NSE7 Advanced VPN and Zero Trust Practice Test 8 — 15 Questions

Question 1

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Accepted Answer

FortiClient on the endpoint device. To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

Answer

FortiNAC for network admission control

Answer

IPsec VPN to encrypt traffic between client and FortiGate

Question 2

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Accepted Answer

The phase1 encryption algorithm or integrity algorithm is mismatched. The 'no acceptable proposal' error occurs when the two peers cannot agree on a set of parameters. Common causes are mismatched encryption/integrity algorithms (phase1 proposal) or mismatched Diffie-Hellman groups.

Answer

The remote peer's IP address is unreachable

Answer

The local FortiGate has the wrong IKE version configured

Answer

The remote peer's pre-shared key is incorrect

Question 3

A network administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spokes are behind NAT and use dynamic IPs. The hub has a static IP. Which IKEv2 configuration is REQUIRED to allow the spokes to initiate the VPN and receive shortcut tunnels?

Accepted Answer

Set the phase1 remote-gateway to 0.0.0.0 and enable 'accept-any-remote-gateway' on the hub. Aggressive mode is not supported in IKEv2 (only main mode). Setting the local ID is not sufficient for NAT traversal. Allowing IKE and ESP from any source is required because spokes may have dynamic IPs, and the hub must accept incoming connections from unknown source IPs. However, the key requirement for ADVPN is that the hub must accept connections from any source, which is achieved by setting the interface to 'any' or allowing 0.0.0.0/0. Option C is the common practice: the hub uses a wildcard selector and accepts connections from any peer ID. But the question asks for 'REQUIRED' – the most accurate is that the hub must be configured to accept connections from any source IP, which is done by setting the remote gateway to 0.0.0.0 or using a peer ID with accept-any. Option C is the best answer.

Answer

Set IKE version 2 to aggressive mode to allow rapid negotiation

Answer

Configure the hub with a static IP in the phase1 local-gateway interface

Answer

Use a preshared key and set the local ID to the spoke's public IP

Question 4

You run 'diagnose vpn ike gateway list' on a FortiGate hub and see the following output for a spoke connection: IKE SA state: ESTABLISHED, IPsec SA state: UP, but the spoke cannot route traffic to other spokes. The ADVPN shortcut tunnel is not being established. What is the MOST likely cause?

Accepted Answer

The hub has a static route for the spoke subnet pointing to the tunnel interface. In ADVPN, the hub must not include static routes for the spoke subnets, otherwise the spokes will use the hub as next-hop and not attempt shortcut establishment. The hub should use dynamic routing (BGP/OSPF) to propagate routes but not install a route with a next-hop of the hub itself for other spoke subnets. Option B is correct.

Answer

DPD is not configured on the hub

Answer

The spoke's phase2 proposal does not match the hub's proposal

Answer

The spoke is using a different IKE version than the hub

Question 5

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

Accepted Answer

Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application. FortiClient uses a ZTNA access proxy to forward traffic. The administrator must configure a ZTNA server on FortiGate and an access proxy rule that maps the external hostname/port to the internal application. The FortiClient connects to the ZTNA gateway's proxy IP/port. Option D is correct: the FortiGate must be configured as a ZTNA gateway and have a ZTNA proxy rule for the application.

Answer

Install a CA-signed certificate on FortiClient

Answer

Create a firewall policy from the WAN interface to the application server

Answer

Configure the application server to accept connections from FortiClient's IP range

Question 6

A FortiGate is configured as a SAML service provider (SP) for SSO. Users authenticate via an external IdP. After successful authentication, the FortiGate should enforce a firewall policy based on the user's group membership. Which FortiGate setting must be enabled to receive group information from the IdP?

Accepted Answer

Configure the 'user-group' attribute in the SAML SP settings. FortiGate as SAML SP can receive user attributes from the IdP, including group membership, through SAML assertions. The IdP must send the group attribute, and FortiGate must be configured to accept it. Option B is correct: 'Set single-sign-on-identity-attribute' or similar? Actually, the correct setting is to enable 'SAML User Group' in the SAML SP configuration to map the group attribute from the IdP. Option B is the best: 'Set the SAML user group attribute in the SP configuration'.

Answer

Enable 'Require IdP Certificate Validation'

Answer

Create a separate firewall policy for each user

Answer

Enable 'Auto-Provision Users' on FortiGate

Question 7

A network administrator is troubleshooting an IPsec VPN between two FortiGates. The phase1 is up, but phase2 keeps failing to establish. The administrator runs 'diagnose vpn ike log' and sees: 'no proposal chosen'. Both sides have the same phase2 configuration: AES256-SHA256, DH group 14, 3600 seconds lifetime. What is the MOST likely cause?

