NSE7 Advanced VPN and Zero Trust Practice Test 18 — 15 Questions

Question 1

A FortiGate administrator is configuring an IPsec VPN to a remote peer behind a device that performs NAT. The administrator notices that the tunnel establishes but rekeys fail after the Phase 1 lifetime expires. Which setting should the administrator enable on the FortiGate to allow the IKE negotiation to survive NAT and pass through the NAT device reliably?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT traversal (NAT-T) on the IPsec Phase 1 interface.. NAT-T allows IKE and ESP to be encapsulated in UDP so NAT devices can translate and track the flow. Enabling NAT-T on the Phase 1 interface lets the tunnel establish and rekey reliably when a peer sits behind NAT, which directly addresses the rekey failures observed after the Phase 1 lifetime expires.

Answer

Dead Peer Detection (DPD) with an aggressive retry interval on Phase 1.

Answer

Aggressive mode for IKE Phase 1 instead of main mode.

Answer

Perfect Forward Secrecy (PFS) on the IPsec Phase 2 interface.

Question 2

An administrator deploys ZTNA with FortiGate as the access proxy for internal web applications. Users authenticate through FortiClient EMS, and device posture checks must be enforced before access is granted. A user with a compliant laptop can reach the application, but when the same user connects from a personal device that fails the posture check, the connection is still allowed. The administrator verifies the ZTNA rule is enabled and the EMS connector is up. Which configuration element is most likely missing to enforce device posture?

Accepted Answer

The ZTNA rule does not reference a device posture tag in the source or policy match criteria.. ZTNA posture enforcement on FortiGate depends on matching EMS-synchronized device tags within the access proxy policy. Authentication alone only proves identity; it does not prove device health. When the policy lacks a posture tag match, every authenticated user is authorized regardless of endpoint compliance. Adding the appropriate EMS tag to the policy match criteria ensures non-compliant devices are denied even though they authenticate successfully.

Answer

The FortiGate is not configured with a valid SSL certificate for the ZTNA access proxy.

Answer

The ZTNA rule is missing a schedule object, allowing access outside business hours.

Answer

The EMS connector is configured with the wrong port number for FortiClient EMS communication.

Question 3

A FortiGate administrator is configuring an IPsec VPN to a remote peer behind a device that performs NAT. The administrator notices that the tunnel establishes but rekeys fail after the Phase 1 lifetime expires. Which setting should the administrator enable on the FortiGate to allow the IKE negotiation to survive NAT and pass through the NAT device reliably?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure phase 2 selectors with local address 192.168.10.0/24 and remote address 10.20.0.0/16, and add a static route for 10.20.0.0/16 pointing to the tunnel interface.. Route-based IPsec uses phase 2 selectors as proxy IDs and relies on routing to steer traffic into the tunnel interface. Configuring the local selector as 192.168.10.0/24 and the remote as 10.20.0.0/16 satisfies the provider, and a static route for 10.20.0.0/16 to the tunnel interface ensures only the intended destination is sent through the VPN.

Answer

Create a policy-based IPsec VPN with firewall policies referencing the tunnel and define the source and destination addresses in those policies.

Answer

Configure phase 2 selectors as 0.0.0.0/0 to 0.0.0.0/0 and rely on firewall policies to restrict traffic to the required subnets.

Answer

Set the tunnel interface IP to 192.168.10.1/24 and configure a route for 0.0.0.0/0 through the tunnel, allowing the provider to filter traffic.

Question 4

A FortiGate administrator is deploying ZTNA to provide access to internal applications for remote users. The administrator wants to ensure that users can only access the specific applications they are authorized for, and that the ZTNA access proxy performs authentication and authorization before forwarding traffic. Which FortiGate component must be configured to define the protected applications and the authentication rules for ZTNA access?

Accepted Answer

A ZTNA server configuration that includes the virtual host, server certificate, and application mappings.. The ZTNA server configuration on the FortiGate is the component that defines the access proxy, including the virtual host, server certificate, and application mappings for protected applications. The ZTNA policy then references this server to enforce authentication and authorization. Without the ZTNA server, there is no application-level proxy to control access, so users could not be restricted to specific applications.

Answer

A firewall policy with the destination set to the internal application server's IP address and the action set to accept.

Answer

An SSL VPN portal with a tunnel mode configuration that maps internal subnets to remote users.

Answer

An IPsec dial-up VPN with extended authentication configured on the phase 1 gateway.

Question 5

A FortiGate administrator is implementing Zero Trust Network Access (ZTNA) for remote users accessing an internal web application. The administrator wants to ensure that only users who have authenticated and whose devices meet posture requirements can reach the application, and that the application itself is never directly exposed to the internet. Which two FortiGate configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Create a firewall policy that matches ZTNA traffic and enforces user authentication and device posture via EMS tags.. ZTNA requires a ZTNA server to define the external FQDN and internal application mapping with a server certificate, and a firewall policy to enforce authentication and device posture using user groups and FortiClient EMS tags. Together these broker access without exposing the application directly to the internet.

