FCP_ZCS-AD-7.4 FCP - Azure Cloud Security 7.4 Administrator Questions and Answers

The debug output shows that the UbuntuServer address object successfully resolved an IP, while the webServer did not. The most likely cause is a mismatch in the dynamic address filter or missing tags on the target VM.

Verify the filter used for the dynamic firewall address – The filter category=windows may not match any VM metadata, resulting in no matched addresses.

Verify the tags on the target VM – Ensure that the VM has the correct tags (e.g., category=windows) that match the dynamic address filter to enable resolution.

Azure does not allow the deployment of virtual machines (VMs) in a gateway subnet.The gateway subnet is specifically reserved forAzure VPN Gateway or ExpressRoute Gateway instances, and deploying other resources in it can causegateway deployment or operation failures.

Thebranch-to-branch topologyin Azure Virtual WAN is characterized bydirect connectivity between branchesthrough the Virtual WAN backbone, whichreduces dependency on centralized hubs. This results in asimplified network architecture, lowering latency and optimizing routing between branch locations.

TheLinux server in the spoke VNet cannot directly peer BGP with the Azure Route Server, as it is not a BGP-enabled device. Instead,Azure propagates routes to VMs through the effective route tablesassociated with theirnetwork interfaces (NICs). Therefore, to diagnose why BGP routes are notreaching the Linux VM, you shouldmonitor the effective routes on the NICto verify if the routes from the FortiGate (via the Route Server) are being injected properly.

Azure Firewall Premiumincludes advanced features not available in the Standard tier, such asenhanced URL filtering and web categories,TLS inspection,IDPS (intrusion detection and prevention system), and support forprivate certificate authorities. These enable more granular and secure traffic inspection and control.

Infrastructure-as-a-Service (IaaS)allows you to deploy FortiWeb as a virtual machine in Azure, giving yougranular control over vCPU and memory allocation. This model provides full flexibility over the compute resources and network configuration, which is essential for deploying and scaling security appliances like FortiWeb.

Enhanced protection for application and data in a single Azure region – Availability Zones provide physical separation of infrastructure within a single Azure region, protecting against datacenter-level failures.

Protect applications and data through high availability with fault isolation and redundancy – They offer fault isolation and redundancy, enabling high availability for applications and services by distributing them across multiple zones within the same region.