NSE7 Advanced VPN and Zero Trust — Timed 20 Questions

Question 1

An organization is designing a Zero Trust Network Access solution with Fortinet. They want to ensure that only devices with up-to-date antivirus software can access sensitive applications. Which component is responsible for enforcing this requirement?

20 minute time limit — choose an answer to begin.

Accepted Answer

FortiClient EMS. FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiGate ZTNA gateway

Question 2

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

Accepted Answer

The ZTNA proxy idle timeout is set to a lower value than the global timeout.. The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

Answer

The internal application is not responding to the proxy request.

Answer

The internal application has a 5-second timeout.

Answer

The client's FortiClient is not receiving the ZTNA tags.

Question 3

A company wants to deploy ZTNA to secure access to internal applications for remote employees. They have a FortiGate with a public IP and internal servers. Which deployment mode should they choose to minimize changes to existing firewall rules?

Accepted Answer

Proxy-based ZTNA. Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

Answer

SSL VPN with ZTNA

Answer

IPsec VPN with ZTNA

Answer

Both proxy-based and IPsec VPN

Question 4

Which THREE of the following are valid methods to deliver ZTNA tags to FortiClient? (Select three.)

Accepted Answer

FortiClient configuration profiles. Option A (FortiClient configuration profiles) is correct because ZTNA tags can be provisioned through XML configuration profiles pushed to FortiClient, which include the tag definitions and their associated rules. Option D (FortiClient EMS) is correct because FortiClient EMS is the primary management platform that assigns and delivers ZTNA tags to endpoints via the FortiClient fabric connection. Option E (FortiGate ZTNA tag delivery) is correct because a FortiGate can dynamically deliver ZTNA tags to FortiClient through the Security Fabric, using the FortiClient fabric connector and tag synchronization. Option B (SNMP) is not a delivery method for ZTNA tags; SNMP is used for monitoring and management data, not for pushing endpoint tags. Option C (DHCP options) is not valid because DHCP options carry network configuration parameters such as gateway, DNS, or vendor-specific strings, but they are not used to deliver ZTNA tags to FortiClient.

Answer

SNMP

Answer

DHCP options

Question 5

Which TWO of the following can be used to authenticate users in a ZTNA connection? (Select two.)

Accepted Answer

SAML authentication. SAML authentication (D) is correct because ZTNA uses SAML 2.0 to authenticate users against an identity provider (IdP), enabling single sign-on and passing user identity/attributes to the ZTNA policy engine. Certificate authentication (E) is correct because ZTNA can authenticate users via client certificates (X.509), validating the user's identity through the certificate presented during the TLS handshake. LDAP authentication (A) is not a ZTNA user authentication method in this context; LDAP is typically used for directory lookups rather than the ZTNA authentication exchange. FortiToken (B) is an MFA token mechanism, not a standalone authentication protocol for ZTNA connections. IPsec authentication (C) is a network-layer tunnel authentication method and is not used to authenticate users in a ZTNA connection.

Answer

LDAP authentication

Answer

FortiToken

Answer

IPsec authentication

Question 6

An administrator needs to configure a site-to-site IPsec VPN with a remote FortiGate that has a dynamic IP address. Which phase1 parameter must be set to support this?

Accepted Answer

Set mode to aggressive and use a pre-shared key. When the remote FortiGate has a dynamic IP address, the local FortiGate cannot initiate the VPN because it does not know the remote peer's IP. Setting the phase1 mode to aggressive and using a pre-shared key allows the remote peer to initiate the connection by sending its identity (ID) in the first exchange, enabling the local FortiGate to identify and authenticate the peer without requiring a static IP address for the remote side.

Answer

Enable Perfect Forward Secrecy (PFS)

Answer

Enable NAT traversal

Answer

Use certificate-based authentication

Question 7

Refer to the exhibit. Users report that they cannot log in to the SSL VPN portal. The stats show 15 login failures with reason 'auth_fail'. What is the most likely cause?

Accepted Answer

The SSL VPN settings do not reference the user group. The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

Answer

The user 'user1' does not exist

Answer

The login-attempt-limit is too low

Answer

The encryption algorithm is set to low

Question 8

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Accepted Answer

Increase the phase2 rekey time to 8 hours.. Option E is correct because enabling Dead Peer Detection (DPD) on the IPsec tunnel interface allows each FortiGate to detect when the peer becomes unreachable and tear down or renegotiate the tunnel, which directly improves stability in the presence of intermittent packet loss. Option D is correct because increasing the phase2 rekey time to 8 hours reduces the frequency of SA rekeying; frequent rekeys can cause brief traffic interruptions, so a longer rekey time lowers the chance of disruption and improves overall tunnel stability. Option A is not correct because reducing the DPD retry interval to 3 seconds makes the device more aggressive in declaring the peer dead, which can cause unnecessary tunnel flapping under intermittent loss rather than improving stability. Option B is not correct because increasing the phase1 lifetime to 86400 seconds does not address intermittent packet loss and may actually delay renegotiation recovery. Option C is not correct because changing from IKEv2 to IKEv1 does not inherently improve stability and may reduce functionality compared to IKEv2.

