NSE4 High Availability and Diagnostics Practice Question
A FortiGate administrator wants to configure ZTNA to secure access to an internal application. Which of the following components is essential for ZTNA to function?
⚠ Common exam trap
NSE4 often tests the misconception that ZTNA requires a VPN or FortiCloud, when the essential component is FortiClient EMS for endpoint management and compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiClient EMS
FortiClient EMS (Enterprise Management Server) is essential for ZTNA because it manages endpoints, enforces compliance, and provides the client certificate and posture information required for zero-trust access decisions. Without FortiClient EMS, the FortiGate cannot verify device identity and health.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FortiCloud
Why it's wrong here
FortiCloud is Fortinet's cloud-based management and monitoring platform, primarily for centralized administration and device lifecycle management. It does not participate in the real-time identity and device posture assessment that ZTNA requires, nor does it supply user/device identity attributes to FortiGate. Without FortiClient EMS, an administrator cannot enforce ZTNA policies because FortiCloud provides no endpoint compliance or identity data.
- ✓
FortiClient EMS
Why this is correct
FortiClient EMS is the cornerstone of Fortinet's ZTNA solution because it collects and reports user identity, endpoint inventory, and device compliance posture to FortiGate. FortiGate then uses this telemetry and EMS tags to make per-session, application-aware access decisions based on the endpoint's trust level. This identity and posture verification is what ZTNA needs to ensure that only authorized users on healthy devices can reach internal applications.
- ✗
FortiAnalyzer
Why it's wrong here
FortiAnalyzer is a central log management and data analytics platform that aggregates logs from FortiGate and other Fortinet products for security event visibility and compliance reporting. It is entirely passive; it does not provide identity, device posture, or endpoint compliance data to FortiGate during an access request. Consequently, while it can enhance monitoring of ZTNA traffic, it is not a necessary component for the ZTNA protocol itself to function.
- ✗
A VPN tunnel to the client
Why it's wrong here
A traditional VPN creates a full-network encrypted tunnel, giving the remote device broad access to the entire corporate subnet rather than limiting access to specific applications. ZTNA, by contrast, uses TLS-based access where FortiGate validates each user/device against FortiClient EMS and enforces least-privilege access to individual applications without placing the device on the internal network. A VPN tunnel is therefore an optional connectivity mechanism and not a prerequisite for ZTNA; ZTNA can operate entirely over HTTPS without any VPN.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator wants to configure Zero Trust Network Access (ZTNA) to secure access to an internal application. What is required on the FortiGate?
medium- A.A FortiClient EMS subscription
- B.A VPN tunnel to the application
- ✓ C.A ZTNA server and a ZTNA rule
- D.A firewall policy with SSL inspection enabled
Why C: FortiGate ZTNA requires configuring a ZTNA server (which defines the protected application, its real server, and the access proxy/certificate) and a ZTNA rule (which binds the server to users/groups and enforcement). Together they let the FortiGate act as an access proxy that authenticates users and brokers connections to the internal app without a full VPN tunnel.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.