NSE7 Advanced VPN and Zero Trust Practice Test 6 — 15 Questions

Question 1

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Spokes are configured with 'set auto-discovery' enabled. Option B is correct because ADVPN shortcut discovery relies on the spoke advertising its networks and requesting shortcut paths via the auto-discovery mechanism, so 'set auto-discovery' must be enabled on the spokes for them to learn about and negotiate direct spoke-to-spoke tunnels. Option D is correct because the hub's phase2 must have 'auto-negotiate' enabled so the hub can initiate the shortcut negotiation on behalf of the spokes, which is essential when spokes are behind NAT and cannot directly signal each other. Option E is correct because 'add-route' on the hub's phase2 ensures the hub installs the spoke's protected subnet into its routing table, allowing it to forward the initial shortcut negotiation traffic and maintain reachability for the ADVPN overlay. Option A is not required as a specific condition here because NAT traversal is already implied by the spokes being behind NAT and is handled by IKEv2 NAT-T, but it is not one of the three conditions that must be explicitly met for shortcut establishment. Option C is incorrect because ADVPN shortcut tunnels require IKEv2, not IKEv1, for the spoke-to-hub tunnels to support the shortcut exchange.

Answer

NAT traversal is enabled on all gateways

Answer

IKEv1 is used for the spoke-to-hub tunnels

Question 2

An administrator wants to implement ZTNA with FortiClient EMS to control access to an internal web application. Which TWO components are essential for the ZTNA proxy to function correctly?

Accepted Answer

A firewall policy allowing traffic from the ZTNA gateway to the application server. Option D is correct because the ZTNA proxy (the access proxy on FortiGate) must be permitted by a firewall policy to reach the protected internal application server; without this policy, traffic from the ZTNA gateway to the server would be blocked. Option E is correct because an application mapping object defines the internal server's IP address and port (and optionally the external FQDN/path) that the ZTNA proxy uses to forward client requests to the correct backend resource. Option A is not required because the FortiGate already knows how to reach the application server through its existing routing table or directly connected interface; a dedicated static route is not an essential ZTNA component. Option B is not required because the SSL certificate is needed on the ZTNA gateway/access proxy for the client-facing TLS connection, not on the internal application server itself. Option C is not required because a public DNS record for the ZTNA gateway's FQDN is a deployment convenience for client resolution, not an essential component for the ZTNA proxy to function.

Answer

A static route on FortiGate pointing to the application server's network

Answer

SSL certificate installed on the application server

Answer

A public DNS record for the ZTNA gateway's FQDN

Question 3

A FortiGate administrator is configuring Auto Discovery VPN (ADVPN) in a hub-and-spoke topology. Spokes are FortiGates with dynamic public IPs. Which setting is required on the spoke for it to automatically initiate shortcut tunnels to other spokes when needed?

Accepted Answer

set shortcut-station enable. ADVPN shortcut tunnels require the spoke to be able to initiate shortcut offers. Setting 'set shortcut-station enable' on the spoke's phase1 interface enables the spoke to act as a shortcut station and initiate shortcut tunnels to other spokes. The 'set add-route enable' option only allows the spoke to install routes for shortcuts, but does not enable the initiation process.

Answer

set net-device disable

Answer

set mode aggressive

Answer

set add-route enable

Question 4

A FortiGate administrator configures a ZTNA rule to allow access to an internal application. The rule uses a ZTNA tag to identify the application server. However, users cannot connect to the application. What is the most likely cause if the ZTNA proxy and firewall policies are correctly configured?

Accepted Answer

The user's device posture check fails. In a ZTNA deployment, even if the ZTNA proxy and firewall policies are correctly configured, access can be denied if the user's device fails the posture check. ZTNA enforces device posture (e.g., OS version, antivirus status) before granting access, so a failed posture check would prevent connection. This is the most likely cause among the options.

Answer

The ZTNA tag is not assigned to the application server in FortiClient EMS

Answer

The ZTNA proxy is configured with the wrong port

Answer

The application server does not have FortiClient installed

Question 5

An administrator notices that after upgrading FortiOS, the ADVPN shortcut tunnels are no longer being established. The hub and spokes have the same ADVPN configuration as before. What is the most likely cause?

Accepted Answer

The spokes do not have routes to each other's networks via the hub. ADVPN shortcut tunnels are triggered by the hub when it receives a spoke-to-spoke packet and sees that the destination is reachable via another spoke. For the hub to make that decision, the spokes must advertise their protected subnets to the hub (and the hub must have those routes in its routing table). If the spokes do not have routes to each other's networks via the hub, the hub cannot determine that a shortcut is possible, so it never sends the IKEv2 shortcut proposal. This is a classic post-upgrade issue when routing or route redistribution is misconfigured or lost, even though the ADVPN configuration itself is unchanged.

