NSE7_PBC-7.2 Exam Training Practice Tests (Fortinet NSE 7

Question 1

What are three important steps required to get Terraform ready using Microsoft Azure Cloud Shell? (Choose three.)

A. Use the wget (te=aform vession) command to upload Terraform. B. Move the Terraform file to the bin directory. C. Subscribe to Terraform in Azure. D. Set up a storage account in Azure. E. use the -O command to download Terraform.

Correct Answer: A,B,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit. You are configuring a second route table on a Transit Gateway to accommodate east-west traffic inspection between two VPCs. However, you are getting an error during the transit gateway route table association with the Connect attachment.

Which action Should you take to fulfill your requirement?

A. In the second route table: create a propagation with the Connect attachment. B. Delete the both Connect and Transport attachments from the first TGW route table C. Add a static route in the Routes section D. Add both Associations and Propagations in the second TGW route table.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit. You attempted to access the Linux1 EC2 instance directly from the internet using its public IP address in AWS.

However, your connection is not successful.
Given the network topology, what can be the issue?

A. The Transit Gateway BGP IP address is incorrect. B. There is no connection between VPC A and VPC B. C. There is no elastic IP address attached to FortiGate in the Security VPC. D. There is no internet gateway attached to the Spoke VPC A.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

Your administrator instructed you to deploy an Azure vWAN solution to create a connection between the main company site and branch sites to the other company VNETs.
What are the two best connection solutions available between your company headquarters, branch sites, and the Azure vWAN hub? (Choose two.)

A. ExpressRoute B. An L2TP connection C. VPN Gateway D. SSL VPN connections E. GRE tunnels

Correct Answer: A,C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit. You are deploying two FortiGate VMS in HA active-passive mode with load balancers in Microsoft Azure.

Which two statements are true in this load balancing scenario? (Choose two.)

A. The FortiGate public IP is the next-hop for all the traffic. B. You must add a route to the Microsoft VIP used for the health check. C. An internal load balancer listener is the next-hop for outgoing traffic. D. A dedicated management interface can be used for load balancing.

Correct Answer: C,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

You are deploying Amazon Web Services (AWS) GuardDuty to monitor malicious or unauthorized behaviors related to AWS resources. You will also use the Fortinet aws-lambda-guardduty script to translate feeds from AWS GuardDuty findings into a list of malicious IP addresses. FortiGate can then consume this list as an external threat feed.
Which Amazon AWS services must you subscribe to in order to use this feature?

A. WAF, Shield, GuardDuty, S3, and DynamoDB. B. GuardDuty, CloudWatch, S3, and DynamoDB. C. Inspector, Shield, GuardDuty, S3, and DynamoDB. D. GuardDuty, CloudWatch, S3, Inspector, WAF, and Shield.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Which two statements about Amazon Web Services (AWS) networking are correct? (Choose two.)

A. Multicast traffic is not allowed. B. 802.1q VLAN tags are allowed inside the same virtual private cloud. C. Proxy ARP entries are disregarded. D. AWS DNS reserves the first host IP address of each subnet.

Correct Answer: A,C

Question 8

A Network security administrator is searching for a solution to secure traffic going in and out of the container infrastructure.
In which two ways can Fortinet container security help secure container infrastructure? (Choose two.)

A. FortiGate NGFW can connect to the worker node and protects the container- B. FortiGate NGFW and FortiSandbox can be used to secure container traffic C. FortiGate NGFW can be placed between each application container for north-south traffic inspection D. FortiGate NGFW can inspect north-south container traffic with label aware policies

Correct Answer: B,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Your company deploys FortiGate VM devices in high availability (HA) (active-active) mode with Microsoft Azure load balancers using the Microsoft Azure ARM template. Your senior administrator instructs you to connect to one of the FortiGate devices and configure the necessary firewall rules. However, you are not sure now to obtain the correct public IP address of the deployed FortiGate VM and identify the access ports.
How do you obtain the public IP address of the FortiGate VM and identify the correct ports to access the device?

A. In the configured load balancer, access the inbound NAT rules section. B. In the configured load balancer, access the health probes section. C. In the configured load balancer, access the inbound and outbound NAT rules section. D. In the configured load balancer, access the backend pools section.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

Refer to the exhibit. In your Amazon Web Services (AWS) virtual private cloud (VPC), you must allow outbound access to the internet and upgrade software on an EC2 instance, without using a NAT instance. This specific EC2 instance is running in a private subnet: 10.0.1.0/24. Also, you must ensure that the EC2 instance source IP address is not exposed to the public internet. There are two subnets in this VPC in the same availability zone, named public (10.0.0.0/24) and private (10.0.1.0/24).

How do you achieve this outcome with minimum configuration?

A. Deploy a NAT gateway with an EIP in the private subnet, edit the public main routing table, and change the destination route 0.0.0.0/0 to the target NAT gateway. B. Deploy a NAT gateway with an EIP in the public subnet, edit route tables, select Public-route, and delete the route destination 10.0.0.0/16 to target local. C. Deploy a NAT gateway with an EIP in the private subnet, edit route tables, select Private- route, and add a new route destination 0.0.0.0/0 to the target internet gateway. D. Deploy a NAT gateway with an EIP in the public subnet, edit route tables, select Private-route and add a new route destination 0.0.0.0/0 to target the NAT gateway.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Fortinet NSE 7 - Public Cloud Security 7.2 - NSE7_PBC-7.2 Exam Practice Test