NSE7 Advanced VPN and Zero Trust Practice Test 12 — 15 Questions

Question 1

An administrator is deploying ADVPN with a hub-and-spoke topology. The hub FortiGate is configured with 'set auto-discovery enable' and 'set add-route enable'. Spokes have 'set auto-discovery-sender enable'. However, shortcut tunnels are not being established. Which two additional conditions must be met for shortcut tunnels to form? (Choose two.)

Accepted Answer

The phase 2 configuration on the hub must have 'set auto-discovery enable'. Shortcut tunnels require traffic between spokes (A) and the hub's phase 2 must have auto-discovery enabled (C).

Answer

The spokes must have a static route to each other's networks

Answer

The spokes must have 'set dpd enable' on the phase 1

Answer

The hub must be configured as a route reflector for BGP

Question 2

A FortiGate administrator is troubleshooting an IPsec VPN that uses IKEv2 with certificate authentication. The VPN fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the gateway state is 'IKE_INIT'. Which three possible causes should the administrator investigate? (Choose three.)

Accepted Answer

The certificate of the remote peer is not trusted by the local FortiGate. IKE_INIT state indicates phase 1 has not completed. Certificate trust issues (A), proposal mismatch (B), and expired certificate (D) can all cause phase 1 failure.

Answer

The pre-shared key is incorrect

Answer

The phase 2 proxy ID is incorrect

Question 3

A network administrator configures an IPsec VPN between two FortiGates using IKEv2. The tunnel establishes, but after a period of inactivity, traffic stops passing and the logs show 'IPsec phase 1 down'. The administrator wants to ensure the tunnel is quickly re-established when traffic resumes. Which setting should be configured?

Answer

Set the phase1 proposal to use AES-256-GCM.

Answer

Configure the phase1 to use main mode instead of aggressive mode.

Answer

Enable Dead Peer Detection (DPD) with 'on-idle' mode.

Answer

Set the IKE idle timeout to 0 (disabled).

Question 4

An administrator is troubleshooting an ADVPN scenario where spoke FortiGates are behind NAT. The shortcut tunnels are not forming between spokes. The hub has the appropriate ADVPN stage settings. What is the most likely cause of the shortcut failure?

Answer

The spokes are using dynamic IP addresses.

Answer

The spokes have the same IKE ID.

Answer

NAT traversal is not enabled on the hub's phase1 interfaces.

Answer

The shortcut tunnel uses a different encryption algorithm than the hub-spoke tunnel.

Question 5

A FortiGate is configured as a SAML Identity Provider (IdP) for a remote user accessing a web application via ZTNA. The user authenticates successfully, but the ZTNA proxy logs show 'access denied' for the user. Which configuration element is most likely missing or misconfigured?

Answer

The ZTNA access proxy application is not enabled for HTTPS.

Answer

The SAML user group is not added to the ZTNA rule's allowed groups.

Answer

A firewall policy with ZTNA tags as source is missing.

Answer

ZTNA tags are not assigned to the user in FortiClient EMS.

Question 6

An administrator wants to ensure that only devices with up-to-date antivirus software can access a sensitive application via ZTNA. Which FortiGate feature should be used to enforce this requirement?

Answer

ZTNA tags from FortiClient EMS

Answer

SSL deep inspection profile

Answer

Application control profile

Answer

AntiVirus profile on the firewall policy

Question 7

A FortiGate administrator runs the following diagnostic command: 'diagnose vpn ike gateway list'. The output shows a gateway with state 'down'. The administrator verifies that the peer is reachable and the pre-shared key is correct. What is a possible reason for the gateway state being 'down'?

Answer

The remote gateway IP address has changed.

Answer

DPD is disabled on both ends.

Answer

IKE idle timeout has expired.

Answer

The phase2 proposal is mismatched.

Question 8

An administrator configures a multi-peer IPsec VPN on FortiGate for redundancy. The primary peer is 10.1.1.1 and secondary is 10.1.1.2. The administrator notices that when the primary peer goes down, the FortiGate does not fail over to the secondary peer until the IKE SA times out (about 60 seconds). Which setting can reduce this failover time?

Answer

Configure 'idle-timeout' to 30 seconds.

Answer

Set 'dpd-retryinterval' to 5 and 'dpd-retrycount' to 3.

Answer

Use aggressive mode for IKE negotiation.

Answer

Enable 'auto-negotiate' on the phase1 interface.

Question 9

A FortiGate is configured as a ZTNA proxy for a web application. Users report that after authenticating, they receive a '502 Bad Gateway' error. What is the most likely cause?

Answer

The backend server is unreachable from the FortiGate.

Answer

The ZTNA proxy is not configured with a valid SSL certificate.

Answer

The user's device posture is not compliant.

Answer

The ZTNA rule is not using the correct source interface.

Question 10

An administrator needs to integrate FortiGate with FortiNAC for network access control. The goal is to dynamically quarantine endpoints that have out-of-date antivirus software. Which component is responsible for enforcing the quarantine on the network?

Answer

FortiNAC's Network Access Policy (NAP)

Answer

The RADIUS server used for 802.1X

Answer

FortiGate firewall policies with ZTNA tags

Answer

FortiClient EMS compliance rules

Question 11

A FortiGate is the SAML Service Provider (SP) for a ZTNA application. The IdP is Azure AD. After successful authentication, the user is redirected to the ZTNA proxy with a '403 Forbidden' error. The ZTNA rule has the correct groups allowed. What is the most likely missing configuration?

Answer

The IdP is not sending the user's group membership in the SAML assertion.

Answer

The ZTNA proxy certificate is not trusted by the browser.

Answer

The SAML user group is not mapped to a FortiGate local group.

Answer

The FortiGate's clock is not synchronized with the IdP.

Question 12

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors form, but routes learned from the remote site are not appearing in the routing table. What is the most likely cause?

Answer

The firewall policy allows OSPF traffic (protocol 89) but not IPsec ESP.

Answer

The IPsec interface MTU is too low for OSPF packets.

Answer

The OSPF network type is not set to point-to-point.

Answer

The 'allowaccess' setting on the IPsec interface does not include OSPF.

Question 13

A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?

Answer

Set the authentication method to 'signature'.

Answer

Set the proposal to include DH groups 14 or higher.

Answer

Configure 'local-gw' with the certificate's CN.

Answer

Enable 'peer-id-option' and set it to 'any'.

Question 14

An administrator configures a hub-and-spoke ADVPN with IBGP over the VPN overlays. The spokes receive the default route from the hub, but they cannot reach each other directly. The administrator wants spoke-to-spoke traffic to use shortcut tunnels. Which additional configuration is required on the hub?

Answer

Enable 'auto-discovery-sender' and 'auto-discovery-receiver' on the phase1 interfaces.

Answer

Configure 'set neighbor <spoke-ip> next-hop-self' under BGP.

Answer

Create a firewall policy that permits traffic between spokes.

Answer

Add 'set advpn-multicast enable' to the phase1 configuration.

Question 15

A FortiGate administrator needs to block an application (e.g., Facebook) while allowing HTTPS traffic for ZTNA users. Which TWO configurations are required to achieve this?

Answer

Web filter profile with Facebook categorized as blocked.

Answer

Enable 'inline CASB' on the ZTNA rule.

Answer

SSL deep inspection profile to decrypt HTTPS traffic.

Answer

Application control profile with Facebook blocked applied to the firewall policy.

Answer

Add a ZTNA tag for Facebook blocking.