Accepted Answer

The phase2 local and remote subnets do not match on both sides. Even if the encryption/authentication proposals match, a common issue is a mismatch in the local and remote subnets (selectors). The phase2 negotiation requires matching traffic selectors. If one side has 192.168.1.0/24 and the other has 10.0.0.0/8, the proposals will be rejected. Option D is correct.

Answer

The NAT traversal setting is inconsistent

Answer

The IKE version is different on each side

Answer

The pre-shared key is incorrect

Question 8

A FortiGate is configured with a ZTNA access proxy rule for a web application. The administrator wants to enforce that only devices with a specific FortiClient tag (e.g., 'Compliant') can access the application. Where is this tag-based access control configured?

Accepted Answer

In the ZTNA access proxy rule under the ZTNA gateway configuration. In ZTNA, device posture tags from FortiClient are used in access proxy rules to grant or deny access. The tags are matched in the ZTNA proxy rule (access proxy rule) under the ZTNA gateway configuration. Option C is correct.

Answer

In the FortiClient EMS policy

Answer

In the firewall policy that permits traffic from the ZTNA gateway to the application

Answer

In the SSL inspection profile

Question 9

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

Accepted Answer

Provide network access control by enforcing policies based on device identity and posture. FortiNAC is the Network Access Control solution from Fortinet. It provides visibility, control, and automated response for endpoints on the network, including device profiling, guest management, and policy enforcement. Option A is correct.

Answer

Perform deep packet inspection on all traffic

Answer

Act as a VPN concentrator for remote access

Answer

Provide a cloud-based sandbox for malware analysis

Question 10

A FortiGate is configured with two VPN tunnels to different remote sites. The administrator notices that traffic is not load-balanced across the tunnels; all traffic uses the first tunnel. The administrator wants to use ECMP (Equal Cost Multi-Path) routing. Which two actions are required? (Choose two.)

Accepted Answer

Set the same distance and priority for both static routes. ECMP requires that routes have the same distance and priority. Also, the administrator must enable ECMP in the routing settings. Option A and D are correct: set the same distance and priority for the static routes, and enable ECMP. Note: ECMP is enabled by default in policy-based routing? Actually, for static routes, ECMP is automatically used when multiple routes have the same distance and priority. Option D is correct: enable ECMP in the routing settings (if not already). But the question asks for two actions. So A and D.

Answer

Configure both tunnels to use the same IKE version

Answer

Set the same phase2 lifetime for both tunnels

Question 11

An administrator is configuring a FortiGate as a SAML Identity Provider (IdP) for a third-party service provider. Which of the following is REQUIRED for the FortiGate IdP configuration?

Accepted Answer

A certificate for signing SAML assertions. As a SAML IdP, FortiGate requires a digital certificate to sign SAML assertions. The service provider's public certificate is needed to encrypt assertions if required, but the IdP's own certificate is mandatory. Option B is correct.

Answer

The SP's metadata must be imported as a firewall address

Answer

User accounts must be synchronized with an LDAP server

Answer

A pre-shared key between FortiGate and the SP

Question 12

What is the purpose of Dead Peer Detection (DPD) in an IPsec VPN?

Accepted Answer

Detect loss of connectivity to the remote VPN peer. DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

Answer

Detect if the VPN tunnel is using the correct encryption algorithm

Answer

Detect duplicate IP addresses on the network

Answer

Detect packet loss over the VPN tunnel

Question 13

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites connect to a central hub. The administrator wants to ensure that if one remote site loses connectivity, the other site can still reach the hub. Which configuration is essential?

Accepted Answer

Configure separate phase1 interfaces for each remote site. Multi-peer VPN requires each remote site to have its own phase1 and phase2 configuration. The hub must have separate phase1 interfaces or separate phase1 configs for each peer. Option D is correct: configure separate phase1 for each remote site.

Answer

Use the same preshared key for both remote sites

Answer

Enable auto-negotiation on all phase1 interfaces

Answer

Configure a single phase1 interface with multiple remote IPs

Question 14

A FortiGate is configured with ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing credit card numbers. Which ZTNA inline CASB feature should be used?

Accepted Answer

Data leak prevention (DLP) profile. ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 15

A network administrator is configuring a hub-and-spoke ADVPN with BGP over the VPN tunnels. Which TWO conditions are necessary for the spokes to establish direct shortcut tunnels between each other?

Accepted Answer

BGP must be configured on all FortiGates (hub and spokes) to exchange routing information. Shortcut tunnels require that the hub propagates routes without setting itself as next-hop (next-hop-self disabled), and that spokes have overlapping routing information so they know the other spoke's subnet via BGP. Option A and D are correct: BGP must be configured on all spokes to exchange routes, and the hub must not set next-hop-self so that the next-hop remains the remote spoke's tunnel IP.

Answer

The spokes must have identical phase2 proposals

Answer

The spokes must use the same IKE version

Answer

The hub must have static routes for each spoke's LAN subnet