NSE7 Advanced VPN and Zero Trust Practice Test 9 — 15 Questions

Question 1

A FortiGate is deployed as a ZTNA access proxy for an internal web application. Users report that after authenticating successfully, they are repeatedly prompted to log in again every few minutes. The administrator confirms that the ZTNA rule is configured with an authentication scheme and that the FortiClient EMS is reachable. Which FortiGate setting should the administrator verify to resolve the repeated authentication prompts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ZTNA rule's 'session-ttl' parameter.. ZTNA sessions on FortiGate are governed by the session-ttl parameter within the ZTNA rule. When this value is too low, users are forced to re-authenticate frequently. The authentication scheme's timeout and EMS polling are separate mechanisms. Adjusting the ZTNA rule's session-ttl to a suitable duration resolves the repeated login prompts without compromising security.

Answer

The SSL VPN idle-timeout setting in the VPN portal.

Answer

The FortiClient EMS compliance polling interval.

Answer

The ZTNA rule's 'auth-timeout' value under the authentication scheme.

Question 2

A FortiGate administrator is deploying ZTNA in a network where the FortiGate acts as the ZTNA access proxy. Users need to access an internal web application at 10.0.5.50. The administrator wants to ensure that only devices with a valid ZTNA certificate issued by FortiClient EMS can access the application, and that the traffic is inspected for threats. Which configuration is required on the FortiGate to enforce device certificate validation before allowing access?

Accepted Answer

Configure a ZTNA server and enable 'client-certificate' in the ZTNA rule, then select the EMS connector as the source of trusted certificates.. ZTNA on FortiGate uses the EMS connector to validate device certificates. The ZTNA rule can require a client certificate and specify the EMS connector as the trusted source. This ensures that only compliant devices with a valid certificate can access the protected application. The ZTNA server then forwards the traffic, allowing security profiles to inspect it. The correct configuration involves enabling client certificate validation in the ZTNA rule, not the server.

Answer

Configure a ZTNA server with 'client-cert' set to 'required' and specify the EMS connector as the certificate authority.

Answer

Configure a ZTNA server with 'device-certificate' enforcement and import the EMS root CA into the FortiGate's certificate store.

Answer

Configure a ZTNA server with a client certificate requirement and enable 'client-cert' in the ZTNA server settings.

Question 3

A FortiGate administrator is configuring an ADVPN with BGP. Spoke FortiGates are behind NAT devices and have dynamic public IP addresses. The administrator wants the hub to automatically update spoke shortcuts when a spoke's public IP changes. Which configuration on the hub is required to achieve this?

Accepted Answer

Enable 'set auto-discovery-forwarder' on the hub's IPsec tunnel interfaces.. In an ADVPN with NAT and dynamic spokes, the hub must act as a forwarder to relay shortcut queries and responses. The auto-discovery-forwarder setting allows the hub to update shortcut information when a spoke's public IP changes, ensuring spokes can establish direct tunnels. The sender and receiver settings are for initiating and receiving queries, respectively, but do not handle IP updates.

Answer

Enable 'set auto-discovery-sender' on the hub's IPsec tunnel interfaces.

Answer

Configure the hub to use 'set auto-discovery-receiver' on the IPsec tunnel interfaces.

Answer

Configure 'set auto-discovery-shortcut' on the hub's IPsec tunnel interfaces.

Question 4

A FortiGate administrator is deploying ZTNA to control access to internal web applications. The administrator wants to ensure that only devices with a specific security posture tag are allowed access. The ZTNA server is configured, and FortiClient EMS is used for posture checks. However, when testing, users with non-compliant devices are still able to access the application. What is the most likely cause?

Accepted Answer

The EMS connector on the FortiGate is not configured or is not synchronizing posture tags.. ZTNA posture enforcement relies on device tags from FortiClient EMS. The FortiGate must have an EMS connector configured and synchronized to receive these tags. Without synchronization, the FortiGate cannot match policies based on posture, leading to non-compliant devices being granted access. Ensuring the EMS connector is operational and tags are current is essential for ZTNA to function as intended.

Answer

The firewall policy is set to allow all users regardless of posture, and the ZTNA policy is not applied.

Answer

The ZTNA firewall policy does not include the posture check tag in the source field.

Answer

The ZTNA server configuration does not include the correct application mapping.

Question 5

A FortiGate at a branch office is configured as an ADVPN shortcut peer. Users report that after the ADVPN shortcut is established, latency to a peer branch drops significantly, but a few days later the shortcut silently disappears and traffic reverts to the hub. The administrator confirms the spoke-to-spoke IKE negotiation succeeded initially. Which FortiGate setting should the administrator verify to keep the shortcut alive for the duration of active session traffic?

Accepted Answer

The 'set auto-discovery-shortcuts enable' option and the shortcut idle-timeout on the spoke's IPsec Phase 1 interface.. ADVPN shortcuts are dynamic IPsec tunnels created on demand between spokes. Their lifetime is governed by the shortcut idle-timeout on the IPsec interface: if no traffic matching the shortcut selector traverses the tunnel within that window, FortiGate removes the shortcut and traffic falls back to the hub. Verifying auto-discovery-shortcuts is enabled and adjusting the idle-timeout preserves the shortcut during active use.

