NSE7 Advanced VPN and Zero Trust Practice Test 9 — 15 Questions

Question 1

A FortiGate administrator configures a ZTNA access proxy rule to allow access to an internal application only if the user's device has the tag 'Compliant'. The tag is assigned by FortiClient EMS. However, a user with a compliant device is still blocked. The admin sees in the ZTNA logs that the tag is not being received. What should the administrator check FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the EMS connector is configured under Security Fabric > External Connectors. For ZTNA tags to be sent to FortiGate, the FortiClient must be registered with EMS and the EMS must be configured as an endpoint control connector on FortiGate. If the connector is missing or misconfigured, FortiGate cannot retrieve tags.

Answer

Verify that the FortiClient is connected to the internet

Answer

Confirm that the ZTNA rule is enabled and using the correct port

Answer

Check if the application server is reachable from the FortiGate

Question 2

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Accepted Answer

Configure BGP to redistribute connected or static routes to the spokes. For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

Answer

Enable 'set auto-discovery-receiver' on the hub's phase1 interface

Answer

Disable DPD on the hub's phase1 interface

Answer

Set the IKE version to IKEv1 on the hub

Question 3

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Accepted Answer

FortiClient on the endpoint device. To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

Answer

FortiNAC for network admission control

Answer

IPsec VPN to encrypt traffic between client and FortiGate

Question 4

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

Accepted Answer

The phase1 encryption algorithm or integrity algorithm is mismatched. The 'no acceptable proposal' error occurs when the two peers cannot agree on a set of parameters. Common causes are mismatched encryption/integrity algorithms (phase1 proposal) or mismatched Diffie-Hellman groups.

Answer

The remote peer's IP address is unreachable

Answer

The local FortiGate has the wrong IKE version configured

Answer

The remote peer's pre-shared key is incorrect

Question 5

You run 'diagnose vpn ike gateway list' on a FortiGate hub and see the following output for a spoke connection: IKE SA state: ESTABLISHED, IPsec SA state: UP, but the spoke cannot route traffic to other spokes. The ADVPN shortcut tunnel is not being established. What is the MOST likely cause?

Accepted Answer

The hub has a static route for the spoke subnet pointing to the tunnel interface. In ADVPN, the hub must not include static routes for the spoke subnets, otherwise the spokes will use the hub as next-hop and not attempt shortcut establishment. The hub should use dynamic routing (BGP/OSPF) to propagate routes but not install a route with a next-hop of the hub itself for other spoke subnets. Option B is correct.

Answer

DPD is not configured on the hub

Answer

The spoke's phase2 proposal does not match the hub's proposal

Answer

The spoke is using a different IKE version than the hub

Question 6

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

Accepted Answer

Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application. To allow FortiClient to forward traffic to the ZTNA gateway, the FortiGate must be configured as a ZTNA gateway with an access proxy rule that maps the application to a specific hostname and port. FortiClient then connects to the ZTNA gateway's proxy address, which forwards traffic to the internal application server. Option A is incorrect because a CA-signed certificate is not required for FortiClient; FortiGate can use a self-signed certificate for ZTNA. Option B is incorrect because a firewall policy from WAN to the application server would bypass ZTNA and expose the server directly. Option D is incorrect because the application server does not need to trust FortiClient's IP range; ZTNA uses identity-based access, not IP-based.

Answer

Install a CA-signed certificate on FortiClient

Answer

Create a firewall policy from the WAN interface to the application server

Answer

Configure the application server to accept connections from FortiClient's IP range

Question 7

A FortiGate is configured as a SAML service provider (SP) for SSO. Users authenticate via an external IdP. After successful authentication, the FortiGate should enforce a firewall policy based on the user's group membership. Which FortiGate setting must be enabled to receive group information from the IdP?

Accepted Answer

Configure the 'user-group' attribute in the SAML SP settings. To receive group membership information from the IdP, the FortiGate SAML SP must be configured with the correct SAML attribute that carries the user group data. This is done by setting the 'user-group' attribute (or equivalent) in the SAML SP configuration. When the IdP sends a SAML assertion containing that attribute, FortiGate maps it to the user's group membership, enabling group-based firewall policies. Option D is correct because it explicitly references configuring the 'user-group' attribute in the SAML SP settings.

Answer

Enable 'Require IdP Certificate Validation'

Answer

Create a separate firewall policy for each user

Answer

Enable 'Auto-Provision Users' on FortiGate

Question 8

A network administrator is troubleshooting an IPsec VPN between two FortiGates. The phase1 is up, but phase2 keeps failing to establish. The administrator runs 'diagnose vpn ike log' and sees: 'no proposal chosen'. Both sides have the same phase2 configuration: AES256-SHA256, DH group 14, 3600 seconds lifetime. What is the MOST likely cause?

