NSE7 Advanced VPN and Zero Trust Practice Test 13 — 15 Questions

Question 1

An administrator has a FortiGate hub with multiple spoke FortiGates in an ADVPN topology. The spokes are behind NAT and have dynamic public IPs. The hub is configured with a static IP. Which THREE steps are necessary for the spokes to establish a shortcut tunnel between each other?

Answer

Enable 'auto-discovery-receiver' on the hub's phase1.

Answer

Set the phase1 authentication method to 'signature' on all devices.

Answer

Configure the spokes with the hub's public IP as the remote gateway.

Answer

Enable 'auto-discovery-sender' on the spokes' phase1.

Answer

Enable NAT traversal on the hub's phase1 configuration.

Question 2

A FortiGate is configured as a ZTNA proxy for an internal application. Users authenticate via SAML with FortiGate as the IdP. The administrator wants to enforce that only devices with a valid ZTNA tag can access the application. Which TWO configurations are required?

Answer

Install a client certificate on each device for authentication.

Answer

Configure FortiClient EMS to push compliance tags to FortiGate.

Answer

Set the ZTNA proxy to require FortiClient on the client device.

Answer

Create a ZTNA rule with tag conditions.

Answer

Enable ZTNA tags on the firewall policy that permits access to the application.

Question 3

A network administrator is configuring an ADVPN hub-and-spoke topology. The hub is FortiGate-A and the spokes are FortiGate-B and FortiGate-C. The administrator wants spoke-to-spoke traffic to dynamically establish direct tunnels when needed. Which two settings must be enabled on the hub's phase 1 interface to support this?

Accepted Answer

set auto-discovery-sender enable. Option B (set auto-discovery-sender enable) on the hub and Option C (set auto-discovery-receiver enable) on each spoke are required. However, since the question asks for the hub's settings, the correct answer is the hub must be configured as sender and also set add-route to enable shortcut tunnels.

Answer

set mode aggressive

Answer

set auto-discovery-shortcut-mode both

Question 4

An administrator is troubleshooting an IPsec VPN tunnel that connects a branch office to the main office. The tunnel is down. The administrator runs 'diagnose vpn ike gateway list' and sees the following output:
IKE gateway: branch
  state: down
  DPD: enabled
  DPD retrycount: 3
  DPD retryinterval: 10
What does the DPD configuration indicate?

Accepted Answer

The tunnel will be brought down after 3 unanswered DPD probes, each 10 seconds apart. DPD (Dead Peer Detection) is configured with a retry count of 3 and a retry interval of 10 seconds. This means the FortiGate will send DPD probes every 10 seconds and after 3 consecutive failures (30 seconds total without response), it will consider the peer dead. The tunnel is currently down, likely because DPD detected the peer as unreachable.

Answer

The tunnel will be brought down immediately after the first DPD timeout

Answer

The tunnel will stay up indefinitely because DPD is disabled

Answer

DPD will send probes every 30 seconds

Question 5

A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?

Accepted Answer

set pfs enable; set dhgrp 14. To enable PFS with DH group 14 on the phase 2 proposal, the correct CLI command is 'set pfs enable' and 'set dhgrp 14'. The command 'set proposal aes256-sha256' defines encryption/integrity, not PFS. The other options do not set PFS correctly.

Answer

set auto-negotiate enable; set dh-group 14

Answer

set proposal aes256-sha256 dh-group 14

Answer

set pfs enable; set dh-group 14

Question 6

A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?

Accepted Answer

External port: 443, Mapped port: 8080, Destination: 10.0.1.100. For ZTNA access proxy, the destination virtual IP maps the external address and port to the internal server. Option A is correct: the external port is the port that the client connects to (e.g., 443) and the mapped port is the internal server port (8080).

Answer

External port: 0, Mapped port: 8080, Destination: 10.0.1.100

Answer

External port: 8080, Mapped port: 443, Destination: 10.0.1.100

Answer

External port: 443, Mapped port: 443, Destination: 10.0.1.100

Question 7

An administrator wants to enforce that only managed FortiClient endpoints with up-to-date antivirus and a specific OS version can access a sensitive internal network via IPsec VPN. Which feature should be used to achieve this?

Accepted Answer

FortiClient EMS compliance enforcement. FortiClient EMS can enforce compliance rules such as requiring up-to-date antivirus and specific OS version. When a FortiClient connects to the FortiGate VPN, the FortiGate can check the endpoint's posture via FortiClient EMS and apply a matching firewall policy.

