NSE7 Practice Test 27 — 15 Questions

Question 1

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The compliance rule is not assigned to a FortiClient configuration profile. In FortiClient EMS, compliance rules are enforced only when they are added to a configuration profile that is assigned to endpoints. The rule itself is just a definition; it must be included in a profile that is deployed to clients. Without being assigned to a profile, the rule is not applied, so unencrypted devices are not blocked. Option D correctly identifies this missing step.

Answer

The FortiClient telemetry is not sending compliance status

Answer

The compliance rule is not enabled on the FortiGate via ZTNA tag

Answer

The VPN policy on the FortiGate does not require compliance check

Question 2

A FortiGate administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which TWO components must be configured on FortiGate to enable ZTNA access?

Accepted Answer

A ZTNA proxy policy. ZTNA requires a proxy policy to define access rules and a ZTNA proxy/gateway to terminate user connections. Tags and EMS are configured separately.

Answer

A firewall policy to allow traffic from ZTNA proxy to internal servers

Answer

A ZTNA tag on the application server

Answer

FortiClient EMS registration on FortiGate

Question 3

An administrator configures ZTNA inline CASB to control access to a SaaS application. The goal is to block uploads of files with credit card numbers. The administrator configures a CASB profile with a DLP rule for credit card numbers. However, uploads are not being blocked. What is the most likely reason?

Accepted Answer

SSL inspection is not enabled for the traffic. Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

Answer

The CASB profile is not applied to the ZTNA policy

Answer

The DLP rule is configured to monitor instead of block

Answer

The SaaS application is not supported by CASB

Question 4

A FortiGate is configured with ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing credit card numbers. Which ZTNA inline CASB feature should be used?

Accepted Answer

Data leak prevention (DLP) profile. ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 5

A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?

Accepted Answer

External port: 443, Mapped port: 8080, Destination: 10.0.1.100. For ZTNA access proxy, the external port is the port clients connect to (typically 443 for HTTPS), and the mapped port is the internal server port (8080). The destination is the internal server IP. Therefore, option D is correct: external port 443, mapped port 8080, destination 10.0.1.100.

Answer

External port: 0, Mapped port: 8080, Destination: 10.0.1.100

Answer

External port: 8080, Mapped port: 443, Destination: 10.0.1.100

Answer

External port: 443, Mapped port: 443, Destination: 10.0.1.100

Question 6

A FortiGate is the SAML Service Provider (SP) for a ZTNA application. The IdP is Azure AD. After successful authentication, the user is redirected to the ZTNA proxy with a '403 Forbidden' error. The ZTNA rule has the correct groups allowed. What is the most likely missing configuration?

Accepted Answer

The SAML user group is not mapped to a FortiGate local group.. A 403 error after successful SAML authentication indicates the user was authenticated but not authorized. Since the ZTNA rule has the correct groups allowed, FortiGate cannot match the user to any allowed group. This requires mapping the SAML user group to a FortiGate local group via 'config user saml'. Option C is correct.

Answer

The IdP is not sending the user's group membership in the SAML assertion.

Answer

The ZTNA proxy certificate is not trusted by the browser.

Answer

The FortiGate's clock is not synchronized with the IdP.

Question 7

What is the purpose of Dead Peer Detection (DPD) in an IPsec VPN?

Accepted Answer

Detect loss of connectivity to the remote VPN peer. DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

Answer

Detect if the VPN tunnel is using the correct encryption algorithm

Answer

Detect duplicate IP addresses on the network

Answer

Detect packet loss over the VPN tunnel

Question 8

A FortiGate is configured as a ZTNA proxy for an internal application. Users authenticate via SAML with FortiGate as the IdP. The administrator wants to enforce that only devices with a valid ZTNA tag can access the application. Which TWO configurations are required?

