NSE7 Advanced VPN and Zero Trust Practice Test 15 — 15 Questions

Question 1

A FortiGate administrator configures SAML SSO with FortiGate as the Service Provider (SP) and an external IdP. Users report that they are prompted for credentials repeatedly without successful authentication. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IdP certificate is not imported or trusted on the FortiGate. When FortiGate acts as SAML SP, it must validate the IdP's signed SAML assertions using the IdP's signing certificate. If the IdP certificate is not imported and trusted on the FortiGate, signature validation fails, and authentication cannot complete — users are repeatedly redirected to the IdP and back without a successful login. This is the most common cause of SAML SSO loops in FortiGate deployments.

Answer

The SAML attribute mapping is incorrect

Answer

The FortiGate's clock is synchronized via NTP

Answer

The firewall policy does not allow SAML traffic

Question 2

A FortiGate administrator wants to use PKI certificates for IPsec VPN authentication instead of pre-shared keys. Which phase1 parameter must be set to 'signature' to enable certificate-based authentication?

Accepted Answer

set authmethod signature. In FortiGate IPsec phase1 configuration, certificate-based authentication is enabled by setting authmethod to signature, which tells the FortiGate to use digital signatures (certificates) instead of pre-shared keys. This is the specific phase1 parameter that switches authentication from PSK to certificate-based.

Answer

set cert-validation enable

Answer

set ike-version 2

Answer

set peer-id certificate

Question 3

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

Accepted Answer

To detect when the remote peer is no longer reachable. DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Answer

To dynamically adjust the tunnel MTU

Answer

To encrypt the IKE negotiation traffic

Answer

To automatically renegotiate the IKE SA before it expires

Question 4

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

Accepted Answer

The phase 2 proposal (encryption, authentication, etc.) does not match between peers. If the IKE SA is established but no IPsec SA entries appear in 'diagnose vpn tunnel list', the most likely cause is a Phase 2 proposal mismatch. Phase 1 (IKE SA) negotiates the secure channel, while Phase 2 (IPsec SA) negotiates the actual tunnel parameters. If the encryption, authentication, or other Phase 2 settings do not match, the IPsec SA will fail to establish, even though Phase 1 is up.

Answer

The firewall policies are not configured to allow traffic through the tunnel

Answer

The pre-shared key on both sides does not match

Answer

The interface MTU is set too low

Question 5

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

Accepted Answer

Signature (RSA). Selecting Signature (RSA) in the IPsec phase 1 configuration enables the FortiGate to use digital certificates for authentication, where the remote peer's identity is validated using its certificate. This meets the requirement of validating the identity of the remote VPN peer using a certificate during IKEv2 phase 1.

Answer

Aggressive mode

Answer

Pre-shared key

Answer

EAP

Question 6

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

Accepted Answer

ZTNA proxy on FortiGate. In Fortinet ZTNA, the FortiGate acts as the ZTNA proxy (also called the access proxy). After it terminates the client's TLS session and performs SSL inspection, the FortiGate itself re-originates the connection to the internal application server. No separate component forwards that decrypted traffic — the FortiGate proxy handles both the client-facing and server-facing legs.

Answer

FortiClient EMS

Answer

IPsec VPN tunnel

Answer

FortiNAC

Question 7

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

Accepted Answer

Configure a ZTNA application with a CASB profile and SSL inspection. ZTNA inline CASB for a SaaS application requires configuring a ZTNA application entry that includes a CASB profile and SSL inspection. The CASB profile defines the DLP rules (e.g., blocking credit card numbers), and SSL inspection decrypts the traffic so the CASB can inspect file uploads. This combination is the required configuration to enforce inline DLP on SaaS uploads.

Answer

Use FortiClient to enforce DLP on endpoints

Answer

Configure an IPsec VPN between FortiGate and the SaaS provider

Answer

Configure a web filter profile with DLP sensor

Question 8

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Accepted Answer

Create a ZTNA access rule with a condition matching the tag. Option E is correct because the FortiGate must first learn the ZTNA tags that FortiClient EMS assigns to endpoints; this is done by configuring the EMS connector (FortiClient EMS fabric connector) and importing/synchronizing the tags, which then appear under ZTNA tags on the FortiGate. Option D is correct because enforcement of a specific tag is performed by a ZTNA access rule (access-proxy rule) whose condition matches the imported tag, so only devices presenting that tag are granted access to the protected application. Option A is incorrect because simply setting the ZTNA proxy as the destination with an 'allow only ZTNA' style setting does not itself match a specific EMS tag; tag-based authorization requires the access rule in D. Option B is incorrect because a policy allowing all traffic to the ZTNA proxy would not restrict access by tag and would undermine the requirement. Option C is incorrect because there is no 'set ztna-tag' interface command; tags are matched in ZTNA access rules, not enabled on an interface.