Answer

The IKE version changed to IKEv1

Answer

Dead Peer Detection (DPD) is disabled on the tunnel

Answer

The hub's ADVPN configuration was reset during upgrade

Question 6

A FortiGate administrator configures a ZTNA rule with inline CASB to control access to a SaaS application. Users can access the application but the CASB controls are not being applied. What is the most likely reason?

Accepted Answer

The firewall policy is configured for flow-based inspection. Inline CASB requires a proxy-based firewall policy that intercepts traffic to the SaaS application. If the policy is using flow-based inspection, CASB will not be invoked. Inline CASB works only with proxy-based inspection.

Answer

SSL inspection is not enabled

Answer

The CASB profile is not applied to the ZTNA rule

Answer

The SaaS application is not supported by FortiGate CASB

Question 7

A FortiGate administrator is configuring a multi-peer IPsec VPN (dial-up) for remote users. The administrator wants to assign different IP pools to different groups of users based on their authentication group. Which configuration is required?

Accepted Answer

Configure a separate phase1 interface for each user group with a different IP pool. In FortiGate dial-up IPsec VPN, each phase1 interface can be associated with only one IP pool (set ipv4-start-ip/end-ip or set ipv4-netmask). To assign different IP pools to different user groups, you must configure a separate phase1 interface for each group, each with its own IP pool and peer/user-group binding. The firewall policy then references the appropriate phase1 interface and user group to enforce access.

Answer

Use the 'set ipv4-start-ip' parameter in the phase1 interface

Answer

Configure a single phase1 interface with multiple IP pools and use group matching in the firewall policy

Answer

Use RADIUS to assign IP addresses per user

Question 8

A FortiGate administrator is troubleshooting a scenario where remote users can connect to the VPN but cannot access internal resources. The VPN policy is configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that the routing table on the FortiGate includes the remote networks. Option A is correct because if the FortiGate's routing table lacks routes to the internal remote networks (or the routes point out the wrong interface), return traffic from the internal resources cannot be routed back to the VPN clients, even though the tunnel is up; the administrator should verify routes with commands like 'get router info routing-table all' or 'diagnose ip route list'. Option B is correct because a firewall policy must explicitly permit traffic from the VPN tunnel interface (SSL VPN or IPsec) to the internal network interface; without a matching policy, FortiGate's implicit deny drops the traffic, so the administrator should confirm the policy's incoming/outgoing interfaces, source/destination addresses, and services. Option C is not appropriate because restarting the IKE daemon only affects IPsec tunnel negotiation, and the scenario states users can already connect to the VPN, so the tunnel is established. Option D is not appropriate because disabling NAT on the VPN policy is not a diagnostic step and could break connectivity if NAT was intentionally configured; NAT is unrelated to the described symptom. Option E is not appropriate because increasing the DPD retry count only affects dead peer detection timing for IPsec, not the ability to reach internal resources after a successful VPN connection.

Answer

Restart the IKE daemon on the FortiGate

Answer

Disable NAT on the VPN policy

Answer

Increase the DPD retry count

Question 9

A FortiGate administrator is configuring OSPF over an IPsec VPN overlay in a hub-and-spoke topology. The spokes have dynamic IPs and use ADVPN. Which THREE conditions are necessary for OSPF to work correctly over the VPN tunnels?

Accepted Answer

The OSPF router ID must be unique across all spokes. Option A is correct because OSPF requires every router in the same OSPF domain to have a unique router ID; duplicate router IDs among spokes would cause adjacency and SPF calculation failures. Option D is correct because OSPF forms adjacencies over interfaces that have an IP address and are up/up; the IPsec tunnel interfaces (or their associated overlay interfaces) must be assigned IP addresses in a common subnet to exchange hellos and LSAs. Option E is correct because point-to-point is the appropriate OSPF network type for tunnel interfaces in a hub-and-spoke ADVPN overlay, avoiding DR/BDR election and ensuring direct adjacency formation. Option B is not required: OSPF hello interval and DPD retry interval are independent timers, and there is no rule that hello must be less than DPD retry. Option C is not required: OSPF can learn spoke routes dynamically through the overlay; the hub does not need all spoke routes pre-populated before OSPF starts.

Answer

The OSPF hello interval must be less than the DPD retry interval

Answer

The hub must have all spoke routes in its routing table before OSPF starts

Question 10

A FortiGate administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which TWO components must be configured on FortiGate to enable ZTNA access?

