FCP_GCS_AD-7.6 Practice Questions

In Google Cloud, VPC Network Peering is strictly non-transitive. The exhibit demonstrates a topology where VPC A is peered with VPC C, and VPC B is peered with VPC C. Because transitive peering is not supported, traffic cannot inherently route between VPC A and VPC B through the intermediate network (VPC C). To enable native network traffic between VPC A and VPC B using their internal IP addresses, an administrator must establish a direct, independent VPC Network Peering connection between them.

B. Google Cloud prohibits configuring custom static routes with a next hop pointing to a peering connection to achieve transitive routing through an intermediate VPC.

C. A custom route cannot point to an unpeered, disconnected VPC as a gateway; a valid next-hop mechanism (like a direct peering connection) must be established first.

D. While deploying a Network Virtual Appliance (like a FortiGate VM) represents a valid transit architecture, it is not a mandatory action. Direct VPC peering is the native resolution.

Google Cloud Official Documentation. "VPC Network Peering overview." Section: "Restrictions" (specifically noting that "Transitive peering is not supported").

Based on the provided exhibit, the environment utilizes a Google Cloud Platform (GCP) Active-Passive High Availability architecture governed by Cloud Load Balancers rather than API-driven Software Defined Networking (SDN). When a failover occurs, the original active FortiGate stops responding to GCP health probes, prompting the load balancers to mark its status as unhealthy. The newly promoted active FortiGate subsequently begins answering these health probes. Consequently, the External Network Load Balancer ensures inbound external traffic is forwarded to the new active member, and the Internal Load Balancer automatically routes internal passthrough traffic to port2 of the newly active cluster member.

D: Management IPs are dedicated, static external addresses bound directly to each specific VM instance's management interface (port3) and do not float or move during failover.

E: The network's custom route statically points to the Internal Load Balancer (0.0.0.0 via ILB) rather than a specific VM interface, eliminating the need for API-based route updates.

[1] Fortinet, Inc., "FortiOS - Google Cloud Administration Guide," Section: High Availability -> Active-passive HA using Google Cloud load balancers.

[2] Google Cloud Architecture Center, "Deploying FortiGate-VM for active-passive high availability on Google Cloud," Section: Load balancing and health checks architecture.

For a FortiGate active-passive HA cluster in Google Cloud, a passthrough network load balancer (NLB) is required over a proxy NLB for three primary reasons. First, the passthrough NLB preserves the original client source IP address, which is essential for the FortiGate to apply security policies and for accurate logging. Second, it can forward any IP protocol (such as TCP, UDP, ESP, ICMP), which is necessary for a firewall that must inspect all traffic types, including IPsec VPNs (ESP). Proxy load balancers are limited to specific protocols like TCP. Third, the active-passive HA architecture requires that traffic is directed to only a single active instance at any time. The passthrough NLB supports this model by using health checks to target the single healthy, active FortiGate VM in the backend pool or instance group.

A. This statement is true but incomplete. The more comprehensive reason is that passthrough NLBs support a wide range of IP protocols beyond just TCP and UDP, as stated in option D.

C. Session affinity is not a unique feature of passthrough NLBs. Google Cloud's proxy network load balancers also support session affinity, so this is not a distinguishing reason for the selection.

1. Google Cloud Documentation | External passthrough Network Load Balancer overview:

"These load balancers are not proxies. ... Packets are received by backend VMs with the packet's source and destination IP addresses, protocol, and... ports unchanged." This supports answer B (preserves source IP).

"You can load balance TCP, UDP, ESP, GRE, ICMP, and ICMPv6 traffic." This supports answer D (forwards any IP protocol).

2. Fortinet Document Library | FortiGate-VM on GCP deployment guide 7.4.1, Page 61:

In the section "Active-passive HA for FortiGate-VM on GCP", the guide specifies the architecture: "The external load balancer must be a TCP/UDP load balancer, not an HTTP(S) or SSL/TCP proxy load balancer." It further states, "The Network Load Balancer preserves the client’s IP address." This directly supports answer B.

3. Fortinet Document Library | FortiGate-VM on GCP deployment guide 7.4.1, Page 64:

The failover mechanism described involves a Cloud Function that "removes the failed primary FortiGate-VM from the instance group and adds the secondary FortiGate-VM to it." This confirms that the load balancer directs traffic to a single instance at a time, which is the core of the active-passive model, supporting answer E.

In network architecture, traffic crossing the perimeter between an external network and an internal environment is classified as North-South traffic. Specifically, traffic originating from the external client (198.51.100.10) entering the cloud environment toward Workload A (10.0.0.10) is South-bound. Conversely, the return traffic from the internal Workload A back to the external client is North-bound. Because the FortiGate cluster acts as a stateful firewall in the network security project, it must inspect both the inbound (South-bound) requests and the outbound (North-bound) responses to fully secure this communication flow. The exhibit explicitly identifies this architecture as "North-south traffic inspection."

C. West-bound: West-bound traffic refers to lateral, internal network communication between systems within the same environment, not traffic crossing the external perimeter.

D. East-bound: East-bound traffic is synonymous with West-bound, describing internal server-to-server or workload-to-workload communication, which does not apply to external client requests.

Google Cloud Documentation, "Design and architect service perimeters," Section: Perimeter design.

Google Cloud Documentation, Cloud Architecture Center, "Meshed pattern," Section: Use a centralized application layer firewall.

Fortinet Document Library, FortiOS 7.6.6 Administration Guide, "Public and private SDN connectors," Section: Cloud SDN connectors.

An analysis of the question has been provided below.

Correct Answer: D

(Assuming the options are similar to the following, based on standard cloud practices)

A. Delete the VM instance from the Compute Engine page.

B. Stop the VM instance from the Compute-Engine page.

C. Delete the entire Google Cloud project.

D. Delete the deployment from the Deployment Manager page.

Explanation

The most efficient method to decommission a FortiWeb instance and all its dependent resources on Google Cloud is to delete the entire deployment from the Google Cloud Deployment Manager. Fortinet provides Deployment Manager templates for deploying FortiWeb, which bundle the VM instance, VPC networks, subnets, firewall rules, and public IPs into a single manageable unit called a "deployment". Deleting this parent deployment object ensures that Google Cloud automatically and atomically removes all the associated child resources, preventing orphaned components and ensuring a complete and clean removal with a single action.

Why Incorrect Options are Wrong

A. Delete the VM instance from the Compute Engine page.

This action is incomplete. It only removes the virtual machine, leaving behind associated resources like persistent disks, firewall rules, and network configurations, which require separate manual deletion.

B. Stop the VM instance from the Compute-Engine page.

This only halts the running instance. All resources remain provisioned and continue to incur costs. It does not decommission or delete any components.

C. Delete the entire Google Cloud project.

This is an excessive and destructive action. It would delete all resources within the project, not just the specific FortiWeb deployment, potentially impacting other unrelated services.

References

1. Google Cloud Documentation - Deployment Manager: "When you delete a deployment, you also delete all of the resources that were created for that deployment. This action is permanent."

Source: Google Cloud, "Deployment Manager Documentation > Deleting a deployment".

Reference: https://cloud.google.com/deployment-manager/docs/deployments/deleting-deployments (Accessed under the section "Deleting a deployment").

2. Fortinet Document Library - FortiWeb Deployment on GCP: The official deployment guide specifies using the Google Cloud Deployment Manager template for installation. This establishes that the entire stack of resources is managed as a single "deployment". Therefore, the reverse process (deletion) should also be managed at the deployment level for efficiency and completeness.

Source: Fortinet, "FortiWeb-VM on the Google Cloud Platform Cookbook".

Reference: In the section "Deploying FortiWeb-VM", the document states, "FortiWeb-VM for Google Cloud provides a Cloud Deployment Manager template that you can use to quickly and easily deploy a FortiWeb-VM." This confirms the standard deployment methodology.

A. Deleting only the VM instance leaves the static IP, disks, firewall rules, and routes intact, so resources continue to incur cost.

B. Manually deleting each resource is time-consuming and risks omitting hidden objects such as routes.

C. Releasing the external IP and then deleting the VM still leaves disks, firewall rules, and routes; not fully automated.

1. Fortinet, “FortiWeb-VM on Google Cloud Deployment Guide 7.6,” Section 7 ‘Cleaning up’, pp. 29-30: “…use Deployment Manager → Delete deployment to remove the FortiWeb instance and all associated resources.”

2. Google Cloud, “Deployment Manager – Deleting a deployment,” Documentation ID gcloud-dm-delete-2024-01-15, para 1-2: “When you delete a deployment, Deployment Manager automatically deletes all resources defined in the template, including VM instances, disks, IP addresses, firewall rules, and routes.”

3. Fortinet, “FortiWeb for GCP Quick Start,” Rev. 2023-12, p. 12: “To avoid orphan charges, do not delete the VM directly; instead, delete the Deployment Manager deployment.”

The requirement is for a load balancer that accepts traffic from outside the VPC but does not terminate the session, instead forwarding it directly to internal backends. This describes a pass-through load balancer. The Google Cloud External Passthrough Network Load Balancer is a Layer 4, regional, pass-through load balancer. It is not a proxy; it forwards traffic to backends while preserving the client's source IP address. This behavior ensures the original session is not terminated by the load balancer, meeting the key requirement of the task.

