NSE7 Advanced VPN and Zero Trust Practice Test 16 — 15 Questions

Question 1

A ZTNA rule is configured to allow access to an internal application only if the client device has the ZTNA tag 'Compliant' and the user is authenticated via SAML. The FortiGate is acting as ZTNA proxy. A user successfully authenticates but the device is not tagged. What happens when the user tries to access the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user is denied access. ZTNA rules on FortiGate enforce both user authentication and device posture (ZTNA tags) as conditions. If the device lacks the required 'Compliant' tag, the rule does not match, so the traffic is denied even though SAML authentication succeeded. ZTNA is zero-trust: authentication alone is insufficient without device compliance.

Answer

The FortiGate dynamically assigns the 'Compliant' tag to the device

Answer

The user is redirected to a device registration portal

Answer

The user is granted access because authentication succeeded

Question 2

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

Accepted Answer

Check the routing table for routes to the remote subnet. If both IPsec phases are up and policies allow traffic, the next most likely issue is missing or incorrect routing. Without a route to the remote subnet pointing to the IPsec tunnel interface, the FortiGate will not send traffic into the tunnel, even though the tunnel is established. Checking the routing table is the logical next step.

Answer

Increase the phase 2 keylife

Answer

Check the FortiGate's NTP status

Answer

Disable DPD

Question 3

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

Accepted Answer

IKE debug is not enabled. The diagnose vpn ike log-filter command sets a filter for which IKE negotiations to log, but it does not itself enable logging — the administrator must also run diagnose debug application ike -1 (or the equivalent debug enable command) to actually turn on IKE debug output. Seeing no logs after setting a filter is the classic symptom of debug not being enabled. The filter only narrows what would be logged if logging were active.

Answer

The pre-shared key does not match

Answer

The tunnel name is misspelled in the filter

Answer

The remote gateway is unreachable

Question 4

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

Accepted Answer

ZTNA proxy. The ZTNA proxy is the FortiGate component that acts as a reverse proxy for HTTPS applications in a ZTNA deployment. It terminates the client's TLS connection, authenticates the user via FortiClient EMS tags or certificates, and then proxies the request to the internal application, enforcing zero trust access policies. This is distinct from SSL-VPN, which provides network-level access rather than application-level reverse proxy.

Answer

FortiClient EMS

Answer

SSL-VPN portal

Answer

ZTNA inline CASB

Question 5

An administrator wants to enforce that only devices with up-to-date antivirus software can access corporate resources via ZTNA. Which FortiClient feature should be used to enforce this requirement?

Accepted Answer

ZTNA tags. ZTNA tags in FortiClient are dynamic posture attributes (such as antivirus status, OS patch level, and domain membership) that FortiGate/FortiClient EMS uses to make zero-trust access decisions. By tagging endpoints based on their antivirus being up-to-date, the administrator can enforce a policy that only tagged devices are allowed to reach corporate resources. This is the core mechanism Fortinet uses for ZTNA posture-based access control.

Answer

VPN tunnel

Answer

Web filter

Answer

Application firewall

Question 6

An organization uses FortiNAC for network access control. They want to enforce that only corporate-managed devices with up-to-date patches can access the production VLAN. Which THREE components must be integrated or configured?

Accepted Answer

FortiClient EMS with compliance rules. FortiClient EMS with compliance rules (B) is required because FortiNAC relies on the EMS integration to receive endpoint posture and compliance data (e.g., patch level, antivirus status) so it can classify corporate-managed devices as compliant before granting production VLAN access. RADIUS authentication on switches (E) is needed because FortiNAC enforces VLAN assignment and access decisions by acting as the RADIUS server (or proxy) that authenticates supplicants via 802.1X/MAC authentication and returns the appropriate VLAN or deny response. SNMP read/write community on network devices (C) is required so FortiNAC can read MAC/ARP/forwarding tables for host discovery and, with write access, send SNMP SET commands to change switch port VLANs or shut/no-shut ports for enforcement. The other options do not belong: a ZTNA proxy on FortiGate (A) is an application-access control feature unrelated to FortiNAC's LAN enforcement, an IPsec VPN between FortiNAC and FortiGate (D) is not a prerequisite for NAC posture and VLAN enforcement, and while RADIUS is correct, it must be on the switches rather than any generic VPN or proxy component.

Answer

ZTNA proxy on FortiGate

Answer

IPsec VPN between FortiNAC and FortiGate

Question 7

A company is deploying ZTNA to replace their legacy VPN. They want to ensure that only users with a valid certificate and compliant antivirus can access the internal application. Which TWO components are required on the FortiGate for this deployment?

Accepted Answer

ZTNA proxy rule with access proxy. Option A is correct because the ZTNA proxy rule with an access proxy is the FortiGate component that publishes the internal application and enforces the ZTNA access proxy, which is where client certificate authentication and device posture (such as compliant antivirus) are validated before traffic is allowed. Option C is correct because a firewall policy with ZTNA tags matching is required to permit and control the traffic from ZTNA-authenticated users, using the dynamic ZTNA tags that FortiClient EMS assigns based on certificate and antivirus compliance. Together, the access proxy handles the ZTNA authentication and posture check, while the firewall policy with ZTNA tag matching authorizes the session to the internal application. Option B is not required because BGP is a dynamic routing protocol unrelated to ZTNA access control. Option D is not required because SSL-VPN portal is the legacy VPN feature being replaced by ZTNA. Option E is not required because IPsec phase1 with certificate authentication is a site-to-site or remote VPN tunnel mechanism, not the ZTNA access proxy enforcement used here.

Answer

Dynamic routing protocol (BGP)

Answer

SSL-VPN portal

Answer

IPsec phase1 with certificate authentication

Question 8

An administrator is troubleshooting an OSPF over IPsec VPN overlay. The OSPF neighbor state is stuck in EXSTART. The VPN tunnel is up. Which TWO issues could cause this?

Accepted Answer

IP fragmentation issue due to GRE/IPsec overhead. Options A and E are correct because EXSTART is the stage where OSPF routers exchange DBD packets to elect Master/Slave, and these packets are large enough to exceed the reduced MTU caused by GRE/IPsec overhead. An IP fragmentation issue due to GRE/IPsec overhead (A) prevents the large DBD packets from being delivered or reassembled, so the routers keep retransmitting DBDs and never advance past EXSTART. An MTU mismatch on the tunnel interface (E) similarly causes large DBD packets to be dropped (or black-holed when DF is set), producing the same stuck-in-EXSTART symptom. Options B, C, and D are incorrect because a hello/dead interval mismatch (B) or an area ID mismatch (C) prevents the routers from forming a neighbor relationship at all, leaving them in DOWN or INIT, not EXSTART, and an IPsec phase2 proposal mismatch (D) would prevent the VPN tunnel from coming up, whereas the scenario states the tunnel is already up.

Answer

OSPF hello/dead interval mismatch

Answer

OSPF area ID mismatch

Answer

IPsec phase2 proposal mismatch

Question 9

An administrator has deployed a ZTNA configuration on a FortiGate where remote users authenticate through FortiClient EMS. The administrator wants to ensure that only devices with an up-to-date operating system and active antivirus are granted access to an internal web application. The FortiGate is configured as the ZTNA access proxy. Which FortiGate component or configuration is required to enforce these device compliance checks?

Accepted Answer

Configure a ZTNA server with a tag that references the FortiClient EMS compliance tags and apply it in the ZTNA policy.. ZTNA on FortiGate integrates with FortiClient EMS to receive compliance tags. Using these tags in a ZTNA policy allows enforcement of device posture before granting access. This dynamic tagging ensures that only devices meeting the defined compliance criteria can reach the protected application, aligning with zero-trust principles.

Answer

Configure an IPsec VPN tunnel between FortiClient and FortiGate and apply a firewall policy with antivirus scanning.

Answer

Create a firewall policy that uses a schedule to allow access only during business hours, assuming devices are patched.

Answer

Enable client certificate authentication on the ZTNA server and require a specific certificate issued by the EMS.

Question 10

A network administrator is configuring an IPsec VPN on a FortiGate to connect to a remote peer that uses a dynamic IP address. The administrator wants to ensure that the tunnel can be initiated by the remote peer and that the FortiGate accepts connections from any IP, as long as the peer ID matches. Which configuration should the administrator use?

Accepted Answer

Set the remote gateway to 0.0.0.0 and configure a peer ID with the remote peer's identifier.. For a remote peer with a dynamic IP, the FortiGate must listen for incoming connections from any IP. Setting the remote gateway to 0.0.0.0 achieves this. The peer ID is then used to uniquely identify and authenticate the remote peer, ensuring that only the legitimate peer can establish the tunnel. This combination is the correct approach.

Answer

Use a dial-up VPN with a pre-shared key and set the remote gateway to the peer's public IP address.

Answer

Configure the remote gateway as a fully qualified domain name (FQDN) and enable dynamic DNS updates.

Answer

Set the remote gateway to 0.0.0.0 and disable peer ID verification, relying on pre-shared key only.

Question 11

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The remote peer is behind a NAT device and has a dynamic public IP. The administrator wants the FortiGate to act as the responder and allow the remote peer to initiate the tunnel, while ensuring that only the remote peer's unique ID (FQDN) is accepted. Which configuration on the FortiGate is required to achieve this?

