NSE7 Advanced VPN and Zero Trust Practice Test 6 — 15 Questions

Question 1

A FortiGate administrator configures a hub-and-spoke VPN with OSPF routing. The spoke FortiGates are learning routes from the hub, but inter-spoke traffic is being routed through the hub instead of using shortcut tunnels. What configuration is missing on the hub to allow ADVPN shortcut establishment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable route redistribution from OSPF into the VPN tunnel interface on the hub. For ADVPN to work, the hub must have 'auto-discovery-sender' enabled and also must not redistribute spoke routes back to other spokes in a way that prevents shortcut. Typically, the hub should not redistribute OSPF routes learned from one spoke into another; ADVPN relies on IKE shortcuts.

Answer

Set the VPN interface type to 'tunnel' instead of 'vlan'

Answer

Enable 'auto-discovery-sender' on the hub and 'auto-discovery-forwarder' on spokes

Answer

Configure a static route for inter-spoke traffic on the hub

Question 2

An administrator runs the following command on a FortiGate and sees the output:
diagnose sys session filter dport 443
diagnose sys session list
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The TCP handshake has not completed; the client sent SYN and is waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in FortiGate's session table indicates a TCP SYN_SENT state. The session has been active for 3600 seconds (1 hour) with 3599 seconds remaining, meaning the client sent a SYN but never received a SYN-ACK, so the TCP three-way handshake is incomplete. This is why option A is correct.

Answer

The session is fully established and has been idle for 1 hour

Answer

The session is in FIN_WAIT state and is closing

Answer

The session is using UDP protocol

Question 3

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

Accepted Answer

The IdP's entity ID or SSO URL is incorrectly entered on FortiGate. As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Answer

The FortiGate's SP entity ID does not match the Azure AD application's identifier

Answer

The administrator's account is not synchronized with Azure AD

Answer

The certificate used for signing is not trusted by the IdP

Question 4

An administrator configures ZTNA inline CASB to control access to a SaaS application. The goal is to block uploads of files with credit card numbers. The administrator configures a CASB profile with a DLP rule for credit card numbers. However, uploads are not being blocked. What is the most likely reason?

Accepted Answer

SSL inspection is not enabled for the traffic. Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

Answer

The CASB profile is not applied to the ZTNA policy

Answer

The DLP rule is configured to monitor instead of block

Answer

The SaaS application is not supported by CASB

Question 5

An administrator needs to configure a FortiGate to act as a SAML identity provider (IdP) for a third-party cloud application (SP). Which TWO settings must be configured on the FortiGate to function as an IdP?

Accepted Answer

SAML IdP user group. The FortiGate requires a SAML IdP user group to define which users are allowed to authenticate via SAML. This group is referenced in the SAML IdP configuration to control access and map attributes to the service provider. Without it, the IdP cannot determine which users to authenticate or how to release attributes.

Answer

LDAP server configuration

Answer

SP metadata import

Answer

SSL VPN portal

Question 6

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Accepted Answer

Check if there is a route on the internal network pointing back to the VPN subnet. If the internal network lacks a route back to the VPN subnet (e.g., 10.10.10.0/24), return traffic from internal resources will be dropped or misrouted, preventing remote users from accessing those resources even though the IPsec tunnel is established. This is a classic asymmetric routing issue where the FortiGate sends traffic to the internal network, but the internal router has no path back to the VPN client IPs.

Answer

Increase the MTU on the VPN interface

Answer

Disable DPD on the VPN phase 1

Question 7

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Accepted Answer

Create a ZTNA policy that includes the 'Compliant' tag as a required condition. To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer

Enable SSL deep inspection on the firewall policy

Answer

Import the FortiClient EMS certificate to FortiGate

Answer

Configure a firewall policy with source set to the EMS connector

Question 8

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

Accepted Answer

The phase2 proposal (encryption, authentication, etc.) does not match.. Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Answer

The firewall policies at Site B are blocking UDP port 500.

Answer

The pre-shared key does not match on both sides.

Answer

The DPD settings are incompatible between the peers.

