NSE7 Advanced VPN and Zero Trust Practice Test 2 — 15 Questions

Question 1

A FortiGate administrator runs the following diagnostic command: 'diagnose vpn ike gateway list'. The output shows a gateway with state 'down'. The administrator verifies that the peer is reachable and the pre-shared key is correct. What is a possible reason for the gateway state being 'down'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The phase2 proposal is mismatched.. In FortiGate, the IKE gateway state reflects the overall status of the VPN tunnel, including both phase1 and phase2. While phase2 proposals are negotiated separately, a mismatch can cause the gateway to transition to 'down' because the gateway may re-evaluate its state after repeated phase2 negotiation failures. The other options are less likely: a changed remote IP would cause unreachability (contradicts given that peer is reachable), disabled DPD would not cause the state to go down, and idle timeout typically results in an 'idle' state, not 'down', unless DPD failures occur.

Answer

The remote gateway IP address has changed.

Answer

DPD is disabled on both ends.

Answer

IKE idle timeout has expired.

Question 2

An administrator configures a multi-peer IPsec VPN on FortiGate for redundancy. The primary peer is 10.1.1.1 and secondary is 10.1.1.2. The administrator notices that when the primary peer goes down, the FortiGate does not fail over to the secondary peer until the IKE SA times out (about 60 seconds). Which setting can reduce this failover time?

Accepted Answer

Set 'dpd-retryinterval' to 5 and 'dpd-retrycount' to 3. [correct]. DPD retry interval and count control how quickly FortiGate detects a dead peer. With retryinterval=5 and retrycount=3, the peer is declared dead after 15 seconds of no response, triggering failover to the secondary.

Answer

Configure 'idle-timeout' to 30 seconds.

Answer

Use aggressive mode for IKE negotiation.

Answer

Enable 'auto-negotiate' on the phase1 interface.

Question 3

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors form, but routes learned from the remote site are not appearing in the routing table. What is the most likely cause?

Accepted Answer

The 'allowaccess' setting on the IPsec interface does not include OSPF.. FortiGate's IPsec virtual interfaces require the 'allowaccess' command to specify which dynamic routing protocols are allowed. Without 'allowaccess ospf', OSPF packets are dropped even if the tunnel is up.

Answer

The firewall policy allows OSPF traffic (protocol 89) but not IPsec ESP. [wrong]

Answer

The IPsec interface MTU is too low for OSPF packets. [wrong]

Answer

The OSPF network type is not set to point-to-point. [wrong]

Question 4

A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?

Accepted Answer

Set the authentication method to 'signature'.. For PKI certificate authentication in IKEv2, the phase1 authentication method must be set to 'signature'. This tells FortiGate to use the certificate's private key for IKE authentication, rather than a pre-shared key.

Answer

Set the proposal to include DH groups 14 or higher.

Answer

Configure 'local-gw' with the certificate's CN.

Answer

Enable 'peer-id-option' and set it to 'any'.

Question 5

An administrator configures a hub-and-spoke ADVPN with IBGP over the VPN overlays. The spokes receive the default route from the hub, but they cannot reach each other directly. The administrator wants spoke-to-spoke traffic to use shortcut tunnels. Which additional configuration is required on the hub?

Accepted Answer

Enable 'auto-discovery-sender' and 'auto-discovery-receiver' on the phase1 interfaces.. To enable spoke-to-spoke shortcut tunnels in an ADVPN with hub-and-spoke topology, the hub must have both 'auto-discovery-sender' and 'auto-discovery-receiver' enabled on its phase1 interfaces (option A). This allows the hub to exchange ADVPN control messages and trigger shortcut setup between spokes. Option B (next-hop-self) is unnecessary because spokes already receive the default route from the hub; shortcut routes are resolved via the ADVPN overlay. Option C (firewall policy) is required for traffic flow but does not initiate shortcut tunnels. Option D (advpn-multicast) is for multicast over ADVPN, not for unicast shortcut tunnels.

Answer

Configure 'set neighbor <spoke-ip> next-hop-self' under BGP.

Answer

Create a firewall policy that permits traffic between spokes.

Answer

Add 'set advpn-multicast enable' to the phase1 configuration.

Question 6

A FortiGate administrator needs to block an application (e.g., Facebook) while allowing HTTPS traffic for ZTNA users. Which TWO configurations are required to achieve this?

Accepted Answer

SSL deep inspection profile to decrypt HTTPS traffic.. To block an application like Facebook while allowing HTTPS traffic for ZTNA users, two configurations are required. First, an application control profile with Facebook blocked must be applied to the firewall policy (option D). Application control can identify and block Facebook traffic regardless of port or protocol. Second, SSL deep inspection must be enabled (option C) to decrypt HTTPS traffic so that the application control engine can inspect the content and detect Facebook. Without SSL inspection, Facebook traffic over HTTPS would be encrypted and bypass application control. Web filter (option A) relies on URL categorization, but Facebook uses many domains and IPs, making it less effective. Inline CASB (option B) is designed for SaaS application governance, not for blocking general applications. ZTNA tags (option E) are used for access control based on client posture, not for application blocking.

Answer

Web filter profile with Facebook categorized as blocked.

Answer

Enable 'inline CASB' on the ZTNA rule.

Answer

Add a ZTNA tag for Facebook blocking.

