NSE7 Advanced VPN and Zero Trust Practice Test 7 — 15 Questions

Question 1

A FortiGate is configured with FortiClient EMS to enforce ZTNA posture checks. The administrator finds that some Windows 10 clients are not reporting their antivirus status correctly, causing them to be blocked. However, the clients have antivirus installed and running. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiClient EMS connector is disabled on the endpoints. FortiClient EMS posture checks depend on the FortiClient EMS connector (the telemetry/agent component) being enabled and running on the endpoint so it can report antivirus, patch, and other posture data to EMS, which FortiGate then queries via the EMS connector. If the connector is disabled, the endpoint may have antivirus running but FortiGate receives no posture data and applies the default block action.

Answer

The clients are not connected to the corporate network

Answer

The antivirus definitions are outdated

Answer

FortiGate is using the wrong EMS tag

Question 2

An administrator wants to use FortiGate as a SAML identity provider (IdP) for a third-party service. Which configuration is required on FortiGate?

Accepted Answer

Configure a SAML identity provider user and export FortiGate's metadata. When FortiGate acts as a SAML IdP, it must be configured with a SAML identity provider user object that defines the IdP settings, and then FortiGate's SAML metadata must be exported and provided to the third-party service (the SP). This metadata contains the IdP's entity ID, SSO URL, and signing certificate, which the SP needs to establish trust. Option C correctly identifies both the required local user configuration and the metadata export step.

Answer

Enable SAML authentication in the firewall policy

Answer

Configure FortiAuthenticator as an external IdP

Answer

Configure a SAML service provider user and import the SP metadata

Question 3

A FortiGate administrator sees the following syslog message repeatedly: 'IPsec phase 2 failed to establish SA with peer due to proposal mismatch.' The administrator has already verified that the phase 2 parameters (encryption, authentication, PFS, and lifetime) match on both sides. What else should the administrator check?

Accepted Answer

The local and remote subnets defined in the phase 2 selector. Even when encryption, authentication, PFS, and lifetime match, a phase 2 proposal mismatch can still occur if the local and remote subnet selectors (quick mode selectors) do not mirror each other — for example, if one side uses 10.0.0.0/24 and the other uses 10.0.0.0/16, or if one side is configured with a wildcard and the other with a specific subnet. The selectors are part of the phase 2 proposal exchange, so a mismatch triggers exactly this 'proposal mismatch' error.

Answer

The phase 1 proposal settings

Answer

The DPD configuration

Answer

The pre-shared key

Question 4

An administrator is deploying ADVPN with a hub-and-spoke topology. The hub FortiGate is configured with 'set auto-discovery enable' and 'set add-route enable'. Spokes have 'set auto-discovery-sender enable'. However, shortcut tunnels are not being established. Which two additional conditions must be met for shortcut tunnels to form? (Choose two.)

Accepted Answer

The phase 2 configuration on the hub must have 'set auto-discovery enable'. Option C is correct because in ADVPN, the hub's phase 2 selectors must also have auto-discovery enabled so the hub can signal spoke-to-spoke shortcut proposals; without 'set auto-discovery enable' in the hub's phase 2, the hub cannot advertise the shortcut and spokes never negotiate the direct tunnel. Option D is correct because ADVPN shortcut tunnels are triggered dynamically by traffic: when a spoke sends traffic destined to another spoke's protected subnet, the hub receives it and, seeing the destination is another ADVPN spoke, sends a shortcut proposal; with no inter-spoke traffic traversing the hub, no shortcut is ever initiated. Option A is not required because shortcut routes are installed dynamically via the ADVPN/BGP exchange rather than static routes between spokes. Option B is not required because DPD is used for dead peer detection and does not gate shortcut tunnel establishment. Option E is not required because ADVPN shortcut signaling is handled by the hub's auto-discovery mechanism, not by acting as a BGP route reflector.

Answer

The spokes must have a static route to each other's networks

Answer

The spokes must have 'set dpd enable' on the phase 1

Answer

The hub must be configured as a route reflector for BGP

Question 5

A FortiGate administrator is troubleshooting an IPsec VPN that uses IKEv2 with certificate authentication. The VPN fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the gateway state is 'IKE_INIT'. Which three possible causes should the administrator investigate? (Choose three.)

