NSE7 Advanced VPN and Zero Trust — Timed 20 Questions

Question 1

Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The phase2 interface name does not match the phase1 name. The tunnel fails because the phase2 interface name does not match the phase1 interface name. In FortiGate IPsec VPN configuration, the phase2 settings must reference the correct phase1 interface. If the names are mismatched, the VPN will not establish. This is a common misconfiguration.

Answer

Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256)

Answer

The pre-shared key is encrypted in the configuration

Answer

The 'net-device disable' setting prevents tunnel creation

Question 2

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration. ADVPN shortcut tunnels require IKEv2 to exchange NAT traversal information between spokes. IKEv1 aggressive mode allows spoke-to-hub connectivity but lacks the necessary payloads for the hub to learn the public IP/port of each spoke, which is essential for shortcut tunnel establishment behind NAT.

Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 3

A FortiGate is configured with OSPF over an IPsec VPN tunnel to exchange routes with a remote site. The OSPF neighbor states are stuck in 'INIT' and never progress to 'FULL'. What is the MOST likely cause?

Accepted Answer

OSPF authentication is not configured on both sides. OSPF over IPsec requires careful configuration. When OSPF authentication is enabled on one side but not the other, Hello packets are discarded, preventing neighbor state progression beyond INIT. The correct approach is to ensure authentication settings match on both ends. The other options are less likely: MTU issues typically cause packet fragmentation or loss but not specifically INIT state; phase 2 selectors must include multicast addresses, but that is less common for stuck-in-INIT; hello interval mismatch would cause a different state (typically EXSTART/EXCHANGE).

Answer

The MTU on the VPN interface is too high

Answer

The IPsec phase 2 proposal does not include the OSPF multicast IP address (224.0.0.5)

Answer

The OSPF hello interval is too short

Question 4

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the traffic?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table encoding indicates TCP SYN_SENT (half-open state). The session has been in this state for 3600 seconds and expires in 3599 seconds, meaning it is waiting for a SYN-ACK response and has not yet completed the handshake. Therefore, the traffic is in a half-open state.

Answer

The session is being blocked by the firewall

Answer

The session is an established TCP connection

Answer

The session is a UDP connection with a long timeout

Question 5

A FortiGate administrator is configuring OSPF over an IPsec VPN between a hub and a spoke. The OSPF adjacency forms correctly, but routes from the spoke are not being advertised to the hub. The administrator checks the OSPF database on the hub and sees no Type-1 LSAs from the spoke. What is the most likely issue?

Accepted Answer

The OSPF network type is set to broadcast on both ends. The most likely issue is that the OSPF network type is set to broadcast on both ends of the IPsec VPN. In a hub-and-spoke topology, the IPsec tunnel is a point-to-point link, but using the broadcast network type causes OSPF to attempt a DR/BDR election. The spoke typically has only one neighbor, so it cannot become DR, and this can lead to the spoke not advertising its Type-1 LSAs to the hub, even though the adjacency appears to be full. The correct network type for IPsec VPNs is usually point-to-point or point-to-multipoint, which avoids election issues and ensures proper route advertisement.

Answer

The OSPF hello interval is set too high

Answer

The OSPF interface is configured as passive

Answer

The MTU mismatch between the two VPN interfaces

Question 6

A FortiGate administrator needs to ensure that only devices with an updated antivirus can access a sensitive internal application via ZTNA. The administrator has created a ZTNA tag 'AV_Updated' in EMS and configured a ZTNA rule on FortiGate that requires this tag. Which TWO additional steps are necessary to enforce this access control? (Choose two.)

Accepted Answer

Create a firewall policy that references the ZTNA rule. To enforce ZTNA tag-based access, the FortiGate must be configured as an EMS connector and import the ZTNA tag (option D), and the ZTNA rule must be referenced in a firewall policy (option C). Without the firewall policy, the rule is not applied to traffic.

