NSE7 Advanced VPN and Zero Trust Practice Test 7 — 15 Questions

Question 1

An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)

Accepted Answer

The spoke tunnel interfaces must be in the same IP subnet. For ADVPN shortcuts, auto-discovery must be enabled on phase1 (B), the hub must have routes to spoke subnets (D), and the spoke must have a tunnel interface with an IP in the same subnet as other spokes (E). The shortcuthub is not required if the hub is the central point.

Answer

The spokes must have static public IP addresses

Answer

The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub

Question 2

A FortiGate administrator is troubleshooting a VPN tunnel that uses IKEv2 with certificate authentication. The tunnel fails to establish, and the IKE debug shows 'no acceptable proposal' for the initial exchange. Which TWO configuration mismatches could cause this error? (Choose two.)

Accepted Answer

Mismatched encryption algorithms between the two peers. 'No acceptable proposal' typically indicates a mismatch in phase1 parameters such as encryption, hash, DH group, or authentication method. Options A and B are correct because IKEv2 proposal includes encryption and authentication algorithms.

Answer

Mismatched phase2 encryption algorithms

Answer

Mismatched IKE version (IKEv1 vs IKEv2)

Answer

Incorrect local certificate configuration on one peer

Question 3

A network administrator configured a hub-and-spoke ADVPN with IKEv2. Spoke sites can establish tunnels to the hub, but shortcut tunnels are not being created between spokes. What is the MOST likely cause?

Accepted Answer

Auto-discovery is disabled on the hub FortiGate. For ADVPN shortcut tunnels to form, the hub must have 'set auto-discovery-sender enable' and spokes must have 'set auto-discovery-receiver enable'. If the hub does not advertise its ability to relay shortcut routes, spokes will not attempt to create direct tunnels.

Answer

Dead Peer Detection is disabled on the hub

Answer

The spokes are using different IKE versions

Answer

The IKEv2 authentication method is not set to pre-shared key

Question 4

You run 'diagnose vpn ike gateway list' and see the following:
gateway name: HUB_GW
  version: IKEv2
  state: UP
  mode: main
  local: 10.0.0.1:500
  remote: 203.0.113.5:500
  auth: psk
  dpd: on
  rekey: 86400
  num_peers: 2
  total_tunnels: 2
  auto-discovery: enabled
What does the 'auto-discovery: enabled' indicate about this VPN gateway?

Accepted Answer

The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation. In an ADVPN setup, enabling auto-discovery on the hub allows it to send shortcut route advertisements to spokes, which then can establish direct tunnels. The output confirms the gateway is configured to participate in ADVPN as a hub or as a spoke that can initiate shortcuts.

Answer

The gateway will automatically create new phase2 selectors for any remote subnet

Answer

The gateway will automatically renegotiate IKEv2 keys before expiration

Answer

The gateway will discover other VPN gateways on the same network and form peer relationships

Question 5

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

Accepted Answer

The SAML user group is not configured with the correct IdP attribute mapping. After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Answer

The FortiGate is configured as an IdP instead of SP

Answer

SAML single logout is enabled and causing session termination

Answer

The IdP certificate is not trusted by the FortiGate

Question 6

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

Accepted Answer

ZTNA tags with device posture checks. ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Answer

ZTNA inline CASB

Answer

NAC with FortiNAC

Answer

IPsec VPN with DPD

Question 7

A FortiGate administrator configures a hub-and-spoke ADVPN with OSPF over the VPN overlay. Spoke routers receive the OSPF default route from the hub, but cannot reach subnets behind other spokes. What configuration is missing?

Accepted Answer

OSPF is not configured to redistribute connected or static routes on the spokes. For ADVPN shortcut tunnels to be used for spoke-to-spoke traffic, the hub must have 'set auto-discovery-sender enable' and the spokes must have 'set auto-discovery-receiver enable'. Without these, traffic between spokes still goes through the hub, but if OSPF is not redistributing spoke routes properly, they may not be reachable.