Accepted Answer

Create a ZTNA rule with tag conditions.. To enforce that only devices with a valid ZTNA tag can access the application, two configurations are required: creating a ZTNA rule with tag conditions (D) and enabling ZTNA tags on the firewall policy that permits access (E). The ZTNA rule defines which tags are allowed, and the firewall policy must have ZTNA tags enabled to apply the rule. Option B (configuring EMS to push tags) is a prerequisite but not an enforcement configuration; options A and C are not required since SAML handles authentication and FortiClient is not mandatory on the proxy itself.

Answer

Install a client certificate on each device for authentication.

Answer

Configure FortiClient EMS to push compliance tags to FortiGate.

Answer

Set the ZTNA proxy to require FortiClient on the client device.

Question 9

A network administrator is configuring a hub-and-spoke ADVPN with BGP over the VPN tunnels. Which TWO conditions are necessary for the spokes to establish direct shortcut tunnels between each other?

Accepted Answer

BGP must be configured on all FortiGates (hub and spokes) to exchange routing information. Shortcut tunnels require that the hub propagates routes without setting itself as next-hop (next-hop-self disabled), and that spokes have overlapping routing information so they know the other spoke's subnet via BGP. Options B and D are correct: BGP must be configured on all spokes to exchange routes, and the hub must not set next-hop-self so that the next-hop remains the remote spoke's tunnel IP.

Answer

The spokes must have identical phase2 proposals

Answer

The spokes must use the same IKE version

Answer

The hub must have static routes for each spoke's LAN subnet

Question 10

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

Accepted Answer

NAC policies. NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Answer

DHCP fingerprinting

Answer

RADIUS accounting

Answer

SNMP traps

Question 11

In a hub-and-spoke ADVPN deployment, the spoke FortiGates are configured with IKEv2 and the hub has ADVPN enabled. After initial setup, spokes communicate through the hub. The administrator wants to enable shortcut tunnels so that spokes can directly communicate. What additional configuration is required on the spokes?

Accepted Answer

Enable 'set auto-discovery-sender' on the spoke's phase 1 interface. In ADVPN, shortcut tunnels allow spokes to communicate directly without traversing the hub. For spokes to initiate shortcut setup, they must have 'set auto-discovery-sender' enabled on the phase 1 interface to the hub. This setting allows the spoke to send route information to other spokes via the hub, enabling the hub to assist in shortcut negotiation.

Answer

Enable 'set add-route' on the hub's phase 1 configuration

Answer

Set 'set dpd retrycount' to a higher value on the spoke

Answer

Configure a static route on the spoke pointing to the hub

Question 12

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

Accepted Answer

The SAML user group is not configured with the correct IdP attribute mapping. After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Answer

The FortiGate is configured as an IdP instead of SP

Answer

SAML single logout is enabled and causing session termination

Answer

The IdP certificate is not trusted by the FortiGate

Question 13

A FortiGate administrator is using FortiNAC to enforce network access control for wired endpoints. The administrator wants to quarantine any endpoint that fails antivirus compliance. Which action should be configured in the FortiNAC policy to achieve this?

Accepted Answer

Assign the endpoint to a quarantine VLAN. FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

Answer

Disable the switch port

Answer

Send a SNMP trap to the admin

Answer

Block the MAC address at the switch port

Question 14

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

Accepted Answer

To detect when the remote peer is no longer reachable. DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Answer

To dynamically adjust the tunnel MTU

Answer

To encrypt the IKE negotiation traffic

Answer

To automatically renegotiate the IKE SA before it expires

Question 15

A FortiGate is configured as the SAML Identity Provider (IdP) for a cloud application. The administrator wants to enforce device compliance as part of authentication. Which THREE steps must be taken?

Accepted Answer

Enable 'require-device-compliance' in the SAML IdP settings. To enforce device compliance during SAML authentication, the FortiGate IdP must have device compliance enabled, integrate with FortiClient EMS to receive posture data, and use ZTNA tags to define compliance requirements.

Answer

Create a firewall policy allowing SAML traffic

Answer

Set up a VPN tunnel to the cloud application