Fortinet NSE7_PBC-7.2 Test Dumps

B.   You must create a new allow SSH rule above rule number 5-

Answer DescriptionExplanation:

Network ACLs are stateless, and they evaluate each packet separately based on the rules that you define. The rules are processed in order, starting with the lowest numbered rule1. If the traffic matches a rule, the rule is applied and no further rules are evaluated1. Therefore, if you want to allow SSH traffic to a subnet, you must create a new allow SSH rule above rule number 5, which denies SSH and telnet traffic. Otherwise, the deny rule will take precedence and block the SSH traffic.

The other options are incorrect because:

• Creating a new allow SSH rule below rule number 5 will not allow SSH traffic, because the deny rule will be evaluated first and block the traffic.

• Creating a new allow SSH rule anywhere in the network ACL rule base will not guarantee that SSH traffic will be allowed, because it depends on the order of the rules. If the allow SSH rule is below the deny rule, it will not be effective.

• You cannot rely on the default security group rule to allow SSH traffic to the subnet, because network ACLs act as an additional layer of security for your VPC. Even if your security group allows SSH traffic, your network ACL must also allow it. Otherwise, the traffic will be blocked at the subnet level.

A.   The first query is targeted to a special IP address to get a token.



D.   Some queries are made to manage public IP addresses.

Answer DescriptionExplanation:

The Azure SDN connector uses two types of queries to interact with the Azure management API. The first query is targeted to a special IP address to get a token. This token is used to authenticate the subsequent queries. The second type of query is used to retrieve information about the Azure resources, such as virtual machines, network interfaces, network security groups, and public IP addresses. Some queries are made to manage public IP addresses, such as assigning or releasing them from the FortiGate VM.

References:

Configuring an SDN connector in Azure, Azure SDN connector using service principal, Troubleshooting Azure SDN connector

A.   Enable send logs-



B.   Create and IPS sensor and a firewall policy



D.   Create an SSL]SSH inspection profile.

Answer DescriptionExplanation:

To configure a FortiGate VM to add to FortiCNP, you need to perform three steps on FortiGate:

• Enable send logs in FortiGate to allow FortiCNP to receive the IPS logs from FortiGate.

• Create an SSL/SSH inspection profile on FortiGate to inspect the encrypted traffic and apply IPS protection.

• Create an IPS sensor and a firewall policy on FortiGate to enable IPS detection and prevention for the traffic.

References:

• FortiCNP 22.4.a Administration Guide, page 22-24

• FortiGate IPS Administration Guide, page 9-10

A.   Set up a storage account in Azure.



D.   Move the Terraform file to the bin directory.



E.   Use the wget (te=aform vession) command to upload Terraform.

Answer DescriptionExplanation:

To get Terraform ready using Microsoft Azure Cloud Shell, you need to perform the following steps:

• Set up a storage account in Azure. This is required to store the Terraform state file in a blob container, which enables collaboration and persistence of the infrastructure configuration1.

• Use the wget (terraform_version) command to upload Terraform. This command downloads the latest version of Terraform from the official website and saves it as a zip file in the current directory2.

• Move the Terraform file to the bin directory. This step extracts the Terraform executable from the zip file and moves it to the bin directory, which is part of the PATH environment variable. This allows you to run Terraform commands from any directory in Cloud Shell2.

The other options are incorrect because:

• You do not need to use the -O command to download Terraform. This command is used to specify a different output file name for the downloaded file, but it is not necessary for this task3.

• You do not need to subscribe to Terraform in Azure. Terraform is an open-source tool that can be used with any cloud provider, and there is no subscription or registration required to use it with Azure4.

References:

• Updating the route table and adding an IAM policy

• Configure Terraform in Azure Cloud Shell with Bash

• wget(1) - Linux man page

• Terraform by HashiCorp

B.   VPC attachment

Answer DescriptionExplanation:

A VPC attachment is the type of attachment that allows you to connect a VPC to a TGW and advertise routes through BGP. A VPC attachment creates a VPN connection between the VPC and the TGW, and enables dynamic routing with BGP. A connect attachment is used to connect a VPN or Direct Connect gateway to a TGW. A route attachment is not a valid type of attachment for TGW. A GRE attachment is used to connect a FortiGate device to a TGW using GRE tunnels.

References:

• Creating the TGW and related resources

• Configuring TGW route tables

• FortiGate Public Cloud 7.2.0 - Fortinet Documentation

• Updating the route table and adding an IAM policy