NSE7 Advanced VPN and Zero Trust Practice Test 4 — 15 Questions

Question 1

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiGate's EMS connector is not syncing tag information in real-time. Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Answer

The user's IP address has changed and the tag is mapped to a different IP

Answer

The ZTNA rule is configured with the wrong application port

Answer

The device posture compliance check requires additional criteria not met

Question 2

An administrator wants to use SAML SSO with FortiGate as the Service Provider (SP) to allow users to authenticate via an external IdP. What must be configured first on the FortiGate to establish the SAML trust?

Accepted Answer

A certificate for SAML signing and encryption. To establish SAML trust, the FortiGate must first configure a certificate for SAML signing and encryption. This certificate is used to sign SAML assertions and encrypt communication with the IdP, ensuring the integrity and confidentiality of the SAML exchange. Without it, the SAML trust cannot be established.

Answer

A firewall policy to allow SAML traffic

Answer

A RADIUS server for user authentication

Answer

An LDAP server for group membership lookup

Question 3

A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?

Accepted Answer

The DPD (Dead Peer Detection) timeout is triggered every 30 minutes. The tunnel dropping every 30 minutes is most likely due to Dead Peer Detection (DPD) timeout, which is a separate mechanism from phase lifetimes. DPD sends keepalive packets to detect peer availability; if the peer does not respond within the timeout, the tunnel is torn down and re-established. The phase lifetimes are much longer (86400 and 3600 seconds), so they are not the cause of a 30-minute cycle. NAT traversal and phase2 rekey failures would not produce such a regular interval.

Answer

The phase2 lifetime is set to 3600 seconds, causing rekey failures

Answer

The phase1 lifetime is too short, causing frequent renegotiation

Answer

The VPN tunnel is not configured to use NAT traversal

Question 4

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

Accepted Answer

The compliance rule is not assigned to a FortiClient configuration profile. In FortiClient EMS, compliance rules are enforced only when they are added to a configuration profile that is assigned to endpoints. The rule itself is just a definition; it must be included in a profile that is deployed to clients. Without being assigned to a profile, the rule is not applied, so unencrypted devices are not blocked. Option D correctly identifies this missing step.

Answer

The FortiClient telemetry is not sending compliance status

Answer

The compliance rule is not enabled on the FortiGate via ZTNA tag

Answer

The VPN policy on the FortiGate does not require compliance check

Question 5

A FortiGate administrator needs to ensure that only devices with an updated antivirus can access a sensitive internal application via ZTNA. The administrator has created a ZTNA tag 'AV_Updated' in EMS and configured a ZTNA rule on FortiGate that requires this tag. Which TWO additional steps are necessary to enforce this access control? (Choose two.)

Accepted Answer

Create a firewall policy that references the ZTNA rule. Option C is correct because a ZTNA rule by itself does not enforce traffic; on FortiGate you must create a firewall policy that references the ZTNA rule (as the source/policy match) so that traffic to the protected application is actually inspected and allowed or denied based on the tag. Option D is correct because the FortiGate must be configured as an EMS connector (using the EMS cloud/on-premises connector settings) and the ZTNA tag 'AV_Updated' must be imported/synchronized from EMS so the FortiGate can evaluate the tag in the ZTNA rule. Option A is not required: HTTPS is a common transport for the application but does not itself enforce the antivirus/tag condition. Option B is incorrect because ZTNA does not use SSL VPN; SSL VPN is a separate remote-access feature and enabling it is not part of ZTNA tag enforcement. Option E is incorrect because client certificates are not the mechanism used here; ZTNA tag-based access relies on the EMS/FortiClient tag synchronization, not on installing client certificates on each device.