Accepted Answer

The certificate of the remote peer is not trusted by the local FortiGate. The gateway stuck in IKE_INIT indicates the failure occurs during IKE_SA_INIT, before authentication, so the administrator should investigate the certificate of the remote peer not being trusted by the local FortiGate (A), because trust-chain validation happens as part of certificate authentication and a missing CA or untrusted issuer will prevent the exchange from progressing. The phase 1 proposal mismatch (C) is also correct because IKE_SA_INIT negotiates encryption, hash, and DH group; any mismatch causes the responder to reject the proposal and the state remains at IKE_INIT. The remote peer's certificate having expired (E) is correct because an expired certificate fails validity checks during certificate authentication, blocking the IKEv2 exchange. Option B (incorrect pre-shared key) does not apply since the scenario uses certificate authentication, not PSK. Option D (incorrect phase 2 proxy ID) is wrong because proxy ID/quick mode issues arise after phase 1 succeeds, not while the gateway is still in IKE_INIT.

Answer

The pre-shared key is incorrect

Answer

The phase 2 proxy ID is incorrect

Question 6

A network administrator configures an IPsec VPN between two FortiGates using IKEv2. The tunnel establishes, but after a period of inactivity, traffic stops passing and the logs show 'IPsec phase 1 down'. The administrator wants to ensure the tunnel is quickly re-established when traffic resumes. Which setting should be configured?

Accepted Answer

Enable Dead Peer Detection (DPD) with 'on-idle' mode.. Dead Peer Detection (DPD) with 'on-idle' mode sends periodic hello packets only when there is no traffic on the tunnel, allowing the FortiGate to detect a dead peer and re-establish phase 1 quickly when traffic resumes. This directly addresses the scenario where the tunnel goes down after inactivity.

Answer

Set the phase1 proposal to use AES-256-GCM.

Answer

Configure the phase1 to use main mode instead of aggressive mode.

Answer

Set the IKE idle timeout to 0 (disabled).

Question 7

An administrator is troubleshooting an ADVPN scenario where spoke FortiGates are behind NAT. The shortcut tunnels are not forming between spokes. The hub has the appropriate ADVPN stage settings. What is the most likely cause of the shortcut failure?

Accepted Answer

NAT traversal is not enabled on the hub's phase1 interfaces.. In ADVPN, shortcut tunnels are established directly between spokes after the hub forwards the first packet. When spokes are behind NAT, the hub must be able to negotiate NAT traversal (NAT-T) so that the spokes' public IP and port mappings are discovered and used for the shortcut. If NAT traversal is not enabled on the hub's phase1 interfaces, the hub cannot signal the correct addresses, and shortcut tunnels fail to form.

Answer

The spokes are using dynamic IP addresses.

Answer

The spokes have the same IKE ID.

Answer

The shortcut tunnel uses a different encryption algorithm than the hub-spoke tunnel.

Question 8

A FortiGate is configured as a SAML Identity Provider (IdP) for a remote user accessing a web application via ZTNA. The user authenticates successfully, but the ZTNA proxy logs show 'access denied' for the user. Which configuration element is most likely missing or misconfigured?

Accepted Answer

The SAML user group is not added to the ZTNA rule's allowed groups.. For ZTNA access via a FortiGate acting as SAML IdP, the ZTNA rule must explicitly reference the SAML user group in its allowed groups list. Even if authentication succeeds, the proxy will deny access if the authenticated user's group is not matched by the ZTNA policy, which is exactly what the 'access denied' log indicates.

Answer

The ZTNA access proxy application is not enabled for HTTPS.

Answer

A firewall policy with ZTNA tags as source is missing.

Answer

ZTNA tags are not assigned to the user in FortiClient EMS.

Question 9

A FortiGate administrator runs the following diagnostic command: 'diagnose vpn ike gateway list'. The output shows a gateway with state 'down'. The administrator verifies that the peer is reachable and the pre-shared key is correct. What is a possible reason for the gateway state being 'down'?

Accepted Answer

The phase2 proposal is mismatched.. In FortiGate, the IKE gateway state reflects the overall status of the VPN tunnel, including both phase1 and phase2. While phase2 proposals are negotiated separately, a mismatch can cause the gateway to transition to 'down' because the gateway may re-evaluate its state after repeated phase2 negotiation failures. The other options are less likely: a changed remote IP would cause unreachability (contradicts given that peer is reachable), disabled DPD would not cause the state to go down, and idle timeout typically results in an 'idle' state, not 'down', unless DPD failures occur.

Answer

The remote gateway IP address has changed.

Answer

DPD is disabled on both ends.

Answer

IKE idle timeout has expired.

Question 10

An administrator configures a multi-peer IPsec VPN on FortiGate for redundancy. The primary peer is 10.1.1.1 and secondary is 10.1.1.2. The administrator notices that when the primary peer goes down, the FortiGate does not fail over to the secondary peer until the IKE SA times out (about 60 seconds). Which setting can reduce this failover time?

Accepted Answer

Set 'dpd-retryinterval' to 5 and 'dpd-retrycount' to 3.. DPD retry interval and count control how quickly FortiGate detects a dead peer. With retryinterval=5 and retrycount=3, the peer is declared dead after 15 seconds of no response, triggering failover to the secondary.

