Free FCP-PCS-7.4 sample questions

Correct answer: Enable appliance mode on the Transit Gateway attachment for the Security VPC.

When using a Transit Gateway with a centralized inspection VPC (Security VPC), asymmetric routing often occurs because the TGW might send return traffic to a different availability zone than the source. Enabling 'Appliance Mode' on the TGW attachment for the Security VPC ensures that return traffic is routed to the same availability zone where the inspection took place, maintaining flow symmetry required for stateful firewalls like FortiGate.

Correct answer: Network Contributor

The Network Contributor role provides the necessary permissions to manage network resources, including the ability to update route tables (UDRs) and IP configurations on network interfaces. This is required for the FortiGate SDN connector to rewrite route next-hops to the active unit during an HA failover.

Correct answer: It eliminates the need for the customer to manage the infrastructure, patching, and scaling of the firewall instances.

FortiGate CNF is a fully managed SaaS offering. The primary benefit is that Fortinet manages the underlying infrastructure, including the provisioning, scaling, and patching of the firewall instances (CNF instances), allowing the customer to focus solely on security policy management via FortiManager or the CNF console.

Correct answers: Verify that the IAM role attached to the FortiGate instance has the 'ec2:Describe*' permission.; Check if the FortiGate-VM has a valid route to the AWS API endpoint or NAT Gateway.

The SDN connector requires permissions to query the AWS API. Specifically, 'ec2:DescribeInstances', 'ec2:DescribeTags', and similar 'Describe' permissions are essential for the connector to fetch metadata about resources and populate dynamic address objects.

The SDN connector runs on the management plane of the FortiGate. It must be able to reach the public AWS API endpoints (e.g., ec2.us-east-1.amazonaws.com). If the management interface is in a private subnet without a NAT Gateway or VPC Endpoint, the connection will fail.

Correct answer: True

This is True. In Azure Active-Active HA with an external Load Balancer, the ALB distributes inbound traffic to both nodes. However, when the FortiGate forwards traffic to backend servers, the return traffic from the server must go back to the *same* FortiGate node that processed the initial packet. Applying Source NAT (SNAT) on the FortiGate ensures the server replies to the FortiGate's interface IP rather than the original client IP, guaranteeing the return path matches the forward path.

Correct answer: Azure (Service Principal or Managed Identity)

The standard 'Azure' type SDN connector (configured with a Service Principal or Managed Identity) allows the FortiGate to query the Azure API for resource tags and properties. This enables the creation of dynamic address objects that filter based on tags like 'Environment=Production' and automatically update as VMs are added or removed.

Correct answer: Implement separate TGW Route Tables: one for the Spoke VPCs (associated) and one for the Security VPC (associated), utilizing route propagation to direct spoke traffic to the Security VPC attachment.

To inspect East-West traffic via a TGW, you must segment the routing domains. A common pattern is to have a 'Spoke Route Table' where the default route (0.0.0.0/0) or specific inter-VPC CIDRs point to the Security VPC attachment. The Security VPC attachment is associated with a separate 'Security Route Table' that propagates routes from the spokes, allowing the FortiGate to send traffic back to the correct destination.

Correct answer: True Transparent Proxy

In True Transparent Proxy mode, FortiWeb is deployed inline (layer 2 bridge) and inspects traffic without modifying the source or destination IP addresses. This makes the WAF invisible to the client and server. Note: In many public cloud environments (Layer 3 only), True Transparent is difficult to implement without specific overlay networking; however, conceptually, this is the mode for 'transparent inspection'. In Cloud native contexts, Reverse Proxy is more common, but the question asks for the mode definition.

Correct answer: The FortiGate SDN Connector on the new primary unit

In an API-based HA architecture (often used when Load Balancers are not preferred for internal routing), the FortiGate SDN Connector on the unit becoming 'Primary' triggers an API call to Azure Resource Manager to update the Next Hop IP in the UDRs to its own interface IP.

Correct answer: Enable Appliance Mode on the Transit Gateway attachment for the Hub VPC.

The issue is likely asymmetric routing caused by the Transit Gateway crossing Availability Zones. When traffic leaves the Hub VPC (after inspection), TGW might send it to an AZ in the destination VPC different from the source. However, the return traffic might enter the TGW in a different AZ and be routed to the *passive* FortiGate or the wrong interface in the Hub VPC if Appliance Mode is not on. Enabling Appliance Mode forces the TGW to use the same AZ attachment for the return traffic flow, ensuring it hits the active FortiGate processing the session.