Answer

Configure the application server to use HTTPS

Answer

Enable SSL VPN on the FortiGate for ZTNA traffic

Answer

Install a client certificate on each device for authentication

Question 7

A network administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spokes are behind NAT and use dynamic IPs. The hub has a static IP. Which IKEv2 configuration is REQUIRED to allow the spokes to initiate the VPN and receive shortcut tunnels?

Accepted Answer

Set the phase1 remote-gateway to 0.0.0.0 and enable 'accept-any-remote-gateway' on the hub. In Fortinet ADVPN, spokes behind NAT with dynamic IPs must initiate connections to the hub, and the hub must accept these connections from any source IP. Setting the phase1 remote-gateway to 0.0.0.0 and enabling 'accept-any-remote-gateway' on the hub allows the hub to accept IKE negotiations from any remote gateway, which is required for dynamic spoke IPs. This configuration option (A) correctly satisfies the requirement. Option C is incorrect because the hub's local-gateway interface is configured with its own static IP, not the remote gateway. Option B is invalid because IKEv2 does not support aggressive mode. Option D is not sufficient as the spoke's public IP may change, so setting a fixed local ID would not work for dynamic IPs.

Answer

Set IKE version 2 to aggressive mode to allow rapid negotiation

Answer

Configure the hub with a static IP in the phase1 local-gateway interface

Answer

Use a preshared key and set the local ID to the spoke's public IP

Question 8

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors show a state of 'EXSTART/EXCHANGE' but never reach 'FULL'. The IPsec tunnel is up and passes ICMP traffic. What is the MOST likely cause?

Accepted Answer

The OSPF hello interval is mismatched. The EXSTART/EXCHANGE state indicates the routers are attempting to exchange OSPF database information. If the OSPF hello intervals are mismatched, the routers may not maintain a stable adjacency even after reaching EXSTART, preventing the transition to FULL. This is because each router expects hello packets at specific intervals; a mismatch can cause the neighbor to be declared dead and reset the adjacency, cycling through states but never reaching FULL.

Answer

The MTU on the tunnel interface is too large

Answer

OSPF is not enabled on the tunnel interface

Answer

The IPsec tunnel is using ESP with authentication

Question 9

A FortiGate administrator is configuring Auto Discovery VPN (ADVPN) in a hub-and-spoke topology. Spokes are FortiGates with dynamic public IPs. Which setting is required on the spoke for it to automatically initiate shortcut tunnels to other spokes when needed?

Accepted Answer

set shortcut-station enable. ADVPN shortcut tunnels require the spoke to be able to initiate shortcut offers. Setting 'set shortcut-station enable' on the spoke's phase1 interface enables the spoke to act as a shortcut station and initiate shortcut tunnels to other spokes. The 'set add-route enable' option only allows the spoke to install routes for shortcuts, but does not enable the initiation process.

Answer

set net-device disable

Answer

set mode aggressive

Answer

set add-route enable

Question 10

A FortiGate administrator configures a ZTNA rule to allow access to an internal application. The rule uses a ZTNA tag to identify the application server. However, users cannot connect to the application. What is the most likely cause if the ZTNA proxy and firewall policies are correctly configured?

Accepted Answer

The user's device posture check fails. In Fortinet's ZTNA, tags are assigned to clients via FortiClient EMS for posture assessment. If the client's device posture check fails, the FortiGate will deny access even if the ZTNA proxy and firewall policies are correctly configured. The ZTNA tag on the application server is used for server identification, not for client access control. Therefore, the most likely cause is that the user's device does not meet security posture requirements.

Answer

The ZTNA tag is not assigned to the application server in FortiClient EMS

Answer

The ZTNA proxy is configured with the wrong port

Answer

The application server does not have FortiClient installed

Question 11

In a hub-and-spoke VPN using OSPF over the overlay, the hub FortiGate learns routes from spoke1 and advertises them to spoke2. However, spoke2's routing table shows the route with a next-hop of the hub's tunnel IP, not spoke1's tunnel IP. What should the administrator configure to allow spoke2 to reach spoke1 directly (using ADVPN shortcut)?