Answer

Configure 'idle-timeout' to 30 seconds.

Answer

Use aggressive mode for IKE negotiation.

Answer

Enable 'auto-negotiate' on the phase1 interface.

Question 11

An administrator needs to integrate FortiGate with FortiNAC for network access control. The goal is to dynamically quarantine endpoints that have out-of-date antivirus software. Which component is responsible for enforcing the quarantine on the network?

Accepted Answer

FortiNAC's Network Access Policy (NAP). FortiNAC's Network Access Policy (NAP) is the component that defines and enforces quarantine actions on the network. When an endpoint is identified as non-compliant (e.g., out-of-date antivirus), FortiNAC applies the NAP, which can include VLAN changes, firewall rules, or other enforcement mechanisms to isolate the endpoint. The NAP is the policy engine that translates compliance status into network access decisions.

Answer

The RADIUS server used for 802.1X

Answer

FortiGate firewall policies with ZTNA tags

Answer

FortiClient EMS compliance rules

Question 12

A FortiGate is the SAML Service Provider (SP) for a ZTNA application. The IdP is Azure AD. After successful authentication, the user is redirected to the ZTNA proxy with a '403 Forbidden' error. The ZTNA rule has the correct groups allowed. What is the most likely missing configuration?

Accepted Answer

The SAML user group is not mapped to a FortiGate local group.. A 403 error after successful SAML authentication indicates the user was authenticated but not authorized. Since the ZTNA rule has the correct groups allowed, FortiGate cannot match the user to any allowed group. This requires mapping the SAML user group to a FortiGate local group via 'config user saml'. Option C is correct.

Answer

The IdP is not sending the user's group membership in the SAML assertion.

Answer

The ZTNA proxy certificate is not trusted by the browser.

Answer

The FortiGate's clock is not synchronized with the IdP.

Question 13

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors form, but routes learned from the remote site are not appearing in the routing table. What is the most likely cause?

Accepted Answer

The 'allowaccess' setting on the IPsec interface does not include OSPF.. FortiGate's IPsec virtual interfaces require the 'allowaccess' command to specify which dynamic routing protocols are allowed. Without 'allowaccess ospf', OSPF packets are dropped even if the tunnel is up.

Answer

The firewall policy allows OSPF traffic (protocol 89) but not IPsec ESP.

Answer

The IPsec interface MTU is too low for OSPF packets.

Answer

The OSPF network type is not set to point-to-point.

Question 14

An administrator configures a hub-and-spoke ADVPN with IBGP over the VPN overlays. The spokes receive the default route from the hub, but they cannot reach each other directly. The administrator wants spoke-to-spoke traffic to use shortcut tunnels. Which additional configuration is required on the hub?

Accepted Answer

Enable 'auto-discovery-sender' and 'auto-discovery-receiver' on the phase1 interfaces.. In a hub-and-spoke ADVPN with IBGP, shortcut tunnels between spokes require the hub to advertise the spokes' routes so that each spoke learns the other's next-hop. Enabling auto-discovery-sender on the hub and auto-discovery-receiver on the spokes (or both on the hub depending on design) allows the hub to send shortcut proposals and the spokes to establish direct tunnels. This is the ADVPN-specific configuration that enables spoke-to-spoke shortcut establishment.

Answer

Configure 'set neighbor <spoke-ip> next-hop-self' under BGP.

Answer

Create a firewall policy that permits traffic between spokes.

Answer

Add 'set advpn-multicast enable' to the phase1 configuration.

Question 15

A FortiGate administrator needs to block an application (e.g., Facebook) while allowing HTTPS traffic for ZTNA users. Which TWO configurations are required to achieve this?

Accepted Answer

SSL deep inspection profile to decrypt HTTPS traffic.. Option C is correct because blocking an application such as Facebook inside HTTPS requires the FortiGate to decrypt the TLS session; without an SSL deep inspection profile applied to the policy, the firewall only sees encrypted traffic and cannot identify the application. Option D is correct because application control is the FortiOS feature that identifies and blocks applications like Facebook, and the profile must be applied to the firewall policy handling the ZTNA users' traffic for the block to take effect. Options A, B, and E are not required: web filtering blocks categories/URLs rather than the Facebook application itself, inline CASB is for SaaS visibility/control and is not the mechanism for this block, and ZTNA tags are used for device/identity-based access decisions, not for blocking a specific application.

Answer

Web filter profile with Facebook categorized as blocked.

Answer

Enable 'inline CASB' on the ZTNA rule.

Answer

Add a ZTNA tag for Facebook blocking.