NSE7 Advanced VPN and Zero Trust Practice Test 3 — 15 Questions

Question 1

An administrator configures a ZTNA rule with an inline CASB profile to protect access to a SaaS application. The rule uses a ZTNA tag that requires 'OS Type = Windows' and 'Antivirus = running'. A user with a Windows 10 device and Symantec antivirus running is denied access. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Symantec antivirus is not listed in the FortiGate's supported antivirus list.. The ZTNA tag requires 'Antivirus = running', which means the FortiGate must receive a compliance report from the FortiClient EMS indicating that a supported antivirus is active. Symantec is not in FortiGate's supported antivirus list, so the EMS reports the antivirus status as 'not compliant', causing the ZTNA rule to deny access even though the user has antivirus running.

Answer

The user's device is not connected to the corporate network.

Answer

The inline CASB profile is blocking all traffic from the ZTNA rule.

Answer

The ZTNA tag requires the FortiClient EMS to be installed on the device.

Question 2

A FortiGate administrator receives an error during IPsec VPN configuration: 'Certificate validation failed: certificate uses weak key.' The admin is using a PKI certificate with RSA 2048-bit key. The FortiGate firmware is up-to-date. What is the MOST likely reason for this error?

Accepted Answer

The FortiGate has a security policy that rejects certificates with keys less than 3072 bits.. The error 'certificate uses weak key' indicates that the certificate's key strength does not meet the FortiGate's minimum security requirement. Even though RSA 2048-bit is generally considered secure, some FortiGate firmware versions or security profiles enforce a minimum of 3072 bits for certificates used in IPsec VPN. Thus, the most likely reason is that the FortiGate has a policy rejecting keys less than 3072 bits.

Answer

The certificate has expired or is not yet valid.

Answer

The certificate's private key is not imported on the FortiGate.

Answer

The certificate authority is not trusted by the FortiGate.

Question 3

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

Accepted Answer

The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.. OSPF uses IP protocol 89, and FortiGate firewalls require an explicit firewall policy to allow OSPF traffic over the IPsec tunnel. Even if the tunnel is up and ping works (ICMP), OSPF packets are blocked by default unless a policy permits protocol 89. This is the most common oversight when configuring dynamic routing over VPNs on FortiGate.

Answer

OSPF is not enabled on the tunnel interface.

Answer

The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.

Answer

The MTU on the tunnel interface is too large for OSPF packets.

Question 4

An administrator configures Multi-Peer VPN (MPVPN) on a FortiGate aggregator. The aggregator has two phase1 configurations for the same remote subnet but different peers. The aggregator's routing table shows both peers as next hops. The administrator notices that traffic between the aggregator and the remote subnet is load-balanced across both peers. What is the cause?

Accepted Answer

The aggregator has two static routes with equal cost to the remote subnet.. The administrator configured two static routes with equal administrative distance and cost to the remote subnet, each pointing to a different peer. This causes ECMP (Equal-Cost Multi-Path) routing, which load-balances traffic across both peers. MPVPN itself does not automatically load-balance; it relies on the underlying routing table to determine next-hop selection.

Answer

The MPVPN feature automatically load-balances traffic across all active peers.

Answer

The phase1 configurations have the same proposal settings, causing implicit load balancing.

Answer

The remote peers are both advertising the same subnet via BGP with equal metrics.

Question 5

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

Accepted Answer

Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.. To use FortiClient's posture check for SSL VPN, the FortiGate must add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data. This allows the FortiGate to receive endpoint posture information from EMS and enforce access policies accordingly. The ZTNA tag can then be used in firewall policies or SSL VPN settings to require compliance.

Answer

Configure the FortiGate as a SAML IdP for FortiClient EMS.

Answer

Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.

Answer

Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.

Question 6

An administrator runs the CLI command 'diagnose vpn ike gateway list' and sees that a phase1 gateway is in 'UP' state, but the 'DPD' field shows 'disabled'. The tunnel is working. What is the implication?