Answer

Reduce the DPD retry interval to 3 seconds.

Answer

Increase the phase1 lifetime to 86400 seconds.

Answer

Change the IKE version to IKEv1.

Question 9

Refer to the exhibit. An administrator runs the 'diagnose vpn ike stats' command on a FortiGate. What does the output indicate?

Accepted Answer

The tunnel has one IKE SA and two IPsec SAs, which is normal for a single VPN tunnel.. The 'diagnose vpn ike stats' output shows one IKE SA (phase 1) and two IPsec SAs (phase 2). This is normal for a single VPN tunnel when using IPsec with both inbound and outbound SAs, or when the tunnel is configured with separate SAs for different traffic selectors. The presence of two IPsec SAs under one IKE SA does not indicate an error or vulnerability; it is the expected behavior for a standard IPsec VPN tunnel.

Answer

The tunnel is vulnerable to a man-in-the-middle attack because the IPsec SAs are using the same encryption algorithm.

Answer

The tunnel configuration is incorrect because there are two IPsec SAs under one IKE SA.

Answer

The tunnel is using two IKE SAs for redundancy.

Question 10

Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?

Accepted Answer

Create a user group that includes the RADIUS server as an authentication method. A user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.

Answer

Configure an LDAP server to synchronize user accounts

Answer

Configure an SSL VPN portal with 'Require Authentication' enabled

Answer

Set a local password policy for SSL VPN users

Question 11

Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The phase2 interface name does not match the phase1 name. The tunnel fails because the phase2 interface name does not match the phase1 interface name. In FortiGate IPsec VPN configuration, the phase2 settings must reference the correct phase1 interface. If the names are mismatched, the VPN will not establish. This is a common misconfiguration.

Answer

Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256)

Answer

The pre-shared key is encrypted in the configuration

Answer

The 'net-device disable' setting prevents tunnel creation

Question 12

Match each SD-WAN component to its role.

Accepted Answer

SD-WAN Rule: Determines traffic steering based on criteria like source, destination, application.. Correct matches: SD-WAN Rule → traffic steering; Performance SLA → link quality monitoring; Virtual-WAN-Link → interface grouping. Common confusions mix these roles.

Answer

SD-WAN Rule: Monitors link quality metrics (latency, jitter, packet loss) against thresholds.

Answer

Performance SLA: Groups WAN interfaces into a logical bundle for load balancing.

Answer

Virtual-WAN-Link: Determines traffic steering based on criteria like source, destination, application.

Question 13

Match each Fortinet command to its function.

Accepted Answer

get system performance: Display real-time system performance statistics. Correct matches: 'get system performance' shows real-time performance statistics; 'diagnose debug application httpd' enables HTTP daemon debugging; 'execute ping' tests network connectivity; 'show system status' displays system summary. Common confusions include swapping the functions of 'get system performance' and 'execute ping'.

Answer

get system performance: Ping a network host

Answer

execute ping: Display real-time system performance statistics

Question 14

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration. ADVPN shortcut tunnels require IKEv2 to exchange NAT traversal information between spokes. IKEv1 aggressive mode allows spoke-to-hub connectivity but lacks the necessary payloads for the hub to learn the public IP/port of each spoke, which is essential for shortcut tunnel establishment behind NAT.

Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 15

A FortiGate is configured as a SAML SP for user authentication. When a user attempts to access a protected resource, the FortiGate redirects the user to the IdP login page, but after successful authentication, the user is not redirected back to the original resource. What is the MOST likely cause?

Accepted Answer

The SAML assertion consumer service URL on the IdP does not include a trailing slash. The SAML assertion consumer service (ACS) URL must exactly match the endpoint configured on the FortiGate. If the IdP's ACS URL lacks a trailing slash that the FortiGate expects, the SAML response will be sent to an incorrect or mismatched endpoint, causing the redirect to fail. This is a common misconfiguration in SAML SP setups where URL normalization differs between the SP and IdP.

Answer

The user's browser has cookies disabled

Answer

The IdP certificate is not trusted by the FortiGate

Answer

The FortiGate is configured as a SAML IdP instead of SP

Question 16

A FortiGate is configured with OSPF over an IPsec VPN tunnel to exchange routes with a remote site. The OSPF neighbor states are stuck in 'INIT' and never progress to 'FULL'. What is the MOST likely cause?

