NSE7 Advanced VPN and Zero Trust Practice Test 7 — 15 Questions

Question 1

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

Accepted Answer

To identify a device's compliance status and attributes for policy enforcement.. ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Answer

To mark packets for quality of service (QoS) prioritization.

Answer

To label network interfaces for traffic steering.

Answer

To assign a security level to application traffic.

Question 2

An administrator configures Multi-Peer VPN (MPVPN) on a FortiGate aggregator. The aggregator has two phase1 configurations for the same remote subnet but different peers. The aggregator's routing table shows both peers as next hops. The administrator notices that traffic between the aggregator and the remote subnet is load-balanced across both peers. What is the cause?

Accepted Answer

The aggregator has two static routes with equal cost to the remote subnet.. The administrator configured two static routes with equal administrative distance and cost to the remote subnet, each pointing to a different peer. This causes ECMP (Equal-Cost Multi-Path) routing, which load-balances traffic across both peers. MPVPN itself does not automatically load-balance; it relies on the underlying routing table to determine next-hop selection.

Answer

The MPVPN feature automatically load-balances traffic across all active peers.

Answer

The phase1 configurations have the same proposal settings, causing implicit load balancing.

Answer

The remote peers are both advertising the same subnet via BGP with equal metrics.

Question 3

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

Accepted Answer

Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.. FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Answer

Configure the FortiGate as a SAML IdP for FortiClient EMS.

Answer

Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.

Answer

Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.

Question 4

An administrator runs the CLI command 'diagnose vpn ike gateway list' and sees that a phase1 gateway is in 'UP' state, but the 'DPD' field shows 'disabled'. The tunnel is working. What is the implication?

Accepted Answer

The tunnel will never detect if the remote peer goes down.. When DPD is disabled, the FortiGate does not send DPD probes to verify the remote peer's liveliness. Without DPD or any other keepalive mechanism (such as IKE keepalives, which are not used in standard IPsec VPNs), the tunnel will remain in the 'UP' state indefinitely even if the remote peer goes down. This means the tunnel will never detect peer failure, leading to blackholed traffic until the administrator manually intervenes or the tunnel is re-established by other means.

Answer

DPD is only used for phase2, so phase1 is unaffected.

Answer

DPD is disabled but the tunnel will still detect peer failure via IKE keepalives.

Answer

The FortiGate is using NAT-T, which disables DPD automatically.

Question 5

A FortiGate administrator needs to configure a hub-and-spoke ADVPN with OSPF as the routing protocol over the VPN tunnels. Which TWO steps are required on the hub FortiGate to enable shortcut tunnels?

Accepted Answer

Enable 'shortcut' option under the phase2 configuration.. Enabling the 'shortcut' option under the phase2 configuration on the hub FortiGate allows the hub to advertise shortcut tunnel capabilities to spoke devices. This is essential for establishing direct spoke-to-spoke tunnels in an ADVPN setup, as it triggers the dynamic negotiation of shortcut paths when traffic patterns warrant them.

Answer

Set 'add-route' to 'disable' on the phase2 configuration.

Answer

Enable 'auto-discovery-receiver' on the hub's phase1 configuration.

Answer

Configure OSPF network type as 'broadcast' on the hub's tunnel interface.

Question 6

An administrator is troubleshooting a ZTNA application access issue. Users can authenticate but cannot reach the internal application via the ZTNA proxy. The FortiGate's ZTNA rule uses a tag requiring 'OS Type = Windows' and 'Antivirus = running'. The device meets both conditions. Which THREE possible reasons could cause the access failure?

Accepted Answer

The ZTNA proxy's destination is pointing to the wrong internal IP or port.. The device meets the ZTNA tag conditions (OS Type=Windows, Antivirus=running), so D (tag assignment) and E (FortiClient installation) are not the cause. Access failure can occur if: A) the ZTNA proxy's destination points to the wrong internal IP or port, B) the firewall policy for ZTNA traffic is not configured or is misordered, or C) the FortiGate's SSL certificate for the ZTNA proxy is not trusted by the client. These are the three most common reasons when posture is satisfied.

Answer

The user is not assigned the ZTNA tag in the FortiClient EMS portal.

Answer

The device does not have FortiClient installed.