Question 9

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

Accepted Answer

ZTNA (Zero Trust Network Access) proxy. ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Answer

IPsec VPN with XAuth authentication

Answer

SSL VPN with web mode portal

Answer

FortiGate's explicit web proxy

Question 10

An administrator configures a hub-and-spoke ADVPN with FortiGate at the hub and multiple remote sites. After setup, spokes establish shortcuts directly. However, traffic between two spokes consistently goes through the hub even though shortcuts should exist. Running 'diagnose npu np6 ipsec peercache' shows no shortcut entries. What is the MOST likely reason?

Accepted Answer

The spokes are not running BGP over the ADVPN tunnels.. In a hub-and-spoke ADVPN, BGP is required to propagate the spoke's private IP addresses (used as tunnel endpoints) across the overlay network. Without BGP, spokes do not learn each other's tunnel IPs, so they cannot initiate shortcut tunnels. The 'diagnose npu np6 ipsec peercache' command shows no shortcut entries because the shortcut negotiation never starts.

Answer

The firewall policies on the spokes do not allow shortcut traffic.

Answer

Shortcut tunnels are disabled on the hub phase1 configuration.

Answer

The network processor (NP6) is not enabled for IPsec acceleration.

Question 11

A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?

Accepted Answer

A user group with SAML authentication method and an SSL VPN portal referencing that group.. For SAML SSO on SSL VPN, you must configure a user group with SAML authentication, then assign an SSL VPN portal that uses that group. The FortiGate acts as SP. RADIUS/LDAP are not required.

Answer

A RADIUS server pointing to the IdP and an authentication rule.

Answer

An LDAP server with the IdP's certificate and a matching policy.

Answer

A local user with SAML attributes and a firewall policy referencing that user.

Question 12

An administrator configures a ZTNA rule with an inline CASB profile to protect access to a SaaS application. The rule uses a ZTNA tag that requires 'OS Type = Windows' and 'Antivirus = running'. A user with a Windows 10 device and Symantec antivirus running is denied access. What is the MOST likely cause?

Accepted Answer

The Symantec antivirus is not listed in the FortiGate's supported antivirus list.. The ZTNA tag requires 'Antivirus = running', which means the FortiGate must receive a compliance report from the FortiClient EMS indicating that a supported antivirus is active. Symantec is not in FortiGate's supported antivirus list, so the EMS reports the antivirus status as 'not compliant', causing the ZTNA rule to deny access even though the user has antivirus running.

Answer

The user's device is not connected to the corporate network.

Answer

The inline CASB profile is blocking all traffic from the ZTNA rule.

Answer

The ZTNA tag requires the FortiClient EMS to be installed on the device.

Question 13

What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN configuration?

Accepted Answer

To detect if a VPN peer is alive by sending periodic probes and bringing down the tunnel if no response is received.. DPD sends keepalive messages to detect peer reachability. If the peer does not respond, the tunnel is marked down, allowing failover. Key renegotiation is handled by IKE lifetime settings, not DPD.

Answer

To establish a backup tunnel in case the primary tunnel fails.

Answer

To automatically renegotiate IKE phase1 keys before they expire.

Answer

To verify the integrity of encrypted packets using HMAC authentication.

Question 14

A FortiGate administrator receives an error during IPsec VPN configuration: 'Certificate validation failed: certificate uses weak key.' The admin is using a PKI certificate with RSA 2048-bit key. The FortiGate firmware is up-to-date. What is the MOST likely reason for this error?

Accepted Answer

The FortiGate has a security policy that rejects certificates with keys less than 3072 bits.. In recent FortiOS versions, a security hardening setting may require minimum RSA key size of 3072 bits. RSA 2048 is considered weak by some compliance standards and may be blocked by the 'weak key' validation check. The admin can adjust the setting or use a stronger key.

Answer

The certificate has expired or is not yet valid.

Answer

The certificate's private key is not imported on the FortiGate.

Answer

The certificate authority is not trusted by the FortiGate.

Question 15

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

Accepted Answer

The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.. Even if the tunnel is up, OSPF packets (protocol 89) must be explicitly permitted by a firewall policy on the tunnel. Without that policy, OSPF Hellos are dropped and adjacency fails. Network type mismatch can also cause issues, but the most common is missing policy.

Answer

OSPF is not enabled on the tunnel interface.

Answer

The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.

Answer

The MTU on the tunnel interface is too large for OSPF packets.