NSE7 Advanced VPN and Zero Trust Practice Test 9 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that FortiClient can reach the ZTNA gateway's IP and port. To diagnose ZTNA connection issues, the administrator should verify network connectivity to the ZTNA gateway, check the ZTNA proxy rule configuration, and verify the application server is reachable from the FortiGate. Option A, C, and D are correct.

Answer

Check the FortiGate's antivirus update status

Answer

Reboot the FortiClient computer

Question 2

A FortiGate is acting as a SAML Service Provider (SP) for user authentication. Which TWO of the following are required for successful SAML SSO?

Accepted Answer

The IdP's metadata must be imported to the FortiGate. For SAML SP, the IdP's metadata (including certificate and endpoints) must be imported, and the SP must have a certificate for signing/encryption. Option A and D are correct.

Answer

The FortiGate must have a static public IP address

Answer

The users must be in the same Active Directory domain as the FortiGate

Answer

A pre-shared key must be configured

Question 3

A network administrator is troubleshooting an ADVPN deployment. Spoke FortiGates can communicate with the hub, but shortcut tunnels between spokes are not being established. The administrator verifies that IKE and IPsec settings are correct on all devices. What is the MOST likely cause?

Accepted Answer

The hub's phase2 configuration has 'auto-negotiate' disabled. In ADVPN, shortcut tunnels require IKEv2 with the 'add-route' option and auto-negotiate. If the hub's phase2 configuration does not have 'auto-negotiate' enabled, it will not initiate shortcut tunnels.

Answer

Dead Peer Detection (DPD) is disabled on the hub

Answer

The hub's phase1 configuration has 'auto-negotiate' disabled

Answer

The spokes have different IKE versions configured

Question 4

An administrator configures a ZTNA proxy rule to allow access to an internal application. Users can connect to the FortiGate ZTNA gateway but receive a '403 Forbidden' error. Which step should the administrator take to resolve the issue?

Accepted Answer

Check that the ZTNA proxy rule's action is set to 'accept' and the correct tags are specified. A 403 error on ZTNA typically indicates that the user's device does not have the required ZTNA tags. The administrator must ensure the FortiClient has the correct tags assigned based on compliance.

Answer

Disable the 'require ZTNA tag' option on the proxy rule

Answer

Ensure the application is reachable from the FortiGate with a ping

Answer

Verify that the application's firewall policy has an SSL inspection profile applied

Question 5

A FortiGate administrator observes the following CLI output from 'diagnose vpn ike gateway list':
vd: root/0
name: VPN_TO_HUB
version: IKEv2
status: up
mode: main
DPD: on
...
Number of IPsec tunnels: 1
  name: phase2_tunnel
  status: up
  inbound: 0 bytes
  outbound: 0 bytes
The tunnel shows up but no traffic is passing. What is the MOST likely cause?

Accepted Answer

Firewall policies are not configured to permit traffic through the VPN tunnel. The output shows the IKE gateway is up but the IPsec tunnel has zero traffic. This often indicates a policy or routing misconfiguration. The most common cause is missing firewall policies to allow traffic through the tunnel.

Answer

Dead Peer Detection is disabled

Answer

The phase1 proposal is mismatched

Answer

The tunnel is in 'down' status

Question 6

An administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which protocol must be allowed between FortiGate and FortiClient EMS?

Accepted Answer

HTTPS (TCP/443). FortiGate communicates with FortiClient EMS using HTTPS (TCP/443) to retrieve tags and endpoint posture information.

Answer

LDAP (TCP/389)

Answer

SNMP (UDP/161)

Answer

Syslog (UDP/514)

Question 7

A FortiGate is configured as a SAML service provider (SP) for ZTNA. Users authenticate via an external IdP. After authentication, users are not able to access applications even though the ZTNA proxy rule lists them. What should the administrator check FIRST?

Accepted Answer

The ZTNA proxy rule's allowed group does not include the user's group. When using SAML, the FortiGate needs to map the SAML attributes (e.g., username) to a user group. If the user is not in the correct group, access will be denied.

Answer

The FortiClient EMS license is invalid

Answer

The application server is unreachable from FortiGate

Answer

The SAML IdP certificate is expired

Question 8

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors show a state of 'EXSTART/EXCHANGE' but never reach 'FULL'. The IPsec tunnel is up and passes ICMP traffic. What is the MOST likely cause?

Accepted Answer

The MTU on the tunnel interface is too large. OSPF over IPsec often requires adjusting the MTU to avoid fragmentation. The default MTU of 1500 can cause OSPF packets to be fragmented, leading to neighbor state issues.

Answer

OSPF is not enabled on the tunnel interface

Answer

The IPsec tunnel is using ESP with authentication

Answer

The OSPF hello interval is mismatched

Question 9

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

Accepted Answer

ZTNA tags and posture checks. FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Answer

Application control profile

Answer

IPsec VPN with pre-shared key

Answer

Web filtering profile

Question 10

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

Accepted Answer

ADVPN with IKEv2. ADVPN (Auto Discovery VPN) enables shortcut tunnels between spokes after initial hub communication, allowing direct traffic.

Answer

Static routes on spokes

Answer

IKEv1 with mode-config

Answer

GRE over IPsec

Question 11

An administrator receives an error when trying to create a ZTNA proxy rule: 'The ZTNA proxy rule requires a valid application mapping.' What does this indicate?

Accepted Answer

The application mapping object is not defined. A ZTNA proxy rule maps an external FQDN/port to an internal application. The error means the application mapping (which defines the internal server) is missing or misconfigured.

Answer

The FortiClient EMS is not reachable

Answer

The SSL certificate is missing

Answer

The firewall policy is not in place

Question 12

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

Accepted Answer

Dead Peer Detection (DPD) retry interval is too short. Tunnel flapping with IKEv2 is often due to DPD mismatches or aggressive DPD retry intervals. If DPD is configured with very short intervals, the tunnel may drop due to transient delays.

Answer

The remote gateway's certificate is expired

Answer

The phase2 proposal is mismatched

Answer

The pre-shared key is incorrect

Question 13

Which of the following is a requirement for FortiGate to act as a SAML Identity Provider (IdP) for ZTNA?

Accepted Answer

A configured user database and SAML IdP settings. FortiGate can be a SAML IdP, providing authentication to service providers. It requires a configured user database (e.g., local users, LDAP) and a SAML IdP profile.

Answer

A public IP address on the WAN interface

Answer

Integration with FortiClient EMS

Answer

An SSL certificate from a public CA

Question 14

An administrator configures a ZTNA gateway with inline CASB to monitor SaaS applications. Users report that access to Salesforce is blocked. The administrator reviews the ZTNA proxy rule and sees that inline CASB is enabled with a 'monitor-only' action. What is the MOST likely reason for the block?

Accepted Answer

A separate application control profile is blocking Salesforce. Inline CASB with 'monitor-only' should not block traffic. The block may be due to a separate application control or web filtering profile applied on the policy.

Answer

The inline CASB profile is set to 'block' for Salesforce

Answer

The ZTNA proxy rule does not have SSL inspection enabled

Answer

FortiClient EMS is not assigning the required ZTNA tags

Question 15

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. To use compliance tags, FortiGate must have EMS configured as a fabric connector and the ZTNA proxy rule must reference the tags.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP