Pass the Fortinet Certified Professional Public Cloud Security FCP_ZCS_AD-7.4 Questions and answers with ExamsMirror

Enabling the IP forwarding setting on FortiGate (or any NVA) in Azure allows the VM to route traffic that is not destined for itself, effectively enabling it to act as a router or firewall. This is essential for scenarios where FortiGate inspects or filters traffic between subnets or from on-premises to Azure.

Two virtual NICs – The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.

One NSG for each interface – The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet’s best practices.

In an active-passive HA deployment of FortiGate VMs in Azure using the Marketplace template, configuration synchronization is handled via unicast FortiGate Clustering Protocol (FGCP). FGCP allows the primary unit to replicate its configuration and session information to the secondary unit, ensuring seamless failover.

Using FortiGate at both ends of a site-to-site IPsec VPN tunnel provides the advantage of applying consistent security policies, configurations, and management tools across both the on-premises and Azure environments. This simplifies policy enforcement, improves operational efficiency, and ensures uniform threat protection.

In an active-active FortiGate cluster deployment in Azure, you must assign the public IP address to an Azure load balancer. This is required because Azure does not support multiple VMs sharing a single public IP directly. The Azure Load Balancer handles inbound traffic and distributes it to the active FortiGate instances.

The Reverse Proxy mode is the most appropriate FortiWeb operation mode for this scenario. In this mode, FortiWeb sits between internet users and the Linux web servers, terminating client connections and then forwarding requests to the backend servers. This enables deep inspection, protection from web attacks (like SQL injection and XSS), and full WAF functionality, making it ideal for securing front-end web servers exposed to the internet.

Azure Route Server simplifies dynamic routing by allowing your FortiGate VMs to exchange BGP routes directly with Azure’s networking fabric. This eliminates the need to manually update route tables and enables seamless, centralized communication between on-premises branches and Azure resources through both VPN Gateway and ExpressRoute Gateway.

A Microsoft Entra tenant is the primary administrative unit that represents an organization within Microsoft’s identity platform. It defines the boundary for identity management, access control, and resource governance, and serves as the core entity that connects the organization to Microsoft's cloud services such as Azure and Microsoft 365.

For VMs in the 10.0.1.0/26 subnet to access the internet through the FortiGate VM, their default gateway must be changed to the internal IP address of the FortiGate’s NIC in that subnet (e.g., LAB1-FGT-A-Nic2). This ensures traffic is routed through FortiGate for inspection and NAT, rather than directly using Azure’s default system routes.

Azure Virtual WAN is designed for large-scale, automated, and global branch connectivity, supporting hub-and-spoke architectures across multiple regions. It enables centralized routing, hub-to-hub connectivity, and integrates with VPN, ExpressRoute, and SD-WAN solutions, making it ideal for complex, multi-region deployments as shown in the diagram.