NSE7 Advanced VPN and Zero Trust — 15 Questions

Question 1

An organization is designing a Zero Trust Network Access solution with Fortinet. They want to ensure that only devices with up-to-date antivirus software can access sensitive applications. Which component is responsible for enforcing this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiClient EMS. FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiGate ZTNA gateway

Question 2

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

Accepted Answer

The ZTNA proxy idle timeout is set to a lower value than the global timeout.. The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

Answer

The internal application is not responding to the proxy request.

Answer

The internal application has a 5-second timeout.

Answer

The client's FortiClient is not receiving the ZTNA tags.

Question 3

A company wants to deploy ZTNA to secure access to internal applications for remote employees. They have a FortiGate with a public IP and internal servers. Which deployment mode should they choose to minimize changes to existing firewall rules?

Accepted Answer

Proxy-based ZTNA. Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

Answer

SSL VPN with ZTNA

Answer

IPsec VPN with ZTNA

Answer

Both proxy-based and IPsec VPN

Question 4

Which THREE of the following are valid methods to deliver ZTNA tags to FortiClient? (Select three.)

Accepted Answer

FortiClient configuration profiles. Option A (FortiClient configuration profiles) is correct because ZTNA tags can be provisioned through XML configuration profiles pushed to FortiClient, which include the tag definitions and their associated rules. Option D (FortiClient EMS) is correct because FortiClient EMS is the primary management platform that assigns and delivers ZTNA tags to endpoints via the FortiClient fabric connection. Option E (FortiGate ZTNA tag delivery) is correct because a FortiGate can dynamically deliver ZTNA tags to FortiClient through the Security Fabric, using the FortiClient fabric connector and tag synchronization. Option B (SNMP) is not a delivery method for ZTNA tags; SNMP is used for monitoring and management data, not for pushing endpoint tags. Option C (DHCP options) is not valid because DHCP options carry network configuration parameters such as gateway, DNS, or vendor-specific strings, but they are not used to deliver ZTNA tags to FortiClient.

Answer

SNMP

Answer

DHCP options

Question 5

Which TWO of the following can be used to authenticate users in a ZTNA connection? (Select two.)

Accepted Answer

SAML authentication. SAML authentication (D) is correct because ZTNA uses SAML 2.0 to authenticate users against an identity provider (IdP), enabling single sign-on and passing user identity/attributes to the ZTNA policy engine. Certificate authentication (E) is correct because ZTNA can authenticate users via client certificates (X.509), validating the user's identity through the certificate presented during the TLS handshake. LDAP authentication (A) is not a ZTNA user authentication method in this context; LDAP is typically used for directory lookups rather than the ZTNA authentication exchange. FortiToken (B) is an MFA token mechanism, not a standalone authentication protocol for ZTNA connections. IPsec authentication (C) is a network-layer tunnel authentication method and is not used to authenticate users in a ZTNA connection.

Answer

LDAP authentication

Answer

FortiToken

Answer

IPsec authentication

Question 6

An administrator needs to configure a site-to-site IPsec VPN with a remote FortiGate that has a dynamic IP address. Which phase1 parameter must be set to support this?

Accepted Answer

Set mode to aggressive and use a pre-shared key. When the remote FortiGate has a dynamic IP address, the local FortiGate cannot initiate the VPN because it does not know the remote peer's IP. Setting the phase1 mode to aggressive and using a pre-shared key allows the remote peer to initiate the connection by sending its identity (ID) in the first exchange, enabling the local FortiGate to identify and authenticate the peer without requiring a static IP address for the remote side.

Answer

Enable Perfect Forward Secrecy (PFS)

Answer

Enable NAT traversal

Answer

Use certificate-based authentication

Question 7

Refer to the exhibit. Users report that they cannot log in to the SSL VPN portal. The stats show 15 login failures with reason 'auth_fail'. What is the most likely cause?

Accepted Answer

The SSL VPN settings do not reference the user group. The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

Answer

The user 'user1' does not exist

Answer

The login-attempt-limit is too low

Answer

The encryption algorithm is set to low

Question 8

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Accepted Answer

Increase the phase2 rekey time to 8 hours.. Option E is correct because enabling Dead Peer Detection (DPD) on the IPsec tunnel interface allows each FortiGate to detect when the peer becomes unreachable and tear down or renegotiate the tunnel, which directly improves stability in the presence of intermittent packet loss. Option D is correct because increasing the phase2 rekey time to 8 hours reduces the frequency of SA rekeying; frequent rekeys can cause brief traffic interruptions, so a longer rekey time lowers the chance of disruption and improves overall tunnel stability. Option A is not correct because reducing the DPD retry interval to 3 seconds makes the device more aggressive in declaring the peer dead, which can cause unnecessary tunnel flapping under intermittent loss rather than improving stability. Option B is not correct because increasing the phase1 lifetime to 86400 seconds does not address intermittent packet loss and may actually delay renegotiation recovery. Option C is not correct because changing from IKEv2 to IKEv1 does not inherently improve stability and may reduce functionality compared to IKEv2.

