NSE7 Advanced VPN and Zero Trust Practice Test 4 — 15 Questions

Question 1

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the phase2 rekey time to 8 hours.. Intermittent packet loss during stable VPN tunnels is often caused by frequent rekey events or DPD misconfiguration. Option D (increase phase2 rekey time to 8 hours) reduces the frequency of rekeying, minimizing packet loss during key regeneration. Option E (enable Dead Peer Detection on the tunnel interface) allows the FortiGate to detect peer failures more reliably without aggressive settings. Option A (reduce DPD retry interval to 3 seconds) is too aggressive and can cause flapping on lossy links. Option B (increase phase1 lifetime) does not address the packet loss issue, as phase1 rekeying is less frequent. Option C (change to IKEv1) would reduce stability since IKEv2 is more robust and supports faster rekeying.

Answer

Reduce the DPD retry interval to 3 seconds.

Answer

Increase the phase1 lifetime to 86400 seconds.

Answer

Change the IKE version to IKEv1.

Question 2

Refer to the exhibit. An administrator runs the 'diagnose vpn ike stats' command on a FortiGate. What does the output indicate?

Accepted Answer

The tunnel has one IKE SA and two IPsec SAs, which is normal for a single VPN tunnel.. The 'diagnose vpn ike stats' output shows one IKE SA (phase 1) and two IPsec SAs (phase 2). This is normal for a single VPN tunnel when using IPsec with both inbound and outbound SAs, or when the tunnel is configured with separate SAs for different traffic selectors. The presence of two IPsec SAs under one IKE SA does not indicate an error or vulnerability; it is the expected behavior for a standard IPsec VPN tunnel.

Answer

The tunnel is vulnerable to a man-in-the-middle attack because the IPsec SAs are using the same encryption algorithm.

Answer

The tunnel configuration is incorrect because there are two IPsec SAs under one IKE SA.

Answer

The tunnel is using two IKE SAs for redundancy.

Question 3

A multinational company uses FortiGate devices as VPN gateways to connect its headquarters (HQ) and branch offices via IPsec VPN tunnels. The company is migrating its remote access solution from IPsec VPN to SSL VPN using FortiClient. Currently, 500 remote users connect via IPsec VPN with pre-shared keys and XAuth authentication. The migration must be seamless with minimal downtime, and users must continue to authenticate using their existing Active Directory credentials. The SSL VPN portal must provide access to internal web applications and some legacy TCP-based applications that do not support HTTP. The security team requires that all traffic between remote users and the internal network be encrypted and that the SSL VPN use a certificate from a public CA to avoid certificate warnings on client devices. The IT team wants to use FortiToken for two-factor authentication (2FA) for all VPN users. Which of the following is the most appropriate course of action to meet all requirements?

Accepted Answer

Deploy SSL VPN with a public CA certificate, configure LDAP authentication against Active Directory, enable FortiToken for 2FA, and create a split-tunneling policy that uses both SSL VPN web mode and tunnel mode via FortiClient.. It meets all requirements: a public CA certificate avoids client certificate warnings, LDAP authentication against Active Directory allows seamless credential reuse, FortiToken provides the required 2FA, and combining SSL VPN web mode (for web apps) with tunnel mode via FortiClient (for legacy TCP applications) ensures full coverage. This approach minimizes downtime by migrating users gradually without changing their authentication backend.

Answer

Configure SSL VPN with a self-signed certificate and use the local password database for authentication. Enable FortiToken and configure the portal to provide both web and TCP forwarding applications.

Answer

Set up SSL VPN with a public CA certificate, use LDAP for authentication, but do not enable FortiToken because it would require a separate token per user.

Answer

Create a new IPsec VPN configuration using certificate-based authentication and FortiToken, and gradually move users to the new IPsec VPN.

Question 4

A company's FortiGate is configured with multiple IPsec VPN tunnels to branch offices. One tunnel keeps dropping and re-establishing every few minutes. The logs show 'IPsec SA negotiation failed' with error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

Mismatched encryption or authentication algorithms between the two VPN peers. The error 'proposal mismatch' directly indicates that the two IPsec peers cannot agree on the security parameters for the IKE or IPsec SA. This occurs when the encryption algorithm (e.g., AES256 vs. AES128), authentication algorithm (e.g., SHA256 vs. SHA1), Diffie-Hellman group, or lifetime values do not match between the FortiGate and the remote peer. The tunnel drops and re-establishes because the negotiation fails, and the FortiGate retries with the same mismatched proposal, leading to repeated failures.

Answer

Dead Peer Detection (DPD) configured too aggressively

Answer

NAT-Traversal (NAT-T) not enabled

Answer

Pre-shared key mismatch

Question 5

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

Accepted Answer

Create a user group that includes the RADIUS server as an authentication method. A user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.