Answer

IKEv2 is configured instead of IKEv1

Answer

The spokes have 'set auto-discovery-receiver enable' configured

Answer

The hub has 'set auto-discovery-sender enable' configured

Question 8

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

Accepted Answer

The FortiClient EMS is not configured as an endpoint control source on the FortiGate. ZTNA tags are assigned by FortiClient EMS based on device posture. If the FortiGate does not trust the EMS server or the tag names are mismatched, the tag check fails. The EMS must be configured as an endpoint control source and the tags must exactly match those defined in EMS.

Answer

The FortiGate does not have a valid PKI certificate for the ZTNA proxy

Answer

The user is not authenticated via SAML

Answer

The ZTNA rule is using the wrong port number

Question 9

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

Accepted Answer

Set the 'proposal' list with AES256-GCM and SHA256 as the first entry. In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Answer

Enable 'set proposal-mode strict'

Answer

Use IKEv2 rekey to change the proposal after initial handshake

Answer

Configure a phase2 selectors with the exact traffic of interest

Question 10

An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?

Accepted Answer

ZTNA proxy (reverse proxy) with FortiClient for posture. ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.

Answer

FortiNAC with agent on the server

Answer

IPsec VPN with full tunnel

Answer

SSL VPN with web mode

Question 11

An administrator configures BGP over an IPsec VPN between two FortiGates. The BGP session is established, but routes from the remote site are not being installed in the local routing table. The admin verifies that the BGP neighbor configuration is correct and the remote site is advertising routes. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking BGP traffic on the VPN interface. BGP routes must be allowed by a firewall policy on the loopback or interface used for BGP. Even if the VPN tunnel is up, BGP traffic (TCP port 179) may be blocked by the local-in policy or by the VPN interface's firewall policy if not explicitly allowed.

Answer

The BGP timers are too aggressive causing route flapping

Answer

The BGP network statement is missing on the local FortiGate

Answer

The next-hop IP address is not reachable

Question 12

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

Accepted Answer

The remote peer has rebooted or restarted its VPN service. INITIAL_CONTACT is a notify message sent by an IKE peer to indicate that it has rebooted or lost its state. When the remote peer sends this, it means the peer has restarted, causing the tunnel to re-establish. This is normal behavior after a reboot but if frequent, indicates instability at the remote end.

Answer

The remote peer is rekeying the VPN tunnel

Answer

The local FortiGate has a mismatched pre-shared key

Answer

A dead peer detection timeout occurred

Question 13

A company wants to ensure that only company-managed laptops with up-to-date antivirus can access the internal file server remotely. Which Fortinet solution integrates with FortiGate to enforce device compliance before granting ZTNA access?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) manages FortiClient endpoints and can enforce compliance policies. It integrates with FortiGate to provide device posture information via ZTNA tags, enabling access control based on compliance.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiWeb

Question 14

A FortiGate administrator configures a ZTNA access proxy rule to allow access to an internal application only if the user's device has the tag 'Compliant'. The tag is assigned by FortiClient EMS. However, a user with a compliant device is still blocked. The admin sees in the ZTNA logs that the tag is not being received. What should the administrator check FIRST?

Accepted Answer

Ensure the EMS connector is configured under Security Fabric > External Connectors. For ZTNA tags to be sent to FortiGate, the FortiClient must be registered with EMS and the EMS must be configured as an endpoint control connector on FortiGate. If the connector is missing or misconfigured, FortiGate cannot retrieve tags.

Answer

Verify that the FortiClient is connected to the internet

Answer

Confirm that the ZTNA rule is enabled and using the correct port

Answer

Check if the application server is reachable from the FortiGate

Question 15

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Accepted Answer

Configure BGP to redistribute connected or static routes to the spokes. For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

Answer

Enable 'set auto-discovery-receiver' on the hub's phase1 interface

Answer

Disable DPD on the hub's phase1 interface

Answer

Set the IKE version to IKEv1 on the hub