Accepted Answer

The tunnel will never detect if the remote peer goes down.. When DPD is disabled, the FortiGate does not send DPD probes to verify the remote peer's liveliness. Without DPD or any other keepalive mechanism (such as IKE keepalives, which are not used in standard IPsec VPNs), the tunnel will remain in the 'UP' state indefinitely even if the remote peer goes down. This means the tunnel will never detect peer failure, leading to blackholed traffic until the administrator manually intervenes or the tunnel is re-established by other means.

Answer

DPD is only used for phase2, so phase1 is unaffected.

Answer

DPD is disabled but the tunnel will still detect peer failure via IKE keepalives.

Answer

The FortiGate is using NAT-T, which disables DPD automatically.

Question 7

A FortiGate administrator needs to configure a hub-and-spoke ADVPN with OSPF as the routing protocol over the VPN tunnels. Which TWO steps are required on the hub FortiGate to enable shortcut tunnels?

Accepted Answer

Enable 'shortcut' option under the phase2 configuration.. Option B is correct because enabling the 'shortcut' option under the phase2 configuration on the hub allows the hub to propagate shortcut information to spokes, enabling them to establish direct tunnels to other spokes in the ADVPN. Option C is correct because 'auto-discovery-sender' on the hub's phase1 configuration makes the hub send ADVPN auto-discovery messages (using IKE) to the spokes, which is the mechanism that advertises shortcut offers and enables the dynamic tunnel creation. The unmarked options do not belong: 'add-route' disable (A) would prevent route installation and is not required for shortcuts, 'auto-discovery-receiver' (D) is configured on spokes (not the hub) to receive discovery messages, and OSPF network type 'broadcast' (E) is not a required step for enabling ADVPN shortcut tunnels.

Answer

Set 'add-route' to 'disable' on the phase2 configuration.

Answer

Enable 'auto-discovery-receiver' on the hub's phase1 configuration.

Answer

Configure OSPF network type as 'broadcast' on the hub's tunnel interface.

Question 8

An administrator is troubleshooting a ZTNA application access issue. Users can authenticate but cannot reach the internal application via the ZTNA proxy. The FortiGate's ZTNA rule uses a tag requiring 'OS Type = Windows' and 'Antivirus = running'. The device meets both conditions. Which THREE possible reasons could cause the access failure?

Accepted Answer

The ZTNA proxy's destination is pointing to the wrong internal IP or port.. Option A is correct because if the ZTNA proxy's destination (the internal server IP or port) is misconfigured, the proxy will forward traffic to the wrong endpoint, causing connection failures even though authentication and tagging succeed. Option B is correct because ZTNA traffic must be permitted by a firewall policy that references the ZTNA proxy and the appropriate source/destination; a missing or misordered policy will silently drop the traffic. Option C is correct because the FortiGate's SSL certificate used for the ZTNA proxy must be trusted by the client; if it is untrusted, the client's TLS connection to the proxy fails, preventing access to the application. Option D is not correct because the scenario states the device already meets the tag conditions (OS Type = Windows and Antivirus = running), which implies the tag is assigned and evaluated successfully. Option E is not correct because the users can authenticate and the device meets the tag conditions, which requires FortiClient to be installed and running.

Answer

The user is not assigned the ZTNA tag in the FortiClient EMS portal.

Answer

The device does not have FortiClient installed.

Question 9

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Accepted Answer

Configure a RADIUS server pointing to FortiNAC.. Option A is correct because the FortiGate must be configured with a RADIUS server entry that points to FortiNAC, allowing FortiNAC to act as the authentication/authorization server for the NAC integration. Option D is correct because enabling the NAC policy on the switch-facing interface is required so the FortiGate can apply the NAC policy to traffic from wired clients and enforce access based on device compliance. Option B is not required because security group tag (SGT) mapping is a Cisco TrustSec concept, not a FortiGate NAC integration requirement. Option C is not required because 802.1x authentication is typically handled by the FortiNAC or the switch, not enabled directly on the FortiGate interface for this integration. Option E is not required because 'nac-mode' with 'global-vlan' is not a standard FortiGate interface setting for FortiNAC NAC integration.

