NSE 7 – Public Cloud Security 6.4 — Question 2

Customer XYZ has an ExpressRoute connection from Microsoft Azure to a data center. They want to secure communication over ExpressRoute, and to install an in-line FortiGate to perform intrusion prevention system (IPS) and antivirus scanning.
Which three methods can the customer use to ensure that all traffic from the data center is sent through FortiGate over ExpressRoute? (Choose three.)

Answer options

• A. Install FortiGate in Azure and build a VPN tunnel to the data center over ExpressRoute
• B. Configure a user-defined route table
• C. Enable the redirect option in ExpressRoute to send data center traffic to a user-defined route table
• D. Configure the gateway subnet as the subnet in the user-defined route table
• E. Define a default route where the next hop IP is the FortiGate WAN interface

Correct answer: A, D, E

Explanation

The correct answers, A, D, and E, involve ensuring that traffic is directed through the FortiGate for security measures. Option A allows for a secure tunnel for traffic, while options D and E configure routing correctly to ensure that the FortiGate processes all data. Options B and C, while relevant to routing, do not specifically guarantee that all traffic will be sent through the FortiGate device.