NSE7 Advanced VPN and Zero Trust Practice Test 6 — 15 Questions

Question 1

An administrator is troubleshooting a ZTNA application access issue. Users can authenticate but cannot reach the internal application via the ZTNA proxy. The FortiGate's ZTNA rule uses a tag requiring 'OS Type = Windows' and 'Antivirus = running'. The device meets both conditions. Which THREE possible reasons could cause the access failure?

Accepted Answer

The ZTNA proxy's destination is pointing to the wrong internal IP or port.. If the tag is met, the device passes posture. Access failure can be due to wrong proxy destination (A), missing firewall policy (C), or untrusted certificate (D). Tag assignment (B) is irrelevant if tag is already satisfied; FortiClient EMS is not required for device posture if using other telemetry (E), but even if required, not having FortiClient would prevent the tag from being met, which contradicts the premise.

Answer

The user is not assigned the ZTNA tag in the FortiClient EMS portal.

Answer

The device does not have FortiClient installed.

Question 2

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Accepted Answer

Configure a RADIUS server pointing to FortiNAC.. FortiGate integrates with FortiNAC via RADIUS (B) to query device compliance and NAC policies (A) on the interface to enforce access. 802.1x is typically handled by the switch, not FortiGate directly. SGT and nac-mode are not standard for this integration.

Answer

Create a security group tag (SGT) mapping.

Answer

Enable '802.1x' authentication on the interface.

Answer

Set the 'nac-mode' to 'global-vlan' under the interface.

Question 3

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

Accepted Answer

The remote FortiGate is behind a NAT device without proper NAT-T configuration. DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option C is correct because DPD relies on bidirectional IKE traffic; if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped.

Answer

The IPsec phase2 proposal is mismatched, causing rekey failures

Answer

The IKE SA lifetime is set too long, causing the tunnel to expire

Answer

The local FortiGate's DPD interval is set too low, causing false positives

Question 4

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. For shortcut tunnels to be established in ADVPN, each spoke must have a tunnel interface with an IP address in the same subnet as other spokes, and the 'auto-discovery' setting must be enabled on the spoke's phase1 configuration. Additionally, a firewall policy must allow the shortcut traffic. Option D is correct because without enabling auto-discovery on the spoke's phase1, the spoke will not initiate shortcut negotiation.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 5

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

Accepted Answer

Configure the FortiGate as an EMS connector and import the tag. ZTNA uses tags from EMS to make access decisions. The FortiGate must be configured to receive these tags via the EMS connector and then use them in firewall policies (via ZTNA rules). Option C is correct because the FortiGate needs to connect to EMS to pull tag information and then apply it in security policies.

Answer

Configure SSL VPN to authenticate users and assign tags

Answer

Install a client certificate on each FortiClient from the FortiGate

Answer

Enable ZTNA inline CASB in the antivirus profile

Question 6

An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?

Accepted Answer

The user's device does not have the required ZTNA tags from EMS. A 403 Forbidden error in ZTNA typically indicates that the access control rule denied the request. This can happen if the device does not meet the required posture checks (ZTNA tags). Option B is correct because the ZTNA rule likely requires a specific tag that the device does not have, resulting in denial.

Answer

The FortiGate firewall policy allowing ZTNA traffic is missing

Answer

The application server does not have a valid certificate

Answer

The ZTNA proxy is configured with the wrong port for the application

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the traffic?

Accepted Answer

The session is an established TCP connection. The output shows a TCP session (proto=6), with proto_state=01 indicating the session is in the 'listen' or 'established' state? Actually, in FortiGate session diagnostics, proto_state=01 means the session is in the 'established' state (TCP state ESTABLISHED). The session has been up for 3600 seconds and will expire in 3599 seconds. Option A is correct because it's an established TCP session.

Answer

The session is being blocked by the firewall

Answer

The session is in a half-open state, waiting for SYN-ACK

Answer

The session is a UDP connection with a long timeout

Question 8

A FortiGate administrator is configuring OSPF over an IPsec VPN between a hub and a spoke. The OSPF adjacency forms correctly, but routes from the spoke are not being advertised to the hub. The administrator checks the OSPF database on the hub and sees no Type-1 LSAs from the spoke. What is the most likely issue?