Answer

The 'set auto-discovery-receiver' and 'auto-discovery-sender' settings on the hub and spokes.

Answer

The IPsec Phase 1 'idle-timeout' value on the hub, which must be 0 to prevent the shortcut from being torn down.

Answer

The BGP 'ebgp-multihop' value on the hub, which must be at least 2 for shortcuts to remain stable.

Question 6

An administrator is configuring an IPsec VPN tunnel between two FortiGates. The administrator wants to ensure that the tunnel automatically re-establishes if the primary WAN link fails and a secondary WAN link becomes active. Which feature should be configured to achieve this?

Accepted Answer

Interface-based IPsec with multiple WAN interfaces and route redundancy.. To achieve automatic tunnel re-establishment when a WAN link fails, the IPsec tunnel must be bound to multiple WAN interfaces and routing must fail over to the secondary link. This allows the tunnel to renegotiate on the alternate interface. DPD can help detect failures but does not switch interfaces. MOBIKE and AKN are not applicable for this FortiGate scenario.

Answer

Automatic Key Negotiation (AKN) in phase 2.

Answer

Dead Peer Detection (DPD) with 'on-idle' mode.

Answer

IKEv2 with MOBIKE support.

Question 7

A FortiGate administrator is configuring an ADVPN with a hub and two spokes. The hub has a static IP, and the spokes are behind NAT devices with dynamic IPs. The administrator wants to enable shortcut tunnels between the spokes for direct communication. Which two statements about the ADVPN configuration are correct? (Choose two.)

Accepted Answer

The hub must be configured with 'set auto-discovery-sender enable' on the IPsec phase1-interface to advertise spoke routes.. ADVPN requires the hub to have auto-discovery-sender enabled to send shortcut offers, and each spoke to have auto-discovery-receiver enabled to accept them. This allows spokes to dynamically establish direct tunnels when traffic between them is detected. The hub does not need static routes to spoke public IPs, nor do spokes need identical PSKs. The exchange-interface-ip setting is unrelated to ADVPN shortcut discovery. The two correct settings are essential for the feature to function.

Answer

The hub must be configured with 'set exchange-interface-ip enable' to allow spokes to learn each other's public IP addresses.

Answer

The spokes must use the same pre-shared key as the hub to establish the initial IPsec tunnels.

Answer

The hub must have a static route to each spoke's public IP address to facilitate shortcut tunnels.

Question 8

A FortiGate administrator is configuring an IPsec VPN with a peer that uses dynamic IP addressing. The administrator wants the FortiGate to initiate the tunnel and keep it up even when the peer's IP changes. Which configuration should the administrator use to achieve this?

Accepted Answer

Set the remote gateway to 0.0.0.0 and configure the tunnel as a dial-up VPN with the FortiGate as the initiator.. In a dial-up VPN, the FortiGate can be configured to initiate the tunnel to a peer with a dynamic IP by using a dynamic DNS hostname as the remote gateway. However, if the peer's IP is truly dynamic and no DNS is available, the FortiGate cannot initiate. The correct configuration for a FortiGate to initiate to a dynamic peer is to use a dynamic DNS hostname and set the tunnel to initiate. Since that option is not present, the intended answer is the dial-up VPN with the FortiGate as the initiator, which allows the FortiGate to accept connections from any IP and can be configured to initiate if the peer's IP is known via DNS. This is a common exam scenario.

Answer

Enable NAT traversal and set the remote gateway to the peer's current IP address.

Answer

Set the remote gateway to 0.0.0.0 and enable mode-cfg.

Answer

Configure the remote gateway as a dynamic DNS hostname and enable auto-discovery.

Question 9

A FortiGate administrator is configuring an ADVPN with a hub and two spokes. The administrator wants to enable shortcut forwarding so that spokes can communicate directly. Which two statements about ADVPN shortcut negotiation are correct? (Choose two.)

Accepted Answer

Spokes must have auto-discovery-receiver enabled to accept shortcut offers from the hub.. For ADVPN shortcut negotiation, the hub must have auto-discovery-sender enabled to send shortcut offers, and each spoke must have auto-discovery-receiver enabled to accept them. Additionally, shortcut negotiation is triggered when a spoke receives traffic for another spoke's subnet and forwards it to the hub. The hub then facilitates the direct tunnel. The other statements are incorrect because they either misplace the configuration or misunderstand the requirements.

Answer

The hub must have auto-discovery-sender enabled for each spoke to receive shortcut offers.

Answer

Shortcut negotiation requires that the hub have a route to both spokes' private subnets.

Answer

The spokes must use the same pre-shared key as the hub for shortcut tunnels.

Question 10

A FortiGate administrator is configuring an IPsec VPN with IKEv2. The remote peer is a third-party device that does not support multiple proposals. The administrator wants to ensure the tunnel uses AES-256 and SHA-256 for encryption and authentication. Which IKEv2 configuration on FortiGate will achieve this?