Answer

Configure the application server to use HTTPS

Answer

Enable SSL VPN on the FortiGate for ZTNA traffic

Answer

Install a client certificate on each device for authentication

Question 6

An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)

Accepted Answer

The spoke tunnel interfaces must be in the same IP subnet. Option A is correct because ADVPN shortcut tunnels are established between spoke tunnel interfaces that share the same IP subnet, allowing the spokes to route traffic directly over the shortcut without traversing the hub. Option D is correct because auto-discovery must be enabled in the phase1 settings on all spokes so they can learn each other's tunnel IP addresses and negotiate shortcut tunnels dynamically. Option E is correct because the hub must have routes to all spoke local subnets so it can forward initial traffic and advertise the routes needed for spokes to discover each other and trigger shortcut establishment. Option B is not required because ADVPN supports spokes with dynamic public IP addresses, as the hub's static IP and auto-discovery handle peer address resolution. Option C is not required because 'set shortcuthub enable' is not a valid FortiGate ADVPN configuration command for enabling shortcut tunnels; shortcut behavior is driven by auto-discovery and routing.

Answer

The spokes must have static public IP addresses

Answer

The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub

Question 7

A FortiGate administrator is troubleshooting a VPN tunnel that uses IKEv2 with certificate authentication. The tunnel fails to establish, and the IKE debug shows 'no acceptable proposal' for the initial exchange. Which TWO configuration mismatches could cause this error? (Choose two.)

Accepted Answer

Mismatched encryption algorithms between the two peers. Option A is correct because the 'no acceptable proposal' error during the initial IKE exchange (IKE_SA_INIT) occurs when the two peers cannot agree on the Phase 1 proposal parameters, and mismatched encryption algorithms (e.g., one side offering AES-256 and the other AES-128) mean no common transform set exists, so the responder rejects the proposal. Option E is correct because the Phase 1 proposal also includes the authentication method, and if one peer is configured for pre-shared key while the other expects certificate (RSA signature) authentication, the proposals will not match and the responder returns 'no acceptable proposal'. Option B is not correct because Phase 2 (IPsec SA) encryption mismatches cause failures during QUICK_MODE/CHILD_SA negotiation, not the initial IKE exchange, and typically produce errors like 'no matching phase2 proposal' rather than 'no acceptable proposal' for the initial exchange. Option C is not correct because an IKE version mismatch (IKEv1 vs IKEv2) causes the peers to not understand each other's packets at all, resulting in timeout or 'received invalid IKE version' errors rather than a proposal mismatch. Option D is not correct because an incorrect local certificate configuration would cause authentication or certificate validation failures (e.g., 'certificate verify failed' or 'no matching certificate') after the proposal is accepted, not a 'no acceptable proposal' error during the initial exchange.

Answer

Mismatched phase2 encryption algorithms

Answer

Mismatched IKE version (IKEv1 vs IKEv2)

Answer

Incorrect local certificate configuration on one peer

Question 8

A network administrator configured a hub-and-spoke ADVPN with IKEv2. Spoke sites can establish tunnels to the hub, but shortcut tunnels are not being created between spokes. What is the MOST likely cause?

Accepted Answer

Auto-discovery is disabled on the hub FortiGate. In a hub-and-spoke ADVPN with IKEv2, shortcut tunnels between spokes require auto-discovery to be enabled on the hub FortiGate. Auto-discovery allows the hub to exchange IKE information (including NAT-T and IP addresses) between spokes, enabling them to establish direct tunnels. When auto-discovery is disabled on the hub, the hub will not forward the necessary IKE messages (such as the IKE_AUTH exchange with the auto-discovery payload) to other spokes, preventing shortcut tunnel creation.

Answer

Dead Peer Detection is disabled on the hub

Answer

The spokes are using different IKE versions

Answer

The IKEv2 authentication method is not set to pre-shared key

Question 9

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

Accepted Answer

The SAML user group is not configured with the correct IdP attribute mapping. After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Answer

The FortiGate is configured as an IdP instead of SP

Answer

SAML single logout is enabled and causing session termination

Answer

The IdP certificate is not trusted by the FortiGate

Question 10

A FortiGate administrator configures a hub-and-spoke ADVPN with OSPF over the VPN overlay. Spoke routers receive the OSPF default route from the hub, but cannot reach subnets behind other spokes. What configuration is missing?

Accepted Answer

OSPF is not configured to redistribute connected or static routes on the spokes. In a hub-and-spoke ADVPN with OSPF, spoke routers receive the default route from the hub but cannot reach subnets behind other spokes because OSPF does not automatically advertise the spoke’s local networks into the VPN overlay. The missing configuration is redistribution of connected or static routes into OSPF on the spokes, which is required for the hub to learn those subnets and propagate them to other spokes via the OSPF database.