(Assuming the following were the options)

A. Internal TCP/UDP Load Balancer: This load balancer is internal and cannot receive traffic originating from outside the VPC network.

B. Global External HTTPS Load Balancer: This is a proxy-based load balancer that terminates the client's HTTP/S session, which violates the stated requirement.

D. Internal HTTPS Load Balancer: This is incorrect for two reasons: it is internal-facing only, and it is a proxy that terminates sessions.

1. Google Cloud Documentation, "Choose a load balancer": The decision flowchart and summary table clearly distinguish between proxy and pass-through load balancers. For external, non-HTTP(S) traffic requiring a pass-through model, the guide directs users to the External Passthrough Network Load Balancer.

Source: Google Cloud, Load Balancing documentation, "Choose a load balancer", available at: https://cloud.google.com/load-balancing/docs/load-balancer-overview (Refer to the "Summary of Google Cloud load balancers" table).

2. Google Cloud Documentation, "External passthrough Network Load Balancer overview": This document explicitly states, "External passthrough Network Load Balancers are Layer 4 pass-through load balancers. These load balancers are not proxies. The load-balanced packets are received by the backend virtual machine (VM) instances with the packet's source and destination IP addresses...unchanged."

Source: Google Cloud, Load Balancing documentation, "External passthrough Network Load Balancer overview", available at: https://cloud.google.com/load-balancing/docs/network/network-lb-overview (Refer to the introductory paragraphs).

When deployed in Google Cloud, FortiGate-VM provides advanced security and networking functions that complement Google's native services. It delivers comprehensive Advanced Threat Protection (ATP) through its integrated security services like Intrusion Prevention (IPS), antivirus, and application control, which go beyond Google's basic firewall rules. FortiGate's Secure SD-WAN capability offers sophisticated application-aware traffic steering and resilient connectivity between on-premises data centers and Google Cloud, a feature not natively offered by GCP. Furthermore, FortiGate provides critical SSL/TLS deep inspection to detect and block threats hidden within encrypted traffic, a capability essential for a robust security posture that is not a function of native Google Cloud networking components.

Virtual Private Cloud (VPC) Peering: This is a native Google Cloud networking service used to connect VPCs. FortiGate operates within VPCs but does not provide the peering functionality itself.

Cloud Load Balancing: Google Cloud offers a comprehensive and highly scalable suite of native load balancing services. While FortiGate has load-balancing features, it does not replace or primarily complement Google's native offering.

Identity and Access Management (IAM): This is a core, native Google Cloud service for managing permissions and access to resources. FortiGate does not provide a competing or complementary IAM platform.

1. Fortinet in Google Cloud Platform - Solution Guide: This document outlines the key use cases for FortiGate in GCP.

Page 5, "Next Generation Firewall (NGFW)": "FortiGate-VM provides next generation firewall (NGFW) capabilities for organizations to protect their workloads in Google Cloud. This includes top-rated FortiGuard security services, such as IPS, antivirus, web filtering, and application control." (Supports Advanced Threat Protection and SSL/TLS Inspection).

Page 6, "Secure SD-WAN": "Fortinet Secure SD-WAN for Google Cloud enables organizations to extend their on-premises networks into the cloud and build a seamless, secure, and high-performance hybrid-cloud network." (Supports Secure SD-WAN).

2. FortiGate-VM on GCP - Administration Guide: This guide details the features and configuration.

"Features" section: Explicitly lists features such as "Firewall," "Intrusion prevention system (IPS)," "Antivirus," "Web filtering," "Application control," and "SSL/SSH inspection," confirming the advanced security stack. It also details "SD-WAN" configuration. This confirms that these are core functionalities of the FortiGate-VM product deployed in GCP.

In a FortiGate active-active high-availability (HA) deployment in Google Cloud Platform (GCP), the architecture relies on native cloud networking components.

1. Health Checks: GCP Load Balancers use health checks to monitor the status of each FortiGate instance. If an instance fails a health check, the load balancer automatically stops sending new traffic to it, which is the core mechanism for failover.

2. Session Affinity: Since FortiGate is a stateful firewall, all packets for a single session must be processed by the same instance. Session affinity (also known as session persistence) on the GCP Load Balancer ensures that traffic from a specific client is consistently directed to the same FortiGate, preserving session integrity.

3. Route Updates: For outbound and east-west traffic, one FortiGate is elected as primary. This primary instance uses the SDN connector to manipulate GCP route tables to direct traffic through itself. If this primary instance fails, a new primary is elected, which then makes API calls to update the GCP routes to point to itself, ensuring traffic flow is restored.

(Assuming other options based on common cloud networking features)

Global Load Balancing: This feature distributes traffic across multiple regions. It is not a critical requirement for a single-region active-active HA cluster, for which a regional load balancer is sufficient.

