NSE7 Advanced VPN and Zero Trust Practice Test 17 — 15 Questions

Question 1

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The administrator wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) for phase 2. Which parameter must be configured in the phase 2 proposal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'set pfs enable' and select a Diffie-Hellman group.. To enable perfect forward secrecy in an IPsec VPN phase 2, the administrator must enable PFS and specify a Diffie-Hellman group in the phase 2 proposal. This forces a new key exchange for each phase 2 rekey, ensuring that session keys are not derived from the phase 1 key. Both peers must have matching PFS settings for the tunnel to establish.

Answer

Configure 'set auto-negotiate enable' in the phase 2 proposal.

Answer

Use a stronger encryption algorithm such as AES-256 in phase 2.

Answer

Set the phase 2 keylife to a value lower than the phase 1 keylife.

Question 2

A FortiGate administrator is configuring ZTNA to provide access to an internal web application. The administrator wants to ensure that only devices with a specific security posture tag are allowed access. The ZTNA rule is configured with a policy that references a device group synced from FortiClient EMS. However, when a user attempts to access the application, the connection is denied even though the device has the correct tag. What is the most likely cause?

Accepted Answer

The FortiClient EMS tag is not synchronized with the FortiGate due to a certificate or connectivity issue.. The most likely cause is that the FortiClient EMS tag is not synchronized with the FortiGate. Even if the device has the tag in EMS, the FortiGate must receive that information via the EMS connector. If synchronization fails due to certificate issues or connectivity, the FortiGate will not recognize the device as compliant, resulting in a denial.

Answer

The user's device is not running FortiClient, so the tag cannot be evaluated.

Answer

The ZTNA rule is missing a matching source interface or source address.

Answer

The ZTNA proxy rule requires an application mapping that has not been configured.

Question 3

A FortiGate administrator is deploying ZTNA to protect an internal application. Users connect with FortiClient, which establishes a tunnel to the FortiGate. The administrator wants the FortiGate to verify the user's identity and device posture before allowing access to the application. Which FortiGate feature performs this verification as part of the ZTNA access proxy?

Accepted Answer

ZTNA access proxy with authentication and posture check configured on the ZTNA server.. ZTNA enforcement happens at the access proxy, which is configured on the ZTNA server and performs authentication plus posture checks before allowing traffic to the internal application. It replaces traditional NAT-based publishing with identity- and compliance-aware access. Phase2 selectors, NAT, and VIP objects operate at the network layer and cannot verify user identity or device posture.

Answer

A firewall policy with NAT enabled to hide the internal application address.

Answer

A virtual IP (VIP) object that maps an external address to the application server.

Answer

IPsec phase2 selectors that restrict traffic to the application subnet.

Question 4

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The administrator wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) for phase 2. Which parameter must be configured in the phase 2 proposal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ZTNA proxy policy with user group and device posture check.. To enforce both SAML authentication and device posture checks for application access, the administrator must use a ZTNA proxy policy. This policy integrates with FortiClient EMS to receive device tags and enforces access based on user group and posture. Other options either provide broader network access or lack the granular application-level control required.

Answer

Firewall policy with user authentication and antivirus scanning.

Answer

SSL VPN with host checking and SAML authentication.

Answer

IPsec VPN with extended authentication (XAuth) and FortiClient compliance.

Question 5

A FortiGate administrator is deploying ZTNA to replace SSL VPN for remote access. The requirement is that endpoint posture (antivirus status, OS patch level) must be verified before a user is allowed to reach internal web applications through the ZTNA proxy, and that posture must be re-evaluated on each new connection. Which FortiGate configuration element is required to enforce this dynamic, per-connection posture check?

Accepted Answer

A ZTNA server object referencing an access-proxy policy, with an EMS connector tag used as the policy source.. ZTNA on FortiGate enforces access through an access-proxy policy, and endpoint posture is expressed as EMS connector tags that FortiClient EMS updates. Because the policy matches those tags at connection time, a device that falls out of compliance stops matching and loses access on its next request, satisfying the per-connection posture requirement. Identity-only mechanisms cannot deliver this behaviour.

Answer

An SSL VPN portal with host-check enforcement bound to the user group.

Answer

An IPsec dial-up tunnel with extended authentication and a peer group tied to the user group.

Answer

A firewall authentication rule using a local user group with two-factor authentication enabled.

Question 6

A FortiGate administrator is implementing Zero Trust Network Access (ZTNA) for remote users accessing internal applications. The administrator wants to ensure that only authenticated and compliant devices can access the applications, and that all traffic is inspected. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Enable device posture checking by integrating FortiClient EMS with the FortiGate.. To implement ZTNA with Zero Trust principles, you must define the applications via a ZTNA server with application mappings, and integrate FortiClient EMS to enforce device posture. These two actions ensure that only authenticated and compliant devices can access the specified applications. The ZTNA server proxies the traffic, and the EMS integration provides the necessary compliance data for policy decisions.