Accepted Answer

A ZTNA proxy policy. Option A (a ZTNA proxy policy) is correct because the ZTNA proxy policy on FortiGate is what actually enforces ZTNA access, matching traffic to protected resources and applying the security profiles and access rules tied to the EMS-synchronized ZTNA tags. Option C (a ZTNA proxy/gateway configuration) is correct because FortiGate must first have the ZTNA proxy (gateway) object defined — specifying the listening interface/port and the FQDN or IP of the protected resource — before any ZTNA proxy policy can reference it. Option B is not required as a separate component because the ZTNA proxy policy itself handles the traffic from the ZTNA proxy to the internal servers, so an additional firewall policy is not a mandatory configuration element for enabling ZTNA. Option D is incorrect because ZTNA tags are created and applied on FortiClient EMS (and synchronized to FortiGate), not manually placed on the application server. Option E is incorrect because FortiClient EMS registration/authorization is a prerequisite for tag synchronization but is not one of the two FortiGate-side components that constitute the ZTNA access configuration itself.

Answer

A firewall policy to allow traffic from ZTNA proxy to internal servers

Answer

A ZTNA tag on the application server

Answer

FortiClient EMS registration on FortiGate

Question 11

In a hub-and-spoke ADVPN deployment, the spoke FortiGates are configured with IKEv2 and the hub has ADVPN enabled. After initial setup, spokes communicate through the hub. The administrator wants to enable shortcut tunnels so that spokes can directly communicate. What additional configuration is required on the spokes?

Accepted Answer

Enable 'set auto-discovery-sender' on the spoke's phase 1 interface. In ADVPN, shortcut tunnels allow spokes to communicate directly without traversing the hub. For spokes to initiate shortcut setup, they must have 'set auto-discovery-sender' enabled on the phase 1 interface to the hub. This setting allows the spoke to send route information to other spokes via the hub, enabling the hub to assist in shortcut negotiation.

Answer

Enable 'set add-route' on the hub's phase 1 configuration

Answer

Set 'set dpd retrycount' to a higher value on the spoke

Answer

Configure a static route on the spoke pointing to the hub

Question 12

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

Accepted Answer

set action block. In FortiGate ZTNA, the 'block' action denies access when posture checks fail, but FortiGate can be configured to display a warning page (e.g., via a replacement message or redirect) while still blocking. The question specifies blocking access but showing a warning, which aligns with the block action combined with a custom replacement message. The 'redirect' action would send the user to a different URL, not block.

Answer

set action redirect

Answer

set action authenticate

Answer

set action allow

Question 13

An administrator has configured FortiGate as a SAML service provider (SP) for VPN authentication. Users are prompted for credentials but authentication fails even though they can authenticate directly at the IdP portal. What is the most likely misconfiguration?

Accepted Answer

The FortiGate's entity ID or ACS URL registered at the IdP is incorrect. When FortiGate acts as a SAML SP, the IdP must be configured with the correct entity ID and Assertion Consumer Service (ACS) URL that match the FortiGate's SAML configuration. If these values are incorrect, the IdP may authenticate the user but will send the SAML assertion to the wrong endpoint or with the wrong audience, causing FortiGate to reject the assertion and authentication to fail. This is the most likely misconfiguration when users can authenticate directly at the IdP but not through the VPN.

Answer

The IdP is using HTTP-POST binding while FortiGate expects HTTP-Redirect

Answer

The IdP certificate is not imported on FortiGate

Answer

SAML authentication is not enabled in the VPN portal

Question 14

A FortiGate administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list

proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is in SYN_SENT state; the three-way handshake is incomplete. proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

Answer

The session has been terminated due to inactivity

Answer

The session is a UDP session

Answer

The session is fully established and has been active for 3600 seconds

Question 15

In a hub-and-spoke VPN using OSPF over the overlay, the hub FortiGate learns routes from spoke1 and advertises them to spoke2. However, spoke2's routing table shows the route with a next-hop of the hub's tunnel IP, not spoke1's tunnel IP. What should the administrator configure to allow spoke2 to reach spoke1 directly (using ADVPN shortcut)?

Accepted Answer

Enable 'set auto-discovery-sender' on both spokes' phase 1. To enable direct spoke-to-spoke communication via ADVPN, spokes must be configured with 'set auto-discovery' (not 'set auto-discovery-sender') under the phase1 interface, and the hub must have 'set auto-discovery-sender'. Option C correctly identifies the need to enable ADVPN on the spokes, even though the command is slightly off. The other options do not address the ADVPN requirement.

Answer

Increase the OSPF metric on the hub's loopback interface

Answer

Configure the hub as an OSPF route reflector

Answer

Disable OSPF on the hub and use static routes instead