NSE7 Advanced VPN and Zero Trust Practice Test 11 — 15 Questions

Question 1

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ZTNA rule's proxy destination IP or port is wrong.. The ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Answer

The firewall policy is set to deny traffic from the ZTNA gateway.

Answer

The client does not have a route to the internal application.

Answer

The client's FortiClient agent is not authenticated.

Question 2

Which TWO of the following are required components for a Fortinet ZTNA solution? (Select two.)

Accepted Answer

FortiGate. FortiGate is the enforcement point in a ZTNA solution, acting as the ZTNA gateway that verifies device posture and user identity before granting access to protected applications. It terminates ZTNA tunnels from FortiClient and applies identity-based policies, making it a required component for traffic inspection and access control.

Answer

FortiAuthenticator

Answer

FortiWeb

Answer

FortiAnalyzer

Question 3

A multinational corporation is implementing ZTNA for remote access to a critical internal application hosted on a server with IP 10.0.1.200:8443. The FortiGate is deployed at the edge with WAN IP 203.0.113.50. The administrator configures a ZTNA rule with proxy destination 10.0.1.200:8443, a firewall policy allowing traffic from the ZTNA gateway to the internal server, and a VIP for port forwarding for testing. However, remote users report that they can establish a ZTNA connection to the gateway but the application page fails to load, showing a blank page after a long delay. The FortiGate logs show no errors, and the debug output indicates that the proxy successfully forwarded the request to 10.0.1.200:8443 and received a response. The internal server team confirms the application is working correctly for on-site users. What is the most likely cause?

Accepted Answer

The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally.. The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally. When the ZTNA proxy forwards the request to the internal server, the server responds with HTML content that references internal resources (e.g., images, scripts, or links) using private IP addresses (like 10.0.1.200) or internal DNS names. The remote client cannot resolve or reach these internal addresses, causing the page to load partially or display a blank page after a delay, even though the initial proxy connection and response are successful.

Answer

The ZTNA proxy is not configured to support HTTPS.

Answer

The internal server is not reachable from the FortiGate.

Answer

The client's ZTNA tags are expired.

Question 4

A healthcare provider is deploying ZTNA to secure access to an internal electronic health records (EHR) system. The EHR system is composed of multiple web services running on different ports behind a load balancer with IP 10.0.10.100. The load balancer listens on ports 443, 8443, and 9090. The administrator configures a single ZTNA rule with proxy destination 10.0.10.100:443, expecting that the other ports will be accessed via the same rule. However, users report that they can only access the service on port 443; connections to ports 8443 and 9090 fail. The FortiGate logs show that requests to other ports are being dropped. What should the administrator do to resolve this?

Accepted Answer

Create separate ZTNA rules for each port (8443 and 9090).. Each ZTNA rule maps to a single proxy destination port. The rule configured with proxy destination 10.0.10.100:443 only forwards traffic for that specific port. To access services on ports 8443 and 9090, separate ZTNA rules must be created for each port, each with its own proxy destination and access proxy configuration.

Answer

Configure the load balancer to redirect all traffic to port 443.

Answer

Configure the ZTNA gateway to allow all ports to the load balancer.

Answer

Ask users to change the port in their browser to 443.

Question 5

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGate devices. The tunnel is established, but traffic is not passing. Which configuration should the administrator check first?

Accepted Answer

Firewall policies. When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Answer

NAT traversal configuration

Answer

Static routes

Answer

Phase1 parameters

Question 6

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

Accepted Answer

Firewall policy allowing ICMP. SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

Answer

Split tunneling settings

Answer

SSL VPN web portal settings

Answer

DNS server configuration

Question 7

Refer to the exhibit. A tunnel interface is configured with IP 10.0.1.1/30 and remote-ip 10.0.1.2/30. The phase2 defines src-subnet as 10.0.1.0/30 and dst-subnet as 10.0.2.0/30. What is the most likely problem with this configuration?

Accepted Answer

The phase2 src-subnet includes the tunnel interface IP. The phase2 src-subnet is set to 10.0.1.0/30, which includes the tunnel interface IP 10.0.1.1/30. In IPsec VPN configurations, the phase2 selector must not include the tunnel interface IP itself because the tunnel interface is used for routing encapsulated traffic; including it can cause routing loops or prevent the tunnel from establishing correctly. The correct src-subnet should be the protected internal network behind the FortiGate, not the tunnel subnet.

Answer

The remote gateway is set to a static IP but the peer might be dynamic

Answer

The tunnel interface is missing the 'ip' command

Answer

The phase2 dst-subnet overlaps with the remote gateway

Question 8

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Accepted Answer

Tunnel mode enabled. Option A (Tunnel mode enabled) is correct because an always-on SSL VPN requires a full tunnel-mode connection, which routes all traffic through the FortiGate and supports the persistent, automatically reconnecting VPN interface; web-mode portals are session-based and cannot provide an always-on tunnel. Option C (Auto-connect setting in FortiClient) is correct because FortiClient's auto-connect feature establishes the SSL VPN tunnel at startup and automatically re-establishes it when the underlying network changes, which is exactly the always-on behavior described. Option B (DTLS enabled) is not required, since DTLS only optimizes transport performance and the tunnel can reconnect over TLS. Option D (Web mode portal) is not required because web mode is a clientless, browser-based access method that cannot deliver an always-on tunnel. Option E (Split tunneling configured) is not required because split tunneling only controls which traffic is routed through the tunnel and does not enable automatic reconnection.

Answer

DTLS enabled

Answer

Web mode portal

Answer

Split tunneling configured

Question 9

Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?

