NSE7 Advanced VPN and Zero Trust Practice Test 8 — 15 Questions

Question 1

An administrator has a FortiGate hub with multiple spoke FortiGates in an ADVPN topology. The spokes are behind NAT and have dynamic public IPs. The hub is configured with a static IP. Which THREE steps are necessary for the spokes to establish a shortcut tunnel between each other?

Choose an answer to begin — your selection is scored in the full session.

Answer

Enable 'auto-discovery-receiver' on the hub's phase1.

Answer

Set the phase1 authentication method to 'signature' on all devices.

Answer

Configure the spokes with the hub's public IP as the remote gateway.

Answer

Enable 'auto-discovery-sender' on the spokes' phase1.

Answer

Enable NAT traversal on the hub's phase1 configuration.

Question 2

A FortiGate is configured as a ZTNA proxy for an internal application. Users authenticate via SAML with FortiGate as the IdP. The administrator wants to enforce that only devices with a valid ZTNA tag can access the application. Which TWO configurations are required?

Accepted Answer

Create a ZTNA rule with tag conditions.. Option D is correct because a ZTNA rule must be created with tag conditions that match the ZTNA tags assigned to authorized devices, so the FortiGate can evaluate device posture before granting access to the internal application. Option E is correct because the firewall policy permitting access to the application must have ZTNA tags enabled and referenced, ensuring that only devices presenting a valid ZTNA tag are allowed through. Option A is incorrect because client certificates are not required for ZTNA tag enforcement; SAML authentication handles user identity, while ZTNA tags handle device trust. Option B is incorrect because FortiClient EMS pushes tags to FortiGate as part of the ZTNA fabric, but this is a supporting infrastructure step, not one of the two required configurations for enforcing tag-based access in this scenario. Option C is incorrect because requiring FortiClient on the client device is necessary for ZTNA to function, but it is not the specific configuration that enforces tag conditions on the application access policy.

Answer

Install a client certificate on each device for authentication.

Answer

Configure FortiClient EMS to push compliance tags to FortiGate.

Answer

Set the ZTNA proxy to require FortiClient on the client device.

Question 3

A network administrator is configuring an ADVPN hub-and-spoke topology. The hub is FortiGate-A and the spokes are FortiGate-B and FortiGate-C. The administrator wants spoke-to-spoke traffic to dynamically establish direct tunnels when needed. Which two settings must be enabled on the hub's phase 1 interface to support this?

Accepted Answer

set auto-discovery-sender enable. For ADVPN hub-and-spoke topology, the hub must be configured as the sender to initiate shortcut messages. This is done by enabling 'set auto-discovery-sender enable' on the hub's phase 1 interface. The 'set add-route enable' setting is used to install routes for the VPN tunnels, but it is not specifically required for the hub to support spoke-to-spoke dynamic shortcuts; spokes need it to install routes for shortcuts. Therefore, only option C is correct.

Answer

set mode aggressive

Answer

set auto-discovery-shortcut-mode both

Answer

set add-route enable

Question 4

An administrator is troubleshooting an IPsec VPN tunnel that connects a branch office to the main office. The tunnel is down. The administrator runs 'diagnose vpn ike gateway list' and sees the following output:
IKE gateway: branch
  state: down
  DPD: enabled
  DPD retrycount: 3
  DPD retryinterval: 10
What does the DPD configuration indicate?

Accepted Answer

The tunnel will be brought down after 3 unanswered DPD probes, each 10 seconds apart. The output shows DPD retrycount: 3 and DPD retryinterval: 10, meaning the FortiGate will send up to 3 DPD probes, each 10 seconds apart, and if all are unanswered, the tunnel is brought down. This is the standard behavior for DPD configuration.

Answer

The tunnel will be brought down immediately after the first DPD timeout

Answer

The tunnel will stay up indefinitely because DPD is disabled

Answer

DPD will send probes every 30 seconds

Question 5

An administrator wants to enforce that only managed FortiClient endpoints with up-to-date antivirus and a specific OS version can access a sensitive internal network via IPsec VPN. Which feature should be used to achieve this?

Accepted Answer

FortiClient EMS compliance enforcement. FortiClient EMS compliance enforcement is the correct feature because it allows the administrator to define compliance rules (such as up-to-date antivirus and a specific OS version) on managed endpoints, and then enforce those rules at VPN authentication time. When a FortiClient endpoint attempts to connect via IPsec VPN, the FortiGate can query FortiClient EMS for the endpoint's compliance status and deny access if the endpoint does not meet the required posture. This provides endpoint posture checking integrated with VPN access control.

Answer

ZTNA tags

Answer

FortiNAC

Answer

SAML SSO

Question 6

A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?

Accepted Answer

The SAML assertion lifetime is configured too short. Frequent re-authentication in a SAML IdP-initiated or SP-initiated flow is most commonly caused by a SAML assertion lifetime (NotOnOrAfter / SessionNotOnOrAfter) configured too short, forcing the SP to request a fresh assertion once the previous one expires. Since the flow works initially and only fails 'after some time,' the assertion validity window is the logical culprit.

