NSE7 Advanced VPN and Zero Trust Practice Test 3 — 15 Questions

Question 1

Match each SD-WAN component to its role.

Question 2

Match each Fortinet command to its function.

Question 3

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1. Aggressive mode is required for IKE behind NAT when using ADVPN shortcut tunnels. Without it, the hub cannot learn the public IP/port of each spoke to facilitate the shortcut.

Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 4

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Accepted Answer

Device posture checks. ZTNA tags define compliance requirements, and device posture checks evaluate endpoint security state. Together they enable conditional access based on endpoint compliance.

Answer

VPN tunnels

Answer

SAML SSO

Question 5

A FortiGate is configured as a SAML SP for user authentication. When a user attempts to access a protected resource, the FortiGate redirects the user to the IdP login page, but after successful authentication, the user is not redirected back to the original resource. What is the MOST likely cause?

Accepted Answer

The SAML assertion consumer service URL on the IdP does not include a trailing slash. The SAML assertion consumer service URL must match exactly, including the trailing slash, for the IdP to send the response correctly. A mismatch prevents proper redirect.

Answer

The user's browser has cookies disabled

Answer

The IdP certificate is not trusted by the FortiGate

Answer

The FortiGate is configured as a SAML IdP instead of SP

Question 6

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 7

A FortiGate is configured with OSPF over an IPsec VPN tunnel to exchange routes with a remote site. The OSPF neighbor states are stuck in 'INIT' and never progress to 'FULL'. What is the MOST likely cause?

Accepted Answer

The IPsec phase 2 proposal does not include the OSPF multicast IP address (224.0.0.5). OSPF requires multicast support (224.0.0.5) to form adjacencies. Without multicast over the VPN tunnel, OSPF cannot exchange hello packets properly.

Answer

The MTU on the VPN interface is too high

Answer

OSPF authentication is not configured on both sides

Answer

The OSPF hello interval is too short

Question 8

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

Accepted Answer

ZTNA access proxy. ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Answer

Web filtering profile

Answer

SSL VPN portal

Answer

IPsec phase 1 configuration

Question 9

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

Accepted Answer

The user's FortiClient does not have the required ZTNA tags assigned. ZTNA uses tags to determine which users or devices can access which applications. If the necessary tags are missing, access is denied even if the client is connected.

Answer

The ZTNA application is not configured with HTTPS

Answer

The FortiClient EMS server is not reachable from the FortiGate

Answer

The FortiGate is not configured with the correct ZTNA application gateway

Question 10

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings

Question 11

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Accepted Answer

ZTNA access proxy. The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 12

An administrator wants to enforce that only devices with corporate-owned certificates can establish an IPsec VPN tunnel. Which IPsec authentication method should be configured?

Accepted Answer

X.509 certificates. PKI certificates allow the FortiGate to verify the identity of remote peers using digital certificates issued by a trusted Certificate Authority.

Answer

Pre-shared keys

Answer

Extended Authentication (XAuth)

Answer

Aggressive mode

Question 13

A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?

Accepted Answer

The IdP session timeout is set to a lower value than the SP session timeout. SAML SSO requires consistent session timeout settings. If the IdP session timeout is shorter than the SP session, users may need to re-authenticate frequently.

Answer

The SAML single logout URL is misconfigured

Answer

The SAML assertion is not signed

Answer

The FortiGate is not configured to generate a Name ID

Question 14

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

Accepted Answer

NAC policies. NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Answer

DHCP fingerprinting

Answer

RADIUS accounting

Answer

SNMP traps

Question 15

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Accepted Answer

Import the remote peer's certificate into the FortiGate's trusted CA list. Certificate-based authentication requires both sides to have valid certificates and the CA must be trusted. Without these, IKE negotiation fails.

Answer

Set the phase 1 proposal to use AES-256-GCM only

Answer

Enable DPD on the phase 1 interface

Answer

Configure the phase 2 selector to include all traffic (0.0.0.0/0)