NSE7 Advanced VPN and Zero Trust Practice Test 13 — 15 Questions

Question 1

An administrator configures a hub-and-spoke ADVPN with FortiGate at the hub and multiple remote sites. After setup, spokes establish shortcuts directly. However, traffic between two spokes consistently goes through the hub even though shortcuts should exist. Running 'diagnose npu np6 ipsec peercache' shows no shortcut entries. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The spokes are not running BGP over the ADVPN tunnels.. In a hub-and-spoke ADVPN, BGP is required to propagate the spoke's private IP addresses (used as tunnel endpoints) across the overlay network. Without BGP, spokes do not learn each other's tunnel IPs, so they cannot initiate shortcut tunnels. The 'diagnose npu np6 ipsec peercache' command shows no shortcut entries because the shortcut negotiation never starts.

Answer

The firewall policies on the spokes do not allow shortcut traffic.

Answer

Shortcut tunnels are disabled on the hub phase1 configuration.

Answer

The network processor (NP6) is not enabled for IPsec acceleration.

Question 2

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

Accepted Answer

A user group with SAML authentication method and an SSL VPN portal referencing that group.. To enable SAML SSO for SSL VPN on FortiGate, the administrator must configure a user group with the SAML authentication method that references the external IdP, and then reference that group in the SSL VPN portal settings. This establishes the trust relationship where FortiGate acts as the SP and redirects authentication to the IdP. Without the user group and portal binding, SAML authentication cannot be applied to VPN users.

Answer

A RADIUS server pointing to the IdP and an authentication rule.

Answer

An LDAP server with the IdP's certificate and a matching policy.

Answer

A local user with SAML attributes and a firewall policy referencing that user.

Question 3

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN configuration?

Accepted Answer

To detect if a VPN peer is alive by sending periodic probes and bringing down the tunnel if no response is received.. Dead Peer Detection (DPD) sends periodic R-U-THERE probes (RFC 3706) to a VPN peer and expects an R-U-THERE-ACK response. If no response arrives within a configured threshold, DPD declares the peer dead and tears down the tunnel, allowing failover or renegotiation. This prevents traffic from being black-holed into a dead tunnel.

Answer

To establish a backup tunnel in case the primary tunnel fails.

Answer

To automatically renegotiate IKE phase1 keys before they expire.

Answer

To verify the integrity of encrypted packets using HMAC authentication.

Question 4

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

Accepted Answer

To identify a device's compliance status and attributes for policy enforcement.. ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Answer

To mark packets for quality of service (QoS) prioritization.

Answer

To label network interfaces for traffic steering.

Answer

To assign a security level to application traffic.

Question 5

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

Accepted Answer

Configure the FortiGate as an EMS connector and import the tag. For FortiGate to enforce ZTNA tags created in FortiClient EMS, the FortiGate must be configured as an EMS connector so it can poll and import the tags. Once the EMS connector is authorized and the tags are imported, the ZTNA rule can match on those tags to grant or deny access based on device posture. Without the EMS connector, FortiGate has no visibility into the EMS-defined tags.

Answer

Configure SSL VPN to authenticate users and assign tags

Answer

Install a client certificate on each FortiClient from the FortiGate

Answer

Enable ZTNA inline CASB in the antivirus profile

Question 6

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

Accepted Answer

FortiGate ZTNA proxy configuration. To enforce ZTNA policies on a FortiGate, you must configure the FortiGate as a ZTNA access proxy, which inspects and controls traffic to the internal application based on device posture and identity tags. This is done via the ZTNA proxy configuration on the FortiGate, which acts as the policy enforcement point. Without this, the FortiGate cannot apply ZTNA rules to the traffic.

Answer

FortiSandbox for content inspection

Answer

FortiAnalyzer for log analysis

Answer

FortiAuthenticator for RADIUS authentication

Question 7

You run 'diagnose vpn ike gateway list' and see the following:
gateway name: HUB_GW
  version: IKEv2
  state: UP
  mode: main
  local: 10.0.0.1:500
  remote: 203.0.113.5:500
  auth: psk
  dpd: on
  rekey: 86400
  num_peers: 2
  total_tunnels: 2
  auto-discovery: enabled
What does the 'auto-discovery: enabled' indicate about this VPN gateway?

Accepted Answer

The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation. In FortiOS, 'auto-discovery: enabled' on an IKE gateway indicates the gateway is operating as an ADVPN (Auto-Discovery VPN) hub. The hub advertises learned spoke routes to other spokes via IKE, enabling them to establish dynamic shortcut tunnels directly with each other instead of hairpinning traffic through the hub. This is the defining behavior of an ADVPN hub in the 'diagnose vpn ike gateway list' output.

Answer

The gateway will automatically create new phase2 selectors for any remote subnet

Answer

The gateway will automatically renegotiate IKEv2 keys before expiration

Answer

The gateway will discover other VPN gateways on the same network and form peer relationships

Question 8

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

Accepted Answer

ZTNA tags with device posture checks. ZTNA tags with device posture checks allow the FortiGate to evaluate the security posture of the endpoint, including whether antivirus software is installed and running. These tags are then used in firewall policies to grant or deny access to sensitive applications based on compliance. This directly enforces the requirement.

Answer

ZTNA inline CASB

Answer

NAC with FortiNAC

Answer

IPsec VPN with DPD

Question 9

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

Accepted Answer

The remote peer has rebooted or restarted its VPN service. An INITIAL_CONTACT notification is sent by an IKE peer when it establishes a new IKE SA and wants the remote peer to delete any existing IKE SAs associated with the same identity. This is standard behavior after a reboot, VPN service restart, or when the peer loses its state and re-initiates from scratch. Repeated INITIAL_CONTACT messages therefore indicate the remote branch device is repeatedly restarting or flapping its VPN daemon, not a normal rekey or DPD event.

