NSE7 Advanced VPN and Zero Trust Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DPD (Dead Peer Detection) timeout is triggered every 30 minutes. The VPN tunnel drops every 30 minutes, which matches a typical DPD (Dead Peer Detection) timeout interval. DPD is used to verify that the remote peer is still reachable; if no response is received within the DPD timeout (default often 30 minutes), the tunnel is torn down. The phase2 lifetime of 3600 seconds (1 hour) would cause rekey every hour, not 30 minutes. The phase1 lifetime of 86400 seconds (24 hours) is long. Therefore, the most likely cause is a DPD timeout triggering every 30 minutes, making option D correct.

Answer

The phase2 lifetime is set to 3600 seconds, causing rekey failures

Answer

The phase1 lifetime is too short, causing frequent renegotiation

Answer

The VPN tunnel is not configured to use NAT traversal

Question 2

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

Accepted Answer

The compliance rule is not assigned to a FortiClient configuration profile. In FortiClient EMS, compliance rules are enforced only when they are added to a configuration profile that is assigned to endpoints. The rule itself is just a definition; it must be included in a profile that is deployed to clients. Without being assigned to a profile, the rule is not applied, so unencrypted devices are not blocked. Option D correctly identifies this missing step.

Answer

The FortiClient telemetry is not sending compliance status

Answer

The compliance rule is not enabled on the FortiGate via ZTNA tag

Answer

The VPN policy on the FortiGate does not require compliance check

Question 3

An administrator is deploying a hub-and-spoke ADVPN with three spoke sites. The spokes have dynamic IP addresses. The hub has a static IP. The administrator wants the spokes to establish direct shortcut tunnels when they communicate with each other. Which THREE conditions must be met for shortcut tunnels to be established? (Choose three.)

Accepted Answer

The spoke tunnel interfaces must be in the same IP subnet. For ADVPN shortcuts to be established, three conditions must be met: (A) The spoke tunnel interfaces must be in the same IP subnet to allow direct routing. (D) Auto-discovery must be enabled in the phase1 settings on all spokes to exchange shortcut information. (E) The hub must have routes to all spoke local subnets so it can forward shortcut initiation packets. Option B is incorrect because spokes can have dynamic IP addresses with ADVPN. Option C is incorrect because 'set shortcuthub enable' is not required; the hub functions as a shortcut hub by default.

Answer

The spokes must have static public IP addresses

Answer

The hub must be configured with 'set shortcuthub enable' to act as a shortcut hub

Question 4

A FortiGate administrator is troubleshooting a VPN tunnel that uses IKEv2 with certificate authentication. The tunnel fails to establish, and the IKE debug shows 'no acceptable proposal' for the initial exchange. Which TWO configuration mismatches could cause this error? (Choose two.)

Accepted Answer

Mismatched encryption algorithms between the two peers. 'No acceptable proposal' in IKEv2 phase1 indicates a mismatch in proposal parameters. Encryption algorithm mismatch (A) and authentication method mismatch (E: pre-shared key vs certificate) can both cause this error. Phase2 mismatches (B) occur later, not during initial exchange.

Answer

Mismatched phase2 encryption algorithms

Answer

Mismatched IKE version (IKEv1 vs IKEv2)

Answer

Incorrect local certificate configuration on one peer

Question 5

A network administrator configured a hub-and-spoke ADVPN with IKEv2. Spoke sites can establish tunnels to the hub, but shortcut tunnels are not being created between spokes. What is the MOST likely cause?

Accepted Answer

Auto-discovery is disabled on the hub FortiGate. In a hub-and-spoke ADVPN with IKEv2, shortcut tunnels between spokes require auto-discovery to be enabled on the hub FortiGate. Auto-discovery allows the hub to exchange IKE information (including NAT-T and IP addresses) between spokes, enabling them to establish direct tunnels. When auto-discovery is disabled on the hub, the hub will not forward the necessary IKE messages (such as the IKE_AUTH exchange with the auto-discovery payload) to other spokes, preventing shortcut tunnel creation.

Answer

Dead Peer Detection is disabled on the hub

Answer

The spokes are using different IKE versions

Answer

The IKEv2 authentication method is not set to pre-shared key

Question 6

You run 'diagnose vpn ike gateway list' and see the following:
gateway name: HUB_GW
  version: IKEv2
  state: UP
  mode: main
  local: 10.0.0.1:500
  remote: 203.0.113.5:500
  auth: psk
  dpd: on
  rekey: 86400
  num_peers: 2
  total_tunnels: 2
  auto-discovery: enabled
What does the 'auto-discovery: enabled' indicate about this VPN gateway?

