NSE7 Practice Test 47 — 15 Questions

Question 1

An administrator configures a ZTNA gateway with inline CASB to monitor SaaS applications. Users report that access to Salesforce is blocked. The administrator reviews the ZTNA proxy rule and sees that inline CASB is enabled with a 'monitor-only' action. What is the MOST likely reason for the block?

Accepted Answer

A separate application control profile is blocking Salesforce. Inline CASB with 'monitor-only' should not block traffic. The block may be due to a separate application control or web filtering profile applied on the policy.

Answer

The inline CASB profile is set to 'block' for Salesforce

Answer

The ZTNA proxy rule does not have SSL inspection enabled

Answer

FortiClient EMS is not assigning the required ZTNA tags

Question 2

An administrator wants to implement ZTNA with FortiClient EMS to control access to an internal web application. Which TWO components are essential for the ZTNA proxy to function correctly?

Accepted Answer

A firewall policy allowing traffic from the ZTNA gateway to the application server. A ZTNA proxy requires a configured application mapping (defining the internal server) and a firewall policy that permits traffic from the ZTNA gateway to the internal server.

Answer

A static route on FortiGate pointing to the application server's network

Answer

SSL certificate installed on the application server

Answer

A public DNS record for the ZTNA gateway's FQDN

Question 3

A FortiGate administrator is configuring a multi-peer IPsec VPN (dial-up) for remote users. The administrator wants to assign different IP pools to different groups of users based on their authentication group. Which configuration is required?

Accepted Answer

Configure a separate phase1 interface for each user group with a different IP pool. FortiGate can assign IP pools based on user groups when using IKE with XAuth or IKEv2. The 'set ipv4-dns-server' and 'set ipv4-exclude-range' are not group-based. The 'set user-group' in phase1 associates a group with the tunnel, but IP pool per group requires separate phase1 configurations or using 'set ipv4-start-ip' with group mapping.

Answer

Use the 'set ipv4-start-ip' parameter in the phase1 interface

Answer

Configure a single phase1 interface with multiple IP pools and use group matching in the firewall policy

Answer

Use RADIUS to assign IP addresses per user

Question 4

A FortiGate is configured as a ZTNA proxy for an internal application. Users authenticate via SAML with FortiGate as the IdP. The administrator wants to enforce that only devices with a valid ZTNA tag can access the application. Which TWO configurations are required?

Answer

Install a client certificate on each device for authentication.

Answer

Configure FortiClient EMS to push compliance tags to FortiGate.

Answer

Set the ZTNA proxy to require FortiClient on the client device.

Answer

Create a ZTNA rule with tag conditions.

Answer

Enable ZTNA tags on the firewall policy that permits access to the application.

Question 5

A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?

Accepted Answer

set pfs enable; set dhgrp 14. To enable PFS with DH group 14 on the phase 2 proposal, the correct CLI command is 'set pfs enable' and 'set dhgrp 14'. The command 'set proposal aes256-sha256' defines encryption/integrity, not PFS. The other options do not set PFS correctly.

Answer

set auto-negotiate enable; set dh-group 14

Answer

set proposal aes256-sha256 dh-group 14

Answer

set pfs enable; set dh-group 14

Question 6

A ZTNA rule is configured to allow access to an internal application only if the client device has the ZTNA tag 'Compliant' and the user is authenticated via SAML. The FortiGate is acting as ZTNA proxy. A user successfully authenticates but the device is not tagged. What happens when the user tries to access the application?

Accepted Answer

The user is denied access. ZTNA rules can require both authentication and device posture (ZTNA tags). If the device tag is missing or does not match, the access will be denied. The user may see an access denied page or a generic error.

Answer

The FortiGate dynamically assigns the 'Compliant' tag to the device

Answer

The user is redirected to a device registration portal

Answer

The user is granted access because authentication succeeded

Question 7

An administrator is troubleshooting an IPsec VPN tunnel that uses PKI certificates for authentication. The tunnel fails to establish. The administrator checks the certificates and finds that the local certificate is valid and the CA certificate is trusted. Which two additional checks should the administrator perform? (Choose TWO)

Accepted Answer

Verify that the certificate's CN matches the peer's IP address. Common certificate issues include: the certificate's Common Name (CN) does not match the peer's IP address, or the certificate has expired. Also, the certificate must have the 'IPsec tunnel' extended key usage (EKU) and the subject alternate name (SAN) must include the peer's IP.

