NSE7 Advanced VPN and Zero Trust Practice Test 10 — 15 Questions

Question 1

An administrator is troubleshooting a ZTNA deployment where FortiClient users can access a protected web application through the access proxy, but the application server logs show all connections coming from the FortiGate's IP address instead of the actual client IPs. The security team needs the real client IPs in server logs for auditing. Which configuration change should the administrator make?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'preserve client IP' option on the ZTNA access proxy rule so the FortiGate forwards the original source address.. ZTNA access proxy acts as a reverse proxy, terminating the client session and creating a new connection to the protected server. By default, that new connection uses the FortiGate’s address, masking client IPs. Enabling the preserve client IP option causes the FortiGate to use the original client address toward the server, so server logs capture the true source for auditing.

Answer

Configure a firewall policy with NAT disabled between the ZTNA server interface and the application server.

Answer

Add an X-Forwarded-For header insertion action in the CASB profile.

Answer

Change the ZTNA access proxy to operate in transparent mode instead of reverse proxy mode.

Question 2

A FortiGate administrator is configuring an ADVPN with BGP. The hub has a static public IP, and spokes use dynamic IPs behind NAT. The administrator wants to ensure that shortcuts are only established between spokes when BGP routes indicate a better path. Which configuration is required on the hub to enable shortcut negotiation?

Accepted Answer

Enable 'set auto-discovery-receiver' on the hub's IPsec tunnel interface.. In ADVPN, the hub must be configured to receive and process shortcut requests from spokes. The auto-discovery-receiver setting allows the hub to act as the central point for shortcut negotiation. Spokes use auto-discovery-sender to initiate requests. This role assignment ensures that spokes can dynamically establish direct tunnels when BGP routing indicates a better path, improving performance and reducing hub load.

Answer

Enable 'set auto-discovery-forwarder' on the hub's IPsec tunnel interface.

Answer

Enable 'set auto-discovery-sender' on the hub's IPsec tunnel interface.

Answer

Enable 'set auto-discovery-shortcut' on the hub's IPsec tunnel interface.

Question 3

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The remote gateway uses a dynamic IP address and the administrator wants to ensure that only a specific remote peer can connect. Which authentication method should be used to verify the remote peer's identity?

Accepted Answer

Pre-shared key with a peer ID set to the remote gateway's FQDN.. Using a pre-shared key with a peer ID allows the FortiGate to identify the remote peer by a unique identifier (like FQDN) even when its IP is dynamic. The remote gateway must be configured to send this ID during IKE negotiation. This method ensures that only the peer with the correct ID can establish the VPN, providing a simple yet effective identity check.

Answer

IKEv2 with EAP authentication using a username and password.

Answer

X.509 certificate authentication with the remote gateway's certificate issued by a trusted CA.

Answer

Pre-shared key with the remote gateway's IP address set to 0.0.0.0.

Question 4

A FortiGate administrator has enabled ZTNA on a FortiGate running FortiOS 7.4. Users report that after authenticating to the ZTNA portal, they can reach the web application, but the FortiGate shows no application-layer inspection and no ZTNA tags are being applied to the sessions. The administrator confirms that the ZTNA server is configured with a reverse-proxy mode and a valid certificate. What is the most likely cause of the missing tag enforcement?

Accepted Answer

The firewall policy does not reference the ZTNA server, so the FortiGate treats the traffic as ordinary proxy traffic and skips ZTNA tag evaluation.. ZTNA enforcement on FortiOS requires the access proxy to be bound to the firewall policy. When the policy does not reference the ZTNA server, the FortiGate can still pass the traffic but never invokes ZTNA tag evaluation or application-layer inspection. The other explanations point to supported modes, temporary connectivity, or a different portal, none of which account for the complete absence of ZTNA processing.

Answer

The FortiClient EMS connector is down, which prevents the FortiGate from applying any ZTNA tags to the session.

Answer

The user authenticated through the SSL VPN portal instead of the ZTNA portal, so the session bypasses ZTNA tag evaluation.

Answer

The ZTNA server is configured in reverse-proxy mode instead of transparent mode, so tags cannot be applied.

Question 5

A FortiGate is configured with an SSL VPN web portal that must provide access to internal web services. The administrator wants to enforce ZTNA tags on the SSL VPN users so that only devices with a valid FortiClient EMS tag can access the portal. Which configuration step is required to achieve this?