Answer

Set the ZTNA server to use 'transparent' mode instead of 'proxy' mode for all applications.

Answer

Create a firewall policy that allows all traffic from the ZTNA server to the internal network.

Answer

Configure SSL VPN for remote users to connect before accessing ZTNA applications.

Question 7

An administrator is building an ADVPN with a single hub and many spokes. Spokes are behind NAT devices and receive dynamic public IP addresses. The administrator wants shortcuts to form directly between spokes without routing traffic through the hub. Which combination of features must be configured on the hub and spokes to allow shortcut negotiation to succeed in this environment?

Accepted Answer

Configure IKEv2 with auto-discovery sender and receiver, and enable NAT traversal on all participating FortiGates.. ADVPN relies on IKEv2 auto-discovery to propagate shortcut offers from spoke to spoke through the hub, and on NAT traversal to keep IKE and ESP reachable across NAT devices. With auto-discovery sender and receiver roles configured and NAT traversal enabled, spokes with dynamic addresses can negotiate direct tunnels. Static addressing or unrelated interface features do not substitute for this signalling.

Answer

Enable IPsec aggregate interfaces and set net-device disable on all tunnel interfaces.

Answer

Enable exchange-interface-ip and set mode-cfg on the spokes while disabling DPD on the hub.

Answer

Set the hub as a dial-up server and configure the spokes with static VIP addresses on the NAT devices.

Question 8

A FortiGate administrator has deployed ZTNA with FortiClient EMS tagging. A remote user's endpoint is tagged as 'Compliant' in EMS, but the FortiGate ZTNA policy still denies the user's connection to the internal web application. The administrator confirmed the EMS connector status on the FortiGate shows 'Connected' and the tag is visible in the FortiGate's device inventory. What is the most likely cause of the access denial?

Accepted Answer

The ZTNA firewall policy references the tag as a source address, but the user's traffic is being matched by a broader policy above it that denies access.. A correctly tagged endpoint can still be denied if a policy earlier in the top-down evaluation order matches the traffic first. The FortiGate applies the first matching firewall policy, so a broad deny or restrictive allow placed above the ZTNA tag-based policy will intercept the connection before the tag-based rule is evaluated. Verifying policy order and specificity resolves the denial.

Answer

FortiClient EMS requires the endpoint to be re-registered with the FortiGate before the tag can be used in a ZTNA policy.

Answer

The ZTNA policy must use the EMS tag as a destination address rather than a source address to match the endpoint.

Answer

The FortiGate requires a valid SSL certificate on the endpoint before it will honor any EMS compliance tag in a ZTNA policy.

Question 9

A FortiGate administrator is deploying ZTNA with a FortiClient EMS that tags endpoints as 'compliant' or 'non-compliant'. The administrator wants the FortiGate to grant access only to endpoints that FortiClient EMS has tagged as compliant, while still allowing non-compliant endpoints to reach a remediation portal. Which two configuration elements on the FortiGate must be aligned to enforce this?

Accepted Answer

A FortiClient EMS fabric connector with the correct EMS tags, and firewall policies that use those tags as source or destination criteria.. FortiClient EMS tags are surfaced on FortiGate through the EMS fabric connector. The FortiGate must be configured with the connector (host, credentials, and tag synchronization) so EMS tags become usable address objects, and firewall or ZTNA policies must reference those tag objects as match criteria. A separate policy can then allow non-compliant endpoints to reach the remediation portal.

Answer

A ZTNA server with an SSL certificate and a firewall policy referencing an EMS-tag-based address object, plus a second policy permitting non-compliant endpoints to the remediation portal.

Answer

An LDAP connector to Active Directory and user group policies that map AD groups to the compliant tag.

Answer

A ZTNA proxy rule with an inline CASB profile and a DLP sensor that inspects endpoint traffic for compliance indicators.

Question 10

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The administrator wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) for phase 2. Which parameter must be configured in the phase 2 proposal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate phase 1 configurations for each peer, and use a route-based VPN with multiple tunnel interfaces and a routing protocol to select the active path.. Automatic failover between IPsec peers requires multiple phase 1 configurations, one for each peer. Route-based VPNs with tunnel interfaces allow dynamic routing protocols to detect failures and reconverge, or static routes with link monitoring can be used. This ensures that if the primary peer becomes unreachable, traffic is redirected to the secondary peer. DPD alone only detects failure; it does not perform failover.

Answer

Configure a single phase 1 with 'set remote-gw' as a DNS name that resolves to both peers, and enable DPD.

Answer

Use a single phase 1 with 'set remote-gw 0.0.0.0' and configure multiple dial-up VPNs, then rely on DPD to failover.

Answer

Configure a single phase 1 with multiple remote gateways and enable 'set dpd on-idle'.

