NSE7_PBC-7.2 100% Pass Guaranteed Download NSE 7 Network Security Architect Exam PDF Q&A [Q49-Q67]

Rate this post

NSE7_PBC-7.2 100% Pass Guaranteed Download NSE 7 Network Security Architect Exam PDF Q&A

NSE7_PBC-7.2 Practice Test Dumps with 100% Passing Guarantee

Fortinet NSE7_PBC-7.2 (Fortinet NSE 7 – Public Cloud Security 7.2) Certification Exam is designed to test and validate the knowledge and skills of IT professionals in the field of cloud security. Fortinet NSE 7 – Public Cloud Security 7.2 certification exam is specifically designed for individuals who work with public cloud infrastructures, such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

Fortinet NSE7_PBC-7.2 is a certification exam offered by Fortinet that is designed to validate the knowledge and expertise of IT professionals in managing and securing public cloud environments. NSE7_PBC-7.2 exam is part of the Fortinet Network Security Expert (NSE) program, which is a comprehensive training and certification program for network security professionals.

NO.49 Refer to Exhibit:

The exhibit shows the Connect Peers settings on Amazon Web Services (AWS) transit gateway attachments With two FortiGate VMS in a security VPC.
Which two statements are correct? (Choose two.)

The peer GRE address is the FortiGate external interface IP address.

The Transit Gateway GRE address is auto-generated

The BGP inside CIDR blocks can be any CIDR block with /29

The Peer GRE address is the FortiGate internal interface IP address

NO.50 Which three properties are configurable Microsoft Azure network security group rule settings?
(Choose three.)

Action

Sequence number

Source and destination IP ranges

Destination port ranges

Source port ranges

NO.51 What are two main features in Amazon Web Services (AWS) network access control lists (ACLs)? (Choose two.)

You cannot use Network ACL and Security Group at the same time.

The default network ACL is configured to allow all traffic

NetworkACLs are stateless, and inbound and outbound rules are used for traffic filtering

Network ACLs are tied to an instance

NO.52 An administrator is looking for a solution that can provide insight into users and data stored in major SaaS applications in the multicloud environment Which product should the administrator deploy to have secure access to SaaS applications?

FortiProxy

FortiSandbox

ForliCASB

FortiWeb

NO.53 Refer to the exhibit.

The exhibit shows an active-passive high availability FortiGate pair with external and internal Azure load balancers. There is no SDN connector used in this solution Which configuration should the administrator implement?

Lambda IP address with one static route.

Probe IP address with two static routes

Probe IP address with one BGP route

Public load balancer IP address with two BGP routes.

NO.54 How does Terraform keep track of provisioned resources?

It uses the terraform. tf state file

Terraform does not keep the state of resources created

It uses the terraform. tfvars file.

It uses the database. tf file.

NO.55 Refer to the exhibit.

What could be the reason that the administrator cannot access the EC2 instance?

You must elevate the permissions to access the EC2 instance

You must run the chmod 400 Staging-key.peracommand before accessing the instance.

There is no . pem key created on in Amazon Web Services (AWS)

The directory location of the .pem file is incorrect.

NO.56 You are using Red Hat Ansible to change the FortiGate VM configuration.
What is the minimum number of files you must create and which file must you use to configure the target FortiGate IP address?

Create two files and use the .yami file.

Create two files and use the hosts file

Create one file and use the variable file

Create three files and use the .yaml file.

NO.57 Refer to the exhibit

In your Amazon Web Services (AWS), you must allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet However, your HTTPS connection to the FortiGate VM in the Customer VPC is not successful.
Also, you must ensure that the Customer VPC FortiGate VM sends all the outbound Internet traffic through the Security VPC How do you correct this Issue with minimal configuration changes?
(Choose three.)

Add a route With your local internet public IP address as thedestination and target transit gateway

Add route destination 0 0.0 0/0 to target the transit gateway

Add a route With your local internet public IP address as the destination and target internet gateway

Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway

Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC,

Explanation
B: Add route destination 0.0.0.0/0 to target the transit gateway. This will ensure that the Customer VPC FortiGate VM sends all the outbound internet traffic through the Security VPC, where it can be inspected by the Security VPC FortiGate VMs1. The transit gateway is a network device that connects multiple VPCs and on-premises networks in a hub-and-spoke model2. D. Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway. This will allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the private subnet where the FortiGate VM is located3. An internet gateway is a service that enables communication between your VPC and the internet4. An EIP is a public IPv4 address that you can allocate to your AWS account and associate with your resources. E. Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC. This will also allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the public subnet where the FortiGate VM is located3. This is an alternative solution to option D, depending on which subnet you want to use for the FortiGate VM.
The other options are incorrect because:
Adding a route with your local internet public IP address as the destination and target transit gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will only apply to traffic coming from your specific IP address, not from any other source on the internet1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.
Adding a route with your local internet public IP address as the destination and target internet gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will bypass the Security VPC and send the traffic directly to the Customer VPC1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.

NO.58 Refer to Exhibit:

After the initial Terraform configuration in Microsoft Azure, the terraform plan command is run Which two statements about running the plan command are true? (Choose two.)

The terraform plan command will deploy the rest of the resources except the service principle details.

You cannot run the terraform apply command before the terraform plan command.

You must run the terraform init command once, before the terraform plan command

The terraform plan command makes terraform do a dry run.

NO.59 Refer to the exhibit

An administrator deployed a FortiGate-VM in a high availability (HA)
(active/passive) architecture in Amazon Web Services (AWS) using Terraform for testing purposes. At the same time, the administrator deployed a single Linux server using AWS Marketplace Which two options are available for the administrator to delete all the resources created in this test? (Choose two.)

Use the terraform destroy command

Use the terraform validate command.

Use the terraform destroy all command.