Answer

The remote peer is rekeying the VPN tunnel

Answer

The local FortiGate has a mismatched pre-shared key

Answer

A dead peer detection timeout occurred

Question 10

A company wants to ensure that only company-managed laptops with up-to-date antivirus can access the internal file server remotely. Which Fortinet solution integrates with FortiGate to enforce device compliance before granting ZTNA access?

Accepted Answer

FortiClient EMS. FortiClient EMS is the endpoint management server that maintains compliance posture (antivirus status, OS patch level, running processes) for managed endpoints and shares that information with FortiGate via the ZTNA fabric. FortiGate consults EMS tags and compliance rules before allowing a device to reach the internal file server, so only compliant company-managed laptops pass the ZTNA access check.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiWeb

Question 11

A FortiGate administrator configures a ZTNA access proxy rule to allow access to an internal application only if the user's device has the tag 'Compliant'. The tag is assigned by FortiClient EMS. However, a user with a compliant device is still blocked. The admin sees in the ZTNA logs that the tag is not being received. What should the administrator check FIRST?

Accepted Answer

Ensure the EMS connector is configured under Security Fabric > External Connectors. For a FortiGate to receive ZTNA device tags from FortiClient EMS, the EMS connector must be configured under Security Fabric > External Connectors. Without this connector, the FortiGate has no channel to query or receive tag information, so ZTNA rules referencing tags like 'Compliant' will fail even if the client is healthy. The log showing 'tag not received' points directly at the missing or broken EMS integration.

Answer

Verify that the FortiClient is connected to the internet

Answer

Confirm that the ZTNA rule is enabled and using the correct port

Answer

Check if the application server is reachable from the FortiGate

Question 12

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Accepted Answer

FortiClient on the endpoint device. Option C is correct because FortiClient is the endpoint agent that performs the on-device posture checks (disk encryption status and OS patch level) and reports that information to FortiClient EMS. Option E is correct because FortiClient EMS is where the compliance/ZTNA tagging policies are defined and where tags (such as 'disk-encrypted' and 'patched') are assigned to endpoints based on those posture results. Option D is correct because the FortiGate ZTNA access proxy enforces tag-based rules, only allowing access to the internal application when the endpoint presents the required compliance tags. Option A is not needed since FortiNAC provides network admission control (NAC) for LAN/port-level access, not ZTNA application access control. Option B is not required because ZTNA uses TLS-based access proxy tunnels rather than an IPsec VPN to reach the protected application.

Answer

FortiNAC for network admission control

Answer

IPsec VPN to encrypt traffic between client and FortiGate

Question 13

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Accepted Answer

The phase1 encryption algorithm or integrity algorithm is mismatched. The 'no acceptable proposal' error in IKEv2 specifically indicates that the responder could not find a matching proposal in the IKE_SA_INIT exchange, which is typically caused by a mismatch in the phase1 encryption algorithm (e.g., AES256 vs 3DES) or integrity algorithm (e.g., SHA256 vs SHA1) between the two peers. Option E is also correct because the Diffie-Hellman group is part of the IKEv2 SA proposal; if one peer offers a DH group (e.g., group 14) that the other peer does not support or has not configured, the responder rejects the proposal with the same 'no acceptable proposal' error. Option A is not correct because an unreachable peer would produce timeout or no-response errors rather than a proposal rejection, since the IKE exchange would never reach the proposal comparison stage. Option C is not correct because an IKE version mismatch (IKEv1 vs IKEv2) would cause the peers to fail to parse each other's messages entirely, resulting in different errors such as 'invalid major version' or no response, not 'no acceptable proposal'. Option D is not correct because an incorrect pre-shared key is detected during the IKE_AUTH exchange after the proposal has already been accepted, producing an authentication failure error rather than a proposal rejection.

Answer

The remote peer's IP address is unreachable

Answer

The local FortiGate has the wrong IKE version configured

Answer

The remote peer's pre-shared key is incorrect

Question 14

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

Accepted Answer

Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application. To allow FortiClient to forward traffic to the ZTNA gateway, the FortiGate must be configured as a ZTNA gateway with an access proxy rule that maps the application to a specific hostname and port. FortiClient then connects to the ZTNA gateway's proxy address, which forwards traffic to the internal application server. Option A is incorrect because a CA-signed certificate is not required for FortiClient; FortiGate can use a self-signed certificate for ZTNA. Option B is incorrect because a firewall policy from WAN to the application server would bypass ZTNA and expose the server directly. Option D is incorrect because the application server does not need to trust FortiClient's IP range; ZTNA uses identity-based access, not IP-based.

Answer

Install a CA-signed certificate on FortiClient

Answer

Create a firewall policy from the WAN interface to the application server

Answer

Configure the application server to accept connections from FortiClient's IP range

Question 15

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

Accepted Answer

Provide network access control by enforcing policies based on device identity and posture. FortiNAC's primary function is network access control (NAC): it identifies devices and users, assesses device posture (e.g., OS patches, antivirus status), and enforces access policies that determine whether a device is allowed on the network and at what level of access. This is the core purpose of FortiNAC in a Fortinet security fabric deployment.

Answer

Perform deep packet inspection on all traffic

Answer

Act as a VPN concentrator for remote access

Answer

Provide a cloud-based sandbox for malware analysis