Accepted Answer

OSPF authentication is not configured on both sides. OSPF over IPsec requires careful configuration. When OSPF authentication is enabled on one side but not the other, Hello packets are discarded, preventing neighbor state progression beyond INIT. The correct approach is to ensure authentication settings match on both ends. The other options are less likely: MTU issues typically cause packet fragmentation or loss but not specifically INIT state; phase 2 selectors must include multicast addresses, but that is less common for stuck-in-INIT; hello interval mismatch would cause a different state (typically EXSTART/EXCHANGE).

Answer

The MTU on the VPN interface is too high

Answer

The IPsec phase 2 proposal does not include the OSPF multicast IP address (224.0.0.5)

Answer

The OSPF hello interval is too short

Question 17

A FortiGate admin is configuring a multi-peer IPsec VPN where the remote site has two ISPs for redundancy. The admin wants to ensure that if the primary ISP fails, the VPN automatically fails over to the secondary ISP without manual intervention. Which feature should be enabled?

Accepted Answer

Dead Peer Detection (DPD) with retry and failover. DPD (Dead Peer Detection) with auto-negotiation allows the FortiGate to detect peer unreachability and automatically re-establish the tunnel using an alternate path if configured.

Answer

IPsec interface mode with DHCP

Answer

IKEv2 with mobility extension

Answer

Auto-negotiate phase 1 settings

Question 18

A FortiGate is configured as a SAML IdP for a partner's cloud application. After configuring the application as a service provider, users report that they are prompted for credentials every time they access the application, even though they already authenticated to FortiGate. What is the MOST likely cause?

Accepted Answer

The IdP session timeout is set to a lower value than the SP session timeout. When the IdP session timeout is shorter than the SP session timeout, the SP will consider the user's session expired and force re-authentication even though the FortiGate still has a valid local session. This mismatch causes the SP to initiate a new SAML authentication flow, prompting the user for credentials again. The SAML single logout URL (A) affects logout behavior, not re-authentication triggers, and an unsigned assertion (B) would cause a different error, not repeated credential prompts.

Answer

The SAML single logout URL is misconfigured

Answer

The SAML assertion is not signed

Answer

The FortiGate is not configured to generate a Name ID

Question 19

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Accepted Answer

Import the remote peer's certificate into the FortiGate's trusted CA list. Option B is correct because IKEv2 with PKI certificates requires the FortiGate to trust the CA that signed the remote peer's certificate; importing the remote peer's certificate (or its issuing CA) into the trusted CA store allows the FortiGate to validate the peer's identity during the IKEv2 authentication exchange. Option C is correct because the local certificate must be bound to the phase 1 interface (via the 'certificate' setting in the phase1 configuration) so the FortiGate can present it to the remote peer and complete mutual certificate authentication. Option A is not essential since AES-256-GCM is only one valid phase 1 encryption choice and the tunnel can establish with other supported algorithms as long as both peers match. Option D is not essential because DPD is a liveness detection feature that helps detect dead peers but is not required for the initial tunnel establishment. Option E is not essential because the phase 2 selector depends on the traffic to be tunneled and does not have to be 0.0.0.0/0 for the IKEv2 tunnel to come up.

Answer

Set the phase 1 proposal to use AES-256-GCM only

Answer

Enable DPD on the phase 1 interface

Answer

Configure the phase 2 selector to include all traffic (0.0.0.0/0)

Question 20

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Accepted Answer

The FortiGate must have a compatible NP7 or CP9 processor. Hardware acceleration of IPsec on a FortiGate requires the right silicon, so option A is correct: the unit must be equipped with a compatible NP7 network processor or CP9 crypto processor, since these are the ASICs that actually perform the offloaded cryptographic operations. Option B is also correct because the phase 2 proposal must negotiate algorithms the accelerator supports, such as AES-GCM (and typically SHA-256 for integrity), otherwise the traffic falls back to the CPU. Option D is correct because certain configurations, like IPsec interface mode combined with kernel-version-dependent features or other offload-disabling options, prevent the session from being handled by the NP/CP hardware. Option C is not a valid requirement because there is no 'set acceleration-mode ipsec' command under the VPN interface configuration; acceleration is enabled via NPU offload settings, not this syntax. Option E is not required because NAT in the firewall policy does not inherently disable IPsec hardware offload, so it is not a condition for acceleration to work.

Answer

The VPN interface must be configured with 'set acceleration-mode ipsec'

Answer

The firewall policy using the VPN interface must not have NAT enabled