NSE7 Advanced VPN and Zero Trust Practice Test 4 — 15 Questions

Question 1

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 2

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Accepted Answer

FortiClient EMS server. ZTNA requires FortiClient for endpoint posture, EMS for policy/tag management, and FortiGate with ZTNA proxy to enforce access control.

Answer

FortiSandbox for threat analysis

Answer

FortiAnalyzer for logging

Question 3

A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?

Accepted Answer

Dynamic routing (BGP/OSPF) is not configured over the VPN overlay. ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.

Answer

DPD is disabled on the phase 1 interface

Answer

The hub FortiGate has 'set auto-discovery-sender enable' configured

Answer

The spoke FortiGates do not have IKEv2 enabled

Question 4

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags are used to define conditions based on device posture (e.g., antivirus status, OS patch level). Tags are assigned via FortiClient EMS and referenced in ZTNA policies to grant or deny access.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 5

An administrator runs the following CLI command on a FortiGate and sees the output below:
diagnose vpn ike gateway list
vd: root/0 name: REMOTE_GW vrf: 0 version: 2
state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500
What is the most likely explanation for the IKE SA being created only 1 second ago?

Accepted Answer

The VPN tunnel was just configured or a configuration change was applied. The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Answer

The remote peer changed its IP address

Answer

DPD detected a dead peer and renegotiated

Answer

The phase 2 SA expired and triggered phase 1 rekey

Question 6

A company uses FortiClient EMS for endpoint compliance and ZTNA tag assignment. An administrator wants to enforce that only endpoints with a ZTNA tag 'Compliant' can access a specific internal application through ZTNA. Which configuration is required on the FortiGate?

Accepted Answer

Create a ZTNA access proxy and a ZTNA policy that references the 'Compliant' tag. ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

Answer

Add a firewall policy with source set to the tag object

Answer

Configure an SSL VPN portal and assign the tag as a group

Answer

Configure a security policy with FortiClient endpoint control

Question 7

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

Accepted Answer

The CA certificate that signed the peer's certificate is not imported on the FortiGate. The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

Answer

The peer's certificate has expired

Answer

The certificate revocation list (CRL) is not configured

Answer

The local certificate does not match the peer's expected CN

Question 8

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

Accepted Answer

Change DPD mode to 'on-demand' and reduce retry count. DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Answer

Increase the phase 2 lifetime

Answer

Enable NAT traversal

Answer

Use IKEv1 instead of IKEv2

Question 9

An administrator configures FortiGate as a SAML identity provider (IdP) for a cloud application. The application (SP) initiates the login. Users are redirected to the FortiGate login page and authenticate successfully, but then receive an error from the SP. What is a common cause?

Accepted Answer

The SP's ACS (Assertion Consumer Service) URL is misconfigured on the FortiGate. When FortiGate is the IdP, it must be configured with the SP's ACS URL and entity ID. If these are incorrect, the SAML assertion is not accepted by the SP.

Answer

The FortiGate's certificate is not trusted by the user's browser

Answer

The user's account is locked

Answer

The SAML attribute mapping is incorrect

Question 10

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

Accepted Answer

FortiNAC Enforcement Engine. FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

Answer

FortiNAC Collector

Answer

FortiNAC Profiler

Answer

FortiNAC Portal

Question 11

A FortiGate administrator configures a hub-and-spoke VPN with OSPF routing. The spoke FortiGates are learning routes from the hub, but inter-spoke traffic is being routed through the hub instead of using shortcut tunnels. What configuration is missing on the hub to allow ADVPN shortcut establishment?

Accepted Answer

Disable route redistribution from OSPF into the VPN tunnel interface on the hub. For ADVPN to work, the hub must have 'auto-discovery-sender' enabled and also must not redistribute spoke routes back to other spokes in a way that prevents shortcut. Typically, the hub should not redistribute OSPF routes learned from one spoke into another; ADVPN relies on IKE shortcuts.

Answer

Set the VPN interface type to 'tunnel' instead of 'vlan'

Answer

Enable 'auto-discovery-sender' on the hub and 'auto-discovery-forwarder' on spokes

Answer

Configure a static route for inter-spoke traffic on the hub

Question 12

An administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The TCP handshake has not completed; the client sent SYN and is waiting for SYN-ACK. The session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds. Proto_state=01 indicates TCP SYN_SENT state, meaning the TCP handshake hasn't completed. This could be due to the server not responding.

Answer

The session is fully established and has been idle for 1 hour

Answer

The session is in FIN_WAIT state and is closing

Answer

The session is using UDP protocol

Question 13

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

Accepted Answer

The IdP's entity ID or SSO URL is incorrectly entered on FortiGate. As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Answer

The FortiGate's SP entity ID does not match the Azure AD application's identifier

Answer

The administrator's account is not synchronized with Azure AD

Answer

The certificate used for signing is not trusted by the IdP

Question 14

An administrator configures ZTNA inline CASB to control access to a SaaS application. The goal is to block uploads of files with credit card numbers. The administrator configures a CASB profile with a DLP rule for credit card numbers. However, uploads are not being blocked. What is the most likely reason?

Accepted Answer

SSL inspection is not enabled for the traffic. Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

Answer

The CASB profile is not applied to the ZTNA policy

Answer

The DLP rule is configured to monitor instead of block

Answer

The SaaS application is not supported by CASB

Question 15

An administrator needs to configure a FortiGate to act as a SAML identity provider (IdP) for a third-party cloud application (SP). Which TWO settings must be configured on the FortiGate to function as an IdP?

Accepted Answer

SAML IdP user group. FortiGate as IdP requires a SAML IdP user group to authenticate users and a service provider configuration that includes the SP's ACS URL and entity ID.

Answer

LDAP server configuration

Answer

SP metadata import

Answer

SSL VPN portal