Accepted Answer

Proxy IDs (local and remote subnets) match on both sides. For IPsec phase2 (Quick Mode) to establish, the proxy IDs (local and remote subnet selectors) must match on both peers, because mismatched selectors cause the responder to reject the Quick Mode proposal — so option A is correct. Option C is correct because if PFS is enabled, both peers must use the same Diffie-Hellman group (e.g., group 2, 5, or 14) during phase2; a mismatch in PFS settings or DH group will fail the key exchange. Option D is correct because phase2 proposals (encryption algorithm, hash, and SA lifetime) must match between peers for the IPsec SA to be negotiated successfully. Option B is not a phase2 negotiation requirement — firewall policies permitting subnet traffic are needed for actual data flow, not for the IKE/IPsec SA establishment itself. Option E is also not required for phase2; NAT-T is only needed when NAT devices exist between peers and is negotiated in phase1, not a mandatory condition for phase2.

Answer

Firewall policies allow traffic between the subnets

Answer

NAT traversal is enabled on both sides

Question 10

An administrator is configuring SSL VPN on FortiGate and wants to allow users to access internal applications via a web portal without installing any client software. Which SSL VPN mode should be used?

Accepted Answer

Web mode. Web mode (option C) is correct because it enables users to access internal web applications through a FortiGate SSL VPN web portal using only a standard browser, with no client software installation required. The portal acts as a reverse proxy, translating HTTPS requests from the client to the internal application servers, making it ideal for clientless remote access.

Answer

DTLS

Answer

Tunnel mode

Answer

Split tunneling

Question 11

A FortiGate is configured with an IPsec VPN that uses certificate-based authentication. The VPN fails to establish. The administrator checks the phase1 debug and sees the message: 'no suitable certificate found'. What is the most likely cause?

Accepted Answer

The local certificate is not imported or does not match the certificate name. The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.

Answer

The peer's certificate is not trusted

Answer

The certificate revocation list (CRL) is outdated

Answer

The CA certificate is missing

Question 12

A multinational company uses FortiGate devices as VPN gateways to connect its headquarters (HQ) and branch offices via IPsec VPN tunnels. The company is migrating its remote access solution from IPsec VPN to SSL VPN using FortiClient. Currently, 500 remote users connect via IPsec VPN with pre-shared keys and XAuth authentication. The migration must be seamless with minimal downtime, and users must continue to authenticate using their existing Active Directory credentials. The SSL VPN portal must provide access to internal web applications and some legacy TCP-based applications that do not support HTTP. The security team requires that all traffic between remote users and the internal network be encrypted and that the SSL VPN use a certificate from a public CA to avoid certificate warnings on client devices. The IT team wants to use FortiToken for two-factor authentication (2FA) for all VPN users. Which of the following is the most appropriate course of action to meet all requirements?

Accepted Answer

Deploy SSL VPN with a public CA certificate, configure LDAP authentication against Active Directory, enable FortiToken for 2FA, and create a split-tunneling policy that uses both SSL VPN web mode and tunnel mode via FortiClient.. It meets all requirements: a public CA certificate avoids client certificate warnings, LDAP authentication against Active Directory allows seamless credential reuse, FortiToken provides the required 2FA, and combining SSL VPN web mode (for web apps) with tunnel mode via FortiClient (for legacy TCP applications) ensures full coverage. This approach minimizes downtime by migrating users gradually without changing their authentication backend.

Answer

Configure SSL VPN with a self-signed certificate and use the local password database for authentication. Enable FortiToken and configure the portal to provide both web and TCP forwarding applications.

Answer

Set up SSL VPN with a public CA certificate, use LDAP for authentication, but do not enable FortiToken because it would require a separate token per user.

Answer

Create a new IPsec VPN configuration using certificate-based authentication and FortiToken, and gradually move users to the new IPsec VPN.

Question 13

A company's FortiGate is configured with multiple IPsec VPN tunnels to branch offices. One tunnel keeps dropping and re-establishing every few minutes. The logs show 'IPsec SA negotiation failed' with error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

Mismatched encryption or authentication algorithms between the two VPN peers. The error 'proposal mismatch' directly indicates that the two IPsec peers cannot agree on the security parameters for the IKE or IPsec SA. This occurs when the encryption algorithm (e.g., AES256 vs. AES128), authentication algorithm (e.g., SHA256 vs. SHA1), Diffie-Hellman group, or lifetime values do not match between the FortiGate and the remote peer. The tunnel drops and re-establishes because the negotiation fails, and the FortiGate retries with the same mismatched proposal, leading to repeated failures.

Answer

Dead Peer Detection (DPD) configured too aggressively

Answer

NAT-Traversal (NAT-T) not enabled

Answer

Pre-shared key mismatch

Question 14

Drag and drop the steps to configure a FortiGate as a DHCP server into the correct order.

Accepted Answer

Select interface, then enable DHCP, then set scope, then configure options, then apply.. The correct sequence to configure a FortiGate as a DHCP server is: first select the interface that will serve DHCP, then enable DHCP on that interface, set the IP address scope (range), configure additional options such as default gateway and DNS servers, and finally apply the configuration. This order ensures dependencies are met and the configuration is valid.

Answer

Enable DHCP, then select interface, then set scope, then configure options, then apply.

Answer

Set scope, then configure options, then enable DHCP, then select interface, then apply.

Answer

Configure options, then apply, then select interface, then enable DHCP, then set scope.

Question 15

Drag and drop the steps to configure a FortiGate VDOM in multi-VDOM mode into the correct order.

Accepted Answer

Enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.. First enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.

Answer

Create and assign interfaces, then enable VDOM mode globally, then configure each VDOM, then resource allocation.

Answer

Configure each VDOM, then enable VDOM mode globally, then create and assign interfaces, then resource allocation.

Answer

Resource allocation, then enable VDOM mode globally, then create and assign interfaces, then configure each VDOM.