Answer

Verify that the certificate is installed in the local certificate store on the FortiGate

Answer

Ensure that the certificate is using RSA 2048-bit keys

Answer

Confirm that the certificate's private key is exportable

Question 8

An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?

Accepted Answer

The user's device does not have the required ZTNA tags from EMS. A 403 Forbidden error in ZTNA typically indicates that the access control rule denied the request. This can happen if the device does not meet the required posture checks (ZTNA tags). Option B is correct because the ZTNA rule likely requires a specific tag that the device does not have, resulting in denial.

Answer

The FortiGate firewall policy allowing ZTNA traffic is missing

Answer

The application server does not have a valid certificate

Answer

The ZTNA proxy is configured with the wrong port for the application

Question 9

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

Accepted Answer

Provide network access control by enforcing policies based on device identity and posture. FortiNAC is the Network Access Control solution from Fortinet. It provides visibility, control, and automated response for endpoints on the network, including device profiling, guest management, and policy enforcement. Option A is correct.

Answer

Perform deep packet inspection on all traffic

Answer

Act as a VPN concentrator for remote access

Answer

Provide a cloud-based sandbox for malware analysis

Question 10

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees 'no matching policy for this IPsec SA'. What is the most likely cause?

Accepted Answer

There is no firewall policy allowing traffic from the local network to the remote network via the VPN tunnel interface. The error indicates that the IKE SA exists but no firewall policy matches the traffic to use the tunnel. The tunnel interface is likely configured but the policy to allow traffic through the tunnel is missing or incorrect.

Answer

The phase2 selectors do not match between peers

Answer

The pre-shared key is mismatched

Answer

The tunnel interface is administratively down

Question 11

A FortiGate administrator wants to use PKI certificates for IPsec VPN authentication instead of pre-shared keys. Which phase1 parameter must be set to 'signature' to enable certificate-based authentication?

Accepted Answer

set authmethod signature. The IKE peer authentication method is controlled by the 'authmethod' parameter. Setting it to 'signature' enables RSA signature-based authentication using certificates.

Answer

set cert-validation enable

Answer

set ike-version 2

Answer

set peer-id certificate

Question 12

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

Accepted Answer

The OSPF router ID must be unique across all spokes. OSPF requires stable network types and correct interface configuration. For ADVPN, OSPF should use point-to-point network type to avoid DR elections and ensure proper neighbor relationships.

Answer

The OSPF hello interval must be less than the DPD retry interval

Answer

The hub must have all spoke routes in its routing table before OSPF starts

Question 13

A FortiGate administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list

proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is in SYN_SENT state; the three-way handshake is incomplete. proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

Answer

The session has been terminated due to inactivity

Answer

The session is a UDP session

Answer

The session is fully established and has been active for 3600 seconds

Question 14

An administrator wants to use FortiGate as a SAML identity provider (IdP) for a third-party service. Which configuration is required on FortiGate?

Accepted Answer

Configure a SAML identity provider user and export FortiGate's metadata. FortiGate can act as an IdP by creating a SAML IdP user and configuring the service provider metadata.

Answer

Enable SAML authentication in the firewall policy

Answer

Configure FortiAuthenticator as an external IdP

Answer

Configure a SAML service provider user and import the SP metadata

Question 15

A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?

Accepted Answer

The SAML assertion lifetime is configured too short. SAML assertions have a validity period. If the IdP (FortiGate) sets a short assertion lifetime or the SP's session timeout is shorter, users will be prompted to re-authenticate. The most common cause is the assertion lifetime being too short.

Answer

The FortiGate's SAML service provider certificate has expired

Answer

The FortiGate's clock is not synchronized with NTP

Answer

The SP is using HTTP-POST binding instead of redirect