FCP_ZCS_AD-7.4 FCP - Azure Cloud Security 7.4 Administrator Questions and Answers

Azure assigns MAC addresses in a specific Organizationally Unique Identifier (OUI) range. The MAC address d8-34-99-c5-0A-BC begins with d8-34-99, which is a Microsoft-assigned OUI used in Azure virtual networks. This strongly indicates the output was taken from a VM running in Azure.

Azure does not allow the deployment of virtual machines (VMs) in a gateway subnet. The gateway subnet is specifically reserved for Azure VPN Gateway or ExpressRoute Gateway instances, and deploying other resources in it can cause gateway deployment or operation failures.

In an active-active FortiGate cluster deployment in Azure, you must assign the public IP address to an Azure load balancer. This is required because Azure does not support multiple VMs sharing a single public IP directly. The Azure Load Balancer handles inbound traffic and distributes it to the active FortiGate instances.

Azure Firewall is a cloud-native, fully managed network security service designed to control and log network traffic using Azure policies. In contrast, the FortiGate VM is a network virtual appliance (NVA) that delivers comprehensive security features, including firewalling, IPS, antivirus, VPN, and application control, suitable for both on-premises and cloud deployments.

Infrastructure-as-a-Service (IaaS) allows you to deploy FortiWeb as a virtual machine in Azure, giving you granular control over vCPU and memory allocation. This model provides full flexibility over the compute resources and network configuration, which is essential for deploying and scaling security appliances like FortiWeb.

Since port 80 traffic is reaching the FortiGate (as shown in the sniffer output) but port 22 traffic is not, the issue lies before the FortiGate, at the Azure Load Balancer level. Azure Load Balancers require an Inbound NAT rule to forward specific ports (like SSH on port 22) to a specific backend VM. Creating a new Inbound NAT rule for port 22 will allow SSH traffic to be properly routed to the FortiGate VM.

A limitation of NSGs is that they are applied only at the subnet level or to network interfaces (vNICs), not directly to other resources like load balancers or application gateways. This means granular application-layer filtering is not supported, and NSGs primarily operate at Layers 3 and 4.