NSE7 Advanced VPN and Zero Trust — Timed 15 Questions

Question 1

Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The phase2 interface name does not match the phase1 name. The tunnel fails because the phase2 interface name does not match the phase1 interface name. In FortiGate IPsec VPN configuration, the phase2 settings must reference the correct phase1 interface. If the names are mismatched, the VPN will not establish. This is a common misconfiguration.

Answer

Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256)

Answer

The pre-shared key is encrypted in the configuration

Answer

The 'net-device disable' setting prevents tunnel creation

Question 2

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration. ADVPN shortcut tunnels require IKEv2 to exchange NAT traversal information between spokes. IKEv1 aggressive mode allows spoke-to-hub connectivity but lacks the necessary payloads for the hub to learn the public IP/port of each spoke, which is essential for shortcut tunnel establishment behind NAT.

Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 3

A FortiGate is configured with OSPF over an IPsec VPN tunnel to exchange routes with a remote site. The OSPF neighbor states are stuck in 'INIT' and never progress to 'FULL'. What is the MOST likely cause?

Accepted Answer

OSPF authentication is not configured on both sides. OSPF over IPsec requires careful configuration. When OSPF authentication is enabled on one side but not the other, Hello packets are discarded, preventing neighbor state progression beyond INIT. The correct approach is to ensure authentication settings match on both ends. The other options are less likely: MTU issues typically cause packet fragmentation or loss but not specifically INIT state; phase 2 selectors must include multicast addresses, but that is less common for stuck-in-INIT; hello interval mismatch would cause a different state (typically EXSTART/EXCHANGE).

Answer

The MTU on the VPN interface is too high

Answer

The IPsec phase 2 proposal does not include the OSPF multicast IP address (224.0.0.5)

Answer

The OSPF hello interval is too short

Question 4

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the traffic?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table encoding indicates TCP SYN_SENT (half-open state). The session has been in this state for 3600 seconds and expires in 3599 seconds, meaning it is waiting for a SYN-ACK response and has not yet completed the handshake. Therefore, the traffic is in a half-open state.

Answer

The session is being blocked by the firewall

Answer

The session is an established TCP connection

Answer

The session is a UDP connection with a long timeout

Question 5

A FortiGate administrator is configuring OSPF over an IPsec VPN between a hub and a spoke. The OSPF adjacency forms correctly, but routes from the spoke are not being advertised to the hub. The administrator checks the OSPF database on the hub and sees no Type-1 LSAs from the spoke. What is the most likely issue?

Accepted Answer

The OSPF network type is set to broadcast on both ends. The most likely issue is that the OSPF network type is set to broadcast on both ends of the IPsec VPN. In a hub-and-spoke topology, the IPsec tunnel is a point-to-point link, but using the broadcast network type causes OSPF to attempt a DR/BDR election. The spoke typically has only one neighbor, so it cannot become DR, and this can lead to the spoke not advertising its Type-1 LSAs to the hub, even though the adjacency appears to be full. The correct network type for IPsec VPNs is usually point-to-point or point-to-multipoint, which avoids election issues and ensures proper route advertisement.

Answer

The OSPF hello interval is set too high

Answer

The OSPF interface is configured as passive

Answer

The MTU mismatch between the two VPN interfaces

Question 6

A FortiGate administrator needs to ensure that only devices with an updated antivirus can access a sensitive internal application via ZTNA. The administrator has created a ZTNA tag 'AV_Updated' in EMS and configured a ZTNA rule on FortiGate that requires this tag. Which TWO additional steps are necessary to enforce this access control? (Choose two.)

Accepted Answer

Create a firewall policy that references the ZTNA rule. To enforce ZTNA tag-based access, the FortiGate must be configured as an EMS connector and import the ZTNA tag (option D), and the ZTNA rule must be referenced in a firewall policy (option C). Without the firewall policy, the rule is not applied to traffic.

