NSE7 Advanced VPN and Zero Trust Practice Test 2 — 15 Questions

Question 1

A FortiGate is configured with OSPF over an IPsec VPN tunnel to exchange routes with a remote site. The OSPF neighbor states are stuck in 'INIT' and never progress to 'FULL'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OSPF authentication is not configured on both sides. OSPF over IPsec requires careful configuration. When OSPF authentication is enabled on one side but not the other, Hello packets are discarded, preventing neighbor state progression beyond INIT. The correct approach is to ensure authentication settings match on both ends. The other options are less likely: MTU issues typically cause packet fragmentation or loss but not specifically INIT state; phase 2 selectors must include multicast addresses, but that is less common for stuck-in-INIT; hello interval mismatch would cause a different state (typically EXSTART/EXCHANGE).

Answer

The MTU on the VPN interface is too high

Answer

The IPsec phase 2 proposal does not include the OSPF multicast IP address (224.0.0.5)

Answer

The OSPF hello interval is too short

Question 2

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings

Question 3

A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?

Accepted Answer

The IdP session timeout is set to a lower value than the SP session timeout. When the IdP session timeout is shorter than the SP session timeout, the SP will consider the user's session expired and force re-authentication even though the FortiGate still has a valid local session. This mismatch causes the SP to initiate a new SAML authentication flow, prompting the user for credentials again. The SAML single logout URL (A) affects logout behavior, not re-authentication triggers, and an unsigned assertion (B) would cause a different error, not repeated credential prompts.

Answer

The SAML single logout URL is misconfigured

Answer

The SAML assertion is not signed

Answer

The FortiGate is not configured to generate a Name ID

Question 4

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Accepted Answer

Import the remote peer's certificate into the FortiGate's trusted CA list. Option B is correct because IKEv2 with PKI certificates requires the FortiGate to trust the CA that signed the remote peer's certificate; importing the remote peer's certificate (or its issuing CA) into the trusted CA store allows the FortiGate to validate the peer's identity during the IKEv2 authentication exchange. Option C is correct because the local certificate must be bound to the phase 1 interface (via the 'certificate' setting in the phase1 configuration) so the FortiGate can present it to the remote peer and complete mutual certificate authentication. Option A is not essential since AES-256-GCM is only one valid phase 1 encryption choice and the tunnel can establish with other supported algorithms as long as both peers match. Option D is not essential because DPD is a liveness detection feature that helps detect dead peers but is not required for the initial tunnel establishment. Option E is not essential because the phase 2 selector depends on the traffic to be tunneled and does not have to be 0.0.0.0/0 for the IKEv2 tunnel to come up.

Answer

Set the phase 1 proposal to use AES-256-GCM only

Answer

Enable DPD on the phase 1 interface

Answer

Configure the phase 2 selector to include all traffic (0.0.0.0/0)

Question 5

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration of IPsec on a FortiGate requires the right silicon, so option A is correct: the unit must be equipped with a compatible NP7 network processor or CP9 crypto processor, since these are the ASICs that actually perform the offloaded cryptographic operations. Option B is also correct because the phase 2 proposal must negotiate algorithms the accelerator supports, such as AES-GCM (and typically SHA-256 for integrity), otherwise the traffic falls back to the CPU. Option D is correct because certain configurations, like IPsec interface mode combined with kernel-version-dependent features or other offload-disabling options, prevent the session from being handled by the NP/CP hardware. Option C is not a valid requirement because there is no 'set acceleration-mode ipsec' command under the VPN interface configuration; acceleration is enabled via NPU offload settings, not this syntax. Option E is not required because NAT in the firewall policy does not inherently disable IPsec hardware offload, so it is not a condition for acceleration to work.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 6

A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?

Accepted Answer

Dynamic routing (BGP/OSPF) is not configured over the VPN overlay. ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.

Answer

DPD is disabled on the phase 1 interface

Answer

The hub FortiGate has 'set auto-discovery-sender enable' configured

Answer

The spoke FortiGates do not have IKEv2 enabled

Question 7

An administrator runs the following CLI command on a FortiGate and sees the output below:
diagnose vpn ike gateway list
vd: root/0 name: REMOTE_GW vrf: 0 version: 2
state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500
What is the most likely explanation for the IKE SA being created only 1 second ago?

Accepted Answer

The VPN tunnel was just configured or a configuration change was applied. The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Answer

The remote peer changed its IP address

Answer

DPD detected a dead peer and renegotiated

Answer

The phase 2 SA expired and triggered phase 1 rekey

Question 8

A company uses FortiClient EMS for endpoint compliance and ZTNA tag assignment. An administrator wants to enforce that only endpoints with a ZTNA tag 'Compliant' can access a specific internal application through ZTNA. Which configuration is required on the FortiGate?

