NSE7 Advanced VPN and Zero Trust Practice Test 5 — 15 Questions

Question 1

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ZTNA access proxy. The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Answer

ZTNA inline CASB

Answer

IPsec VPN gateway

Answer

FortiClient EMS

Question 2

An administrator wants to enforce that only devices with corporate-owned certificates can establish an IPsec VPN tunnel. Which IPsec authentication method should be configured?

Accepted Answer

X.509 certificates. X.509 certificates provide a strong, identity-based authentication mechanism that allows the VPN gateway to verify that only devices possessing a corporate-issued certificate can establish an IPsec tunnel. This method relies on a public key infrastructure (PKI) where the gateway validates the certificate chain and optionally checks certificate revocation lists (CRLs) or OCSP responses, ensuring that unauthorized devices without a valid corporate certificate are rejected.

Answer

Pre-shared keys

Answer

Extended Authentication (XAuth)

Answer

Aggressive mode

Question 3

A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?

Accepted Answer

The IdP session timeout is set to a lower value than the SP session timeout. When the IdP session timeout is shorter than the SP session timeout, the SP will consider the user's session expired and force re-authentication even though the FortiGate still has a valid local session. This mismatch causes the SP to initiate a new SAML authentication flow, prompting the user for credentials again. The SAML single logout URL (A) affects logout behavior, not re-authentication triggers, and an unsigned assertion (B) would cause a different error, not repeated credential prompts.

Answer

The SAML single logout URL is misconfigured

Answer

The SAML assertion is not signed

Answer

The FortiGate is not configured to generate a Name ID

Question 4

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

Accepted Answer

NAC policies. NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Answer

DHCP fingerprinting

Answer

RADIUS accounting

Answer

SNMP traps

Question 5

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Accepted Answer

Import the remote peer's certificate into the FortiGate's trusted CA list. For IKEv2 with PKI certificates, the remote peer's certificate must be validated against a trusted CA. Importing the CA certificate that signed the remote peer's certificate into the FortiGate's trusted CA list allows the FortiGate to build a valid certificate chain and authenticate the remote peer during IKEv2 phase 1. Without this, the certificate validation fails and the tunnel cannot establish.

Answer

Set the phase 1 proposal to use AES-256-GCM only

Answer

Enable DPD on the phase 1 interface

Answer

Configure the phase 2 selector to include all traffic (0.0.0.0/0)

Question 6

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled

Question 7

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Accepted Answer

FortiClient EMS server. FortiClient EMS (Endpoint Management Server) is the central management and policy distribution point for ZTNA. It manages endpoint compliance, pushes ZTNA tags, and provides real-time telemetry to FortiGate, enabling dynamic access control based on device posture and user identity.

Answer

FortiSandbox for threat analysis

Answer

FortiAnalyzer for logging

Question 8

A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?

Accepted Answer

Dynamic routing (BGP/OSPF) is not configured over the VPN overlay. ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.

Answer

DPD is disabled on the phase 1 interface

Answer

The hub FortiGate has 'set auto-discovery-sender enable' configured

Answer

The spoke FortiGates do not have IKEv2 enabled

Question 9

A FortiGate administrator wants to ensure that only devices with an up-to-date antivirus and OS patch level can access a sensitive application published via ZTNA. Which ZTNA component should the administrator configure to enforce this requirement?

Accepted Answer

ZTNA tags with posture checks. ZTNA tags with posture checks allow the FortiGate to verify endpoint compliance (e.g., antivirus version, OS patch level) before granting access to a ZTNA-published application. The FortiGate collects posture data from the FortiClient endpoint and compares it against configured compliance rules; only devices that meet the requirements receive the appropriate ZTNA tag and are allowed through the ZTNA proxy.

Answer

ZTNA proxy configuration

Answer

SSL VPN portal settings

Answer

Firewall policy with application control

Question 10

An administrator runs the following CLI command on a FortiGate and sees the output below:
diagnose vpn ike gateway list
vd: root/0 name: REMOTE_GW vrf: 0 version: 2
state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500
What is the most likely explanation for the IKE SA being created only 1 second ago?

Accepted Answer

The VPN tunnel was just configured or a configuration change was applied. The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Answer

The remote peer changed its IP address

Answer

DPD detected a dead peer and renegotiated

Answer

The phase 2 SA expired and triggered phase 1 rekey

Question 11

A company uses FortiClient EMS for endpoint compliance and ZTNA tag assignment. An administrator wants to enforce that only endpoints with a ZTNA tag 'Compliant' can access a specific internal application through ZTNA. Which configuration is required on the FortiGate?

Accepted Answer

Create a ZTNA access proxy and a ZTNA policy that references the 'Compliant' tag. ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

Answer

Add a firewall policy with source set to the tag object

Answer

Configure an SSL VPN portal and assign the tag as a group

Answer

Configure a security policy with FortiClient endpoint control

Question 12

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

Accepted Answer

The CA certificate that signed the peer's certificate is not imported on the FortiGate. The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

Answer

The peer's certificate has expired

Answer

The certificate revocation list (CRL) is not configured

Answer

The local certificate does not match the peer's expected CN

Question 13

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

Accepted Answer

Change DPD mode to 'on-demand' and reduce retry count. DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Answer

Increase the phase 2 lifetime

Answer

Enable NAT traversal

Answer

Use IKEv1 instead of IKEv2

Question 14

An administrator configures FortiGate as a SAML identity provider (IdP) for a cloud application. The application (SP) initiates the login. Users are redirected to the FortiGate login page and authenticate successfully, but then receive an error from the SP. What is a common cause?

Accepted Answer

The SP's ACS (Assertion Consumer Service) URL is misconfigured on the FortiGate. When FortiGate is the IdP, it must be configured with the SP's ACS URL and entity ID. If these are incorrect, the SAML assertion is not accepted by the SP.

Answer

The FortiGate's certificate is not trusted by the user's browser

Answer

The user's account is locked

Answer

The SAML attribute mapping is incorrect

Question 15

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

Accepted Answer

FortiNAC Enforcement Engine. FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

Answer

FortiNAC Collector

Answer

FortiNAC Profiler

Answer

FortiNAC Portal