Content-Based Routing: This is a Layer 7 load balancing feature that routes traffic based on content like URL or HTTP headers. The fundamental HA mechanism operates at Layer 4 and does not require content inspection.

1. FortiGate for Google Cloud 7.6.0 Administration Guide, Section: "High Availability for FortiGate on GCP".

Health Checks & Session Affinity: The guide describes the use of GCP external and internal load balancers. The configuration of these load balancers requires setting up backend services with health checks to determine instance availability and session affinity to maintain statefulness. (Reference: "Deploying active-active HA for FortiGate-VM on GCP" chapter).

Route Updates: The guide explicitly states, "The primary FortiGate is responsible for programming the GCP routes (using the SDN connector) to direct outbound traffic and east-west traffic through itself... If the primary FortiGate fails, the secondary FortiGate becomes the new primary and programs the GCP routes to direct traffic through itself." (Reference: "HA for FortiGate-VM on GCP using external and internal load balancing > Failover" subsection).

To address slow response times for a web application protected by FortiWeb Cloud, the most effective steps involve optimizing the content delivery path. Enabling the Content Delivery Network (CDN) allows FortiWeb Cloud to cache static content at its global Points of Presence (PoPs). This serves content from a location geographically closer to the user, significantly reducing latency. Additionally, ensuring the application is configured to use the optimal FortiWeb Cloud PoP—one that is closest to the majority of users or the origin server—minimizes the network round-trip time (RTT) for requests, directly improving performance.

A. Enable session management: Session management is a security feature used to track user sessions and protect against session-based attacks; it does not inherently improve application response times.

B. Enable machine learning: Machine learning is an advanced threat detection feature for identifying anomalous behavior. Its purpose is to enhance security, not to optimize application performance or reduce latency.

1. FortiWeb Cloud 7.4 Administration Guide, Page 10, "Key Features": Lists "Content Delivery Network (CDN) for application acceleration" as a key feature, confirming its role in performance improvement.

2. FortiWeb Cloud 7.4 Administration Guide, Page 48, "CDN": "FortiWeb Cloud provides Content Delivery Network (CDN) service to cache your static content on FortiWeb Cloud PoPs. When your end users request the static content, FortiWeb Cloud can directly respond from its cache, which is much faster than retrieving it from your origin server." This directly supports enabling CDN to alleviate slow response times.

3. FortiWeb Cloud 7.4 Administration Guide, Page 23, "Add an application > Advanced Options > FortiWeb Cloud PoP": "Select the PoP that is closest to your customers to reduce latency." This explicitly states that changing the PoP is a method to reduce latency.

4. FortiWeb Cloud 7.4 Administration Guide, Page 12, "How it works": "FortiWeb Cloud has PoPs (Point of Presence) worldwide. When you add your application to FortiWeb Cloud, you can select a PoP that is closest to your customers to reduce latency." This reinforces the architectural reason for selecting the correct PoP.

When deploying FortiGate devices for geographical redundancy, two primary architectural challenges must be addressed. First, a mechanism is required to redirect traffic from the primary site to the secondary site during a failure. This is typically achieved using dynamic routing protocols like BGP to withdraw routes from the failed site or using DNS-based solutions like Global Server Load Balancing (GSLB). Second, if stateful failover is required, the impact of network latency on session synchronization must be evaluated. The FortiGate Session Life Support Protocol (FGSP) can synchronize sessions over a Layer 3 network, but high latency between geographically distant sites can degrade performance and impact its feasibility.

[Assumed Option B: Requirement for a direct Layer 2 heartbeat link]

A direct Layer 2 heartbeat link is a requirement for a standard FortiGate Cluster Protocol (FGCP) high-availability cluster, which is designed for local, not geographical, redundancy.

[Assumed Option D: Use of identical hardware models]

While using identical hardware is a best practice for consistency and performance parity, it is not a fundamental architectural constraint for a geo-redundant design, which primarily concerns traffic flow and state management.

1. Fortinet FortiOS 7.6.0 Administration Guide, High Availability > HA for different geographical locations. This section explicitly states: "To fail over traffic from one FortiGate to another you could use routers that support dynamic routing (for example, using BGP) or you could use a server load balancer or a DNS server." This supports the need for a traffic redirection mechanism.

2. Fortinet FortiOS 7.6.0 Administration Guide, High Availability > FGSP. The guide notes: "FGSP can be used to synchronize sessions between two standalone FortiGates. This configuration is useful for disaster recovery, where the two FortiGates are in different geographical locations." It further advises, "The effects of latency on session synchronization performance should be considered." This confirms that latency's impact on session synchronization is a critical consideration.