IPs are properties of the Elastic Network Interface (ENI), not the EC2 instance itself. The correct approach in Terraform is to define an aws_network_interface resource and use the private_ips argument (which accepts a list of strings) to specify one or more secondary private IP addresses. This ENI is then attached to the primary FortiGate instance.