[Aug 09, 2025] NSE7_PBC-7.2 certification guide Q&A from Training Expert VCEPrep [Q25-Q41]

Q25. Which two statements are true about Transit Gateway Connect peers in anlPv4 BGP configuration’? (Choose two.)

The inside CIDR blocks are used for BGP peering

You cannot use IPv6 addresses

You must specify a /29CIDR block from the 169.254.0.0/16 range

You must configure the second address from the IPv4 range on the device as the BGP IP address

Q26. Refer to the exhibit. You are tasked with deploying a webserver and FortiGate VMS in AWS. You are using Terraform to automate the process.

Which two important details should you know about the Terraform files? (Choose two.)

All the output values are available after a successful terraform apply command

The subnet_private 1 value is defined in the variables . tf file

After the deployment, Terraform output values are visible only through AWS CloudShell.

You must specify all the AWS credentials in the output. of file.

Q27. Which two Amazon Web Services (AWS) features support east-west traffic inspection within the AWS cloud by the FortiGate VM? (Choose two.)

A NAT gateway with an EIP

A transit gateway with an attachment

An Internet gateway with an EIP

A transit VPC

Q28. Refer to the exhibit. An administrator is trying to deploy a FortiGate VM in Microsoft Azure using Terraform. However, during the configuration, the Azure client secret is no longer visible in the Azure portal.

How would the administrator obtain the Azure client secret to configure on Terratorm?

The administrator must create a new Azure account

Log in to the Azure CLI with power user to obtain the client secret

The administrator can create a new client secret

The administrator must obtain the client secret through Azure Cloud Shell.

Q29. Refer to the exhibit

In your Amazon Web Services (AWS), you must allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet However, your HTTPS connection to the FortiGate VM in the Customer VPC is not successful.
Also, you must ensure that the Customer VPC FortiGate VM sends all the outbound Internet traffic through the Security VPC How do you correct this Issue with minimal configuration changes?
(Choose three.)

Add a route With your local internet public IP address as the
destination and target transit gateway

Add route destination 0 0.0 0/0 to target the transit gateway

Add a route With your local internet public IP address as the destination and target internet gateway

Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway

Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC,

B . Add route destination 0.0.0.0/0 to target the transit gateway. This will ensure that the Customer VPC FortiGate VM sends all the outbound internet traffic through the Security VPC, where it can be inspected by the Security VPC FortiGate VMs1. The transit gateway is a network device that connects multiple VPCs and on-premises networks in a hub-and-spoke model2. D. Deploy an internet gateway, associate an EIP in the private subnet, edit route tables, and add a new route destination 0.0.0.0/0 to the target internet gateway. This will allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the private subnet where the FortiGate VM is located3. An internet gateway is a service that enables communication between your VPC and the internet4. An EIP is a public IPv4 address that you can allocate to your AWS account and associate with your resources. E. Deploy an internet gateway, associate an EIP in the public subnet, and attach the internet gateway to the Customer VPC. This will also allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, by creating a public route for the public subnet where the FortiGate VM is located3. This is an alternative solution to option D, depending on which subnet you want to use for the FortiGate VM.
The other options are incorrect because:
Adding a route with your local internet public IP address as the destination and target transit gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will only apply to traffic coming from your specific IP address, not from any other source on the internet1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.
Adding a route with your local internet public IP address as the destination and target internet gateway will not allow inbound HTTPS access to the Customer VPC FortiGate VM from the internet, because it will bypass the Security VPC and send the traffic directly to the Customer VPC1. Moreover, it will not ensure that the outbound internet traffic goes through the Security VPC, because it will only apply to traffic going to your specific IP address, not to any other destination on the internet1.

Q30. Refer to the exhibit. What value or values must the administrator use in the SSH Key section to deploy a FortiGate VM using Terraform in Amazon Web Services (AWS)?

Use the Name and ID values of the key pair

Use the Name of the key pair

Use the ID value of the key pair.

Use the Fingerprint value of the key pair

Q31. You are tasked with deploying a FortiGate HA solution in Amazon Web Services (AWS) using Terraform What are two steps you must take to complete this deployment? (Choose two.)

