NSE7 Practice Test 4 — 10 Questions

Question 1

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

set action block. ZTNA access rules can block or allow with optional warning. 'Allow with warning' is not available; to show a warning while blocking, the action should be 'Block' with a redirect to a warning portal.

Answer

set action redirect

Answer

set action authenticate

Answer

set action allow

Question 2

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

Accepted Answer

The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.. Even if the tunnel is up, OSPF packets (protocol 89) must be explicitly permitted by a firewall policy on the tunnel. Without that policy, OSPF Hellos are dropped and adjacency fails. Network type mismatch can also cause issues, but the most common is missing policy.

Answer

OSPF is not enabled on the tunnel interface.

Answer

The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.

Answer

The MTU on the tunnel interface is too large for OSPF packets.

Question 3

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. To use compliance tags, FortiGate must have EMS configured as a fabric connector and the ZTNA proxy rule must reference the tags.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP

Question 4

An administrator configures a ZTNA gateway with inline CASB to monitor SaaS applications. Users report that access to Salesforce is blocked. The administrator reviews the ZTNA proxy rule and sees that inline CASB is enabled with a 'monitor-only' action. What is the MOST likely reason for the block?

Accepted Answer

A separate application control profile is blocking Salesforce. Inline CASB with 'monitor-only' should not block traffic. The block may be due to a separate application control or web filtering profile applied on the policy.

Answer

The inline CASB profile is set to 'block' for Salesforce

Answer

The ZTNA proxy rule does not have SSL inspection enabled

Answer

FortiClient EMS is not assigning the required ZTNA tags

Question 5

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 6

An administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA state is 'UP' but the IPsec SA state is 'DOWN'. The remote peer is a FortiGate. What is the most likely cause of this issue?

Accepted Answer

The Phase2 parameters (encryption, authentication, proxy IDs) do not match between the peers. If IKE is up but IPsec is down, the Phase2 parameters are not matching between peers. Common causes include mismatched encryption algorithms, proxy IDs, or lifetimes.

Answer

The pre-shared key is incorrect

Answer

The tunnel interface is down

Answer

The firewall policy on the remote FortiGate is blocking UDP 500

Question 7

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Accepted Answer

ZTNA access proxy. The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 8

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

Accepted Answer

Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.. FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Answer

Configure the FortiGate as a SAML IdP for FortiClient EMS.

Answer

Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.

Answer

Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.

Question 9

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 10

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

Accepted Answer

The CA certificate is not configured for peer certificate validation. For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

Answer

The IKEv2 proposal includes an incompatible encryption algorithm

Answer

The local certificate is not associated with the phase1 interface

Answer

The remote peer's certificate is not signed by the imported CA