Accepted Answer

Create a firewall policy that includes the ZTNA tag as a source and apply it to the SSL VPN tunnel interface.. ZTNA tags are enforced through firewall policies, not through SSL VPN portal settings or authentication methods. After FortiClient EMS assigns tags to endpoints, the FortiGate dynamically learns them and you can use them as source objects in policies. Applying such a policy to the SSL VPN tunnel interface ensures that only devices with the required tag can access protected resources.

Answer

Configure the SSL VPN settings to use client certificate authentication and map the certificate to the ZTNA tag.

Answer

Enable ZTNA on the SSL VPN portal and select the EMS tag as the authentication method.

Answer

Add the ZTNA tag to the SSL VPN portal's 'Allowed Hosts' list to restrict access based on device compliance.

Question 6

A FortiGate administrator is configuring ZTNA to protect a web application. The administrator wants to ensure that only users who authenticate via SAML and whose devices have a specific compliance tag can access the application. Which two configurations are required on the FortiGate to achieve this? (Choose two.)

Accepted Answer

Configure a ZTNA proxy policy with source user group and device posture check.. To enforce SAML authentication and device compliance for ZTNA access, the administrator must configure a ZTNA server object to define the application and a ZTNA proxy policy that references the user group and device posture check. These two components work together to authenticate users and verify device tags before granting access to the web application.

Answer

Configure an IPsec VPN tunnel between the user and the FortiGate.

Answer

Configure a firewall policy allowing traffic from the ZTNA proxy to the application server.

Answer

Configure an SSL VPN portal with SAML authentication and host-check profile.

Question 7

A FortiGate administrator is troubleshooting an IPsec VPN that fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE gateway is stuck in a state of 'connecting'. Which two actions should the administrator take to troubleshoot this issue? (Choose two.)

Accepted Answer

Verify that the pre-shared keys are identical on both peers.. When an IKE gateway is stuck in connecting, the most common causes are mismatched phase 1/phase 2 proposals or incorrect pre-shared keys. Verifying these two elements on both peers is essential. Debugging can provide more details, but the fundamental checks should be performed first to quickly identify configuration errors.

Answer

Run 'diagnose debug application ike -1' to capture detailed IKE negotiations.

Answer

Increase the IPsec tunnel MTU to 1500.

Answer

Enable Dead Peer Detection (DPD) on the phase 1 configuration.

Question 8

A FortiGate administrator wants to replace the legacy SSL VPN portal with ZTNA to provide remote users access to internal web applications. The administrator configures a ZTNA server with a virtual host name and a real server, and creates a firewall policy with a ZTNA action. However, remote users receive a 'connection refused' error when accessing the application. The administrator verifies that the ZTNA server is reachable from the internal network. What is the most likely cause of the issue?

Accepted Answer

The ZTNA server is not enabled on the FortiGate's public-facing interface, so the client's connection attempt is not being intercepted.. The ZTNA server must be enabled on the interface where client traffic arrives. Without this, the FortiGate does not intercept the connection, and clients receive a connection refused error because no service is listening on the expected IP and port. The other options would produce different error symptoms, such as certificate warnings or timeouts, not an immediate refusal.

Answer

The firewall policy with the ZTNA action is placed after a deny policy that blocks all traffic.

Answer

The ZTNA server is configured to use HTTPS but the real server is using HTTP.

Answer

The ZTNA server is not associated with a valid SSL certificate, causing the client to reject the connection.

Question 9

A FortiGate administrator is configuring an ADVPN with a hub and multiple spokes. The hub has a static public IP, while spokes are behind NAT with dynamic IPs. The administrator wants to ensure that spokes can establish shortcuts directly between each other when needed. Which configuration is required on the hub to facilitate shortcut establishment?

Accepted Answer

Enable both 'set auto-discovery-sender enable' and 'set auto-discovery-forwarder enable' on the hub's IPsec phase 1 interface.. In ADVPN, the hub must be configured as both an auto-discovery sender and forwarder to enable shortcut establishment between spokes. The sender sends shortcut offers to spokes, and the forwarder relays shortcut requests between spokes. This is especially important when spokes are behind NAT, as the hub acts as the rendezvous point. Enabling both settings on the hub's IPsec phase 1 interface ensures that spokes can negotiate direct tunnels.

Answer

Enable 'set auto-discovery-sender enable' on the hub's IPsec phase 1 interface.