Answer

ZTNA tags

Answer

FortiNAC

Answer

SAML SSO

Question 8

A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?

Accepted Answer

The SAML assertion lifetime is configured too short. SAML assertions have a validity period. If the IdP (FortiGate) sets a short assertion lifetime or the SP's session timeout is shorter, users will be prompted to re-authenticate. The most common cause is the assertion lifetime being too short.

Answer

The FortiGate's SAML service provider certificate has expired

Answer

The FortiGate's clock is not synchronized with NTP

Answer

The SP is using HTTP-POST binding instead of redirect

Question 9

An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?

Accepted Answer

The route's OSPF cost is higher than an existing route with a lower administrative distance. Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.

Answer

The IPsec tunnel is using transport mode instead of tunnel mode

Answer

OSPF authentication is mismatched

Answer

The OSPF network type is not set to point-to-point

Question 10

A FortiGate administrator is using FortiNAC to enforce network access control for wired endpoints. The administrator wants to quarantine any endpoint that fails antivirus compliance. Which action should be configured in the FortiNAC policy to achieve this?

Accepted Answer

Assign the endpoint to a quarantine VLAN. FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

Answer

Disable the switch port

Answer

Send a SNMP trap to the admin

Answer

Block the MAC address at the switch port

Question 11

An administrator wants to configure a multi-peer IPsec VPN where one FortiGate (hub) connects to multiple remote FortiGates (spokes) using a single phase 1 interface with dynamic IP addresses. Which configuration is required on the hub?

Accepted Answer

Set type to dynamic and set remote-gw 0.0.0.0. To allow multiple peers to connect with dynamic IPs, the hub must use a phase 1 interface with mode-cfg enabled to assign IPs to clients and accept connections from any remote IP (set remote-gw 0.0.0.0). This is commonly called a dial-up VPN configuration.

Answer

Set psksecret to a group password and enable XAuth

Answer

Set mode to aggressive and use pre-shared keys

Answer

Set type to static and configure each peer's IP in separate phase1

Question 12

A ZTNA rule is configured to allow access to an internal application only if the client device has the ZTNA tag 'Compliant' and the user is authenticated via SAML. The FortiGate is acting as ZTNA proxy. A user successfully authenticates but the device is not tagged. What happens when the user tries to access the application?

Accepted Answer

The user is denied access. ZTNA rules can require both authentication and device posture (ZTNA tags). If the device tag is missing or does not match, the access will be denied. The user may see an access denied page or a generic error.

Answer

The FortiGate dynamically assigns the 'Compliant' tag to the device

Answer

The user is redirected to a device registration portal

Answer

The user is granted access because authentication succeeded

Question 13

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

Accepted Answer

Check the routing table for routes to the remote subnet. Since both phases are up and policies are correct, the issue is likely routing. The administrator should verify that the correct routes are pointing to the VPN interface (tunnel interface) on both sides. Without proper routes, traffic will not be forwarded into the tunnel.

Answer

Increase the phase 2 keylife

Answer

Check the FortiGate's NTP status

Answer

Disable DPD

Question 14

An administrator is configuring a hub-and-spoke ADVPN with IBGP as the overlay routing protocol. The hub is configured as a route reflector. Which two conditions must be met for a shortcut tunnel to be established between two spokes? (Choose TWO)

Accepted Answer

The hub must have a route to the spoke's subnet via the IPsec tunnel. For shortcut tunnels to establish, the hub must send a shortcut offer to the spokes. This requires that the hub learns the route from one spoke via IBGP and reflects it to the other spoke. The spoke must also have auto-discovery-shortcut-mode enabled to accept the shortcut. Additionally, the spokes must be able to communicate directly (no NAT between them).

Answer

The spokes must use overlapping IPsec proposal sets

Answer

The hub must have 'set auto-discovery-shortcut-mode both'

Answer

The spokes must be in the same VDOM

Question 15

An administrator wants to implement ZTNA inline CASB to control access to a SaaS application (e.g., Office 365). Which three components are required for this setup? (Choose THREE)

Accepted Answer

FortiClient EMS for device posture and tag assignment. ZTNA inline CASB requires FortiGate as an inline proxy, FortiClient EMS for device posture and identity, and a ZTNA rule that proxies traffic to the SaaS application. Additionally, SSL deep inspection is required to decrypt and inspect traffic.

Answer

FortiNAC for network access control

Answer

A VPN tunnel between FortiGate and the SaaS provider