Question 7

An administrator has a FortiGate hub with multiple spoke FortiGates in an ADVPN topology. The spokes are behind NAT and have dynamic public IPs. The hub is configured with a static IP. Which THREE steps are necessary for the spokes to establish a shortcut tunnel between each other?

Answer

Enable 'auto-discovery-receiver' on the hub's phase1.

Answer

Set the phase1 authentication method to 'signature' on all devices.

Answer

Configure the spokes with the hub's public IP as the remote gateway.

Answer

Enable 'auto-discovery-sender' on the spokes' phase1.

Answer

Enable NAT traversal on the hub's phase1 configuration.

Question 8

A network administrator is configuring an ADVPN hub-and-spoke topology. The hub is FortiGate-A and the spokes are FortiGate-B and FortiGate-C. The administrator wants spoke-to-spoke traffic to dynamically establish direct tunnels when needed. Which two settings must be enabled on the hub's phase 1 interface to support this?

Accepted Answer

set auto-discovery-sender enable. For ADVPN hub-and-spoke topology, the hub must be configured as the sender to initiate shortcut messages. This is done by enabling 'set auto-discovery-sender enable' on the hub's phase 1 interface. The 'set add-route enable' setting is used to install routes for the VPN tunnels, but it is not specifically required for the hub to support spoke-to-spoke dynamic shortcuts; spokes need it to install routes for shortcuts. Therefore, only option C is correct.

Answer

set mode aggressive

Answer

set auto-discovery-shortcut-mode both

Answer

set add-route enable

Question 9

A company is implementing Zero Trust Network Access using Fortinet's ZTNA solution. They have deployed a FortiGate as the ZTNA gateway and are using FortiClient as the ZTNA agent. Users report that they can initiate ZTNA connections but the connections drop after a few minutes. The FortiGate logs show that the ZTNA session is being terminated due to a endpoint compliance check failure. Which action should the administrator take to resolve this issue?

Accepted Answer

Review and adjust the endpoint compliance rules in FortiClient EMS.. The FortiGate logs explicitly indicate that the ZTNA session is being terminated due to an endpoint compliance check failure. This means the FortiGate is enforcing compliance rules defined in FortiClient EMS, and when the endpoint fails those checks (e.g., missing antivirus updates, firewall disabled), the session is dropped. Reviewing and adjusting the compliance rules in EMS allows the administrator to align the requirements with the actual endpoint posture or correct the misconfiguration causing the failure.

Answer

Disable endpoint compliance checks on the FortiGate.

Answer

Increase the session timeout on the FortiGate ZTNA gateway.

Answer

Change the authentication method from certificate to LDAP.

Question 10

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

Accepted Answer

The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.. In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Answer

The client's FortiClient agent is not connected to the EMS server.

Answer

The destination server does not have internet connectivity.

Answer

The FortiGate policy is set to deny traffic from the client's subnet.

Question 11

An organization is designing a Zero Trust Network Access solution with Fortinet. They want to ensure that only devices with up-to-date antivirus software can access sensitive applications. Which component is responsible for enforcing this requirement?

Accepted Answer

FortiClient EMS. FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiGate ZTNA gateway

Question 12

A company uses FortiGate ZTNA to provide remote access to an internal web application. The application requires client certificates for authentication. The administrator has configured the ZTNA rule to use certificate authentication. However, users report that they are prompted for credentials repeatedly. What is the most likely cause?

Accepted Answer

The client certificate is not trusted by the FortiGate.. When a ZTNA rule is configured for certificate authentication, the FortiGate must trust the client certificate's issuing CA. If the CA certificate is not imported into the FortiGate's trusted CA list, the certificate chain validation fails, causing the authentication to be rejected and the client to be repeatedly prompted for credentials. This is the most common cause of repeated credential prompts in certificate-based ZTNA setups.

Answer

The user's password has expired.

Answer

The ZTNA rule is configured to use SAML authentication instead.

Answer

The FortiClient EMS server is not reachable from the client.

Question 13

In a Zero Trust Network Access architecture, which component acts as the policy enforcement point for access decisions?

Accepted Answer

FortiGate ZTNA gateway. In a Zero Trust Network Access (ZTNA) architecture, the FortiGate ZTNA gateway acts as the policy enforcement point (PEP). It terminates encrypted ZTNA tunnels from FortiClient agents, inspects traffic against configured access policies, and enforces decisions based on identity, device posture, and context. This is distinct from the control plane (FortiClient EMS) or logging (FortiAnalyzer).

Answer

FortiClient agent

Answer

FortiAnalyzer

Answer

FortiClient EMS

Question 14

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

Accepted Answer

The ZTNA proxy idle timeout is set to a lower value than the global timeout.. The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

Answer

The internal application is not responding to the proxy request.

Answer

The internal application has a 5-second timeout.

Answer

The client's FortiClient is not receiving the ZTNA tags.

Question 15

A company wants to deploy ZTNA to secure access to internal applications for remote employees. They have a FortiGate with a public IP and internal servers. Which deployment mode should they choose to minimize changes to existing firewall rules?

Accepted Answer

Proxy-based ZTNA. Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

Answer

SSL VPN with ZTNA

Answer

IPsec VPN with ZTNA

Answer

Both proxy-based and IPsec VPN