FCP_ZCS_AD-7.4 FCP - Azure Cloud Security 7.4 Administrator Questions and Answers

A Microsoft Entra tenant is the primary administrative unit that represents an organization within Microsoft’s identity platform. It defines the boundary for identity management, access control, and resource governance , and serves as the core entity that connects the organization to Microsoft ' s cloud services such as Azure and Microsoft 365.

Using FortiGate at both ends of a site-to-site IPsec VPN tunnel provides the advantage of applying consistent security policies, configurations, and management tools across both the on-premises and Azure environments. This simplifies policy enforcement, improves operational efficiency, and ensures uniform threat protection.

In an active-passive HA deployment of FortiGate VMs in Azure using the Marketplace template, configuration synchronization is handled via unicast FortiGate Clustering Protocol (FGCP) . FGCP allows the primary unit to replicate its configuration and session information to the secondary unit, ensuring seamless failover.

The FortiGate VM and the Windows Server VM are in different subnets but within the same Production virtual network , which means they can communicate by default unless restricted. Azure allows ICMP between subnets, but Windows VMs have ICMP blocked by default in their firewall settings. Therefore, the likely reason for the ping failure is that the Windows Server’s firewall is blocking ICMP (ping) traffic .

Azure Virtual WAN is designed for large-scale, automated, and global branch connectivity , supporting hub-and-spoke architectures across multiple regions. It enables centralized routing , hub-to-hub connectivity , and integrates with VPN, ExpressRoute, and SD-WAN solutions , making it ideal for complex, multi-region deployments as shown in the diagram.

Enabling the IP forwarding setting on FortiGate (or any NVA) in Azure allows the VM to route traffic that is not destined for itself , effectively enabling it to act as a router or firewall . This is essential for scenarios where FortiGate inspects or filters traffic between subnets or from on-premises to Azure.

Azure Route Server enables dynamic route exchange using BGP between your Azure virtual network and network virtual appliances (NVAs) or on-premises networks. It provides a centralized and scalable solution for route management , allowing seamless integration of routing updates without manual configuration changes.