NSE7 Advanced VPN and Zero Trust Practice Test 12 — 15 Questions

Question 1

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device posture checks. Option A (Device posture checks) is correct because posture checks in FortiClient EMS evaluate endpoint compliance conditions such as antivirus signature currency and disk encryption status, which are exactly the requirements the administrator wants to enforce. Option D (ZTNA tags) is correct because FortiClient EMS dynamically assigns ZTNA tags to endpoints based on posture results, and these tags are then used in ZTNA firewall policies to allow or deny access to the sensitive application. Together, posture checks generate the compliance data and ZTNA tags translate that data into enforceable access control. Option B (VPN tunnels) is not needed because ZTNA provides application-level access without requiring a traditional VPN tunnel. Option C (SAML SSO) is an identity authentication mechanism and does not by itself verify antivirus signatures or disk encryption compliance.

Answer

VPN tunnels

Answer

SAML SSO

Question 2

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. When 'diagnose vpn ike gateway list' shows DPD status as 'dead', it means the FortiGate has not received DPD (Dead Peer Detection) responses from the peer within the configured retry period, so it considers the peer unreachable and tears down the tunnel. The IKE SA and IPsec SAs are removed, and the tunnel is considered down. This is the correct interpretation of the 'dead' status.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 3

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

Accepted Answer

ZTNA access proxy. FortiGate ZTNA access proxy enables granular policy enforcement based on endpoint security posture, such as OS version, antivirus status, and disk encryption. It acts as a reverse proxy that evaluates ZTNA tags (derived from endpoint posture) before granting access to protected applications, aligning with zero-trust principles.

Answer

Web filtering profile

Answer

SSL VPN portal

Answer

IPsec phase 1 configuration

Question 4

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

Accepted Answer

The user's FortiClient does not have the required ZTNA tags assigned. When users can authenticate and the ZTNA status shows 'Connected' on FortiClient, but the application still fails to load, the most likely cause is that the client lacks the required ZTNA tags. ZTNA tags are used by the FortiGate to enforce access policies; without the correct tags, the FortiGate will block the application traffic even though the tunnel is established. This scenario indicates a tag assignment or synchronization issue between FortiClient and EMS.

Answer

The ZTNA application is not configured with HTTPS

Answer

The FortiClient EMS server is not reachable from the FortiGate

Answer

The FortiGate is not configured with the correct ZTNA application gateway

Question 5

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Accepted Answer

ZTNA access proxy. The ZTNA access proxy is responsible for securely proxying traffic from the user to the application, hiding the application's actual network location. It acts as a reverse proxy that enforces access policies based on user identity and device posture, ensuring that only authorized users can reach the application without exposing it directly to the network.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 6

An administrator wants to enforce that only devices with corporate-owned certificates can establish an IPsec VPN tunnel. Which IPsec authentication method should be configured?

Accepted Answer

X.509 certificates. X.509 certificates provide a strong, identity-based authentication mechanism that allows the VPN gateway to verify that only devices possessing a corporate-issued certificate can establish an IPsec tunnel. This method relies on a public key infrastructure (PKI) where the gateway validates the certificate chain and optionally checks certificate revocation lists (CRLs) or OCSP responses, ensuring that unauthorized devices without a valid corporate certificate are rejected.

Answer

Pre-shared keys

Answer

Extended Authentication (XAuth)

Answer

Aggressive mode

Question 7

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

Accepted Answer

NAC policies. NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Answer

DHCP fingerprinting

Answer

RADIUS accounting

Answer

SNMP traps

Question 8

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Accepted Answer

FortiClient EMS server. FortiClient EMS server (B) is required because it acts as the central management and policy authority for ZTNA, handling endpoint registration, tagging, and synchronization of ZTNA configuration to FortiGates and FortiClients. FortiClient installed on endpoint devices (C) is required because it provides the endpoint identity, posture information, and ZTNA client functionality needed to establish secure tunnels to the access proxy. A FortiGate configured as ZTNA access proxy (D) is required because it enforces ZTNA policies and brokers access between endpoints and the protected corporate web application. FortiSandbox (A) is not required for ZTNA deployment; it provides sandboxing/threat analysis and is not a core ZTNA component. FortiAnalyzer (E) is also not required; it provides logging, reporting, and analytics but ZTNA can function without it.

