NSE7 Practice Test 43 — 15 Questions

Question 1

A company uses FortiClient EMS for endpoint compliance and ZTNA tag assignment. An administrator wants to enforce that only endpoints with a ZTNA tag 'Compliant' can access a specific internal application through ZTNA. Which configuration is required on the FortiGate?

Accepted Answer

Create a ZTNA access proxy and a ZTNA policy that references the 'Compliant' tag. ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

Answer

Add a firewall policy with source set to the tag object

Answer

Configure an SSL VPN portal and assign the tag as a group

Answer

Configure a security policy with FortiClient endpoint control

Question 2

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

Accepted Answer

A user group with SAML authentication method and an SSL VPN portal referencing that group.. For SAML SSO on SSL VPN, you must configure a user group with SAML authentication, then assign an SSL VPN portal that uses that group. The FortiGate acts as SP. RADIUS/LDAP are not required.

Answer

A RADIUS server pointing to the IdP and an authentication rule.

Answer

An LDAP server with the IdP's certificate and a matching policy.

Answer

A local user with SAML attributes and a firewall policy referencing that user.

Question 3

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

Accepted Answer

Set the 'proposal' list with AES256-GCM and SHA256 as the first entry. In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Answer

Enable 'set proposal-mode strict'

Answer

Use IKEv2 rekey to change the proposal after initial handshake

Answer

Configure a phase2 selectors with the exact traffic of interest

Question 4

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

Accepted Answer

The remote peer has rebooted or restarted its VPN service. INITIAL_CONTACT is a notify message sent by an IKE peer to indicate that it has rebooted or lost its state. When the remote peer sends this, it means the peer has restarted, causing the tunnel to re-establish. This is normal behavior after a reboot but if frequent, indicates instability at the remote end.

Answer

The remote peer is rekeying the VPN tunnel

Answer

The local FortiGate has a mismatched pre-shared key

Answer

A dead peer detection timeout occurred

Question 5

A network administrator is troubleshooting an ADVPN deployment. Spoke FortiGates can communicate with the hub, but shortcut tunnels between spokes are not being established. The administrator verifies that IKE and IPsec settings are correct on all devices. What is the MOST likely cause?

Accepted Answer

The hub's phase2 configuration has 'auto-negotiate' disabled. In ADVPN, shortcut tunnels require IKEv2 with the 'add-route' option and auto-negotiate. If the hub's phase2 configuration does not have 'auto-negotiate' enabled, it will not initiate shortcut tunnels.

Answer

Dead Peer Detection (DPD) is disabled on the hub

Answer

The hub's phase1 configuration has 'auto-negotiate' disabled

Answer

The spokes have different IKE versions configured

Question 6

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

Accepted Answer

ADVPN with IKEv2. ADVPN (Auto Discovery VPN) enables shortcut tunnels between spokes after initial hub communication, allowing direct traffic.

Answer

Static routes on spokes

Answer

IKEv1 with mode-config

Answer

GRE over IPsec

Question 7

A FortiGate administrator configures a ZTNA rule with inline CASB to control access to a SaaS application. Users can access the application but the CASB controls are not being applied. What is the most likely reason?

Accepted Answer

The firewall policy is configured for flow-based inspection. Inline CASB requires a proxy-based firewall policy that intercepts traffic to the SaaS application. If the policy is using flow-based inspection, CASB will not be invoked. Inline CASB works only with proxy-based inspection.

Answer

SSL inspection is not enabled

Answer

The CASB profile is not applied to the ZTNA rule

Answer

The SaaS application is not supported by FortiGate CASB

Question 8

An administrator has configured FortiGate as a SAML service provider (SP) for VPN authentication. Users are prompted for credentials but authentication fails even though they can authenticate directly at the IdP portal. What is the most likely misconfiguration?

Accepted Answer

The FortiGate's entity ID or ACS URL registered at the IdP is incorrect. If users can authenticate at the IdP but not via FortiGate SP, the problem is likely that the FortiGate entity ID or ACS URL does not match what is registered at the IdP.

Answer

The IdP is using HTTP-POST binding while FortiGate expects HTTP-Redirect

Answer

The IdP certificate is not imported on FortiGate

Answer

SAML authentication is not enabled in the VPN portal

Question 9

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

Accepted Answer

Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.. FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Answer

Configure the FortiGate as a SAML IdP for FortiClient EMS.

Answer

Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.

Answer

Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.

Question 10

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

Accepted Answer

The FortiGate's EMS connector is not syncing tag information in real-time. Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Answer

The user's IP address has changed and the tag is mapped to a different IP

Answer

The ZTNA rule is configured with the wrong application port

Answer

The device posture compliance check requires additional criteria not met

Question 11

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Accepted Answer

Configure BGP to redistribute connected or static routes to the spokes. For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

Answer

Enable 'set auto-discovery-receiver' on the hub's phase1 interface

Answer

Disable DPD on the hub's phase1 interface

Answer

Set the IKE version to IKEv1 on the hub

Question 12

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1. Aggressive mode is required for IKE behind NAT when using ADVPN shortcut tunnels. Without it, the hub cannot learn the public IP/port of each spoke to facilitate the shortcut.

Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 13

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

Accepted Answer

The CA certificate that signed the peer's certificate is not imported on the FortiGate. The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

Answer

The peer's certificate has expired

Answer

The certificate revocation list (CRL) is not configured

Answer

The local certificate does not match the peer's expected CN

Question 14

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN configuration?

Accepted Answer

To detect if a VPN peer is alive by sending periodic probes and bringing down the tunnel if no response is received.. DPD sends keepalive messages to detect peer reachability. If the peer does not respond, the tunnel is marked down, allowing failover. Key renegotiation is handled by IKE lifetime settings, not DPD.

Answer

To establish a backup tunnel in case the primary tunnel fails.

Answer

To automatically renegotiate IKE phase1 keys before they expire.

Answer

To verify the integrity of encrypted packets using HMAC authentication.

Question 15

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

Accepted Answer

The compliance rule is not assigned to a FortiClient configuration profile. For compliance enforcement, the compliance rule must be applied to a configuration profile that is assigned to the users. Option B is correct because without assigning the compliance rule via a profile, the rule is not enforced on endpoints.

Answer

The FortiClient telemetry is not sending compliance status

Answer

The compliance rule is not enabled on the FortiGate via ZTNA tag

Answer

The VPN policy on the FortiGate does not require compliance check