Accepted Answer

Set the IKEv2 proposal to aes256-sha256 and ensure the remote peer uses the same.. For IKEv2, FortiGate uses a single proposal for the IKE SA and child SAs. The proposal aes256-sha256 defines AES-256 encryption and SHA-256 integrity. This directly meets the requirement. The other options either apply IKEv1 concepts or misconfigure the parameters. Ensuring the remote peer supports the same proposal is essential for successful negotiation.

Answer

Set the phase1 proposal to aes256-sha256 and phase2 to aes256-sha256.

Answer

Enable IKEv2 and set the encryption to aes256 and authentication to sha256 in the phase1 settings.

Answer

Use a custom IKEv2 proposal with encryption aes256 and prf sha256.

Question 11

A FortiGate administrator is configuring SSL VPN for remote users. The administrator wants to ensure that only users who have installed FortiClient and are compliant with endpoint posture checks can connect. Which SSL VPN configuration setting must be enabled to enforce endpoint compliance?

Accepted Answer

Enable 'endpoint-compliance' in the SSL VPN settings and select the EMS connector as the compliance source.. To enforce endpoint compliance with FortiClient EMS in SSL VPN, the FortiGate must have the EMS connector configured and enable endpoint-compliance in the SSL VPN settings. This allows the FortiGate to check the device's compliance status with EMS before allowing the VPN connection. Other methods like client certificates or host-check do not provide EMS-based compliance. The correct setting is 'endpoint-compliance' referencing the EMS connector.

Answer

Enable 'host-check' in the SSL VPN portal and configure host check rules based on FortiClient compliance.

Answer

Enable 'device-posture' in the SSL VPN portal and configure posture checks with FortiClient EMS tags.

Answer

Enable 'client-certificate' in the SSL VPN settings and require a certificate from FortiClient.

Question 12

A FortiGate administrator is deploying ZTNA to control access to internal web applications. The administrator wants to enforce device posture checks before allowing access to a web server at 10.10.10.50. The FortiClient EMS is already integrated, and ZTNA tags are being populated. Which FortiGate configuration is required to enforce ZTNA tags in a firewall policy for this internal web server?

Accepted Answer

Create a ZTNA server object and reference it in the firewall policy as the destination, along with ZTNA tags in the source.. ZTNA on FortiGate requires a ZTNA server object that acts as an access proxy for the protected resource. The firewall policy must reference this ZTNA server as the destination and include ZTNA tags in the source to enforce device posture. This combination ensures that only devices matching the required tags can reach the internal web server.

Answer

Enable ZTNA on the incoming interface and reference a ZTNA server in the firewall policy.

Answer

Configure a virtual IP (VIP) mapping the public IP to the internal server, and apply ZTNA tags in the firewall policy.

Answer

Enable ZTNA on the firewall policy by selecting the ZTNA checkbox and specifying device groups.

Question 13

A FortiGate administrator is configuring an IPsec VPN with a remote peer that uses a dynamic IP address. The administrator wants the tunnel to automatically re-establish if the peer's IP changes. Which feature should be enabled on the FortiGate?

Accepted Answer

IKEv2 with dynamic gateway. IKEv2 with a dynamic gateway allows the FortiGate to accept connections from a peer with a changing IP. The remote gateway is set to 0.0.0.0, and the FortiGate acts as a responder. When the peer's IP changes, it can initiate a new IKE session, and the tunnel re-establishes. DPD and DDNS do not provide this automatic re-establishment on their own.

Answer

Auto-negotiation

Answer

Dead Peer Detection (DPD)

Answer

Dynamic DNS (DDNS) on the remote peer

Question 14

A FortiGate administrator is configuring an IPsec VPN with multiple dial-up tunnels to the same remote peer that has two public IP addresses. The administrator wants the FortiGate to automatically select the best path based on link quality and to fail over without manual intervention. Which IPsec configuration parameter should the administrator enable on the dial-up tunnel to achieve this?

Accepted Answer

Set auto-negotiate enable. The auto-negotiate parameter enables the FortiGate to automatically select the best path among multiple dial-up tunnels based on link quality. It leverages DPD to monitor each path and can fail over to a better path if the current one degrades. This is the correct setting for achieving automatic best-path selection and failover without manual intervention.

Answer

Set auto-discovery-forwarder enable

Answer

Set auto-discovery-receiver enable

Answer

Set auto-discovery-sender enable

Question 15

An administrator is configuring an ADVPN with a hub and two spokes. The spokes are behind NAT devices and have dynamic public IPs. The administrator wants to enable shortcut tunnels between the spokes for direct communication. Which configuration is required on the hub to support this?

Accepted Answer

Enable IPsec NAT traversal on the hub and spokes.. For ADVPN shortcut tunnels to work between spokes that are behind NAT, IPsec NAT traversal must be enabled on all participating FortiGates. NAT-T allows the IPsec packets to be encapsulated in UDP, enabling them to traverse NAT devices. The hub must also have auto-discovery enabled to facilitate route propagation, but NAT-T is the fundamental requirement for NATed spokes to establish direct tunnels.

Answer

Set the hub's remote gateway to 0.0.0.0 and enable mode-cfg.

Answer

Configure the hub as a shortcut server and enable auto-discovery.

Answer

Enable DPD on the hub and spokes with a short interval.