NSE7 Advanced VPN and Zero Trust Practice Test 11 — 15 Questions

Question 1

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

Accepted Answer

The OSPF router ID must be unique across all spokes. OSPF requires stable network types and correct interface configuration. For ADVPN, OSPF should use point-to-point network type to avoid DR elections and ensure proper neighbor relationships.

Answer

The OSPF hello interval must be less than the DPD retry interval

Answer

The hub must have all spoke routes in its routing table before OSPF starts

Question 2

A FortiGate administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which TWO components must be configured on FortiGate to enable ZTNA access?

Accepted Answer

A ZTNA proxy policy. ZTNA requires a proxy policy to define access rules and a ZTNA proxy/gateway to terminate user connections. Tags and EMS are configured separately.

Answer

A firewall policy to allow traffic from ZTNA proxy to internal servers

Answer

A ZTNA tag on the application server

Answer

FortiClient EMS registration on FortiGate

Question 3

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

Accepted Answer

The phase 2 proposal (encryption, authentication, etc.) does not match between peers. IKE SA established but no IPsec SA indicates that phase 2 parameters are misconfigured or the proposal is not matching.

Answer

The firewall policies are not configured to allow traffic through the tunnel

Answer

The pre-shared key on both sides does not match

Answer

The interface MTU is set too low

Question 4

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

Accepted Answer

Signature (RSA). IKEv2 supports certificate-based authentication (RSA signature) for peer identity verification.

Answer

Aggressive mode

Answer

Pre-shared key

Answer

EAP

Question 5

In a hub-and-spoke ADVPN deployment, the spoke FortiGates are configured with IKEv2 and the hub has ADVPN enabled. After initial setup, spokes communicate through the hub. The administrator wants to enable shortcut tunnels so that spokes can directly communicate. What additional configuration is required on the spokes?

Accepted Answer

Enable 'set auto-discovery-sender' on the spoke's phase 1 interface. ADVPN shortcut negotiation requires that the spokes have 'set add-route enable' to install the learned shortcut route, and also the phase 2 configuration should accept shortcut tunnels.

Answer

Enable 'set add-route' on the hub's phase 1 configuration

Answer

Set 'set dpd retrycount' to a higher value on the spoke

Answer

Configure a static route on the spoke pointing to the hub

Question 6

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

Accepted Answer

set action block. ZTNA access rules can block or allow with optional warning. 'Allow with warning' is not available; to show a warning while blocking, the action should be 'Block' with a redirect to a warning portal.

Answer

set action redirect

Answer

set action authenticate

Answer

set action allow

Question 7

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

Accepted Answer

ZTNA proxy on FortiGate. ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

Answer

FortiClient EMS

Answer

IPsec VPN tunnel

Answer

FortiNAC

Question 8

An administrator has configured FortiGate as a SAML service provider (SP) for VPN authentication. Users are prompted for credentials but authentication fails even though they can authenticate directly at the IdP portal. What is the most likely misconfiguration?

Accepted Answer

The FortiGate's entity ID or ACS URL registered at the IdP is incorrect. If users can authenticate at the IdP but not via FortiGate SP, the problem is likely that the FortiGate entity ID or ACS URL does not match what is registered at the IdP.

Answer

The IdP is using HTTP-POST binding while FortiGate expects HTTP-Redirect

Answer

The IdP certificate is not imported on FortiGate

Answer

SAML authentication is not enabled in the VPN portal

Question 9

A FortiGate administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list

proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is in SYN_SENT state; the three-way handshake is incomplete. proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

Answer

The session has been terminated due to inactivity

Answer

The session is a UDP session

Answer

The session is fully established and has been active for 3600 seconds

Question 10

In a hub-and-spoke VPN using OSPF over the overlay, the hub FortiGate learns routes from spoke1 and advertises them to spoke2. However, spoke2's routing table shows the route with a next-hop of the hub's tunnel IP, not spoke1's tunnel IP. What should the administrator configure to allow spoke2 to reach spoke1 directly (using ADVPN shortcut)?

Accepted Answer

Enable 'set auto-discovery-sender' on both spokes' phase 1. To enable direct spoke-to-spoke communication, ADVPN must be enabled and the OSPF configuration should not prevent the shortcut.

Answer

Increase the OSPF metric on the hub's loopback interface

Answer

Configure the hub as an OSPF route reflector

Answer

Disable OSPF on the hub and use static routes instead

Question 11

A FortiGate is configured with FortiClient EMS to enforce ZTNA posture checks. The administrator finds that some Windows 10 clients are not reporting their antivirus status correctly, causing them to be blocked. However, the clients have antivirus installed and running. What is the most likely cause?

Accepted Answer

The FortiClient EMS connector is disabled on the endpoints. FortiClient requires the EMS connector to be enabled and the correct compliance profile must be applied. If the antivirus status is not reported, the connector might be disabled or the profile not assigned.

Answer

The clients are not connected to the corporate network

Answer

The antivirus definitions are outdated

Answer

FortiGate is using the wrong EMS tag

Question 12

An administrator wants to use FortiGate as a SAML identity provider (IdP) for a third-party service. Which configuration is required on FortiGate?

Accepted Answer

Configure a SAML identity provider user and export FortiGate's metadata. FortiGate can act as an IdP by creating a SAML IdP user and configuring the service provider metadata.

Answer

Enable SAML authentication in the firewall policy

Answer

Configure FortiAuthenticator as an external IdP

Answer

Configure a SAML service provider user and import the SP metadata

Question 13

A FortiGate administrator sees the following syslog message repeatedly: 'IPsec phase 2 failed to establish SA with peer due to proposal mismatch.' The administrator has already verified that the phase 2 parameters (encryption, authentication, PFS, and lifetime) match on both sides. What else should the administrator check?

Accepted Answer

The local and remote subnets defined in the phase 2 selector. Phase 2 negotiation can also fail due to mismatched traffic selectors (local and remote subnets).

Answer

The phase 1 proposal settings

Answer

The DPD configuration

Answer

The pre-shared key

Question 14

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

Accepted Answer

Configure a ZTNA application with a CASB profile and SSL inspection. ZTNA inline CASB uses a ZTNA proxy with SSL inspection and a CASB profile that includes a data leak prevention (DLP) rule to detect credit card numbers.

Answer

Use FortiClient to enforce DLP on endpoints

Answer

Configure an IPsec VPN between FortiGate and the SaaS provider

Answer

Configure a web filter profile with DLP sensor

Question 15

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a ZTNA access rule with a condition matching the tag. To restrict access based on ZTNA tags, the tag must be imported from EMS (D) and then used in a ZTNA access rule condition (A).

Answer

Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

Answer

Create a firewall policy allowing all traffic to the ZTNA proxy

Answer

Enable 'set ztna-tag' on the FortiGate interface