NSE7_PBC-7-2 Practice Questions

In this scenario, the issue is caused by the Azure service principle account not having a contributor

role. This is required for the FortiGate HA floating IP to work properly. Without this role, the new

primary device will not have the previous primary device floating IP address after failover. Reference:

Fortinet Public Cloud Security knowledge source documents or study guide.

https://docs.fortinet.com/product/fortigate-public-cloud/7.2

The reason the administrator cannot access the EC2 instance could be:

D. The directory location of the .pem file is incorrect.

SSH Key Location: When initiating an SSH connection to an AWS EC2 instance, you must specify the

private key file (.pem file) location that corresponds to the public key used when the instance was

launched. The error "Warning: Identity file Staging-key.pem not accessible: No such file or directory"

indicates that the SSH client cannot find the .pem file at the specified location.

Correct File Path: The administrator needs to ensure that the path to the Staging-key.pem file is

correctly specified when running the SSH command. If the file is not in the current directory from

which the command is executed, the full or relative path to the file must be provided.

Reference: This behavior is in line with standard SSH connection practices and AWS guidelines for

accessing EC2 instances. It is a common issue that occurs when the private key file is not located in

the directory from which the SSH command is being executed or the path provided is incorrect.

This is because the Linux1 EC2 instance is not accessible directly from the internet using its public IP

address in AWS.

An internet gateway is a horizontally scaled, redundant, and highly available VPC component that

allows communication between instances in your VPC and the internet. Without an internet

gateway, the Linux1 EC2 instance cannot receive or send traffic to or from the internet, even if it has

a public IP address assigned to it.

To fix this issue, you need to attach an internet gateway to the Spoke VPC A and configure a route

table that directs internet-bound traffic to the internet gateway. You also need to ensure that the

Linux1 EC2 instance has a security group that allows inbound and outbound traffic on the desired

ports.

: [Internet Gateways - Amazon Virtual Private Cloud] : [Attach an Internet Gateway to Your VPC -

Amazon Virtual Private Cloud] : [Security Groups for Your VPC - Amazon Virtual Private Cloud]

To deploy a FortiGate HA solution in AWS using Terraform, you need to create an AWS IAM user with

permissions to access the AWS resources and services required by the FortiGate-VM. You also need

to use CloudShell to install Terraform, which is a tool for building, changing, and versioning

infrastructure as code.

Reference:

Deploying FortiGate-VM using Terraform | AWS Administration Guide

Setting up IAM roles | AWS Administration Guide

Launching the instance using roles and user data | AWS Administration Guide

Terraform by HashiCorp

For configuring the failover settings on a FortiGate active-passive SDN connector solution in

Microsoft Azure, the two mandatory settings required after the initial deployment are:

A . Subscription-id

D . Resource group name

Subscription ID: This is a unique identifier for your Azure subscription under which all resources are

created and billed. FortiGate needs this to interact with the Azure resources associated with that

subscription.

Resource Group Name: A resource group in Azure is a container that holds related resources for an

Azure solution. The SDN connector requires the resource group name to correctly identify and

manage the resources it should control, especially in a failover scenario.

Reference: The requirement for these specific details is found in Azure's best practices for resource

management and Fortinet's documentation on deploying and configuring FortiGate appliances in

Azure environments.

According to the Terraform documentation for installing Terraform on Linux1, you need to download

a zip archive that contains a single binary file called terraform. You need to unzip the archive and

move the binary file to a directory that is included in your system’s PATH environment variable, such

as /usr/local/bin. This way, you can run the terraform command from any directory without

specifying the full path1.

If you do not move the binary file to the bin directory, you will get a command not found error when

you try to run the terraform version command, as shown in the screenshot. To fix this error, you need

to move the binary file to the bin directory or specify the full path of the binary file when running the

command1.

1: Install Terraform | Terraform - HashiCorp Learn

The correct answer is C and D. Use a transit VPC with hub and spoke topology to create multiple VPN

connections to the on-premises data center. Use the transit gateway attachment with VPN option to

create multiple VPN connections to the on-premises data center.

According to the Fortinet documentation for Public Cloud Security, a transit VPC is a VPC that serves

as a global network transit center for connecting multiple VPCs, remote networks, and virtual private

networks (VPNs). A transit VPC can use a hub and spoke topology to create multiple VPN connections

to the on-premises data center, using the FortiGate VM as a virtual appliance that provides network

security and threat prevention. A transit VPC can also leverage Equal-Cost Multi-Path (ECMP) routing

to achieve higher bandwidth and load balancing across multiple VPN tunnels1.