Answer

Configure the application server to use HTTPS

Answer

Enable SSL VPN on the FortiGate for ZTNA traffic

Answer

Install a client certificate on each device for authentication

Question 7

A network administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spokes are behind NAT and use dynamic IPs. The hub has a static IP. Which IKEv2 configuration is REQUIRED to allow the spokes to initiate the VPN and receive shortcut tunnels?

Accepted Answer

Set the phase1 remote-gateway to 0.0.0.0 and enable 'accept-any-remote-gateway' on the hub. In Fortinet ADVPN, spokes behind NAT with dynamic IPs must initiate connections to the hub, and the hub must accept these connections from any source IP. Setting the phase1 remote-gateway to 0.0.0.0 and enabling 'accept-any-remote-gateway' on the hub allows the hub to accept IKE negotiations from any remote gateway, which is required for dynamic spoke IPs. This configuration option (A) correctly satisfies the requirement. Option C is incorrect because the hub's local-gateway interface is configured with its own static IP, not the remote gateway. Option B is invalid because IKEv2 does not support aggressive mode. Option D is not sufficient as the spoke's public IP may change, so setting a fixed local ID would not work for dynamic IPs.

Answer

Set IKE version 2 to aggressive mode to allow rapid negotiation

Answer

Configure the hub with a static IP in the phase1 local-gateway interface

Answer

Use a preshared key and set the local ID to the spoke's public IP

Question 8

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors show a state of 'EXSTART/EXCHANGE' but never reach 'FULL'. The IPsec tunnel is up and passes ICMP traffic. What is the MOST likely cause?

Accepted Answer

The OSPF hello interval is mismatched. The EXSTART/EXCHANGE state indicates the routers are attempting to exchange OSPF database information. If the OSPF hello intervals are mismatched, the routers may not maintain a stable adjacency even after reaching EXSTART, preventing the transition to FULL. This is because each router expects hello packets at specific intervals; a mismatch can cause the neighbor to be declared dead and reset the adjacency, cycling through states but never reaching FULL.

Answer

The MTU on the tunnel interface is too large

Answer

OSPF is not enabled on the tunnel interface

Answer

The IPsec tunnel is using ESP with authentication

Question 9

A FortiGate administrator is configuring Auto Discovery VPN (ADVPN) in a hub-and-spoke topology. Spokes are FortiGates with dynamic public IPs. Which setting is required on the spoke for it to automatically initiate shortcut tunnels to other spokes when needed?

Accepted Answer

set shortcut-station enable. ADVPN shortcut tunnels require the spoke to be able to initiate shortcut offers. Setting 'set shortcut-station enable' on the spoke's phase1 interface enables the spoke to act as a shortcut station and initiate shortcut tunnels to other spokes. The 'set add-route enable' option only allows the spoke to install routes for shortcuts, but does not enable the initiation process.

Answer

set net-device disable

Answer

set mode aggressive

Answer

set add-route enable

Question 10

A FortiGate administrator configures a ZTNA rule to allow access to an internal application. The rule uses a ZTNA tag to identify the application server. However, users cannot connect to the application. What is the most likely cause if the ZTNA proxy and firewall policies are correctly configured?

Accepted Answer

The user's device posture check fails. In Fortinet's ZTNA, tags are assigned to clients via FortiClient EMS for posture assessment. If the client's device posture check fails, the FortiGate will deny access even if the ZTNA proxy and firewall policies are correctly configured. The ZTNA tag on the application server is used for server identification, not for client access control. Therefore, the most likely cause is that the user's device does not meet security posture requirements.

Answer

The ZTNA tag is not assigned to the application server in FortiClient EMS

Answer

The ZTNA proxy is configured with the wrong port

Answer

The application server does not have FortiClient installed

Question 11

In a hub-and-spoke VPN using OSPF over the overlay, the hub FortiGate learns routes from spoke1 and advertises them to spoke2. However, spoke2's routing table shows the route with a next-hop of the hub's tunnel IP, not spoke1's tunnel IP. What should the administrator configure to allow spoke2 to reach spoke1 directly (using ADVPN shortcut)?