Accepted Answer

The phase2 local and remote subnets do not match on both sides. Even if the encryption/authentication proposals match, a common issue is a mismatch in the local and remote subnets (selectors). The phase2 negotiation requires matching traffic selectors. If one side has 192.168.1.0/24 and the other has 10.0.0.0/8, the proposals will be rejected. Option C is correct.

Answer

The NAT traversal setting is inconsistent

Answer

The IKE version is different on each side

Answer

The pre-shared key is incorrect

Question 9

A FortiGate is configured with a ZTNA access proxy rule for a web application. The administrator wants to enforce that only devices with a specific FortiClient tag (e.g., 'Compliant') can access the application. Where is this tag-based access control configured?

Accepted Answer

In the ZTNA access proxy rule under the ZTNA gateway configuration. In FortiGate ZTNA, device posture tags from FortiClient are evaluated in the ZTNA access proxy rule under the ZTNA gateway configuration. The administrator configures the tag match condition directly in the access proxy rule, not in a firewall policy, SSL profile, or EMS policy. Therefore, option D is correct.

Answer

In the FortiClient EMS policy

Answer

In the firewall policy that permits traffic from the ZTNA gateway to the application

Answer

In the SSL inspection profile

Question 10

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

Accepted Answer

Provide network access control by enforcing policies based on device identity and posture. FortiNAC is Fortinet's Network Access Control (NAC) solution. Its primary function is to provide visibility, control, and automated response for endpoints based on identity and posture, enabling policy enforcement for network access. Option C correctly describes this.

Answer

Perform deep packet inspection on all traffic

Answer

Act as a VPN concentrator for remote access

Answer

Provide a cloud-based sandbox for malware analysis

Question 11

A FortiGate is configured with two VPN tunnels to different remote sites. The administrator notices that traffic is not load-balanced across the tunnels; all traffic uses the first tunnel. The administrator wants to use ECMP (Equal Cost Multi-Path) routing. Which two actions are required? (Choose two.)

Accepted Answer

Set the same distance and priority for both static routes. ECMP requires that routes have the same distance and priority. Also, the administrator must enable ECMP in the routing settings. Option A and D are correct: set the same distance and priority for the static routes, and enable ECMP. Note: ECMP is enabled by default in policy-based routing? Actually, for static routes, ECMP is automatically used when multiple routes have the same distance and priority. Option D is correct: enable ECMP in the routing settings (if not already). But the question asks for two actions. So A and D.

Answer

Configure both tunnels to use the same IKE version

Answer

Set the same phase2 lifetime for both tunnels

Question 12

An administrator is configuring a FortiGate as a SAML Identity Provider (IdP) for a third-party service provider. Which of the following is REQUIRED for the FortiGate IdP configuration?

Accepted Answer

A certificate for signing SAML assertions. When FortiGate acts as a SAML IdP, it must sign SAML assertions to prove their authenticity to the SP. A certificate is required for this signing, as the SP will validate the assertion using the IdP's public key. Without a signing certificate, the SAML response cannot be cryptographically verified, breaking the trust model defined in the SAML 2.0 specification.

Answer

The SP's metadata must be imported as a firewall address

Answer

User accounts must be synchronized with an LDAP server

Answer

A pre-shared key between FortiGate and the SP

Question 13

What is the purpose of Dead Peer Detection (DPD) in an IPsec VPN?

Accepted Answer

Detect loss of connectivity to the remote VPN peer. DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

Answer

Detect if the VPN tunnel is using the correct encryption algorithm

Answer

Detect duplicate IP addresses on the network

Answer

Detect packet loss over the VPN tunnel

Question 14

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites connect to a central hub. The administrator wants to ensure that if one remote site loses connectivity, the other site can still reach the hub. Which configuration is essential?

Accepted Answer

Configure separate phase1 interfaces for each remote site. In a multi-peer IPsec VPN hub-and-spoke topology, each remote site must have its own phase1 interface to maintain independent security associations (SAs). If a single phase1 interface is shared, the loss of one remote peer can disrupt the SA state for all peers, potentially breaking connectivity for the other remote site. Configuring separate phase1 interfaces ensures that each remote site's VPN tunnel operates independently, so a failure at one site does not affect the other.

Answer

Use the same preshared key for both remote sites

Answer

Enable auto-negotiation on all phase1 interfaces

Answer

Configure a single phase1 interface with multiple remote IPs

Question 15

A FortiGate is configured with ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing credit card numbers. Which ZTNA inline CASB feature should be used?

Accepted Answer

Data leak prevention (DLP) profile. ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile