A is incorrect because the FortiGate public IP is not the next-hop for all the traffic. The FortiGate

public IP is only used for incoming traffic from the internet. The Azure load balancer distributes the

incoming traffic to the active FortiGate VM based on a health probe123. The FortiGate public IP is not

used for outgoing traffic or internal traffic.

B is correct because an internal load balancer listener is the next-hop for outgoing traffic. The

internal load balancer listener is configured with a floating IP address that is assigned to the active

FortiGate VM. The internal load balancer listener also has a health probe to monitor the status of the

FortiGate VMs123. The internal load balancer listener forwards the outgoing traffic to the internet

through the public load balancer.

C is incorrect because you do not need to add a route to the Microsoft VIP used for the health

check. The Microsoft VIP is an internal IP address that is used by the Azure load balancer to send

health probes to the FortiGate VMs123. The Microsoft VIP is not reachable from outside the Azure

network and does not require any routing configuration on the FortiGate VMs.

D is correct because a dedicated management interface can be used for load balancing. In this

deployment, port4 is used as a dedicated management interface that connects to the management

network3. The dedicated management interface can be used to access the FortiGate VMs for

configuration and monitoring purposes. The dedicated management interface can also be used to

synchronize the configuration and session information between the primary and secondary devices

in an HA cluster2.

B . The default network ACL is configured to allow all traffic. This means that when you create a VPC,

AWS automatically creates a default network ACL for that VPC, and associates it with all the subnets

in the VPC1. By default, the default network ACL allows all inbound and outbound IPv4 traffic and, if

applicable, IPv6 traffic1. You can modify the default network ACL, but you cannot delete it1. C.

Network ACLs are stateless, and inbound and outbound rules are used for traffic filtering. This means

that network ACLs do not keep track of the traffic that they allow or deny, and they evaluate each

packet separately1. Therefore, you need to create both inbound and outbound rules for each type of

traffic that you want to allow or deny1. For example, if you want to allow SSH traffic from a specific IP

address to your subnet, you need to create an inbound rule to allow TCP port 22 from that IP

address, and an outbound rule to allow TCP port 1024-65535 (the ephemeral ports) to that IP

address2.

The other options are incorrect because:

You can use network ACL and security group at the same time. Network ACL and security group are

two different types of security layers for your VPC that can work together to control traffic3. Network

ACL acts as a firewall for your subnets, while security group acts as a firewall for your instances3. You

can use both of them to create a more granular and effective security policy for your VPC.

Network ACLs are not tied to an instance. Network ACLs are associated with subnets, not

instances1. This means that network ACLs apply to all the instances in the subnets that they are

associated with1. You cannot associate a network ACL with a specific instance. However, you can

associate a security group with a specific instance or multiple instances3.

When adding the Amazon Web Services (AWS) account to the FortiCNP, you must follow these three

mandatory configuration steps:

Add AWS accounts through FortiCNP. This is the first step to enable cloud protection for your AWS

account. You can add one or multiple accounts automatically or manually. You need to provide the

AWS account ID and a name for the account. You also need to select the optional permissions to be

granted to FortiCNP as needed1.

Accept FortiCNP to create CloudTrail for the account. This is required for FortiCNP to collect and

analyze the AWS API calls and events. You can choose to let FortiCNP create a CloudTrail for the

account or use an existing one. You also need to specify the aggregation region for the CloudTrail1.

Launch the CloudFormation template. This is required for FortiCNP to create a stack and a role in

your AWS account. The stack contains the resources that FortiCNP needs to access and monitor your

AWS account. The role allows FortiCNP to assume it and perform actions on your behalf. You need to

enter a custom or default role name and a unique UUID that is designated for your company on

FortiCNP1.

Reference: Add AWS Account Automatically

https://docs.fortinet.com/document/forticnp/22.4.a/online-help/246021/add-aws-accountautomatically

To keep track of sensitive data files located in AWS S3 buckets and protect them from malware, the

administrator should use:

C . FortiCNP DLP policies.

Data Loss Prevention (DLP): DLP policies are designed to detect and prevent unauthorized access or

sharing of sensitive data. In the context of AWS S3, DLP policies can be used to scan for sensitive

information stored in S3 objects and enforce protective measures to prevent data exfiltration or

compromise.

FortiCNP Integration: FortiCNP is Fortinet’s cloud-native protection platform that offers security and

compliance solutions across cloud environments. By applying DLP policies within FortiCNP, the

administrator can ensure sensitive data within S3 is monitored and protected consistently.

Reference: Fortinet's FortiCNP documentation provides information on implementing DLP policies

within cloud environments, highlighting the capabilities for protecting sensitive data within cloud

storage services like AWS S3.

Thank you for your visit.

Immutable infrastructure is a DevOps approach that emphasizes the creation of disposable resources

instead of modifying existing ones1. This approach helps to achieve stability, consistency, and

predictability in IT operations by reducing the risk of configuration drift and eliminating stateful

components1.

One way to implement immutable infrastructure is to use a blue-green deployment strategy, which

runs two live environments for configuration changes2. The blue environment is the current

production environment, while the green environment is the new version of the application or

service. When the green environment is ready, the traffic is switched from blue to green, and the

blue environment is destroyed or kept as a backup2. This way, there is no need to update or patch

the existing infrastructure, but rather replace it with a new one.

Reference:

1: Immutable Infrastructure, Architecture, and its benefits

2: Introduction to Immutable Infrastructure – BMC Software | Blogs