Answer

Create a security group tag (SGT) mapping.

Answer

Enable '802.1x' authentication on the interface.

Answer

Set the 'nac-mode' to 'global-vlan' under the interface.

Question 10

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

Accepted Answer

The remote FortiGate is behind a NAT device without proper NAT-T configuration. DPD (Dead Peer Detection) timeout messages indicate that the FortiGate is not receiving DPD acknowledgments from the remote peer. When the remote FortiGate is behind a NAT device without NAT-T (NAT Traversal) enabled, the IKE and IPsec packets may be dropped or the UDP encapsulation may fail, causing DPD to time out and the tunnel to stop passing traffic. NAT-T encapsulates ESP in UDP port 4500 to traverse NAT.

Answer

The IPsec phase2 proposal is mismatched, causing rekey failures

Answer

The IKE SA lifetime is set too long, causing the tunnel to expire

Answer

The local FortiGate's DPD interval is set too low, causing false positives

Question 11

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 12

An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?

Accepted Answer

The user's device does not have the required ZTNA tags from EMS. A 403 Forbidden error from the ZTNA proxy after successful authentication typically indicates that the user's device does not meet the ZTNA tagging requirements enforced by the access rule. Even if the user is authenticated and the rule is configured, the FortiGate checks device posture tags from EMS (FortiClient EMS) and denies access if the required tags are missing. This is the most likely cause of the 403.

Answer

The FortiGate firewall policy allowing ZTNA traffic is missing

Answer

The application server does not have a valid certificate

Answer

The ZTNA proxy is configured with the wrong port for the application

Question 13

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the traffic?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table encoding indicates TCP SYN_SENT (half-open state). The session has been in this state for 3600 seconds and expires in 3599 seconds, meaning it is waiting for a SYN-ACK response and has not yet completed the handshake. Therefore, the traffic is in a half-open state.

Answer

The session is being blocked by the firewall

Answer

The session is an established TCP connection

Answer

The session is a UDP connection with a long timeout

Question 14

A FortiGate administrator is configuring OSPF over an IPsec VPN between a hub and a spoke. The OSPF adjacency forms correctly, but routes from the spoke are not being advertised to the hub. The administrator checks the OSPF database on the hub and sees no Type-1 LSAs from the spoke. What is the most likely issue?

Accepted Answer

The OSPF network type is set to broadcast on both ends. The most likely issue is that the OSPF network type is set to broadcast on both ends of the IPsec VPN. In a hub-and-spoke topology, the IPsec tunnel is a point-to-point link, but using the broadcast network type causes OSPF to attempt a DR/BDR election. The spoke typically has only one neighbor, so it cannot become DR, and this can lead to the spoke not advertising its Type-1 LSAs to the hub, even though the adjacency appears to be full. The correct network type for IPsec VPNs is usually point-to-point or point-to-multipoint, which avoids election issues and ensures proper route advertisement.

Answer

The OSPF hello interval is set too high

Answer

The OSPF interface is configured as passive

Answer

The MTU mismatch between the two VPN interfaces

Question 15

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

Accepted Answer

The CA certificate is not configured for peer certificate validation. The most likely missing configuration is that the CA certificate is not configured for peer certificate validation. In IKEv2 certificate-based authentication, the FortiGate must be configured to use the imported CA certificate to validate the remote peer's certificate. Without this, the certificate validation fails, leading to authentication failure.

Answer

The IKEv2 proposal includes an incompatible encryption algorithm

Answer

The local certificate is not associated with the phase1 interface

Answer

The remote peer's certificate is not signed by the imported CA