Answer

The FortiGate's SAML service provider certificate has expired

Answer

The FortiGate's clock is not synchronized with NTP

Answer

The SP is using HTTP-POST binding instead of redirect

Question 7

An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?

Accepted Answer

The route's OSPF cost is higher than an existing route with a lower administrative distance. The OSPF neighbor relationship is fully established (FULL state), which means hello packets, authentication, MTU, and network type all match correctly. Therefore the problem is not in OSPF adjacency formation but in route selection. When OSPF installs a route into the routing table, it competes with routes from other sources based on administrative distance (AD). If a static route, connected route, or another protocol's route to the same prefix has a lower AD than OSPF's default AD of 110, the OSPF route is rejected and never appears in the routing table.

Answer

The IPsec tunnel is using transport mode instead of tunnel mode

Answer

OSPF authentication is mismatched

Answer

The OSPF network type is not set to point-to-point

Question 8

An administrator is configuring a hub-and-spoke ADVPN with IBGP as the overlay routing protocol. The hub is configured as a route reflector. Which two conditions must be met for a shortcut tunnel to be established between two spokes? (Choose TWO)

Accepted Answer

The hub must have a route to the spoke's subnet via the IPsec tunnel. In a hub-and-spoke ADVPN with IBGP, the hub acting as route reflector must be able to resolve and forward the spoke's subnet route through the IPsec tunnel so that the shortcut negotiation can be triggered and the spoke prefix is reachable (option A). The spokes must also have 'set auto-discovery-shortcut-mode client' enabled so they can initiate and accept shortcut tunnel negotiation with other spokes (option E). Options B, C, and D are not required conditions: overlapping IPsec proposals are not necessary for shortcut establishment, the hub does not need 'set auto-discovery-shortcut-mode both' for spoke-to-spoke shortcuts, and spokes do not need to be in the same VDOM.

Answer

The spokes must use overlapping IPsec proposal sets

Answer

The hub must have 'set auto-discovery-shortcut-mode both'

Answer

The spokes must be in the same VDOM

Question 9

An administrator wants to implement ZTNA inline CASB to control access to a SaaS application (e.g., Office 365). Which three components are required for this setup? (Choose THREE)

Accepted Answer

FortiClient EMS for device posture and tag assignment. Option A (FortiClient EMS) is correct because EMS performs endpoint posture assessment and assigns the ZTNA tags that the FortiGate uses to make access decisions for the SaaS application. Option B (FortiGate with ZTNA proxy enabled) is correct because the FortiGate acts as the inline ZTNA access proxy that inspects and enforces traffic to Office 365. Option E (a ZTNA rule configured as an access proxy for the SaaS application) is correct because the ZTNA rule defines the protected SaaS resource and binds the proxy, tags, and policies together. Option C (FortiNAC) is not required, as it handles network access control for LAN/OT devices rather than inline CASB enforcement. Option D (a VPN tunnel to the SaaS provider) is not required, since ZTNA inline CASB uses the FortiGate proxy and does not rely on a tunnel to the SaaS provider.

Answer

FortiNAC for network access control

Answer

A VPN tunnel between FortiGate and the SaaS provider

Question 10

An administrator is troubleshooting an IPsec VPN tunnel that uses PKI certificates for authentication. The tunnel fails to establish. The administrator checks the certificates and finds that the local certificate is valid and the CA certificate is trusted. Which two additional checks should the administrator perform? (Choose TWO)

Accepted Answer

Verify that the certificate's CN matches the peer's IP address. Option D is correct because in IPsec PKI authentication the peer's certificate identity must match what the local gateway expects; if the remote gateway's certificate CN (or SAN) does not correspond to the peer identifier configured in the VPN phase 1 (often the peer IP or FQDN), the tunnel negotiation fails even though the certificate itself is valid. Option E is correct because a certificate can be within its validity dates and still be revoked; checking the CRL (or OCSP) ensures the peer's certificate has not been revoked by the issuing CA, which would cause IKE authentication to fail. Option A is not a valid additional check here because the scenario already states the local certificate is valid, implying it is present and usable in the local store. Option B is unnecessary since RSA 2048-bit is not a mandatory requirement for IPsec PKI authentication; other key sizes and algorithms can work if both peers support them. Option C is irrelevant because private key exportability is not required for the local gateway to authenticate itself; the key only needs to be present and usable, not exportable.

