NSE7 Advanced VPN and Zero Trust Practice Test 5 — 15 Questions

Question 1

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Accepted Answer

Check if there is a route on the internal network pointing back to the VPN subnet. Common issues: firewall policies must allow traffic from VPN IP pool to internal network; routing must be correct; NAT should not be applied to VPN traffic (unless required). Checking these three areas typically resolves connectivity issues.

Answer

Increase the MTU on the VPN interface

Answer

Disable DPD on the VPN phase 1

Question 2

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 3

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

Accepted Answer

The phase2 proposal (encryption, authentication, etc.) does not match.. Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Answer

The firewall policies at Site B are blocking UDP port 500.

Answer

The pre-shared key does not match on both sides.

Answer

The DPD settings are incompatible between the peers.

Question 4

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

Accepted Answer

ZTNA (Zero Trust Network Access) proxy. ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Answer

IPsec VPN with XAuth authentication

Answer

SSL VPN with web mode portal

Answer

FortiGate's explicit web proxy

Question 5

An administrator configures a hub-and-spoke ADVPN with FortiGate at the hub and multiple remote sites. After setup, spokes establish shortcuts directly. However, traffic between two spokes consistently goes through the hub even though shortcuts should exist. Running 'diagnose npu np6 ipsec peercache' shows no shortcut entries. What is the MOST likely reason?

Accepted Answer

The spokes are not running BGP over the ADVPN tunnels.. ADVPN shortcut tunnels require dynamic routing (e.g., BGP/OSPF) to exchange routes; otherwise, traffic continues via hub. The command output indicates no shortcut entries (peercache), typically because routes are not learned via routing protocol.

Answer

The firewall policies on the spokes do not allow shortcut traffic.

Answer

Shortcut tunnels are disabled on the hub phase1 configuration.

Answer

The network processor (NP6) is not enabled for IPsec acceleration.

Question 6

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

Accepted Answer

A user group with SAML authentication method and an SSL VPN portal referencing that group.. For SAML SSO on SSL VPN, you must configure a user group with SAML authentication, then assign an SSL VPN portal that uses that group. The FortiGate acts as SP. RADIUS/LDAP are not required.

Answer

A RADIUS server pointing to the IdP and an authentication rule.

Answer

An LDAP server with the IdP's certificate and a matching policy.

Answer

A local user with SAML attributes and a firewall policy referencing that user.

Question 7

An administrator configures a ZTNA rule with an inline CASB profile to protect access to a SaaS application. The rule uses a ZTNA tag that requires 'OS Type = Windows' and 'Antivirus = running'. A user with a Windows 10 device and Symantec antivirus running is denied access. What is the MOST likely cause?

Accepted Answer

The Symantec antivirus is not listed in the FortiGate's supported antivirus list.. FortiGate checks device posture against known antivirus vendors. If Symantec is not in the supported list, the tag condition fails. FortiClient EMS is not required for ZTNA tags if using other telemetry, but the AV check requires a recognized AV.

Answer

The user's device is not connected to the corporate network.

Answer

The inline CASB profile is blocking all traffic from the ZTNA rule.

Answer

The ZTNA tag requires the FortiClient EMS to be installed on the device.

Question 8

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN configuration?

Accepted Answer

To detect if a VPN peer is alive by sending periodic probes and bringing down the tunnel if no response is received.. DPD sends keepalive messages to detect peer reachability. If the peer does not respond, the tunnel is marked down, allowing failover. Key renegotiation is handled by IKE lifetime settings, not DPD.

Answer

To establish a backup tunnel in case the primary tunnel fails.

Answer

To automatically renegotiate IKE phase1 keys before they expire.

Answer

To verify the integrity of encrypted packets using HMAC authentication.

Question 9

A FortiGate administrator receives an error during IPsec VPN configuration: 'Certificate validation failed: certificate uses weak key.' The admin is using a PKI certificate with RSA 2048-bit key. The FortiGate firmware is up-to-date. What is the MOST likely reason for this error?