A transit gateway is a network transit hub that connects VPCs and on-premises networks. A transit

gateway attachment is a resource that connects a VPC or VPN to a transit gateway. You can use the

transit gateway attachment with VPN option to create multiple VPN connections to the on-premises

data center, using the FortiGate VM as a virtual appliance that provides network security and threat

prevention. A transit gateway attachment with VPN option can also leverage ECMP routing to

achieve higher bandwidth and load balancing across multiple VPN tunnels2.

The other options are incorrect because:

Using ECMP and VPN to achieve higher bandwidth is not a complete solution, as it does not specify

how to replace the existing VPC peering topology or how to connect the AWS VPCs to the on-

premises data center.

Using transit VPC to build multiple VPC connections to the on-premises data center is not a correct

solution, as it does not specify how to use a hub and spoke topology or how to leverage ECMP

routing for higher bandwidth.

1: Fortinet Documentation Library - Transit VPC on AWS 2: Fortinet Documentation Library -

Deploying FortiGate VMs on AWS

The correct answer is D. CloudWatch and S3.

According to the GitHub repository for the Fortinet aws-lambda-tgw script1, this function requires

the following AWS services:

CloudWatch: A monitoring and observability service that collects and processes events from various

AWS resources, including Transit Gateway attachments and route tables.

S3: A scalable object storage service that can store the configuration files and logs generated by the

Lambda function.

By using the Fortinet aws-lambda-tgw script, you can automate the creation and configuration of

Transit Gateway Connect attachments for your FortiGate devices. This can help you save time and

avoid errors when adding more spoke VPCs to an existing hub and spoke topology1.

The other AWS services mentioned in the options are not required for this task. GuardDuty is a threat

detection service that monitors for malicious and unauthorized behavior to help protect AWS

accounts and workloads. WAF is a web application firewall that helps protect web applications from

common web exploits. Inspector is a security assessment service that helps improve the security and

compliance of applications deployed on AWS. DynamoDB is a fast and flexible NoSQL database

service that can store various types of data.

1: GitHub - fortinet/aws-lambda-tgw

According to the AWS documentation for Transit Gateway, a Transit Gateway is a network transit hub

that connects VPCs and on-premises networks. To route traffic from Linux instances to the TGW, you

need to do the following steps:

In the TGW route table, associate two attachments. An attachment is a resource that connects a VPC

or VPN to a Transit Gateway. By associating the attachments to the TGW route table, you enable the

TGW to route traffic between the VPCs and the VPN.

In the main subnet routing table in VPC A and B, add a new route with destination 0_0.0.0/0, next

hop TGW. This route directs all traffic from the Linux instances to the TGW, which can then forward it

to the appropriate destination based on the TGW route table.

The other options are incorrect because:

In the TGW route table, adding route propagation to 192.168.0 0/16 is not necessary, as this is

already the default route for the TGW. Route propagation allows you to automatically propagate

routes from your VPC or VPN to your TGW route table.

In the main subnet routing table in VPC A and B, adding a new route with destination 0_0.0.0/0, next

hop Internet gateway (IGW) is not correct, as this would bypass the TGW and send all traffic directly

to the internet. An IGW is a VPC component that enables communication between instances in your

VPC and the internet.

: [Transit Gateways - Amazon Virtual Private Cloud]

B . The default network ACL is configured to allow all traffic. This means that when you create a VPC,

AWS automatically creates a default network ACL for that VPC, and associates it with all the subnets

in the VPC1. By default, the default network ACL allows all inbound and outbound IPv4 traffic and, if

applicable, IPv6 traffic1. You can modify the default network ACL, but you cannot delete it1. C.

Network ACLs are stateless, and inbound and outbound rules are used for traffic filtering. This means

that network ACLs do not keep track of the traffic that they allow or deny, and they evaluate each

packet separately1. Therefore, you need to create both inbound and outbound rules for each type of

traffic that you want to allow or deny1. For example, if you want to allow SSH traffic from a specific IP

address to your subnet, you need to create an inbound rule to allow TCP port 22 from that IP

address, and an outbound rule to allow TCP port 1024-65535 (the ephemeral ports) to that IP

address2.

The other options are incorrect because:

You can use network ACL and security group at the same time. Network ACL and security group are

two different types of security layers for your VPC that can work together to control traffic3. Network

ACL acts as a firewall for your subnets, while security group acts as a firewall for your instances3. You

can use both of them to create a more granular and effective security policy for your VPC.

Network ACLs are not tied to an instance. Network ACLs are associated with subnets, not

instances1. This means that network ACLs apply to all the instances in the subnets that they are

associated with1. You cannot associate a network ACL with a specific instance. However, you can

associate a security group with a specific instance or multiple instances3.