Answer

Verify that the certificate is installed in the local certificate store on the FortiGate

Answer

Ensure that the certificate is using RSA 2048-bit keys

Answer

Confirm that the certificate's private key is exportable

Question 11

A company wants to provide external contractors with access to a specific internal web application without granting full network access. The solution must authenticate the user, verify device compliance, and log all access. Which three Fortinet features should be combined to meet these requirements? (Choose THREE)

Accepted Answer

SSL deep inspection. Option C (ZTNA proxy) is correct because Fortinet's ZTNA proxy provides per-application access to internal web apps without exposing the whole network, and it enforces user authentication before granting access. Option D (FortiClient EMS with compliance enforcement) is correct because EMS registers and manages endpoints, evaluates device posture (e.g., antivirus, OS patch level), and only allows compliant devices to reach the ZTNA-protected application. Option B (SSL deep inspection) is correct because the traffic to the internal web application is TLS-encrypted, and SSL deep inspection is required to decrypt, inspect, and log that traffic for full visibility and auditing. Option A (FortiNAC) is not needed here because it is a network access control solution for LAN/wireless onboarding and profiling, not for publishing a specific internal web app to external contractors. Option E (IPsec VPN with XAuth) is not appropriate because it grants broad network-level access rather than granular per-application access, and it does not by itself verify device compliance or provide the application-layer logging required.

Answer

FortiNAC

Answer

IPsec VPN with XAuth

Question 12

A FortiGate administrator configures a hub-and-spoke ADVPN network. Spokes are behind NAT. After deployment, spokes can communicate with each other only through the hub. What must be configured to allow spokes to establish direct shortcut tunnels?

Accepted Answer

Set 'add-route' to 'enable' on the hub's ADVPN configuration. For shortcut tunnels to be established, the hub must have 'add-route' enabled so that it advertises routes to other spokes. Without this, spokes will not know how to reach each other directly and will continue to route through the hub.

Answer

Enable auto-negotiate on the IPsec phase1 interface

Answer

Configure NAT traversal on the hub's phase1

Answer

Add a firewall policy allowing IKE from spoke to spoke

Question 13

A FortiGate administrator configures SAML SSO with FortiGate as the Identity Provider (IdP). Users are redirected to the FortiGate login page, but after successful authentication, they are not redirected back to the service provider. What is a likely cause?

Accepted Answer

The assertion consumer service URL is misconfigured on the FortiGate. When FortiGate acts as the SAML IdP, it must know the Assertion Consumer Service (ACS) URL of the service provider to redirect users back after authentication. If the ACS URL is misconfigured on the FortiGate, the redirection fails, and users are not returned to the SP. This is a common configuration error.

Answer

SAML authentication timeout is too short

Answer

The ACS URL on the service provider does not match the FortiGate's SAML settings

Answer

The SP certificate is not imported on the FortiGate

Question 14

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites (Site A and Site B) connect to a central hub. The administrator wants to ensure that if the primary peer for a site goes down, traffic automatically fails over to the backup peer. Which TWO settings must be configured on the hub's phase1?

Accepted Answer

Set 'peer-options' to include both peers with 'priority'. Option D is correct because in a multi-peer IPsec configuration on FortiOS, the phase1 must define the peer-options with both remote peers and assign a priority to each, so the hub knows the primary and backup peer order for a given site. Option E is correct because enabling failover on the phase1 allows the hub to automatically switch traffic to the next configured peer when the primary peer becomes unreachable, which is exactly the required behavior. Option A is incorrect because auto-negotiate controls whether the FortiGate initiates the tunnel negotiation and does not provide peer failover. Option B is incorrect because dpd on-demand only triggers dead peer detection when outbound traffic exists, and it is not the mechanism that enables failover between multiple peers. Option C is incorrect because aggregate-ipsec round-robin is used for aggregating multiple IPsec tunnels for load balancing, not for primary/backup peer failover.

Answer

Set 'auto-negotiate' to 'enable'

Answer

Set 'dpd' to 'on-demand'

Answer

Set 'aggregate-ipsec' to 'round-robin'

Question 15

A FortiGate is configured as the SAML Identity Provider (IdP) for a cloud application. The administrator wants to enforce device compliance as part of authentication. Which THREE steps must be taken?

Accepted Answer

Enable 'require-device-compliance' in the SAML IdP settings. Option A is correct because enabling 'require-device-compliance' in the FortiGate SAML IdP settings makes the IdP include the device compliance status as a SAML attribute/condition in the assertion, so the cloud application can enforce compliance during authentication. Option B is correct because a ZTNA tag (device compliance tag) is the mechanism FortiGate uses to represent and evaluate a device's compliance state; the tag is applied to the device and referenced in the SAML IdP configuration to determine whether the device meets the compliance requirement. Option E is correct because FortiClient EMS is the source of endpoint compliance information, and integrating it with the FortiGate allows the FortiGate to receive device compliance status and dynamically assign ZTNA tags used for the SAML IdP compliance check. Option C is not required because SAML authentication traffic between the user, FortiGate, and cloud application is normal HTTPS traffic and does not need a dedicated firewall policy for SAML; any necessary access is governed by existing policies. Option D is not required because SAML IdP authentication does not depend on a VPN tunnel to the cloud application; the browser-based SAML exchange occurs over HTTPS without a tunnel.

Answer

Create a firewall policy allowing SAML traffic

Answer

Set up a VPN tunnel to the cloud application