Accepted Answer

The FortiGate has a security policy that rejects certificates with keys less than 3072 bits.. In recent FortiOS versions, a security hardening setting may require minimum RSA key size of 3072 bits. RSA 2048 is considered weak by some compliance standards and may be blocked by the 'weak key' validation check. The admin can adjust the setting or use a stronger key.

Answer

The certificate has expired or is not yet valid.

Answer

The certificate's private key is not imported on the FortiGate.

Answer

The certificate authority is not trusted by the FortiGate.

Question 10

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

Accepted Answer

The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.. Even if the tunnel is up, OSPF packets (protocol 89) must be explicitly permitted by a firewall policy on the tunnel. Without that policy, OSPF Hellos are dropped and adjacency fails. Network type mismatch can also cause issues, but the most common is missing policy.

Answer

OSPF is not enabled on the tunnel interface.

Answer

The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.

Answer

The MTU on the tunnel interface is too large for OSPF packets.

Question 11

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

Accepted Answer

To identify a device's compliance status and attributes for policy enforcement.. ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Answer

To mark packets for quality of service (QoS) prioritization.

Answer

To label network interfaces for traffic steering.

Answer

To assign a security level to application traffic.

Question 12

An administrator configures Multi-Peer VPN (MPVPN) on a FortiGate aggregator. The aggregator has two phase1 configurations for the same remote subnet but different peers. The aggregator's routing table shows both peers as next hops. The administrator notices that traffic between the aggregator and the remote subnet is load-balanced across both peers. What is the cause?

Accepted Answer

The aggregator has two static routes with equal cost to the remote subnet.. MPVPN itself does not load balance; it provides redundancy. Load balancing occurs if multiple routes to the same destination exist with equal administrative distance and cost. Static routes with equal distance cause ECMP behavior. BGP with equal metrics can also cause it, but the question states static routes are in the routing table.

Answer

The MPVPN feature automatically load-balances traffic across all active peers.

Answer

The phase1 configurations have the same proposal settings, causing implicit load balancing.

Answer

The remote peers are both advertising the same subnet via BGP with equal metrics.

Question 13

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

Accepted Answer

Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.. FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Answer

Configure the FortiGate as a SAML IdP for FortiClient EMS.

Answer

Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.

Answer

Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.

Question 14

An administrator runs the CLI command 'diagnose vpn ike gateway list' and sees that a phase1 gateway is in 'UP' state, but the 'DPD' field shows 'disabled'. The tunnel is working. What is the implication?

Accepted Answer

The tunnel will never detect if the remote peer goes down.. DPD is the mechanism to detect peer liveness. If disabled, the FortiGate will not proactively check if the peer is reachable, so a dead peer will not be detected until traffic fails. IKE keepalives are not a separate mechanism; DPD is the standard method. NAT-T does not inherently disable DPD.

Answer

DPD is only used for phase2, so phase1 is unaffected.

Answer

DPD is disabled but the tunnel will still detect peer failure via IKE keepalives.

Answer

The FortiGate is using NAT-T, which disables DPD automatically.

Question 15

A FortiGate administrator needs to configure a hub-and-spoke ADVPN with OSPF as the routing protocol over the VPN tunnels. Which TWO steps are required on the hub FortiGate to enable shortcut tunnels?

Accepted Answer

Enable 'shortcut' option under the phase2 configuration.. For ADVPN, the hub must be configured as auto-discovery-sender (to advertise shortcut capability) and the phase2 must have the 'shortcut' option enabled. Receiver is for spokes. OSPF network type can be point-to-multipoint; broadcast is not required. 'add-route' is unrelated.

Answer

Set 'add-route' to 'disable' on the phase2 configuration.

Answer

Enable 'auto-discovery-receiver' on the hub's phase1 configuration.

Answer

Configure OSPF network type as 'broadcast' on the hub's tunnel interface.