Question 11

A FortiGate administrator is troubleshooting a ZTNA access proxy rule that is not matching traffic from a specific user group. The rule is configured with a source of 'ZTNA_Users' and a destination of the internal web server. The administrator confirms that the user is authenticated and has the correct EMS tag. Which FortiGate CLI command should the administrator use to verify that the ZTNA rule is being evaluated correctly?

Accepted Answer

diagnose wad debug enable category ztna. The 'diagnose wad debug enable category ztna' command enables detailed debugging of ZTNA processing in the WAD daemon, which handles access proxy rules. It shows rule matching, user identification, and any errors. Other commands like 'diagnose firewall auth list' only show authentication status, while 'fnbamd' debugging is for authentication daemon issues. For ZTNA rule matching, WAD debug is the correct tool.

Answer

diagnose debug application fnbamd -1

Answer

diagnose vpn ike gateway list

Answer

diagnose firewall auth list

Question 12

A FortiGate administrator is troubleshooting a site-to-site IPsec tunnel that intermittently drops. The administrator runs 'diagnose vpn ike gateway list' and observes that the tunnel re-establishes every few minutes, and 'diagnose debug application ike -1' shows repeated INVALID_KE_PAYLOAD notifications. The remote peer is a third-party gateway that only supports a specific Diffie-Hellman group. What is the most likely cause of the repeated renegotiation?

Accepted Answer

The FortiGate phase 1 proposal includes a Diffie-Hellman group that the remote gateway does not support, causing IKE to restart with a different group.. INVALID_KE_PAYLOAD is emitted when the proposed Diffie-Hellman group is unacceptable to the peer, and the initiator then retries with a different group. A third-party gateway restricted to one group will keep rejecting the FortiGate's default proposal, producing the periodic renegotiation. Matching the phase 1 DH group to the remote gateway's supported value fixes the loop.

Answer

Dead peer detection is configured with an interval shorter than the remote gateway's idle timeout, causing premature tunnel deletion.

Answer

The pre-shared key on the FortiGate does not match the remote gateway, so authentication fails and IKE restarts.

Answer

The phase 2 selectors do not match between peers, so the quick mode negotiation fails and the tunnel is torn down.

Question 13

A FortiGate administrator is setting up a ZTNA environment where FortiClient EMS is used to tag endpoints. The administrator wants to create a firewall policy that allows access to a web application only for users whose endpoints have the tag 'Compliant'. Which configuration step is required to use the tag in the firewall policy?

Accepted Answer

Create a dynamic firewall address that references the ZTNA tag.. To enforce ZTNA tag-based access in a firewall policy, the administrator must create a dynamic firewall address that references the ZTNA tag. This dynamic address is then used in the policy's source or destination field. The FortiGate populates the address with IPs of endpoints that have the tag, as reported by FortiClient EMS. This allows granular control based on endpoint compliance status.

Answer

Configure a ZTNA server and add the tag to the server's rule.

Answer

Enable ZTNA tagging in the global settings.

Answer

Add the tag to the FortiClient EMS compliance rule.

Question 14

A FortiGate administrator is deploying ZTNA to provide secure access to internal web applications. The administrator wants to ensure that only devices with up-to-date antivirus signatures are granted access. Which FortiGate component should be used to enforce this requirement?

Accepted Answer

FortiClient EMS compliance rules.. In FortiGate ZTNA, endpoint compliance is enforced through integration with FortiClient EMS. FortiClient EMS compliance rules define the required posture, such as antivirus signature version, and FortiGate queries EMS for the compliance status of the device. ZTNA rules then use this information to allow or deny access. This ensures that only compliant devices can reach protected applications.

Answer

SSL VPN portal with host checking.

Answer

ZTNA proxy rules with application mapping.

Answer

Firewall policies with antivirus security profiles.

Question 15

An administrator is configuring an IPsec VPN on a FortiGate that will interoperate with a third-party peer. The peer requires the use of a specific encryption domain and does not support IKEv2. The administrator wants to ensure that only specific subnets are permitted through the tunnel, while all other traffic is excluded from the SA. Which configuration element on the FortiGate directly controls which traffic is selected for the IPsec tunnel?

Accepted Answer

The phase 2 selector, configured with the local and remote subnet pairs that match the peer's encryption domain.. The phase 2 selector is the configuration element that defines the encryption domain by specifying the local and remote subnet pairs permitted through the IPsec SA. It must match the third-party peer's required subnets. Firewall policies and routes influence forwarding and permission, but only the phase 2 selector determines which traffic is actually selected and encrypted for the tunnel.

Answer

The routing table entries that direct traffic to the IPsec interface.

Answer

The phase 1 proposal, which includes the encryption and authentication algorithms negotiated with the peer.

Answer

The firewall address objects referenced in the policy that permits traffic from the local subnet to the remote subnet.