Question 7

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Accepted Answer

Configure a RADIUS server pointing to FortiNAC.. To integrate FortiGate with FortiNAC, two configurations are needed: first, a RADIUS server pointing to FortiNAC (A) must be configured on the FortiGate so it can query device compliance status from FortiNAC. Second, the 'nac-policy' option must be enabled on the FortiGate interface that connects to the switch (D). This allows the FortiGate to apply NAC-based access policies to wired clients. Options B (security group tag mapping) and C (802.1x on the interface) are not required on the FortiGate for this integration; 802.1x is typically handled by the switch. Option E (nac-mode to global-vlan) is not a standard setting for this scenario.

Answer

Create a security group tag (SGT) mapping.

Answer

Enable '802.1x' authentication on the interface.

Answer

Set the 'nac-mode' to 'global-vlan' under the interface.

Question 8

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

Accepted Answer

The remote FortiGate is behind a NAT device without proper NAT-T configuration. DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option A is correct because if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped or not reach the peer, causing the timeout.

Answer

The IPsec phase2 proposal is mismatched, causing rekey failures

Answer

The IKE SA lifetime is set too long, causing the tunnel to expire

Answer

The local FortiGate's DPD interval is set too low, causing false positives

Question 9

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

Accepted Answer

Auto-discovery is not enabled on the spoke's phase1 configuration. In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.

Answer

The spoke's phase2 proposal includes a different encryption algorithm than the hub

Answer

The hub does not have a route to the spoke's local subnets

Answer

The spoke's VPN interface is not in the same VDOM as the hub

Question 10

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

Accepted Answer

Configure the FortiGate as an EMS connector and import the tag. For FortiGate ZTNA integration with EMS, the FortiGate must be configured as an EMS connector to import ZTNA tags. These tags are then used in firewall policies to enforce access based on device posture. Option D is correct because the connector enables the FortiGate to receive tags from EMS. Option A is incorrect because SSL VPN is not required for ZTNA; ZTNA uses client certificates or other methods. Option B is incorrect because client certificates are not installed from FortiGate for ZTNA; EMS handles certificate distribution. Option C is incorrect because inline CASB is a different feature and not related to ZTNA tag enforcement.

Answer

Configure SSL VPN to authenticate users and assign tags

Answer

Install a client certificate on each FortiClient from the FortiGate

Answer

Enable ZTNA inline CASB in the antivirus profile

Question 11

An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?

Accepted Answer

The user's device does not have the required ZTNA tags from EMS. A 403 Forbidden error in ZTNA typically indicates that the access control rule denied the request. This can happen if the device does not meet the required posture checks (ZTNA tags). Option B is correct because the ZTNA rule likely requires a specific tag that the device does not have, resulting in denial.

Answer

The FortiGate firewall policy allowing ZTNA traffic is missing

Answer

The application server does not have a valid certificate

Answer

The ZTNA proxy is configured with the wrong port for the application

Question 12

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

Accepted Answer

FortiGate ZTNA proxy configuration. ZTNA on FortiGate requires the FortiGate to be configured as a ZTNA proxy (gateway) that intercepts traffic to internal applications and enforces access policies. Option C is correct because the FortiGate must have the ZTNA proxy configuration to act as the enforcement point. Options A, B, and D are not directly responsible for enforcing ZTNA policies; FortiSandbox is for sandboxing, FortiAnalyzer for logging, and FortiAuthenticator for authentication services, but the enforcement itself is done by the FortiGate ZTNA proxy.

Answer

FortiSandbox for content inspection

Answer

FortiAnalyzer for log analysis

Answer

FortiAuthenticator for RADIUS authentication

Question 13

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

Accepted Answer

The CA certificate is not configured for peer certificate validation. For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

Answer

The IKEv2 proposal includes an incompatible encryption algorithm

Answer

The local certificate is not associated with the phase1 interface

Answer

The remote peer's certificate is not signed by the imported CA

Question 14

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

Accepted Answer

The FortiGate's EMS connector is not syncing tag information in real-time. Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Answer

The user's IP address has changed and the tag is mapped to a different IP

Answer

The ZTNA rule is configured with the wrong application port

Answer

The device posture compliance check requires additional criteria not met

Question 15

An administrator wants to use SAML SSO with FortiGate as the Service Provider (SP) to allow users to authenticate via an external IdP. What must be configured first on the FortiGate to establish the SAML trust?

Accepted Answer

A certificate for SAML signing and encryption. SAML SSO requires the FortiGate to have a certificate that the IdP trusts for signing assertions. Option D is correct because the FortiGate needs to import a CA-signed certificate (or use a self-signed) to sign SAML requests and also to establish the trust relationship with the IdP.

Answer

A firewall policy to allow SAML traffic

Answer

A RADIUS server for user authentication

Answer

An LDAP server for group membership lookup