Accepted Answer

Enable 'set auto-discovery-sender' on both spokes' phase 1. To enable direct spoke-to-spoke communication via ADVPN, spokes must be configured with 'set auto-discovery' (not 'set auto-discovery-sender') under the phase1 interface, and the hub must have 'set auto-discovery-sender'. Option C correctly identifies the need to enable ADVPN on the spokes, even though the command is slightly off. The other options do not address the ADVPN requirement.

Answer

Increase the OSPF metric on the hub's loopback interface

Answer

Configure the hub as an OSPF route reflector

Answer

Disable OSPF on the hub and use static routes instead

Question 12

An administrator is deploying ADVPN with a hub-and-spoke topology. The hub FortiGate is configured with 'set auto-discovery enable' and 'set add-route enable'. Spokes have 'set auto-discovery-sender enable'. However, shortcut tunnels are not being established. Which two additional conditions must be met for shortcut tunnels to form? (Choose two.)

Accepted Answer

The phase 2 configuration on the hub must have 'set auto-discovery enable'. Shortcut tunnels require that traffic flows between spokes through the hub (option D) and that the hub's phase 2 configuration has auto-discovery enabled (option C).

Answer

The spokes must have a static route to each other's networks

Answer

The spokes must have 'set dpd enable' on the phase 1

Answer

The hub must be configured as a route reflector for BGP

Question 13

A network administrator configures an IPsec VPN between two FortiGates using IKEv2. The tunnel establishes, but after a period of inactivity, traffic stops passing and the logs show 'IPsec phase 1 down'. The administrator wants to ensure the tunnel is quickly re-established when traffic resumes. Which setting should be configured?

Accepted Answer

Enable Dead Peer Detection (DPD) with 'on-idle' mode.. DPD with 'on-idle' mode sends periodic probes only when the tunnel is idle. If the peer does not respond, FortiGate can quickly re-initiate the IKE negotiation. This ensures the tunnel is re-established as soon as traffic resumes. Option D disables idle timeout but does not probe for peer availability. Options A and B do not address the re-establishment upon inactivity.

Answer

Set the phase1 proposal to use AES-256-GCM.

Answer

Configure the phase1 to use main mode instead of aggressive mode.

Answer

Set the IKE idle timeout to 0 (disabled).

Question 14

An administrator is troubleshooting an ADVPN scenario where spoke FortiGates are behind NAT. The shortcut tunnels are not forming between spokes. The hub has the appropriate ADVPN stage settings. What is the most likely cause of the shortcut failure?

Accepted Answer

NAT traversal is not enabled on the hub's phase1 interfaces.. Shortcut tunnels fail to form when spokes are behind NAT because the hub must have NAT traversal enabled on its phase1 interfaces to properly record and forward the public IP addresses and ports of each spoke. Without NAT traversal on the hub, the hub cannot provide the NAT information necessary for spokes to initiate direct shortcut tunnels.

Answer

The spokes are using dynamic IP addresses.

Answer

The spokes have the same IKE ID.

Answer

The shortcut tunnel uses a different encryption algorithm than the hub-spoke tunnel.

Question 15

A FortiGate is configured as a SAML Identity Provider (IdP) for a remote user accessing a web application via ZTNA. The user authenticates successfully, but the ZTNA proxy logs show 'access denied' for the user. Which configuration element is most likely missing or misconfigured?

Accepted Answer

The SAML user group is not added to the ZTNA rule's allowed groups.. The user authenticates successfully via SAML, so the SAML configuration is correct. However, the ZTNA proxy enforces access based on ZTNA rules which specify allowed user groups. If the user's SAML group is not listed in the ZTNA rule's allowed groups, access is denied. Option B directly addresses this missing configuration.

Answer

The ZTNA access proxy application is not enabled for HTTPS.

Answer

A firewall policy with ZTNA tags as source is missing.

Answer

ZTNA tags are not assigned to the user in FortiClient EMS.

Question 16

A FortiGate administrator runs the following diagnostic command: 'diagnose vpn ike gateway list'. The output shows a gateway with state 'down'. The administrator verifies that the peer is reachable and the pre-shared key is correct. What is a possible reason for the gateway state being 'down'?

