NSE7 Advanced VPN and Zero Trust Practice Test 12 — 15 Questions

Question 1

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The phase 2 proposal (encryption, authentication, etc.) does not match between peers. IKE SA established but no IPsec SA indicates that phase 2 parameters are misconfigured or the proposal is not matching.

Answer

The firewall policies are not configured to allow traffic through the tunnel

Answer

The pre-shared key on both sides does not match

Answer

The interface MTU is set too low

Question 2

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

Accepted Answer

Signature (RSA). IKEv2 supports certificate-based authentication (RSA signature) for peer identity verification.

Answer

Aggressive mode

Answer

Pre-shared key

Answer

EAP

Question 3

In a hub-and-spoke ADVPN deployment, the spoke FortiGates are configured with IKEv2 and the hub has ADVPN enabled. After initial setup, spokes communicate through the hub. The administrator wants to enable shortcut tunnels so that spokes can directly communicate. What additional configuration is required on the spokes?

Accepted Answer

Enable 'set auto-discovery-sender' on the spoke's phase 1 interface. In ADVPN, shortcut tunnels allow spokes to communicate directly without traversing the hub. For spokes to initiate shortcut setup, they must have 'set auto-discovery-sender' enabled on the phase 1 interface to the hub. This setting allows the spoke to send route information to other spokes via the hub, enabling the hub to assist in shortcut negotiation.

Answer

Enable 'set add-route' on the hub's phase 1 configuration

Answer

Set 'set dpd retrycount' to a higher value on the spoke

Answer

Configure a static route on the spoke pointing to the hub

Question 4

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

Accepted Answer

set action block. ZTNA access rules can block or allow with optional warning. 'Allow with warning' is not available; to show a warning while blocking, the action should be 'Block' with a redirect to a warning portal.

Answer

set action redirect

Answer

set action authenticate

Answer

set action allow

Question 5

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

Accepted Answer

ZTNA proxy on FortiGate. ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

Answer

FortiClient EMS

Answer

IPsec VPN tunnel

Answer

FortiNAC

Question 6

An administrator has configured FortiGate as a SAML service provider (SP) for VPN authentication. Users are prompted for credentials but authentication fails even though they can authenticate directly at the IdP portal. What is the most likely misconfiguration?

Accepted Answer

The FortiGate's entity ID or ACS URL registered at the IdP is incorrect. If users can authenticate at the IdP but not via FortiGate SP, the problem is likely that the FortiGate entity ID or ACS URL does not match what is registered at the IdP.

Answer

The IdP is using HTTP-POST binding while FortiGate expects HTTP-Redirect

Answer

The IdP certificate is not imported on FortiGate

Answer

SAML authentication is not enabled in the VPN portal

Question 7

A FortiGate administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list

proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is in SYN_SENT state; the three-way handshake is incomplete. proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

Answer

The session has been terminated due to inactivity

Answer

The session is a UDP session

Answer

The session is fully established and has been active for 3600 seconds

Question 8

A FortiGate is configured with FortiClient EMS to enforce ZTNA posture checks. The administrator finds that some Windows 10 clients are not reporting their antivirus status correctly, causing them to be blocked. However, the clients have antivirus installed and running. What is the most likely cause?

Accepted Answer

The FortiClient EMS connector is disabled on the endpoints. FortiClient requires the EMS connector to be enabled and the correct compliance profile must be applied. If the antivirus status is not reported, the connector might be disabled or the profile not assigned.

Answer

The clients are not connected to the corporate network

Answer

The antivirus definitions are outdated

Answer

FortiGate is using the wrong EMS tag

Question 9

An administrator wants to use FortiGate as a SAML identity provider (IdP) for a third-party service. Which configuration is required on FortiGate?

Accepted Answer

Configure a SAML identity provider user and export FortiGate's metadata. FortiGate can act as an IdP by creating a SAML IdP user and configuring the service provider metadata.

Answer

Enable SAML authentication in the firewall policy

Answer

Configure FortiAuthenticator as an external IdP

Answer

Configure a SAML service provider user and import the SP metadata

Question 10

A FortiGate administrator sees the following syslog message repeatedly: 'IPsec phase 2 failed to establish SA with peer due to proposal mismatch.' The administrator has already verified that the phase 2 parameters (encryption, authentication, PFS, and lifetime) match on both sides. What else should the administrator check?

Accepted Answer

The local and remote subnets defined in the phase 2 selector. Phase 2 negotiation can also fail due to mismatched traffic selectors (local and remote subnets).

Answer

The phase 1 proposal settings

Answer

The DPD configuration

Answer

The pre-shared key

Question 11

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

Accepted Answer

Configure a ZTNA application with a CASB profile and SSL inspection. ZTNA inline CASB uses a ZTNA proxy with SSL inspection and a CASB profile that includes a data leak prevention (DLP) rule to detect credit card numbers.

Answer

Use FortiClient to enforce DLP on endpoints

Answer

Configure an IPsec VPN between FortiGate and the SaaS provider

Answer

Configure a web filter profile with DLP sensor

Question 12

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a ZTNA access rule with a condition matching the tag. To restrict access based on ZTNA tags, the tag must be imported from FortiClient EMS into FortiGate (option E) and then used in a ZTNA access rule condition that matches the tag (option D). This ensures only devices with the specific tag are allowed.

Answer

Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

Answer

Create a firewall policy allowing all traffic to the ZTNA proxy

Answer

Enable 'set ztna-tag' on the FortiGate interface

Question 13

A FortiGate administrator is troubleshooting an IPsec VPN that uses IKEv2 with certificate authentication. The VPN fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the gateway state is 'IKE_INIT'. Which three possible causes should the administrator investigate? (Choose three.)

Accepted Answer

The certificate of the remote peer is not trusted by the local FortiGate. The IKE_INIT state indicates phase 1 has not completed. Possible causes include the remote peer's certificate not being trusted (A), phase 1 proposal mismatch (C), and the remote peer's certificate having expired (E). Note that with IKEv2 certificate authentication, a pre-shared key (B) is not used, and phase 2 proxy ID mismatch (D) would not cause phase 1 failure.

Answer

The pre-shared key is incorrect

Answer

The phase 2 proxy ID is incorrect

Question 14

An administrator wants to ensure that only devices with up-to-date antivirus software can access a sensitive application via ZTNA. Which FortiGate feature should be used to enforce this requirement?

Accepted Answer

ZTNA tags from FortiClient EMS. ZTNA tags from FortiClient EMS are used to enforce device posture requirements such as up-to-date antivirus software. FortiClient EMS assesses endpoint compliance and assigns tags, which FortiGate uses in ZTNA access policies to grant or deny access based on the tag. An AntiVirus profile on a firewall policy scans traffic content but does not directly check the device's antivirus status for ZTNA access.

Answer

SSL deep inspection profile

Answer

Application control profile

Answer

AntiVirus profile on the firewall policy

Question 15

A FortiGate is configured as a ZTNA proxy for a web application. Users report that after authenticating, they receive a '502 Bad Gateway' error. What is the most likely cause?

Accepted Answer

The backend server is unreachable from the FortiGate.. The 502 Bad Gateway error indicates that the ZTNA proxy successfully received the request but could not get a valid response from the backend server. Therefore, the most likely cause is that the backend server is unreachable from the FortiGate (option A). The other options would result in different errors.

Answer

The ZTNA proxy is not configured with a valid SSL certificate.

Answer

The user's device posture is not compliant.

Answer

The ZTNA rule is not using the correct source interface.