[Q36-Q60] Free NSE7_PBC-7.2 Exam Files Downloaded Instantly UPDATED [2025]

NO.36 Refer to the exhibit. You deployed an HA active-passive FortiGate VM in Microsoft Azure.

Which two statements regarding this particular deployment are true? (Choose two.)

During the failover, the passive FortiGate issues API calls to Azure

Use the vdom-excepticn command to synchronize the configuration.

There is no SLA for API calls from Microsoft Azure.

By default, the configuration does not synchromze between the primary and secondary devices.

NO.37 Refer to the exhibit.
You are configuring a second route table on a Transit Gateway to accommodate east-west traffic inspection between two VPCs_ However, you are getting an error during the transit gateway route table association With the Connect attachment.
Which action Should you take to fulfill your requirement?

Add both Associations and Propagations in the second TGW route table.

Delete the both Connect and Transport attachments from the first TGW route table

Add a static route in the Routes section

In the second route table: create a propagation with the Connect attachment.

NO.38 An administrator decides to use the Use managed identity option on the FortiGate SDN connector with Microsoft Azure However, the SDN connector is failing on the connection What must the administrator do to correct this issue?

Make sure to add the Tenant ID on FortiGate side of the configuration

Make sure to set the type to system managed identity on FortiGate SDN connectorsettings

Make sure to enable the system assigned managed identity on Azure

Make sure to add the Client secret on FortiGate side of the configuration

NO.39 Which two Amazon Web Services (AWS) features do you use for the transit virtual private cloud (VPC) automation process to add new spoke N/PCs? (Choose two )

Amazon S3 bucket

AWS Security Hub

AWS Transit Gateway

Amazon CloudWatch

NO.40 Which two statements about Amazon Web Services (AWS) networking are correct? (Choose two.)

Proxy ARP entries are disregarded.

802.1q VLAN tags are allowed inside the same virtual private cloud.

AWS DNS reserves the first host IP address of each subnet.

Multicast traffic is not allowed.

NO.41 Refer to the exhibit. You are troubleshooting a FortiGate HA floating IP issue with Microsoft Azure. After the failover, the new primary device does not have the previous primary device floating IP address.

What could be the possible issue With this scenario?

FortiGate port4 does not have internet access.

A wrong client secret credential is used

The error is caused by credential time expiration.

The Azure service principle account must have a contributor role.

NO.42 Refer to Exhibit:

After the initial Terraform configuration in Microsoft Azure, the terraform plan command is run Which two statements about running the plan command are true? (Choose two.)

The terraform plan command will deploy the rest of the resources except the service principle details.

You cannot run the terraform apply command before the terraform plan command.

You must run the terraform init command once, before the terraform plan command

The terraform plan command makes terraform do a dry run.

NO.43 You have created a TGW route table to route traffic from your spoke VPC to the security VPC where two FortiGate devices are inspecting traffic. Your spoke VPC CIDR block is already propagated to the Transit Gateway (TGW) route table.
Which type of attachment should you use to advertise routes through BGP from the spoke VPC to the security VPC?

Connect attachment

VPC attachment

Route attachment

GRE attachment

NO.44 Refer to the exhibit.

You have deployed a Linux EC2 instance in Amazon Web Services (AWS) with the settings shown on the exhibit What next step must the administrator take to access this instance from the internet?

Configure the user name and password.

Enable source and destination checks on the instance

Enable SSH and allocate it to the device

Allocate an Elastic IP address and assign it to the instance.

NO.45 Refer to the exhibit

In your Amazon Web Services (AWS), you must allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet However, your HTTPS connection to the FortiGate VM in the Customer VPC is not successful.
Also, you must ensure that the Customer VPC FortiGate VM sends all the outbound Internet traffic through the Security VPC How do you correct this Issue with minimal configuration changes?
(Choose three.)

Add a route With your local internet public IP address as thedestination and target transit gateway

Add route destination 0 0.0 0/0 to target the transit gateway

Add a route With your local internet public IP address as the destination and target internet gateway

Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway

Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC,

Explanation
B: Add route destination 0.0.0.0/0 to target the transit gateway. This will ensure that the Customer VPC FortiGate VM sends all the outbound internet traffic through the Security VPC, where it can be inspected by the Security VPC FortiGate VMs1. The transit gateway is a network device that connects multiple VPCs and on-premises networks in a hub-and-spoke model2. D. Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway. This will allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the private subnet where the FortiGate VM is located3. An internet gateway is a service that enables communication between your VPC and the internet4. An EIP is a public IPv4 address that you can allocate to your AWS account and associate with your resources. E. Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC. This will also allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the public subnet where the FortiGate VM is located3. This is an alternative solution to option D, depending on which subnet you want to use for the FortiGate VM.
The other options are incorrect because:
Adding a route with your local internet public IP address as the destination and target transit gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will only apply to traffic coming from your specific IP address, not from any other source on the internet1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.
Adding a route with your local internet public IP address as the destination and target internet gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will bypass the Security VPC and send the traffic directly to the Customer VPC1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.

NO.46 You are adding more spoke VPCs to an existing hub and spoke topology Your goal is to finish this task in the minimum amount of time without making errors.
Which Amazon AWS services must you subscribe to accomplish your goal?