Answer

Configure a site-to-site IPsec VPN between the remote user's device and the FortiGate.

Answer

Publish the internal application through a public IP with a DNAT VIP so remote users can connect directly.

Answer

Enable inline CASB on the policy to inspect SaaS application usage.

Question 6

An administrator is configuring ZTNA inline CASB on a FortiGate to control access to a sanctioned SaaS application. The requirement is to block uploads of files containing credit card numbers while allowing normal business uploads. The administrator creates an access proxy rule and a CASB profile with a data loss prevention sensor. During testing, uploads of files with credit card numbers are still allowed. Which action should the administrator take to enforce the block?

Accepted Answer

Attach the CASB profile to the ZTNA access proxy rule so the inline inspection can act on the upload.. Inline CASB requires the CASB profile to be attached to the ZTNA access proxy rule that handles the SaaS session. The profile contains the DLP sensor and SaaS application definitions that enable content inspection. Without this attachment, the FortiGate proxies the traffic but does not apply CASB controls, allowing sensitive uploads to proceed even though the profile and sensor exist.

Answer

Add the SaaS application FQDN to the ZTNA access proxy destination list.

Answer

Enable deep inspection on the firewall policy that carries the SaaS traffic.

Answer

Configure the DLP sensor to use the 'block' action instead of 'monitor' in the sensor definition.

Question 7

A FortiGate administrator is implementing Zero Trust Network Access using ZTNA tags from FortiClient EMS to control access to internal applications. The administrator must ensure that devices losing compliance are denied access and that only managed endpoints can reach the applications. Which two configuration actions are required to meet these goals? (Choose two.)

Accepted Answer

Authorize the FortiGate on FortiClient EMS so it can receive endpoint compliance tags through the EMS connector.. Enforcing posture-based ZTNA requires two things: the FortiGate must be authorized on FortiClient EMS so the EMS connector can deliver dynamic compliance tags, and a ZTNA access-proxy policy must match those tags to allow or deny application access. Together they ensure only compliant, managed endpoints reach the internal applications and that access is revoked when compliance is lost.

Answer

Enable SSL VPN host checking and bind it to the same user group used by the ZTNA policy.

Answer

Configure a static route for the ZTNA application subnets pointing to the EMS connector interface.

Answer

Import the EMS server certificate into the FortiGate's local certificate store and set it as the ZTNA server certificate.

Question 8

A network administrator is setting up an IPsec VPN between two FortiGates. The administrator wants to ensure that if the VPN tunnel goes down, the FortiGate can automatically re-establish it without manual intervention. Which IPsec feature should the administrator enable to detect peer failures and trigger tunnel renegotiation?

Accepted Answer

Dead Peer Detection (DPD) with the mode set to on-idle or always.. Dead Peer Detection is the IPsec mechanism that monitors peer liveness by sending probes or waiting for idle periods. When the peer fails to respond, DPD marks the tunnel as down and triggers renegotiation or failover. Setting DPD mode to on-idle or always ensures continuous monitoring, enabling automatic tunnel recovery without manual intervention.

Answer

Automatic Key Negotiation (AutoIKE) to dynamically negotiate new SAs.

Answer

Perfect Forward Secrecy (PFS) to generate new keys for each phase 2 negotiation.

Answer

IKEv2 fragmentation to allow large packets to traverse the tunnel.

Question 9

A FortiGate administrator is troubleshooting an IPsec VPN where Phase 1 completes but Phase 2 fails to establish. The administrator reviews the Phase 2 configuration and notices that the local and remote subnets do not match between the two peers. Which action should the administrator take to resolve the Phase 2 failure?

Accepted Answer

Adjust the Phase 2 selectors on both peers so the local and remote subnet definitions mirror each other.. Phase 2 selectors must mirror each other: one peer's local subnet must equal the other peer's remote subnet. When they do not match, the child SA negotiation fails even though Phase 1 succeeds. Aligning the selectors on both peers restores the correct traffic selectors and allows Phase 2 to complete.

Answer

Increase the Phase 1 lifetime so the tunnel stays up longer during renegotiation.

Answer

Enable PFS on both peers and set the same Diffie-Hellman group.

Answer

Change the Phase 1 authentication method from pre-shared key to certificates on both peers.

Question 10

A FortiGate is configured as a hub in an ADVPN with multiple spokes. The administrator notices that some spokes are not learning routes from other spokes, even though the ADVPN tunnel is up. The hub is using BGP for routing. Which configuration on the hub is required to enable spoke-to-spoke route propagation?

Accepted Answer

Configure the hub as a BGP route reflector and set the spokes as route reflector clients.. For spoke-to-spoke route propagation in ADVPN, the hub must be configured as a BGP route reflector. This allows the hub to reflect routes received from one spoke to other spokes, enabling dynamic tunnel establishment between spokes. Without route reflection, spokes only learn routes from the hub and cannot directly reach other spokes.

Answer

Set the hub's BGP router ID to match the IPsec tunnel IP address.