Accepted Answer

The OSPF interface is configured as passive. For OSPF to advertise routes, the interfaces must be in the correct area and not passive. Option D is correct because if the interface is set as passive, OSPF will not send or receive updates on that interface, preventing route advertisement.

Answer

The OSPF hello interval is set too high

Answer

The OSPF network type is set to broadcast on both ends

Answer

The MTU mismatch between the two VPN interfaces

Question 9

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

Accepted Answer

FortiGate ZTNA proxy configuration. ZTNA on FortiGate requires the FortiGate to act as a ZTNA proxy (gateway) that intercepts traffic to internal applications. Option B is correct because the FortiGate must be configured as a ZTNA proxy to receive and forward traffic according to access rules.

Answer

FortiSandbox for content inspection

Answer

FortiAnalyzer for log analysis

Answer

FortiAuthenticator for RADIUS authentication

Question 10

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

Accepted Answer

The CA certificate is not configured for peer certificate validation. For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

Answer

The IKEv2 proposal includes an incompatible encryption algorithm

Answer

The local certificate is not associated with the phase1 interface

Answer

The remote peer's certificate is not signed by the imported CA

Question 11

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

Accepted Answer

The FortiGate's EMS connector is not syncing tag information in real-time. Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Answer

The user's IP address has changed and the tag is mapped to a different IP

Answer

The ZTNA rule is configured with the wrong application port

Answer

The device posture compliance check requires additional criteria not met

Question 12

An administrator wants to use SAML SSO with FortiGate as the Service Provider (SP) to allow users to authenticate via an external IdP. What must be configured first on the FortiGate to establish the SAML trust?

Accepted Answer

A certificate for SAML signing and encryption. SAML SSO requires the FortiGate to have a certificate that the IdP trusts for signing assertions. Option D is correct because the FortiGate needs to import a CA-signed certificate (or use a self-signed) to sign SAML requests and also to establish the trust relationship with the IdP.

Answer

A firewall policy to allow SAML traffic

Answer

A RADIUS server for user authentication

Answer

An LDAP server for group membership lookup

Question 13

A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?

Accepted Answer

The DPD (Dead Peer Detection) timeout is triggered every 30 minutes. The phase2 lifetime of 3600 seconds (1 hour) would cause rekey every hour, but the tunnel drops every 30 minutes. Option B is correct because DPD settings can cause the tunnel to be considered dead if the peer does not respond; if DPD timeout is set to 1800 seconds (30 minutes), the tunnel would be torn down. However, the rekey should succeed; DPD timeout indicates the peer is not reachable, possibly due to a transient issue. But among options, DPD is most plausible.

Answer

The phase2 lifetime is set to 3600 seconds, causing rekey failures

Answer

The phase1 lifetime is too short, causing frequent renegotiation

Answer

The VPN tunnel is not configured to use NAT traversal

Question 14

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

Accepted Answer

The compliance rule is not assigned to a FortiClient configuration profile. For compliance enforcement, the compliance rule must be applied to a configuration profile that is assigned to the users. Option B is correct because without assigning the compliance rule via a profile, the rule is not enforced on endpoints.

Answer

The FortiClient telemetry is not sending compliance status

Answer

The compliance rule is not enabled on the FortiGate via ZTNA tag

Answer

The VPN policy on the FortiGate does not require compliance check

Question 15

A FortiGate administrator needs to ensure that only devices with an updated antivirus can access a sensitive internal application via ZTNA. The administrator has created a ZTNA tag 'AV_Updated' in EMS and configured a ZTNA rule on FortiGate that requires this tag. Which TWO additional steps are necessary to enforce this access control? (Choose two.)

Accepted Answer

Create a firewall policy that references the ZTNA rule. To enforce ZTNA tag-based access, the FortiGate must import the tag from EMS (A) and the ZTNA rule must be referenced in a firewall policy (D). Without the firewall policy, the rule is not applied to traffic.

Answer

Configure the application server to use HTTPS

Answer

Enable SSL VPN on the FortiGate for ZTNA traffic

Answer

Install a client certificate on each device for authentication