Answer

Enable 'set auto-discovery-forwarder enable' on the hub's IPsec phase 1 interface.

Answer

Enable 'set auto-discovery-receiver enable' on the hub's IPsec phase 1 interface.

Question 10

A FortiGate administrator is implementing Zero Trust Network Access (ZTNA) for remote users. The administrator wants to ensure that only users with compliant devices can access internal applications. The administrator has integrated FortiClient EMS with FortiGate and configured ZTNA rules. However, some users with compliant devices are still being denied access. The administrator checks the ZTNA logs and sees that the devices are marked as non-compliant. What is the most likely reason for this?

Accepted Answer

The ZTNA rule is configured to check for a specific compliance tag that the devices do not have.. ZTNA rules can require specific compliance tags. If the rule demands a tag that the device does not have, access is denied even if the device is otherwise compliant. The administrator must ensure that the required tags match those assigned in FortiClient EMS. Other options would produce different log entries or errors.

Answer

The FortiGate is not configured to use the correct SSL certificate for ZTNA.

Answer

The users are not members of the correct user group in the ZTNA policy.

Answer

The FortiClient EMS tags are not being synchronized with the FortiGate.

Question 11

A FortiGate administrator is configuring an ADVPN with a hub and multiple spokes. The administrator wants to ensure that spokes can establish direct tunnels to each other for optimized traffic flow. The administrator has configured the hub with 'set auto-discovery-sender enable' and the spokes with 'set auto-discovery-receiver enable'. However, some spokes are unable to establish direct tunnels. Which two actions should the administrator take to troubleshoot this issue? (Choose two.)

Accepted Answer

Verify that the spokes have a route to the remote spoke's subnet through the ADVPN interface.. For ADVPN shortcuts to work, spokes must have a route to the remote spoke's subnet through the ADVPN interface, and all spokes must use the same pre-shared key for the dynamic tunnels. These two factors are critical for shortcut establishment. The other options are either not valid settings or would affect all spokes uniformly.

Answer

Verify that the spokes are using the same IKE version as the hub.

Answer

Check that the hub has 'set auto-discovery-sender enable' configured on the correct phase1 interface.

Answer

Check that the hub is configured with 'set auto-discovery-forwarder enable'.

Question 12

A company is implementing Zero Trust Network Access using Fortinet's ZTNA solution. They have deployed a FortiGate as the ZTNA gateway and are using FortiClient as the ZTNA agent. Users report that they can initiate ZTNA connections but the connections drop after a few minutes. The FortiGate logs show that the ZTNA session is being terminated due to a endpoint compliance check failure. Which action should the administrator take to resolve this issue?

Accepted Answer

Review and adjust the endpoint compliance rules in FortiClient EMS.. The FortiGate logs explicitly indicate that the ZTNA session is being terminated due to an endpoint compliance check failure. This means the FortiGate is enforcing compliance rules defined in FortiClient EMS, and when the endpoint fails those checks (e.g., missing antivirus updates, firewall disabled), the session is dropped. Reviewing and adjusting the compliance rules in EMS allows the administrator to align the requirements with the actual endpoint posture or correct the misconfiguration causing the failure.

Answer

Disable endpoint compliance checks on the FortiGate.

Answer

Increase the session timeout on the FortiGate ZTNA gateway.

Answer

Change the authentication method from certificate to LDAP.

Question 13

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.

Question 14

A company uses FortiGate ZTNA to provide remote access to an internal web application. The application requires client certificates for authentication. The administrator has configured the ZTNA rule to use certificate authentication. However, users report that they are prompted for credentials repeatedly. What is the most likely cause?

Accepted Answer

The client certificate is not trusted by the FortiGate.. When a ZTNA rule is configured for certificate authentication, the FortiGate must trust the client certificate's issuing CA. If the CA certificate is not imported into the FortiGate's trusted CA list, the certificate chain validation fails, causing the authentication to be rejected and the client to be repeatedly prompted for credentials. This is the most common cause of repeated credential prompts in certificate-based ZTNA setups.

Answer

The user's password has expired.

Answer

The ZTNA rule is configured to use SAML authentication instead.

Answer

The FortiClient EMS server is not reachable from the client.

Question 15

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

Accepted Answer

FortiGate ZTNA gateway. In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Answer

FortiClient agent

Answer

FortiAnalyzer

Answer

FortiClient EMS