I85PREP
⌘ K
FCSS Public Cloud Security study materials
FCSS Public Cloud Security study resources

FCSS Public Cloud Security: Cloud Traffic Inspection, Automation, and Operations

FCSS Public Cloud Security · Work through your exam, one topic at a time.

All guide sections

Cloud Traffic Inspection, Automation, and Operations

Domain five tests operations: how traffic reaches a FortiGate for inspection, how to automate deployment and response, and how to observe the result. Expect inline and out-of-band designs, TLS inspection, logging pipelines, and API-driven workflows.

Core rules

  • Inline inspection uses a gateway load balancer or route-table steering; the appliance must see both directions of a flow. Out-of-band mirroring is for detection, not blocking.
  • AWS GWLB uses Geneve encapsulation and health checks; the FortiGate must be configured for GWLB and the endpoint routes must point to the GWLB endpoint. Azure Gateway Load Balancer plays a similar role with a provider chain.
  • TLS inspection requires a trusted certificate chain on endpoints and a FortiGate SSL inspection profile. Without trust, users get certificate warnings; with break-and-inspect, privacy and legal review are required.
  • Send logs to FortiAnalyzer or a SIEM; keep local logging minimal and retention policy explicit. Cloud flow logs and FortiGate logs answer different questions.
  • Automate with Terraform/CloudFormation for repeatable infrastructure, FortiManager JSON-RPC/REST API for policy, and event-driven functions for response. Store secrets in a cloud secret manager, not in user-data.

Worked example

A private subnet must reach the internet through inspection. Create a security VPC with a GWLB and FortiGate-VM appliances in multiple AZs. Add a route in the workload subnet's route table for 0.0.0.0/0 to the GWLB endpoint, and a route in the inspection subnet for 0.0.0.0/0 to the internet gateway/NAT gateway. The FortiGate policy allows the workload CIDR to any, applies antivirus/IPS/SSL profiles as required, and NATs on egress. The return path follows the GWLB endpoint because the flow is symmetric. Verify with a trace and FortiGate session table; if the workload route points directly to the NAT gateway, inspection is bypassed.

Traps

  • Routing only outbound traffic and losing the return path.
  • Forgetting GWLB health-check ports.
  • Deploying TLS inspection without distributing the CA certificate.
  • Assuming cloud flow logs contain payload or IPS verdicts.
  • Hard-coding API keys in Terraform or bootstrap scripts.
  • Scaling automation without idempotency and error handling.