Answer

Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'

Answer

Create a firewall policy allowing all traffic to the ZTNA proxy

Answer

Enable 'set ztna-tag' on the FortiGate interface

Question 9

An administrator wants to ensure that only devices with up-to-date antivirus software can access a sensitive application via ZTNA. Which FortiGate feature should be used to enforce this requirement?

Accepted Answer

ZTNA tags from FortiClient EMS. ZTNA tags from FortiClient EMS are used to enforce device posture requirements such as up-to-date antivirus software. FortiClient EMS assesses endpoint compliance and assigns tags, which FortiGate uses in ZTNA access policies to grant or deny access based on the tag. An AntiVirus profile on a firewall policy scans traffic content but does not directly check the device's antivirus status for ZTNA access.

Answer

SSL deep inspection profile

Answer

Application control profile

Answer

AntiVirus profile on the firewall policy

Question 10

A FortiGate is configured as a ZTNA proxy for a web application. Users report that after authenticating, they receive a '502 Bad Gateway' error. What is the most likely cause?

Accepted Answer

The backend server is unreachable from the FortiGate.. A '502 Bad Gateway' error from a reverse proxy like FortiGate's ZTNA proxy indicates that the proxy successfully received the client request but could not reach the backend server. The most likely cause is that the backend server is unreachable from the FortiGate — due to network issues, firewall rules, or the server being down. This is the classic meaning of a 502 in proxy architectures.

Answer

The ZTNA proxy is not configured with a valid SSL certificate.

Answer

The user's device posture is not compliant.

Answer

The ZTNA rule is not using the correct source interface.

Question 11

A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?

Accepted Answer

Set the authentication method to 'signature'.. In FortiOS IPsec phase1 configuration, the 'authentication-method' parameter controls how the peers authenticate during IKEv2. Setting it to 'signature' instructs the FortiGate to use digital signatures (RSA or ECDSA) with X.509 certificates instead of pre-shared keys. This is the mandatory change to enable certificate-based authentication; other parameters like 'certificate' and 'remote-certificate' are then used to specify the actual certificates.

Answer

Set the proposal to include DH groups 14 or higher.

Answer

Configure 'local-gw' with the certificate's CN.

Answer

Enable 'peer-id-option' and set it to 'any'.

Question 12

A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?

Accepted Answer

set pfs enable; set dhgrp 14. On a FortiGate IPsec phase 2 proposal, PFS is enabled with 'set pfs enable' and the Diffie-Hellman group is specified with 'set dhgrp 14' (note the abbreviated keyword 'dhgrp', not 'dh-group'). This ensures that child SA rekeying performs a fresh DH exchange using group 14 (2048-bit MODP), providing Perfect Forward Secrecy. The 'auto-negotiate' and 'proposal' keywords belong to different configuration contexts and do not control PFS.

Answer

set auto-negotiate enable; set dh-group 14

Answer

set proposal aes256-sha256 dh-group 14

Answer

set pfs enable; set dh-group 14

Question 13

A FortiGate administrator is configuring ZTNA to provide secure access to an internal application. The application is hosted on a server with IP 10.0.1.100 and port 8080. The administrator creates a ZTNA rule on the FortiGate as an access proxy. What is the correct configuration for the ZTNA rule's 'Application Access' entry?

Accepted Answer

External port: 443, Mapped port: 8080, Destination: 10.0.1.100. For ZTNA access proxy, the external port is the port clients connect to (typically 443 for HTTPS), and the mapped port is the internal server port (8080). The destination is the internal server IP. Therefore, option D is correct: external port 443, mapped port 8080, destination 10.0.1.100.

Answer

External port: 0, Mapped port: 8080, Destination: 10.0.1.100

Answer

External port: 8080, Mapped port: 443, Destination: 10.0.1.100

Answer

External port: 443, Mapped port: 443, Destination: 10.0.1.100

Question 14

A FortiGate administrator is using FortiNAC to enforce network access control for wired endpoints. The administrator wants to quarantine any endpoint that fails antivirus compliance. Which action should be configured in the FortiNAC policy to achieve this?

Accepted Answer

Assign the endpoint to a quarantine VLAN. FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

Answer

Disable the switch port

Answer

Send a SNMP trap to the admin

Answer

Block the MAC address at the switch port

Question 15

An administrator wants to configure a multi-peer IPsec VPN where one FortiGate (hub) connects to multiple remote FortiGates (spokes) using a single phase 1 interface with dynamic IP addresses. Which configuration is required on the hub?

Accepted Answer

Set type to dynamic and set remote-gw 0.0.0.0. For a hub-and-spoke IPsec VPN where spokes have dynamic IP addresses, the hub's phase 1 must be configured with `set type dynamic` and `set remote-gw 0.0.0.0` so it can accept connections from any peer IP. This allows a single phase 1 interface to serve multiple spokes with dynamic addresses, which is the standard FortiGate dial-up VPN configuration.

Answer

Set psksecret to a group password and enable XAuth

Answer

Set mode to aggressive and use pre-shared keys

Answer

Set type to static and configure each peer's IP in separate phase1