Answer

Enable multihop on the hub's BGP peering with the spokes.

Answer

Enable split-horizon on the hub's IPsec tunnel interfaces.

Question 11

A FortiGate administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the tunnel state as 'connecting' but no phase2 selectors are listed. Which step should the administrator take next to identify the issue?

Accepted Answer

Run 'diagnose debug application ike -1' and then attempt to bring up the tunnel to capture IKE negotiation details.. When an IPsec tunnel is stuck in 'connecting' with no phase2 selectors, the issue is likely in phase2 negotiation. Enabling IKE debug with 'diagnose debug application ike -1' will show the detailed negotiation, including proposals and selectors, and any error messages. This is the best next step to identify the cause, such as mismatched phase2 proposals or incorrect proxy IDs. Other commands may not provide the necessary detail.

Answer

Run 'diagnose vpn tunnel list' to check the status of all IPsec tunnels and their selectors.

Answer

Run 'diagnose vpn ike gateway list' with the 'name' parameter to see detailed phase1 and phase2 information.

Answer

Run 'diagnose vpn ike status' to check the IKE status and any error counters.

Question 12

A FortiGate administrator is troubleshooting a ZTNA deployment. Users report that they can access the ZTNA application, but the EMS tags are not being enforced. The administrator verifies that the FortiGate is connected to FortiClient EMS and that the EMS tags exist. What is the most likely cause?

Accepted Answer

The ZTNA rule does not include a device posture check for the EMS tags.. EMS tag enforcement in ZTNA requires a device posture check in the ZTNA rule. If the rule does not reference EMS tags, they are ignored. The administrator confirmed EMS connectivity and tag existence, so the missing posture check is the likely cause. Other options either would prevent access entirely or are unrelated to tag enforcement.

Answer

The FortiClient EMS tags are not synchronized with the FortiGate.

Answer

The ZTNA server configuration is missing the application mapping.

Answer

The firewall policy allowing ZTNA traffic does not have UTM profiles applied.

Question 13

A FortiGate administrator is configuring an IPsec VPN to a remote peer behind a device that performs NAT. The administrator notices that the tunnel establishes but rekeys fail after the Phase 1 lifetime expires. Which setting should the administrator enable on the FortiGate to allow the IKE negotiation to survive NAT and pass through the NAT device reliably?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a ZTNA rule with an inline CASB profile that has a DLP profile configured to block files with sensitive data.. ZTNA inline CASB on FortiGate can inspect traffic to SaaS applications using security profiles. To block uploads of files containing sensitive data, a DLP profile must be configured with rules that detect sensitive data and set the action to block. This DLP profile is then referenced in the inline CASB profile within the ZTNA rule. This combination allows the FortiGate to inspect file contents and block only those that match sensitive data patterns, while allowing other uploads.

Answer

Create a ZTNA rule with an inline CASB profile and enable 'sensitive-data-block' in the CASB settings.

Answer

Create a ZTNA rule with a CASB profile that has 'file-upload-block' enabled.

Answer

Create a ZTNA rule with an application control profile that blocks the upload action for the SaaS application.

Question 14

A FortiGate administrator is configuring an IPsec VPN tunnel to a remote site that is behind a NAT device. The administrator notices that the tunnel establishes, but traffic intermittently fails. Which setting should be adjusted to improve reliability?

Accepted Answer

Enable NAT traversal (NAT-T) and set the keepalive frequency.. When an IPsec peer is behind NAT, the NAT device may close the UDP session if no traffic is sent for a period. Enabling NAT traversal (NAT-T) encapsulates IPsec packets in UDP, and setting a keepalive frequency ensures that periodic packets are sent to keep the NAT mapping alive. This prevents intermittent tunnel failures caused by NAT session timeouts.

Answer

Enable Dead Peer Detection (DPD) with a shorter interval.

Answer

Configure the remote gateway as a dynamic DNS hostname.

Answer

Set the IPsec phase-1 proposal to use AES-256 encryption.

Question 15

A FortiGate administrator is configuring an IPsec VPN to a remote peer behind a device that performs NAT. The administrator notices that the tunnel establishes but rekeys fail after the Phase 1 lifetime expires. Which setting should the administrator enable on the FortiGate to allow the IKE negotiation to survive NAT and pass through the NAT device reliably?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shortcut tunnels are established when a spoke receives a shortcut offer from the hub and the spoke has a route to the destination spoke's public IP.. ADVPN shortcut tunnels are established on demand when the hub sends a shortcut offer and the originating spoke can reach the destination spoke's public IP. They are torn down after an idle timeout when no traffic matches, reverting traffic to the hub path. This dynamic creation and teardown optimizes spoke-to-spoke communication while preserving the hub as a fallback and control point.

Answer

Shortcut tunnels are always established between all spokes at initial VPN bring-up, regardless of traffic patterns.

Answer

Shortcut tunnels can only be established between spokes that are in the same IP subnet.

Answer

Shortcut tunnels require the hub to be removed from the routing path permanently once established.