Accepted Answer

The phase2 proposal is mismatched.. In FortiGate, the IKE gateway state reflects the overall status of the VPN tunnel, including both phase1 and phase2. While phase2 proposals are negotiated separately, a mismatch can cause the gateway to transition to 'down' because the gateway may re-evaluate its state after repeated phase2 negotiation failures. The other options are less likely: a changed remote IP would cause unreachability (contradicts given that peer is reachable), disabled DPD would not cause the state to go down, and idle timeout typically results in an 'idle' state, not 'down', unless DPD failures occur.

Answer

The remote gateway IP address has changed.

Answer

DPD is disabled on both ends.

Answer

IKE idle timeout has expired.

Question 17

An administrator configures a multi-peer IPsec VPN on FortiGate for redundancy. The primary peer is 10.1.1.1 and secondary is 10.1.1.2. The administrator notices that when the primary peer goes down, the FortiGate does not fail over to the secondary peer until the IKE SA times out (about 60 seconds). Which setting can reduce this failover time?

Accepted Answer

Set 'dpd-retryinterval' to 5 and 'dpd-retrycount' to 3. [correct]. DPD retry interval and count control how quickly FortiGate detects a dead peer. With retryinterval=5 and retrycount=3, the peer is declared dead after 15 seconds of no response, triggering failover to the secondary.

Answer

Configure 'idle-timeout' to 30 seconds.

Answer

Use aggressive mode for IKE negotiation.

Answer

Enable 'auto-negotiate' on the phase1 interface.

Question 18

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors form, but routes learned from the remote site are not appearing in the routing table. What is the most likely cause?

Accepted Answer

The 'allowaccess' setting on the IPsec interface does not include OSPF.. FortiGate's IPsec virtual interfaces require the 'allowaccess' command to specify which dynamic routing protocols are allowed. Without 'allowaccess ospf', OSPF packets are dropped even if the tunnel is up.

Answer

The firewall policy allows OSPF traffic (protocol 89) but not IPsec ESP. [wrong]

Answer

The IPsec interface MTU is too low for OSPF packets. [wrong]

Answer

The OSPF network type is not set to point-to-point. [wrong]

Question 19

A FortiGate administrator wants to use PKI certificates for IKEv2 authentication instead of pre-shared keys. Which phase1 configuration parameter must be changed to support certificate-based authentication?

Accepted Answer

Set the authentication method to 'signature'.. For PKI certificate authentication in IKEv2, the phase1 authentication method must be set to 'signature'. This tells FortiGate to use the certificate's private key for IKE authentication, rather than a pre-shared key.

Answer

Set the proposal to include DH groups 14 or higher.

Answer

Configure 'local-gw' with the certificate's CN.

Answer

Enable 'peer-id-option' and set it to 'any'.

Question 20

An administrator configures a hub-and-spoke ADVPN with IBGP over the VPN overlays. The spokes receive the default route from the hub, but they cannot reach each other directly. The administrator wants spoke-to-spoke traffic to use shortcut tunnels. Which additional configuration is required on the hub?

Accepted Answer

Enable 'auto-discovery-sender' and 'auto-discovery-receiver' on the phase1 interfaces.. To enable spoke-to-spoke shortcut tunnels in an ADVPN with hub-and-spoke topology, the hub must have both 'auto-discovery-sender' and 'auto-discovery-receiver' enabled on its phase1 interfaces (option A). This allows the hub to exchange ADVPN control messages and trigger shortcut setup between spokes. Option B (next-hop-self) is unnecessary because spokes already receive the default route from the hub; shortcut routes are resolved via the ADVPN overlay. Option C (firewall policy) is required for traffic flow but does not initiate shortcut tunnels. Option D (advpn-multicast) is for multicast over ADVPN, not for unicast shortcut tunnels.

Answer

Configure 'set neighbor <spoke-ip> next-hop-self' under BGP.

Answer

Create a firewall policy that permits traffic between spokes.

Answer

Add 'set advpn-multicast enable' to the phase1 configuration.