Enable automation on the AWS portal.

Create an AWS Identity and Access Management (IAM) user With permissions.

Use CloudSheIl to install Terraform.

Create an AWS Active Directory user with permissions.

Q32. Refer to the exhibit

A customer has deployed an environment in Amazon Web Services (AWS) and is now trying to send outbound traffic from the Linux1 and Linux2 instances to the internet through the security VPC (virtual private cloud). The FortiGate policies are configured to allow all outbound traffic; however, the traffic is not reaching the FortiGate internal interface. Assume there are no issues with the Transit Gateway (TGW) configuration Which two settings must the customer add to correct the issue? (Choose two.)

Both landing subnets in the spoke VPCs must have a 0.0.0.0/0 traffic route to the Internet Gateway (IOW).

Both landing subnets in the spoke VPCs must have a 0.0 00/0 traffic route to the TGW

Both landing subnets in the security VPC must have a 0.0.0.0/0 traffic route to the FortiGate port2.

The four landing subnets in all the VPCs must have a 0.0 0 0/0 traffic route to the TGW

Q33. You are adding more spoke VPCs to an existing hub and spoke topology Your goal is to finish this task in the minimum amount of time without making errors.
Which Amazon AWS services must you subscribe to accomplish your goal?

GuardDuty, CloudWatch

WAF, DynamoDB

Inspector, S3

CloudWatch, S3

Q34. Refer to the exhibit

An administrator deployed an HA active-active load balance sandwich in Microsoft Azure. The setup requires configuration synchronization between devices- What are two outcomes from the configured settings? (Choose two.)

FortiGate-VM instances are scaled out automatically according to predefined workload levels.

FortiGate A and FortiGate B are two independent devices.

By default, FortiGate uses FGCP

It does not synchronize the FortiGate hostname

Q35. Your goal is to deploy resources in multiple places and regions in the public cloud using Terraform.
What is the most efficient way to deploy resources without changing much of the Terraform code?

Use multiple terraform.tfvars files With a variables.tf file.

Use the provider. tf file to add all the new values

Install and configure two Terraform staging servers to deploy resources.

Use the variable, tf file and edit its values to match multiple resources

Q36. You are asked to find a solution to replace the existing VPC peering topology to have a higher bandwidth connection from Amazon Web Services (AWS) to the on-premises data center Which two solutions will satisfy the requirement? (Choose two.)

Use ECMP and VPN to achieve higher bandwidth.

Use transit VPC to build multiple VPC connections to the on-premises data center

Use a transit VPC with hub and spoke topology to create multiple VPN connections to the on-premises data center.

Use the transit gateway attachment With VPN option to create multiple VPN connections to the on-premises data center

Q37. You are automating configuration changes on one of the FortiGate VMS using Linux Red Hat Ansible.
How does Linux Red Hat Ansible connect to FortiGate to make the configuration change?

It uses a FortiGate internal or external IP address with TCP port 21

It uses SSH as a connection method to FortiOS.

It uses an API.

It uses YAML

Q38. Refer to Exhibit. The exhibit shows the Connect Peers settings on Amazon Web Services (AWS) transit gateway attachments with two FortiGate VMS in a security VPC.

Which two statements are correct? (Choose two.)

The peer GRE address is the FortiGate external interface IP address.

The Transit Gateway GRE address is auto-generated

The BGP inside CIDR blocks can be any CIDR block with /29

The Peer GRE address is the FortiGate internal interface IP address

Q39. How does Terraform keep track of provisioned resources?

It uses the terraform. tf state file

Terraform does not keep the state of resources created

It uses the terraform. tfvars file.

It uses the database. tf file.

Q40. Which statement about Transit Gateway (TGW) in Amazon Web Services (AWS) is true?

TGW can have multiple TGW route tables.

Both the TGW attachment and propagation must be in the same TGW route table

A TGW attachment can be associated with multiple TGW route tables.

The TGW default route table cannot be disabled.

Q41. Refer to the exhibit.

What value or values must the administrator use in the SSH Key section to deploy a FortiGate VM using Terraform in Amazon Web Services (AWS)?