GuardDuty, CloudWatch

WAF, DynamoDB

Inspector, S3

CloudWatch, S3

NO.47 Refer to the exhibit.

You deployed an HA active-active load balance sandwich with two FortiGate VMs in Microsoft Azure.
After the deployment, you prefer to use FGSP to synchronize sessions, and allow asymmetric return traffic In the environment, FortiGate port 1 and port 2 are facing external and internal load balancers respectively What IP address must you use in the peerip configuration?

The opposite FortiGate port 1 IP address.

The public load balancer port 2 IP address

The internal load balancer port 1 IP address.

The opposite FortiGate port 2 IP address.

NO.48 Refer to Exhibit:

The exhibit shows the Connect Peers settings on Amazon Web Services (AWS) transit gateway attachments With two FortiGate VMS in a security VPC.
Which two statements are correct? (Choose two.)

The peer GRE address is the FortiGate external interface IP address.

The Transit Gateway GRE address is auto-generated

The BGP inside CIDR blocks can be any CIDR block with /29

The Peer GRE address is the FortiGate internal interface IP address

NO.49 Refer to the exhibit

An administrator deployed an HA active-active load balance sandwich in Microsoft Azure. The setup requires configuration synchronization between devices- What are two outcomes from the configured settings? (Choose two.)

FortiGate-VM instances are scaled out automatically according to predefined workload levels.

FortiGate A and FortiGate B are two independent devices.

By default, FortiGate uses FGCP

It does not synchronize the FortiGate hostname

NO.50 Which two Amazon Web Services (AWS) topologies support east-west traffic inspection within the AWS cloud by the FortiGate VM? (Choose two.)

A single VPC deployment with multiple subnets and a NAT gateway

A single VPC deployment with multiple subnets

A multiple VPC deployment utilizing a transit VPC topology

A multiple VPC deployment utilizing a transit gateway

NO.51 What kind of underlying mechanism does Transit Gateway Connect use to send traffic from the virtual private cloud (VPC) to the transit gateway?

A GRE attachment

Transit Gateway Connect attachment

A transport attachment

A BGP attachment

NO.52 Refer to the exhibit. You have deployed a Linux EC2 instance in Amazon Web Services (AWS) with the settings shown on the exhibit What next step must the administrator take to access this instance from the internet?

Configure the user name and password.

Enable source and destination checks on the instance

Enable SSH and allocate it to the device

Allocate an Elastic IP address and assign it to the instance

NO.53 What kind of underlying mechanism does Transit Gateway Connect use to send traffic from the virtual private cloud (VPC) to the transit gateway?

A BGP attachment

A GRE attachment

A transport attachment

Transit Gateway Connect attachment

NO.54 Refer to Exhibit:

The exhibit shows the Connect Peers settings on Amazon Web Services (AWS) transit gateway attachments With two FortiGate VMS in a security VPC.
Which two statements are correct? (Choose two.)

The peer GRE address is the FortiGate external interface IP address.

The Transit Gateway GRE address is auto-generated

The BGP inside CIDR blocks can be any CIDR block with /29

The Peer GRE address is the FortiGate internal interface IP address

NO.55 What is the main advantage of using SD-WAN Transit Gateway Connect over traditional SD-WAN?

It eliminates the use of ECMP

You can use GRE-based tunnel attachments

You can combine it with IPsec to achieve higher bandwidth

You can use BGP over IPsec for maximum throughput

NO.56 Refer to the exhibit

You are deploying two FortiGate VMS in HA active-passive mode with load balancers in Microsoft Azure Which two statements are true in this load balancing scenario? (Choose two.)

The FortiGate public IP is the next-hop for all the traffic.

An internal load balancer listener is the next-hop for outgoing traffic.

You must add a route to the Microsoft VIP used for the health check.

A dedicated management interface can be used for load balancing.

NO.57 Which statement about immutable infrastructure in automation is true?

It is the practice of deploying a new server for every configuration change

It is the practice of modifying the existing server configuration after it is deployed

It is the practice of deploying two parallel servers for high availability.

It is the practice of applying hotfixes and OS patches after deployment

NO.58 Which two Amazon Web Services (AWS) features support east-west traffic inspection within the AWS cloud by the FortiGate VM? (Choose two.)

An Internet gateway with an EIP

A transit VPC

A NAT gateway with an EIP

A transit gateway with an attachment

NO.59 You are adding more spoke VPCs to an existing hub and spoke topology Your goal is to finish this task in the minimum amount of time without making errors.
Which Amazon AWS services must you subscribe to accomplish your goal?

GuardDuty, CloudWatch

WAF, DynamoDB

Inspector, S3

CloudWatch, S3

NO.60 Refer to the exhibit
An administrator deployed a FortiGate-VM in a high availability (HA)
(active/passive) architecture in Amazon Web Services (AWS) using Terraform for testing purposes. At the same time, the administrator deployed a single Linux server using AWS Marketplace Which two options are available for the administrator to delete all the resources created in this test? (Choose two.)

Use the terraform destroy command

Use the terraform validate command.

Use the terraform destroy all command.

The administrator must manually delete the Linux server.

Leave a Reply Cancel reply