Free NSE7-PBC-7-2 sample questions

Correct answer: module: `fortios_firewall_address`, state: `present`

The `fortios_firewall_address` module is the correct tool for managing firewall address objects. Using `state: present` ensures idempotency. If the named address object does not exist, Ansible will create it. If it already exists with the specified parameters, Ansible will report 'ok' and make no changes. If it exists but has different parameters, Ansible will update it to match the playbook definition and report 'changed'.

Correct answer: The FortiGate is missing a static route for the spoke VPC (192.168.1.0/24) pointing back to the TGW.

Since the packet capture shows traffic arriving but not leaving the FortiGate, the issue is likely within the FortiGate's configuration. For the FortiGate to route traffic to the spoke VPC, it must have a route in its routing table for that destination. In a TGW environment, this route should point to the TGW as the next hop. A missing static route for 192.168.1.0/24 would cause the FortiGate to drop the packets, as it wouldn't know where to send them.

Correct answers: Use FortiCNP's remediation guidance to generate a script or CLI command to update the S3 bucket policy and block public access.; Configure an automated workflow within FortiCNP to immediately apply a more restrictive S3 bucket policy upon detection.

FortiCNP provides actionable remediation guidance, often including specific CLI commands or console steps to fix misconfigurations. This is a primary feature for mitigating identified risks.

A key benefit of FortiCNP is its ability to automate remediation. Setting up a workflow to automatically correct common, high-risk misconfigurations like public S3 buckets is a best practice for immediate risk mitigation.

Correct answer: False

While using a Managed Identity is the recommended and most secure method, the Azure SDN Connector also supports authentication using a Service Principal with a client ID and secret. Therefore, it is not mandatory to use a Managed Identity, although it is a best practice.

Correct answers: Multiple TGW route tables; TGW route table association and propagation

Multiple TGW route tables are fundamental to creating separate routing domains. Each business unit's VPC attachments can be associated with a specific route table, and propagation can be controlled to ensure traffic is isolated and only routed where intended (e.g., to the security VPC).

Controlling route table association (which route table an attachment uses) and propagation (which attachments dynamically propagate their routes into a route table) is the core mechanism for enforcing traffic isolation and directing traffic flows within the TGW.

Correct answer: A FortiGate CNF policy configured with Kubernetes service objects as source and destination, and an IPS profile.

FortiGate CNF integrates with the Kubernetes API to understand its objects. The correct way to enforce this policy is to create a firewall policy within FortiGate CNF that uses Kubernetes labels or service objects to define the 'frontend' namespace as the source and the 'database' namespace as the destination. Applying an Intrusion Prevention System (IPS) profile to this policy will enable the inspection for SQL injection attacks.

Correct answer: To act as a transport mechanism for dynamic routing protocol packets, such as BGP, between the FortiGate and the TGW.

The GRE (Generic Routing Encapsulation) tunnel in a TGW Connect setup serves as a transport layer. Its primary function is to encapsulate and carry the packets of a dynamic routing protocol, specifically BGP, between the customer's SD-WAN appliance (FortiGate) and the Transit Gateway. This allows for dynamic exchange of routes, which is a core benefit of TGW Connect over static TGW attachments. GRE itself does not provide encryption.

Correct answer: Modify the vWAN hub's default route table to set the next hop for 0.0.0.0/0 to the FortiGate NVA.

In an Azure Virtual WAN architecture, routing for spoke VNets is controlled by the hub's route tables. To force internet-bound traffic through the NVA, you must edit the effective route table associated with the spoke VNet connection (often the 'default' route table). You would add a static route for 0.0.0.0/0 and set the next hop to the specific vWAN connection corresponding to the FortiGate NVA. UDRs in the spoke VNet are not the primary mechanism for this in a vWAN hub scenario.

Correct answer: Use Terraform to provision infrastructure and Ansible to configure the FortiGate instances.

This is a widely-accepted best practice. Terraform excels at declarative infrastructure provisioning and managing the state of cloud resources (the 'what'). Ansible is a procedural configuration management tool that excels at configuring software and devices once they are running (the 'how'). Using Terraform for the initial build-out and Ansible for the detailed configuration of the FortiGates leverages the core strengths of each tool.

Correct answer: `inbound_rule` controls traffic to the FortiGate-VM, while `outbound_rule` controls traffic originating from the FortiGate-VM.

Azure NSGs are stateful firewalls that filter traffic at the network interface or subnet level. An `inbound_rule` defines the permissions for traffic arriving at the network interface from external sources. An `outbound_rule` defines permissions for traffic leaving the network interface, initiated from the VM itself. Both are crucial for controlling access to and from the FortiGate.