Accepted Answer

The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation. In an ADVPN setup, enabling auto-discovery on the hub allows it to send shortcut route advertisements to spokes, which then can establish direct tunnels. The output confirms the gateway is configured to participate in ADVPN as a hub or as a spoke that can initiate shortcuts.

Answer

The gateway will automatically create new phase2 selectors for any remote subnet

Answer

The gateway will automatically renegotiate IKEv2 keys before expiration

Answer

The gateway will discover other VPN gateways on the same network and form peer relationships

Question 7

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

Accepted Answer

The SAML user group is not configured with the correct IdP attribute mapping. After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Answer

The FortiGate is configured as an IdP instead of SP

Answer

SAML single logout is enabled and causing session termination

Answer

The IdP certificate is not trusted by the FortiGate

Question 8

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

Accepted Answer

ZTNA tags with device posture checks. ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Answer

ZTNA inline CASB

Answer

NAC with FortiNAC

Answer

IPsec VPN with DPD

Question 9

A FortiGate administrator configures a hub-and-spoke ADVPN with OSPF over the VPN overlay. Spoke routers receive the OSPF default route from the hub, but cannot reach subnets behind other spokes. What configuration is missing?

Accepted Answer

OSPF is not configured to redistribute connected or static routes on the spokes. In a hub-and-spoke ADVPN with OSPF, spoke routers receive the default route from the hub but cannot reach subnets behind other spokes because OSPF does not automatically advertise the spoke’s local networks into the VPN overlay. The missing configuration is redistribution of connected or static routes into OSPF on the spokes, which is required for the hub to learn those subnets and propagate them to other spokes via the OSPF database.

Answer

IKEv2 is configured instead of IKEv1

Answer

The spokes have 'set auto-discovery-receiver enable' configured

Answer

The hub has 'set auto-discovery-sender enable' configured

Question 10

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

Accepted Answer

The FortiClient EMS is not configured as an endpoint control source on the FortiGate. ZTNA tags are assigned by FortiClient EMS based on device posture. If the FortiGate does not trust the EMS server or the tag names are mismatched, the tag check fails. The EMS must be configured as an endpoint control source and the tags must exactly match those defined in EMS.

Answer

The FortiGate does not have a valid PKI certificate for the ZTNA proxy

Answer

The user is not authenticated via SAML

Answer

The ZTNA rule is using the wrong port number

Question 11

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

Accepted Answer

Set the 'proposal' list with AES256-GCM and SHA256 as the first entry. In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Answer

Enable 'set proposal-mode strict'

Answer

Use IKEv2 rekey to change the proposal after initial handshake

Answer

Configure a phase2 selectors with the exact traffic of interest

Question 12

An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?

Accepted Answer

ZTNA proxy (reverse proxy) with FortiClient for posture. ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.

Answer

FortiNAC with agent on the server

Answer

IPsec VPN with full tunnel

Answer

SSL VPN with web mode

Question 13

An administrator configures BGP over an IPsec VPN between two FortiGates. The BGP session is established, but routes from the remote site are not being installed in the local routing table. The admin verifies that the BGP neighbor configuration is correct and the remote site is advertising routes. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking BGP traffic on the VPN interface. BGP routes must be allowed by a firewall policy on the loopback or interface used for BGP. Even if the VPN tunnel is up, BGP traffic (TCP port 179) may be blocked by the local-in policy or by the VPN interface's firewall policy if not explicitly allowed.

Answer

The BGP timers are too aggressive causing route flapping

Answer

The BGP network statement is missing on the local FortiGate

Answer

The next-hop IP address is not reachable

Question 14

A FortiGate is configured with multiple IPsec VPNs to remote branches. One of the branch VPN tunnels goes down frequently. The administrator runs 'diagnose vpn ike log' and sees repeated INITIAL_CONTACT notifications from the remote peer. What does this indicate?

Accepted Answer

The remote peer has rebooted or restarted its VPN service. INITIAL_CONTACT is a notify message sent by an IKE peer to indicate that it has rebooted or lost its state. When the remote peer sends this, it means the peer has restarted, causing the tunnel to re-establish. This is normal behavior after a reboot but if frequent, indicates instability at the remote end.

Answer

The remote peer is rekeying the VPN tunnel

Answer

The local FortiGate has a mismatched pre-shared key

Answer

A dead peer detection timeout occurred

Question 15

A company wants to ensure that only company-managed laptops with up-to-date antivirus can access the internal file server remotely. Which Fortinet solution integrates with FortiGate to enforce device compliance before granting ZTNA access?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) manages FortiClient endpoints and can enforce compliance policies. It integrates with FortiGate to provide device posture information via ZTNA tags, enabling access control based on compliance.

Answer

FortiAnalyzer

Answer

FortiSandbox

Answer

FortiWeb