NSE7 Practice Test 48 — 15 Questions

Question 1

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

Accepted Answer

The CA certificate is not configured for peer certificate validation. For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

Answer

The IKEv2 proposal includes an incompatible encryption algorithm

Answer

The local certificate is not associated with the phase1 interface

Answer

The remote peer's certificate is not signed by the imported CA

Question 2

An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)

Accepted Answer

The spoke tunnel interfaces must be in the same IP subnet. For ADVPN shortcuts, auto-discovery must be enabled on phase1 (B), the hub must have routes to spoke subnets (D), and the spoke must have a tunnel interface with an IP in the same subnet as other spokes (E). The shortcuthub is not required if the hub is the central point.

Answer

The spokes must have static public IP addresses

Answer

The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub

Question 3

A company wants to ensure that only company-managed laptops with up-to-date antivirus can access the internal file server remotely. Which Fortinet solution integrates with FortiGate to enforce device compliance before granting ZTNA access?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) manages FortiClient endpoints and can enforce compliance policies. It integrates with FortiGate to provide device posture information via ZTNA tags, enabling access control based on compliance.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiWeb

Question 4

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Accepted Answer

FortiClient on the endpoint device. To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

Answer

FortiNAC for network admission control

Answer

IPsec VPN to encrypt traffic between client and FortiGate

Question 5

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

Accepted Answer

Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application. FortiClient uses a ZTNA access proxy to forward traffic. The administrator must configure a ZTNA server on FortiGate and an access proxy rule that maps the external hostname/port to the internal application. The FortiClient connects to the ZTNA gateway's proxy IP/port. Option D is correct: the FortiGate must be configured as a ZTNA gateway and have a ZTNA proxy rule for the application.

Answer

Install a CA-signed certificate on FortiClient

Answer

Create a firewall policy from the WAN interface to the application server

Answer

Configure the application server to accept connections from FortiClient's IP range

Question 6

A network administrator is configuring a hub-and-spoke ADVPN with BGP over the VPN tunnels. Which TWO conditions are necessary for the spokes to establish direct shortcut tunnels between each other?

Accepted Answer

BGP must be configured on all FortiGates (hub and spokes) to exchange routing information. Shortcut tunnels require that the hub propagates routes without setting itself as next-hop (next-hop-self disabled), and that spokes have overlapping routing information so they know the other spoke's subnet via BGP. Option A and D are correct: BGP must be configured on all spokes to exchange routes, and the hub must not set next-hop-self so that the next-hop remains the remote spoke's tunnel IP.

Answer

The spokes must have identical phase2 proposals

Answer

The spokes must use the same IKE version

Answer

The hub must have static routes for each spoke's LAN subnet

Question 7

A FortiGate is configured with FortiClient EMS to enforce ZTNA posture checks. The administrator finds that some Windows 10 clients are not reporting their antivirus status correctly, causing them to be blocked. However, the clients have antivirus installed and running. What is the most likely cause?

Accepted Answer

The FortiClient EMS connector is disabled on the endpoints. FortiClient requires the EMS connector to be enabled and the correct compliance profile must be applied. If the antivirus status is not reported, the connector might be disabled or the profile not assigned.

Answer

The clients are not connected to the corporate network

Answer

The antivirus definitions are outdated

Answer

FortiGate is using the wrong EMS tag

Question 8

A FortiGate is configured as a SAML Identity Provider (IdP) for a remote user accessing a web application via ZTNA. The user authenticates successfully, but the ZTNA proxy logs show 'access denied' for the user. Which configuration element is most likely missing or misconfigured?

Answer

The ZTNA access proxy application is not enabled for HTTPS.

Answer

The SAML user group is not added to the ZTNA rule's allowed groups.

Answer

A firewall policy with ZTNA tags as source is missing.

Answer

ZTNA tags are not assigned to the user in FortiClient EMS.

Question 9

A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?

Answer

Set the authentication method to 'signature'.