Answer

IKEv2 is configured instead of IKEv1

Answer

The spokes have 'set auto-discovery-receiver enable' configured

Answer

The hub has 'set auto-discovery-sender enable' configured

Question 11

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

Accepted Answer

The FortiClient EMS is not configured as an endpoint control source on the FortiGate. The 'Tag mismatch' error in the ZTNA connection monitor indicates that the FortiGate is not receiving the expected endpoint tags ('AV_Installed' and 'OS_Updated') from the endpoint. This occurs when FortiClient EMS is not configured as an endpoint control source on the FortiGate, so the FortiGate has no way to learn the endpoint's compliance tags. Without this integration, the ZTNA rule cannot evaluate the tags and denies access.

Answer

The FortiGate does not have a valid PKI certificate for the ZTNA proxy

Answer

The user is not authenticated via SAML

Answer

The ZTNA rule is using the wrong port number

Question 12

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

Accepted Answer

Set the 'proposal' list with AES256-GCM and SHA256 as the first entry. In FortiGate IKEv2 configuration, the proposal list is ordered by preference — the first entry is the most preferred proposal. By placing AES256-GCM and SHA256 as the first entry in the proposal list, the administrator ensures that the FortiGate offers this combination first during IKE negotiation. If the remote peer supports it, the tunnel will use AES256-GCM and SHA256. This is the standard method for enforcing encryption and integrity preferences in FortiGate IPsec VPNs.

Answer

Enable 'set proposal-mode strict'

Answer

Use IKEv2 rekey to change the proposal after initial handshake

Answer

Configure a phase2 selectors with the exact traffic of interest

Question 13

An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?

Accepted Answer

ZTNA proxy (reverse proxy) with FortiClient for posture. A ZTNA proxy (reverse proxy) with FortiClient for posture allows clientless access to internal applications because the proxy sits in front of the application and does not require software on the server. FortiClient on the user's device provides posture checking and authentication. This meets the requirement of no client software on the server while enforcing Zero Trust principles.

Answer

FortiNAC with agent on the server

Answer

IPsec VPN with full tunnel

Answer

SSL VPN with web mode

Question 14

An administrator configures BGP over an IPsec VPN between two FortiGates. The BGP session is established, but routes from the remote site are not being installed in the local routing table. The admin verifies that the BGP neighbor configuration is correct and the remote site is advertising routes. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking BGP traffic on the VPN interface. BGP routes must be allowed by a firewall policy on the loopback or interface used for BGP. Even if the VPN tunnel is up, BGP traffic (TCP port 179) may be blocked by the local-in policy or by the VPN interface's firewall policy if not explicitly allowed.

Answer

The BGP timers are too aggressive causing route flapping

Answer

The BGP network statement is missing on the local FortiGate

Answer

The next-hop IP address is not reachable

Question 15

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Accepted Answer

Configure BGP to redistribute connected or static routes to the spokes. Option C is correct because the hub must enable 'set auto-discovery-sender' on its IPsec phase1-interface so that it advertises the ADVPN shortcut information (the hub's IP address and the shortcut offer) to the spokes, allowing them to negotiate direct spoke-to-spoke tunnels. Option A is correct because the hub must redistribute the routes (connected/static, typically the overlay and protected subnets) into BGP so that spokes learn the necessary routing information and can resolve next-hop reachability, which is a prerequisite for shortcut tunnel establishment and traffic forwarding. Option B is incorrect because 'auto-discovery-receiver' is configured on the spokes, not the hub; the receiver role is what accepts the shortcut offers sent by the hub. Option D is incorrect because disabling DPD is not required and would actually harm dead-peer detection and tunnel failover in an ADVPN. Option E is incorrect because ADVPN shortcut functionality relies on IKEv2, not IKEv1.

Answer

Enable 'set auto-discovery-receiver' on the hub's phase1 interface

Answer

Disable DPD on the hub's phase1 interface

Answer

Set the IKE version to IKEv1 on the hub