FCP_ZCS-AD-7.4 FCP - Azure Cloud Security 7.4 Administrator Questions and Answers

Azure does not allow the deployment of virtual machines (VMs) in a gateway subnet.The gateway subnet is specifically reserved forAzure VPN Gateway or ExpressRoute Gateway instances, and deploying other resources in it can causegateway deployment or operation failures.

In anactive-active FortiGate clusterdeployment in Azure, you must assign thepublic IP address to an Azure load balancer. This is required because Azure does not support multiple VMs sharing a single public IP directly. TheAzure Load Balancerhandles inbound traffic and distributes it to the active FortiGate instances.

For VMs in the10.0.1.0/26subnet to access the internetthrough the FortiGate VM, theirdefault gateway must be changedto the internal IP address of the FortiGate’s NIC in that subnet (e.g.,LAB1-FGT-A-Nic2). This ensures traffic is routedthrough FortiGate for inspection and NAT, rather than directly using Azure’s default system routes.

Azure Firewallis acloud-native, fully managednetwork security servicedesigned to control and log network traffic using Azure policies. In contrast, theFortiGate VMis anetwork virtual appliance (NVA)that deliverscomprehensive security features, including firewalling, IPS, antivirus, VPN, and application control, suitable forboth on-premises and cloud deployments.

Thetrace output shows only one hopto reach10.0.2.4, indicating that the destination isin the same Azure virtual network (VNet)as the Windows VM. Since the VM’s IP is10.0.1.4and the destination is10.0.2.4, they are indifferent subnets, but Azure allowsdirect routing between subnets within the same VNetwithout additional hops.