Answer

Reduce the DPD retry interval to 3 seconds.

Answer

Increase the phase1 lifetime to 86400 seconds.

Answer

Change the IKE version to IKEv1.

Question 9

Refer to the exhibit. An administrator runs the 'diagnose vpn ike stats' command on a FortiGate. What does the output indicate?

Accepted Answer

The tunnel has one IKE SA and two IPsec SAs, which is normal for a single VPN tunnel.. The 'diagnose vpn ike stats' output shows one IKE SA (phase 1) and two IPsec SAs (phase 2). This is normal for a single VPN tunnel when using IPsec with both inbound and outbound SAs, or when the tunnel is configured with separate SAs for different traffic selectors. The presence of two IPsec SAs under one IKE SA does not indicate an error or vulnerability; it is the expected behavior for a standard IPsec VPN tunnel.

Answer

The tunnel is vulnerable to a man-in-the-middle attack because the IPsec SAs are using the same encryption algorithm.

Answer

The tunnel configuration is incorrect because there are two IPsec SAs under one IKE SA.

Answer

The tunnel is using two IKE SAs for redundancy.

Question 10

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

Accepted Answer

Create a user group that includes the RADIUS server as an authentication method. A user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.

Answer

Configure an LDAP server to synchronize user accounts

Answer

Configure an SSL VPN portal with 'Require Authentication' enabled

Answer

Set a local password policy for SSL VPN users

Question 11

Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The phase2 interface name does not match the phase1 name. The tunnel fails because the phase2 interface name does not match the phase1 interface name. In FortiGate IPsec VPN configuration, the phase2 settings must reference the correct phase1 interface. If the names are mismatched, the VPN will not establish. This is a common misconfiguration.

Answer

Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256)

Answer

The pre-shared key is encrypted in the configuration

Answer

The 'net-device disable' setting prevents tunnel creation

Question 12

Match each SD-WAN component to its role.

Accepted Answer

SD-WAN Rule: Determines traffic steering based on criteria like source, destination, application.. Correct matches: SD-WAN Rule → traffic steering; Performance SLA → link quality monitoring; Virtual-WAN-Link → interface grouping. Common confusions mix these roles.

Answer

SD-WAN Rule: Monitors link quality metrics (latency, jitter, packet loss) against thresholds.

Answer

Performance SLA: Groups WAN interfaces into a logical bundle for load balancing.

Answer

Virtual-WAN-Link: Determines traffic steering based on criteria like source, destination, application.

Question 13

Match each Fortinet command to its function.

Accepted Answer

get system performance: Display real-time system performance statistics. Correct matches: 'get system performance' shows real-time performance statistics; 'diagnose debug application httpd' enables HTTP daemon debugging; 'execute ping' tests network connectivity; 'show system status' displays system summary. Common confusions include swapping the functions of 'get system performance' and 'execute ping'.

Answer

get system performance: Ping a network host

Answer

execute ping: Display real-time system performance statistics

Question 14

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration. ADVPN shortcut tunnels require IKEv2 to exchange NAT traversal information between spokes. IKEv1 aggressive mode allows spoke-to-hub connectivity but lacks the necessary payloads for the hub to learn the public IP/port of each spoke, which is essential for shortcut tunnel establishment behind NAT.

Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 15

A FortiGate is configured as a SAML SP for user authentication. When a user attempts to access a protected resource, the FortiGate redirects the user to the IdP login page, but after successful authentication, the user is not redirected back to the original resource. What is the MOST likely cause?

Accepted Answer

The SAML assertion consumer service URL on the IdP does not include a trailing slash. The SAML assertion consumer service (ACS) URL must exactly match the endpoint configured on the FortiGate. If the IdP's ACS URL lacks a trailing slash that the FortiGate expects, the SAML response will be sent to an incorrect or mismatched endpoint, causing the redirect to fail. This is a common misconfiguration in SAML SP setups where URL normalization differs between the SP and IdP.

Answer

The user's browser has cookies disabled

Answer

The IdP certificate is not trusted by the FortiGate

Answer

The FortiGate is configured as a SAML IdP instead of SP