Accepted Answer

Create a ZTNA access proxy and a ZTNA policy that references the 'Compliant' tag. ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

Answer

Add a firewall policy with source set to the tag object

Answer

Configure an SSL VPN portal and assign the tag as a group

Answer

Configure a security policy with FortiClient endpoint control

Question 9

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

Accepted Answer

Change DPD mode to 'on-demand' and reduce retry count. DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Answer

Increase the phase 2 lifetime

Answer

Enable NAT traversal

Answer

Use IKEv1 instead of IKEv2

Question 10

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

Accepted Answer

FortiNAC Enforcement Engine. The FortiNAC Enforcement Engine is the component that applies network access policies, such as quarantining a device, by communicating with network infrastructure (switches, wireless controllers, firewalls) to change VLANs, apply ACLs, or block ports. When a device fails the antivirus compliance check, the Enforcement Engine executes the quarantine action. It is the policy enforcement point that translates compliance decisions into network changes.

Answer

FortiNAC Collector

Answer

FortiNAC Profiler

Answer

FortiNAC Portal

Question 11

A FortiGate administrator configures a hub-and-spoke VPN with OSPF routing. The spoke FortiGates are learning routes from the hub, but inter-spoke traffic is being routed through the hub instead of using shortcut tunnels. What configuration is missing on the hub to allow ADVPN shortcut establishment?

Accepted Answer

Disable route redistribution from OSPF into the VPN tunnel interface on the hub. ADVPN shortcut establishment requires the hub to send shortcut offers, which is controlled by auto-discovery settings and routing behaviour. The option stating to disable route redistribution from OSPF into the VPN tunnel interface on the hub is the configuration change that allows spokes to learn routes in a way that triggers shortcut offers rather than keeping all inter-spoke traffic centralized through the hub.

Answer

Set the VPN interface type to 'tunnel' instead of 'vlan'

Answer

Enable 'auto-discovery-sender' on the hub and 'auto-discovery-forwarder' on spokes

Answer

Configure a static route for inter-spoke traffic on the hub

Question 12

An administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The TCP handshake has not completed; the client sent SYN and is waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in FortiGate's session table indicates a TCP SYN_SENT state. The session has been active for 3600 seconds (1 hour) with 3599 seconds remaining, meaning the client sent a SYN but never received a SYN-ACK, so the TCP three-way handshake is incomplete. This is why option A is correct.

Answer

The session is fully established and has been idle for 1 hour

Answer

The session is in FIN_WAIT state and is closing

Answer

The session is using UDP protocol

Question 13

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

Accepted Answer

The IdP's entity ID or SSO URL is incorrectly entered on FortiGate. The most likely misconfiguration is that the IdP's entity ID or SSO URL is incorrectly entered on the FortiGate. If the FortiGate sends a SAML request with the wrong destination or issuer, Microsoft Entra ID rejects it as invalid before any user authentication occurs.

Answer

The FortiGate's SP entity ID does not match the Azure AD application's identifier

Answer

The administrator's account is not synchronized with Azure AD

Answer

The certificate used for signing is not trusted by the IdP

Question 14

An administrator configures ZTNA inline CASB to control access to a SaaS application. The goal is to block uploads of files with credit card numbers. The administrator configures a CASB profile with a DLP rule for credit card numbers. However, uploads are not being blocked. What is the most likely reason?

Accepted Answer

SSL inspection is not enabled for the traffic. Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

Answer

The CASB profile is not applied to the ZTNA policy

Answer

The DLP rule is configured to monitor instead of block

Answer

The SaaS application is not supported by CASB

Question 15

An administrator needs to configure a FortiGate to act as a SAML identity provider (IdP) for a third-party cloud application (SP). Which TWO settings must be configured on the FortiGate to function as an IdP?

Accepted Answer

SAML IdP user group. Option B (SAML IdP user group) is required because the FortiGate must define a user group that is designated as the SAML IdP group, which binds the local or remote users that will be authenticated and asserted to the SP. Option C (Service provider configuration with ACS URL and entity ID) is required because the FortiGate needs to know the SP's Assertion Consumer Service (ACS) URL where SAML assertions are posted and the SP's entity ID to correctly target and validate the SAML flow. Option A (LDAP server configuration) is not mandatory for acting as an IdP, since user authentication can be satisfied by local users or other methods and LDAP is only one optional backend. Option D (SP metadata import) is not required because the SP's ACS URL and entity ID can be entered manually rather than importing metadata. Option E (SSL VPN portal) is unrelated, as SSL VPN portals are for remote-access VPN services, not for SAML IdP functionality.

Answer

LDAP server configuration

Answer

SP metadata import

Answer

SSL VPN portal