The administrator must manually delete the Linux server.

NO.60 Refer to Exhibit:

You are troubleshooting a Microsoft Azure SDN connector issue on your FortiGate VM in Azure Which three settings should you check while troubleshooting this problem? (Choose three.)

Use the show vdom command to see hidden VDOMs.

use the diag sys va command.

Ensure FortiGate port4 can resolve DNS.

Ensure FortiGate portl has internet access

Ensure IP address 169.254.169_254 is not blocked

NO.61 Refer to the exhibit

You are deploying two FortiGate VMS in HA active-passive mode with load balancers in Microsoft Azure Which two statements are true in this load balancing scenario? (Choose two.)

The FortiGate public IP is the next-hop for all the traffic.

An internal load balancer listener is the next-hop for outgoing traffic.

You must add a route to the Microsoft VIP used for the health check.

A dedicated management interface can be used for load balancing.

NO.62 Refer to the exhibit. Which two conditions will enable you to segregate and secure the traffic between the hub and the spokes in Microsoft Azure? (Choose two.)

Implement the FortiGate-VM network virtual appliance (NVA) in the hub and use user-defined routes (UDRs) in the spokes.

Use ExpressRoute to interconnect the hub VNets and spoke VNets.

Configure VNet peering between the spokes only.

Configure VNet peering between the hub and spokes.

NO.63 Refer to the exhibit

You are tasked with deploying FortiGate using Terraform. When you run the terraform version command during the Terraform installation, you get an error message.
What could be the reason that you are getting the command not found error?

You must move the binary file to the bin directory.

You must change the directory location to the root directory

You must assign correct permissions to the ec2-user.

You must reinstall Terraform

NO.64 In an SD-WAN TGW Connect topology, which three initial steps are mandatory when routing traffic from a spoke VPC to a security VPC through a Transit Gateway? (Choose three.)

From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW

From the security VPC TGW subnet routing table: point 0.0.0.0/0 traffic to theFortiGate internal port

From the security VPC TGW subnet routing table: point 0.0.0.0/0 traffic to the TGW

From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW

From both spoke VPCs and the security VPC, point 0.0.0.0/0 traffic to the Internet Gateway

* Spoke VPC Routing: The 0.0.0.0/0 (default) route in the spoke VPC must point to the Transit Gateway attachment for traffic to reach other VPCs or external destinations.
* Security VPC Routing: Traffic from the security VPC needs to pass through the FortiGate for inspection and security controls. Therefore, the 0.0.0.0/0 route in the security VPC’s TGW subnet routing table must point to the FortiGate’s internal port.
* FortiGate Routing: The FortiGate’s internal subnet must have its 0.0.0.0/0 route configured to point to the Transit Gateway attachment, allowing traffic to be returned to other VPCs or reach the internet.
In an SD-WAN TGW Connect topology, when routing traffic from a spoke VPC to a security VPC through a Transit Gateway, the mandatory initial steps include:
* From the spoke VPC internal routing table, point 0.0.0.0/0 traffic to the TGW (Option A):This step is crucial for ensuring that all traffic from the spoke VPC destined for external networks is directed through the Transit Gateway, allowing for centralized management and security inspection.
* From the security VPC TGW subnet routing table: point 0.0.0.0/0 traffic to the FortiGate internal port (Option B):Routing all traffic from the TGW subnet in the security VPC to the FortiGate’s internal port ensures that traffic is subjected to the necessary security policies and inspections provided by the FortiGate appliance before it proceeds to other destinations or returns to the spoke VPCs.
* From the security VPC FortiGate internal subnet routing table, point 0.0.0.0/0 traffic to the TGW (Option D):This configuration ensures that traffic returning from the security processes handled by the FortiGate is routed back through the Transit Gateway, maintaining the integrity of the secure transit path and ensuring proper routing back to the originating spoke or onward to the internet.
References:These steps align with best practices for implementing SD-WAN solutions in a cloud environment, ensuring that all traffic is appropriately routed through security appliances for necessary controls and monitoring, asdetailed in the Fortinet SD-WAN documentation and AWS Transit Gateway connectivity guidelines.

NO.65 A Network security administrator is searching for a solution to secure traffic going in and out of the container infrastructure.
In which two ways can Fortinet container security help secure container infrastructure?(Choose two.)

FortiGate NGFW can be placed between each application container for north-south traffic inspection

FortiGate NGFW can connect to the worker node and protects the container-

FortiGate NGFW can inspect north-south container traffic with label aware policies

FortiGate NGFW and FortiSandbox can be used to secure container traffic

NO.66 You must allow an SSH traffic rule in an Amazon Web Services (AWS) network access list (NACL) to allow SSH traffic to travel to a subnet for temporary testing purposes. When you review the current inbound network ACL rules, you notice that rule number 5 demes SSH and telnet traffic to the subnet What can you do to allow SSH traffic?

You must create a new allow SSH rule below rule number 5

You must create a new allow SSH rule above rule number 5-

You must create a new allow SSH rule anywhere in the network ACL rule base to allow SSH traffic.

You do not have to create any NACL rules because the default security group rule automatically allows SSH traffic to the subnet.

NO.67 Your company deploys FortiGate VM devices in high availability (HA) (active-active) mode with Microsoft Azure load balancers using the Microsoft Azure ARM template. Your senior administrator instructs you to connect to one of the FortiGate devices and configure the necessary firewall rules. However, you are not sure now to obtain the correct public IP address of the deployed FortiGate VM and identify the access ports.
How do you obtain the public IP address of the FortiGate VM and identify the correct ports to access the device?

In the configured load balancer, access the inbound NAT rules section.

In the configured load balancer, access the backend pools section.

In the configured load balancer, access the inbound and outbound NAT rules section.

In the configured load balancer, access the health probes section.