Answer

FortiSandbox for threat analysis

Answer

FortiAnalyzer for logging

Question 9

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 10

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

Accepted Answer

The CA certificate that signed the peer's certificate is not imported on the FortiGate. The error 'unable to get local issuer certificate' indicates that the FortiGate cannot find the CA certificate that signed the peer's certificate in its local store. Without the CA certificate, the FortiGate cannot validate the peer's certificate chain. Importing the correct CA certificate resolves the issue.

Answer

The peer's certificate has expired

Answer

The certificate revocation list (CRL) is not configured

Answer

The local certificate does not match the peer's expected CN

Question 11

An administrator configures FortiGate as a SAML identity provider (IdP) for a cloud application. The application (SP) initiates the login. Users are redirected to the FortiGate login page and authenticate successfully, but then receive an error from the SP. What is a common cause?

Accepted Answer

The SP's ACS (Assertion Consumer Service) URL is misconfigured on the FortiGate. When FortiGate is the IdP, it must be configured with the SP's ACS URL and entity ID. If these are incorrect, the SAML assertion is not accepted by the SP.

Answer

The FortiGate's certificate is not trusted by the user's browser

Answer

The user's account is locked

Answer

The SAML attribute mapping is incorrect

Question 12

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Accepted Answer

Check if there is a route on the internal network pointing back to the VPN subnet. Option A is correct because remote-access IPsec VPN clients use a virtual IP pool subnet, and internal hosts or routers must have a return route for that VPN subnet; without it, return traffic is dropped and users cannot reach internal resources even though the tunnel is up. Option B is correct because NAT must be disabled on the VPN policy; if NAT is enabled, the FortiGate translates the source address of VPN traffic, which breaks routing and access to internal resources that expect the original VPN pool address. Option E is correct because the FortiGate requires an explicit firewall policy permitting traffic from the VPN IP pool (source) to the internal network (destination), and without this policy the tunnel establishes but no traffic is allowed through. Option C is not appropriate because increasing MTU on the VPN interface is not a standard fix for access failures and can worsen fragmentation issues; MTU problems typically require lowering or adjusting MSS, not raising MTU. Option D is not appropriate because disabling Dead Peer Detection (DPD) on phase 1 does not resolve internal resource access problems and can prevent the FortiGate from detecting dead VPN peers.

Answer

Increase the MTU on the VPN interface

Answer

Disable DPD on the VPN phase 1

Question 13

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. Option B is correct because the FortiGate enforces ZTNA tag-based posture by referencing the 'Compliant' tag as a matching condition inside a ZTNA policy (ztna-policy), which is what actually allows or denies the user's traffic based on device posture. Option C is correct because ZTNA on FortiGate requires a ZTNA access proxy (ztna access-proxy) that defines the protected internal application, its real server, and the listening/portal parameters; without it there is no ZTNA object for the policy to protect. Option A is not required because SSL deep inspection is a UTM/content-inspection feature and is not needed to match ZTNA tags. Option D is not required because the FortiClient EMS certificate is used for EMS fabric authorization/connector trust, not for enforcing a ZTNA tag in the access policy. Option E is not required because a plain firewall policy with the EMS connector as source does not enforce ZTNA tag posture; tag enforcement is done through the ZTNA policy and access proxy.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 14

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

Accepted Answer

The phase2 proposal (encryption, authentication, etc.) does not match.. Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Answer

The firewall policies at Site B are blocking UDP port 500.

Answer

The pre-shared key does not match on both sides.

Answer

The DPD settings are incompatible between the peers.

Question 15

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

Accepted Answer

ZTNA (Zero Trust Network Access) proxy. ZTNA (Zero Trust Network Access) proxy in FortiOS allows a FortiGate to act as a proxy for client-initiated connections to internal applications, verifying device posture and user identity without requiring a full VPN client tunnel. This is the defining feature of FortiGate's ZTNA implementation, which uses FortiClient EMS for posture and FortiGate for policy enforcement.

Answer

IPsec VPN with XAuth authentication

Answer

SSL VPN with web mode portal

Answer

FortiGate's explicit web proxy