Answer

Set the proposal to include DH groups 14 or higher.

Answer

Configure 'local-gw' with the certificate's CN.

Answer

Enable 'peer-id-option' and set it to 'any'.

Question 10

An organization uses FortiNAC for network access control. They want to enforce that only corporate-managed devices with up-to-date patches can access the production VLAN. Which THREE components must be integrated or configured?

Accepted Answer

FortiClient EMS with compliance rules. For NAC enforcement, FortiNAC typically uses SNMP to query switch port status and RADIUS to authenticate devices. FortiClient EMS provides endpoint compliance data that FortiNAC can use to determine access rights.

Answer

ZTNA proxy on FortiGate

Answer

IPsec VPN between FortiNAC and FortiGate

Question 11

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

Accepted Answer

The SAML user group is not configured with the correct IdP attribute mapping. After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Answer

The FortiGate is configured as an IdP instead of SP

Answer

SAML single logout is enabled and causing session termination

Answer

The IdP certificate is not trusted by the FortiGate

Question 12

In a hub-and-spoke ADVPN deployment, the spoke FortiGates are configured with IKEv2 and the hub has ADVPN enabled. After initial setup, spokes communicate through the hub. The administrator wants to enable shortcut tunnels so that spokes can directly communicate. What additional configuration is required on the spokes?

Accepted Answer

Enable 'set auto-discovery-sender' on the spoke's phase 1 interface. ADVPN shortcut negotiation requires that the spokes have 'set add-route enable' to install the learned shortcut route, and also the phase 2 configuration should accept shortcut tunnels.

Answer

Enable 'set add-route' on the hub's phase 1 configuration

Answer

Set 'set dpd retrycount' to a higher value on the spoke

Answer

Configure a static route on the spoke pointing to the hub

Question 13

A FortiGate administrator configures SAML SSO with FortiGate as the Identity Provider (IdP). Users are redirected to the FortiGate login page, but after successful authentication, they are not redirected back to the service provider. What is a likely cause?

Accepted Answer

The assertion consumer service URL is misconfigured on the FortiGate. When FortiGate is the IdP, it must have the correct Assertion Consumer Service (ACS) URL to which the SAML response is sent after authentication. A mismatch prevents the redirect back to the SP.

Answer

SAML authentication timeout is too short

Answer

The ACS URL on the service provider does not match the FortiGate's SAML settings

Answer

The SP certificate is not imported on the FortiGate

Question 14

An administrator configures BGP over an IPsec VPN between two FortiGates. The BGP session is established, but routes from the remote site are not being installed in the local routing table. The admin verifies that the BGP neighbor configuration is correct and the remote site is advertising routes. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking BGP traffic on the VPN interface. BGP routes must be allowed by a firewall policy on the loopback or interface used for BGP. Even if the VPN tunnel is up, BGP traffic (TCP port 179) may be blocked by the local-in policy or by the VPN interface's firewall policy if not explicitly allowed.

Answer

The BGP timers are too aggressive causing route flapping

Answer

The BGP network statement is missing on the local FortiGate

Answer

The next-hop IP address is not reachable

Question 15

You run 'diagnose vpn ike gateway list' on a FortiGate hub and see the following output for a spoke connection: IKE SA state: ESTABLISHED, IPsec SA state: UP, but the spoke cannot route traffic to other spokes. The ADVPN shortcut tunnel is not being established. What is the MOST likely cause?

Accepted Answer

The hub has a static route for the spoke subnet pointing to the tunnel interface. In ADVPN, the hub must not include static routes for the spoke subnets, otherwise the spokes will use the hub as next-hop and not attempt shortcut establishment. The hub should use dynamic routing (BGP/OSPF) to propagate routes but not install a route with a next-hop of the hub itself for other spoke subnets. Option B is correct.

Answer

DPD is not configured on the hub

Answer

The spoke's phase2 proposal does not match the hub's proposal

Answer

The spoke is using a different IKE version than the hub