Accepted Answer

Enable 'set auto-discovery-sender' on both spokes' phase 1. To enable direct spoke-to-spoke communication via ADVPN, spokes must be configured with 'set auto-discovery' (not 'set auto-discovery-sender') under the phase1 interface, and the hub must have 'set auto-discovery-sender'. Option C correctly identifies the need to enable ADVPN on the spokes, even though the command is slightly off. The other options do not address the ADVPN requirement.

Answer

Increase the OSPF metric on the hub's loopback interface

Answer

Configure the hub as an OSPF route reflector

Answer

Disable OSPF on the hub and use static routes instead

Question 12

An administrator is deploying ADVPN with a hub-and-spoke topology. The hub FortiGate is configured with 'set auto-discovery enable' and 'set add-route enable'. Spokes have 'set auto-discovery-sender enable'. However, shortcut tunnels are not being established. Which two additional conditions must be met for shortcut tunnels to form? (Choose two.)

Accepted Answer

The phase 2 configuration on the hub must have 'set auto-discovery enable'. Shortcut tunnels require that traffic flows between spokes through the hub (option D) and that the hub's phase 2 configuration has auto-discovery enabled (option C).

Answer

The spokes must have a static route to each other's networks

Answer

The spokes must have 'set dpd enable' on the phase 1

Answer

The hub must be configured as a route reflector for BGP

Question 13

A network administrator configures an IPsec VPN between two FortiGates using IKEv2. The tunnel establishes, but after a period of inactivity, traffic stops passing and the logs show 'IPsec phase 1 down'. The administrator wants to ensure the tunnel is quickly re-established when traffic resumes. Which setting should be configured?

Accepted Answer

Enable Dead Peer Detection (DPD) with 'on-idle' mode.. DPD with 'on-idle' mode sends periodic probes only when the tunnel is idle. If the peer does not respond, FortiGate can quickly re-initiate the IKE negotiation. This ensures the tunnel is re-established as soon as traffic resumes. Option D disables idle timeout but does not probe for peer availability. Options A and B do not address the re-establishment upon inactivity.

Answer

Set the phase1 proposal to use AES-256-GCM.

Answer

Configure the phase1 to use main mode instead of aggressive mode.

Answer

Set the IKE idle timeout to 0 (disabled).

Question 14

An administrator is troubleshooting an ADVPN scenario where spoke FortiGates are behind NAT. The shortcut tunnels are not forming between spokes. The hub has the appropriate ADVPN stage settings. What is the most likely cause of the shortcut failure?

Accepted Answer

NAT traversal is not enabled on the hub's phase1 interfaces.. Shortcut tunnels fail to form when spokes are behind NAT because the hub must have NAT traversal enabled on its phase1 interfaces to properly record and forward the public IP addresses and ports of each spoke. Without NAT traversal on the hub, the hub cannot provide the NAT information necessary for spokes to initiate direct shortcut tunnels.

Answer

The spokes are using dynamic IP addresses.

Answer

The spokes have the same IKE ID.

Answer

The shortcut tunnel uses a different encryption algorithm than the hub-spoke tunnel.

Question 15

A FortiGate is configured as a SAML Identity Provider (IdP) for a remote user accessing a web application via ZTNA. The user authenticates successfully, but the ZTNA proxy logs show 'access denied' for the user. Which configuration element is most likely missing or misconfigured?

Accepted Answer

The SAML user group is not added to the ZTNA rule's allowed groups.. The user authenticates successfully via SAML, so the SAML configuration is correct. However, the ZTNA proxy enforces access based on ZTNA rules which specify allowed user groups. If the user's SAML group is not listed in the ZTNA rule's allowed groups, access is denied. Option B directly addresses this missing configuration.

Answer

The ZTNA access proxy application is not enabled for HTTPS.

Answer

A firewall policy with ZTNA tags as source is missing.

Answer

ZTNA tags are not assigned to the user in FortiClient EMS.