Answer

Configure an LDAP server to synchronize user accounts

Answer

Configure an SSL VPN portal with 'Require Authentication' enabled

Answer

Set a local password policy for SSL VPN users

Question 6

Drag and drop the steps to configure a FortiGate as a DHCP server into the correct order.

Accepted Answer

Select interface, then enable DHCP, then set scope, then configure options, then apply.. The correct sequence to configure a FortiGate as a DHCP server is: first select the interface that will serve DHCP, then enable DHCP on that interface, set the IP address scope (range), configure additional options such as default gateway and DNS servers, and finally apply the configuration. This order ensures dependencies are met and the configuration is valid.

Answer

Enable DHCP, then select interface, then set scope, then configure options, then apply.

Answer

Set scope, then configure options, then enable DHCP, then select interface, then apply.

Answer

Configure options, then apply, then select interface, then enable DHCP, then set scope.

Question 7

Drag and drop the steps to configure a FortiGate VDOM in multi-VDOM mode into the correct order.

Accepted Answer

Enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.. First enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.

Answer

Create and assign interfaces, then enable VDOM mode globally, then configure each VDOM, then resource allocation.

Answer

Configure each VDOM, then enable VDOM mode globally, then create and assign interfaces, then resource allocation.

Answer

Resource allocation, then enable VDOM mode globally, then create and assign interfaces, then configure each VDOM.

Question 8

Match each SD-WAN component to its role.

Accepted Answer

SD-WAN Rule: Determines traffic steering based on criteria like source, destination, application.. Correct matches: SD-WAN Rule → traffic steering; Performance SLA → link quality monitoring; Virtual-WAN-Link → interface grouping. Common confusions mix these roles.

Answer

SD-WAN Rule: Monitors link quality metrics (latency, jitter, packet loss) against thresholds.

Answer

Performance SLA: Groups WAN interfaces into a logical bundle for load balancing.

Answer

Virtual-WAN-Link: Determines traffic steering based on criteria like source, destination, application.

Question 9

Match each Fortinet command to its function.

Accepted Answer

get system performance: Display real-time system performance statistics. Correct matches: 'get system performance' shows real-time performance statistics; 'diagnose debug application httpd' enables HTTP daemon debugging; 'execute ping' tests network connectivity; 'show system status' displays system summary. Common confusions include swapping the functions of 'get system performance' and 'execute ping'.

Answer

get system performance: Ping a network host

Answer

execute ping: Display real-time system performance statistics

Question 10

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Accepted Answer

Device posture checks. ZTNA tags define compliance requirements, and device posture checks evaluate endpoint security state. Together they enable conditional access based on endpoint compliance.

Answer

VPN tunnels

Answer

SAML SSO

Question 11

A FortiGate is configured as a SAML SP for user authentication. When a user attempts to access a protected resource, the FortiGate redirects the user to the IdP login page, but after successful authentication, the user is not redirected back to the original resource. What is the MOST likely cause?

Accepted Answer

The SAML assertion consumer service URL on the IdP does not include a trailing slash. The SAML assertion consumer service (ACS) URL must exactly match the endpoint configured on the FortiGate. If the IdP's ACS URL lacks a trailing slash that the FortiGate expects, the SAML response will be sent to an incorrect or mismatched endpoint, causing the redirect to fail. This is a common misconfiguration in SAML SP setups where URL normalization differs between the SP and IdP.

Answer

The user's browser has cookies disabled

Answer

The IdP certificate is not trusted by the FortiGate

Answer

The FortiGate is configured as a SAML IdP instead of SP

Question 12

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

Accepted Answer

The VPN peer has been detected as unreachable and the tunnel is considered down. DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Answer

The remote peer has been manually disconnected from the network

Answer

The VPN tunnel is still up but the peer is not responding to DPD messages

Answer

The IKE SA is still active but the IPsec SA has expired

Question 13

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

Accepted Answer

ZTNA access proxy. ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Answer

Web filtering profile

Answer

SSL VPN portal

Answer

IPsec phase 1 configuration

Question 14

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

Accepted Answer

The user's FortiClient does not have the required ZTNA tags assigned. When users can authenticate and the ZTNA status shows 'Connected' on FortiClient, but the application still fails to load, the most likely cause is that the client lacks the required ZTNA tags. ZTNA tags are used by the FortiGate to enforce access policies; without the correct tags, the FortiGate will block the application traffic even though the tunnel is established. This scenario indicates a tag assignment or synchronization issue between FortiClient and EMS.

Answer

The ZTNA application is not configured with HTTPS

Answer

The FortiClient EMS server is not reachable from the FortiGate

Answer

The FortiGate is not configured with the correct ZTNA application gateway

Question 15

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings