NSE7 Practice Test 45 — 15 Questions

Question 1

An administrator wants to enforce that only managed FortiClient endpoints with up-to-date antivirus and a specific OS version can access a sensitive internal network via IPsec VPN. Which feature should be used to achieve this?

Accepted Answer

FortiClient EMS compliance enforcement. FortiClient EMS can enforce compliance rules such as requiring up-to-date antivirus and specific OS version. When a FortiClient connects to the FortiGate VPN, the FortiGate can check the endpoint's posture via FortiClient EMS and apply a matching firewall policy.

Answer

ZTNA tags

Answer

FortiNAC

Answer

SAML SSO

Question 2

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

Accepted Answer

Check the routing table for routes to the remote subnet. Since both phases are up and policies are correct, the issue is likely routing. The administrator should verify that the correct routes are pointing to the VPN interface (tunnel interface) on both sides. Without proper routes, traffic will not be forwarded into the tunnel.

Answer

Increase the phase 2 keylife

Answer

Check the FortiGate's NTP status

Answer

Disable DPD

Question 3

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 4

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

Accepted Answer

FortiNAC Enforcement Engine. FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

Answer

FortiNAC Collector

Answer

FortiNAC Profiler

Answer

FortiNAC Portal

Question 5

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 6

A FortiGate administrator needs to ensure that only devices with an updated antivirus can access a sensitive internal application via ZTNA. The administrator has created a ZTNA tag 'AV_Updated' in EMS and configured a ZTNA rule on FortiGate that requires this tag. Which TWO additional steps are necessary to enforce this access control? (Choose two.)

Accepted Answer

Create a firewall policy that references the ZTNA rule. To enforce ZTNA tag-based access, the FortiGate must import the tag from EMS (A) and the ZTNA rule must be referenced in a firewall policy (D). Without the firewall policy, the rule is not applied to traffic.

Answer

Configure the application server to use HTTPS

Answer

Enable SSL VPN on the FortiGate for ZTNA traffic

Answer

Install a client certificate on each device for authentication

Question 7

A FortiGate is configured with ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing credit card numbers. Which ZTNA inline CASB feature should be used?

Accepted Answer

Data leak prevention (DLP) profile. ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 8

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

Accepted Answer

Signature (RSA). IKEv2 supports certificate-based authentication (RSA signature) for peer identity verification.

Answer

Aggressive mode

Answer

Pre-shared key

Answer

EAP

Question 9

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

Accepted Answer

The IdP's entity ID or SSO URL is incorrectly entered on FortiGate. As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Answer

The FortiGate's SP entity ID does not match the Azure AD application's identifier

Answer

The administrator's account is not synchronized with Azure AD

Answer

The certificate used for signing is not trusted by the IdP

Question 10

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

Accepted Answer

The remote FortiGate is behind a NAT device without proper NAT-T configuration. DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option C is correct because DPD relies on bidirectional IKE traffic; if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped.

Answer

The IPsec phase2 proposal is mismatched, causing rekey failures

Answer

The IKE SA lifetime is set too long, causing the tunnel to expire

Answer

The local FortiGate's DPD interval is set too low, causing false positives

Question 11

An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?

Accepted Answer

ZTNA proxy (reverse proxy) with FortiClient for posture. ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.

Answer

FortiNAC with agent on the server

Answer

IPsec VPN with full tunnel

Answer

SSL VPN with web mode

Question 12

An administrator configures a ZTNA proxy rule to allow access to an internal application. Users can connect to the FortiGate ZTNA gateway but receive a '403 Forbidden' error. Which step should the administrator take to resolve the issue?

Accepted Answer

Check that the ZTNA proxy rule's action is set to 'accept' and the correct tags are specified. A 403 error on ZTNA typically indicates that the user's device does not have the required ZTNA tags. The administrator must ensure the FortiClient has the correct tags assigned based on compliance.

Answer

Disable the 'require ZTNA tag' option on the proxy rule

Answer

Ensure the application is reachable from the FortiGate with a ping

Answer

Verify that the application's firewall policy has an SSL inspection profile applied

Question 13

A FortiGate administrator configures a ZTNA rule to allow access to an internal application. The rule uses a ZTNA tag to identify the application server. However, users cannot connect to the application. What is the most likely cause if the ZTNA proxy and firewall policies are correctly configured?

Accepted Answer

The ZTNA tag is not assigned to the application server in FortiClient EMS. ZTNA tags must be registered with FortiGate via FortiClient EMS. If the tags are not assigned to the server, the FortiGate cannot match the server to the ZTNA rule, and access will be denied.

Answer

The ZTNA proxy is configured with the wrong port

Answer

The user's device posture check fails

Answer

The application server does not have FortiClient installed

Question 14

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

Accepted Answer

ZTNA (Zero Trust Network Access) proxy. ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Answer

IPsec VPN with XAuth authentication

Answer

SSL VPN with web mode portal

Answer

FortiGate's explicit web proxy

Question 15

An administrator notices that after upgrading FortiOS, the ADVPN shortcut tunnels are no longer being established. The hub and spokes have the same ADVPN configuration as before. What is the most likely cause?

Accepted Answer

The spokes do not have routes to each other's networks via the hub. ADVPN shortcut tunnel initiation may require proper routing. If dynamic routing (e.g., BGP or OSPF) is not advertising the spoke networks to each other, spokes won't have routes to trigger shortcuts.

Answer

The IKE version changed to IKEv1

Answer

Dead Peer Detection (DPD) is disabled on the tunnel

Answer

The hub's ADVPN configuration was reset during upgrade