Accepted Answer

Set the local gateway to 0.0.0.0 and configure the remote gateway as 0.0.0.0, then set the peer ID to the remote peer's FQDN.. For a remote peer with a dynamic IP behind NAT, the FortiGate must listen on all interfaces and accept connections from any IP. Setting the local gateway to 0.0.0.0 and the remote gateway to 0.0.0.0 enables this. The peer ID is then used to authenticate the remote peer by its FQDN, providing security without relying on a static IP. This configuration is standard for dynamic IP peers.

Answer

Set the local gateway to 0.0.0.0 and configure the remote gateway as the remote peer's current public IP, then set the peer ID to the remote peer's FQDN.

Answer

Set the local gateway to the FortiGate's public IP and configure the remote gateway as 0.0.0.0, then set the peer ID to the remote peer's FQDN.

Answer

Set the local gateway to 0.0.0.0 and configure a pre-shared key with the remote peer's FQDN as the peer ID.

Question 12

A FortiGate is configured as a ZTNA access proxy for an internal application. The administrator wants to enforce device compliance using FortiClient EMS tags before allowing access. Which configuration step is required to ensure that only endpoints with a specific EMS tag can access the application?

Accepted Answer

Configure FortiClient EMS as a fabric connector and synchronize EMS tags.. Enforcing device compliance via EMS tags in ZTNA requires FortiGate to be integrated with FortiClient EMS using a fabric connector. This integration synchronizes EMS tags, which can then be used as source objects in ZTNA rules. Without this, tags are not available, and compliance cannot be enforced. Other steps like device detection or deny actions are secondary.

Answer

Set the ZTNA rule action to 'deny' for non-compliant devices.

Answer

Create a ZTNA rule with a source address of the EMS tag.

Answer

Enable 'device-detection' on the ZTNA rule.

Question 13

A FortiGate is the hub of an IPsec VPN and also terminates SSL VPN for remote users. The administrator wants remote users to access internal resources only after the FortiGate validates the endpoint's compliance through FortiClient EMS, and wants the validation to happen before the user is placed in a VPN address pool. Which SSL VPN configuration element enforces endpoint compliance during the connection handshake?

Accepted Answer

SSL VPN host check policy that references FortiClient EMS compliance tags.. Endpoint compliance before address assignment is enforced by the SSL VPN host check policy, which can reference FortiClient EMS compliance tags and runs during the connection handshake. It blocks or restricts non-compliant endpoints before they receive a VPN address, satisfying the requirement. Certificate and portal settings affect authentication and routing but not posture evaluation.

Answer

SSL VPN settings with the 'Require Client Certificate' option enabled.

Answer

SSL VPN realm configured with a custom authentication timeout.

Answer

SSL VPN portal with split tunneling disabled.

Question 14

A FortiGate administrator is deploying ZTNA for remote users who connect through FortiClient. The administrator wants to enforce device compliance based on the FortiClient EMS tags. The FortiGate is already integrated with FortiClient EMS. Which configuration step is required to use EMS tags in a ZTNA policy?

Accepted Answer

Create a ZTNA rule and specify the EMS tags as a device posture check.. ZTNA rules on FortiGate can enforce device compliance by referencing EMS tags as device posture checks. The FortiGate queries FortiClient EMS for tags and applies them in the ZTNA rule to permit or deny access. This ensures that only compliant devices can reach protected resources. The other options either misplace EMS tags in firewall policies or confuse ZTNA with SSL VPN.

Answer

Enable ZTNA on the SSL VPN portal and map EMS tags to user groups.

Answer

Configure a ZTNA server and add the EMS tags as a source in the firewall policy.

Answer

Define an address object for the EMS server and use it in a firewall policy.

Question 15

A FortiGate administrator is configuring a ZTNA rule that uses a proxy-based policy to inspect traffic to a web application. The administrator wants to ensure that only users who have a valid certificate installed on their endpoint are allowed access. The certificate is issued by the corporate PKI and is stored in the user's certificate store. Which ZTNA configuration element should the administrator use to enforce this requirement?

Accepted Answer

Client certificate authentication in the ZTNA proxy rule. Client certificate authentication in the ZTNA proxy rule is the correct choice because it enforces certificate validation during the TLS handshake. The FortiGate acts as a proxy and can request a client certificate, verify it against a trusted CA, and check revocation. This provides strong authentication that the user possesses a valid certificate from the corporate PKI. Other options either rely on endpoint compliance reporting or are for different access methods, and they do not provide the same cryptographic assurance.

Answer

ZTNA tagging with a dynamic firewall address

Answer

FortiClient EMS compliance rule with certificate check

Answer

SSL VPN with certificate authentication