FCP_ZCS_AD-7.4 Fortinet FCP - Azure Cloud Security 7.4 Administrator Free Practice Exam Questions (2025 Updated)

A user-defined route (UDR) in Azure is used to redirect traffic from other VMs through a FortiGate VM for inspection. By modifying the routing table, you ensure that outbound or inter-subnet traffic is sent to the FortiGate as the next hop, enabling traffic filtering, logging, and security enforcement.

Enhanced protection for application and data in a single Azure region – Availability Zones provide physical separation of infrastructure within a single Azure region, protecting against datacenter-level failures.

Protect applications and data through high availability with fault isolation and redundancy – They offer fault isolation and redundancy, enabling high availability for applications and services by distributing them across multiple zones within the same region.

Two virtual NICs – The FortiGate Azure Marketplace template deploys the VM with at least two network interfaces: one for the external/public interface and one for the internal/private interface.

One NSG for each interface – The deployment creates separate Network Security Groups (NSGs) attached to each NIC to control inbound and outbound traffic as per Fortinet’s best practices.

In an active-active FortiGate ELB/ILB deployment, the inbound NAT rules configured on the external load balancer are used to allow administrative access (e.g., HTTPS, SSH) to the individual FortiGate VMs. Since the public IP is associated with the load balancer, NAT rules are required to map specific ports to backend FortiGate instances for management access.

The debug output shows that the UbuntuServer address object successfully resolved an IP, while the webServer did not. The most likely cause is a mismatch in the dynamic address filter or missing tags on the target VM.

Verify the filter used for the dynamic firewall address – The filter category=windows may not match any VM metadata, resulting in no matched addresses.

Verify the tags on the target VM – Ensure that the VM has the correct tags (e.g., category=windows) that match the dynamic address filter to enable resolution.

The branch-to-branch topology in Azure Virtual WAN is characterized by direct connectivity between branches through the Virtual WAN backbone, which reduces dependency on centralized hubs. This results in a simplified network architecture, lowering latency and optimizing routing between branch locations.

The Software-defined network (SDN) connector allows FortiGate to dynamically pull metadata such as tags, IP addresses, and resource groups from Azure resources. This enables automatic policy updates based on dynamic IP changes, such as those of a Linux server in a protected subnet.

The Linux server in the spoke VNet cannot directly peer BGP with the Azure Route Server, as it is not a BGP-enabled device. Instead, Azure propagates routes to VMs through the effective route tables associated with their network interfaces (NICs). Therefore, to diagnose why BGP routes are not reaching the Linux VM, you should monitor the effective routes on the NIC to verify if the routes from the FortiGate (via the Route Server) are being injected properly.

Azure assigns MAC addresses in a specific Organizationally Unique Identifier (OUI) range. The MAC address d8-34-99-c5-0A-BC begins with d8-34-99, which is a Microsoft-assigned OUI used in Azure virtual networks. This strongly indicates the output was taken from a VM running in Azure.