What Are the Essential Components for ZTNA on FortiGate?
An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?
Quick Answer
The answer is a ZTNA rule that verifies endpoint identity and posture, combined with a proxy-based ZTNA policy that inspects traffic. These two components are essential because ZTNA on FortiGate operates on a zero-trust model: the rule enforces access conditions by checking endpoint tags and compliance, while the proxy policy ensures deep traffic inspection rather than simple allow/deny. On the Fortinet NSE 4 Network Security Professional exam, this distinction often appears as a trap—candidates mistakenly choose a traditional firewall policy or an IPsec VPN tunnel, but ZTNA requires the proxy-based architecture to validate device posture before granting access. The exam tests your understanding that ZTNA is not just about network segmentation but about identity-driven, context-aware access control. A helpful memory tip: “Rule for posture, policy for proxy”—the rule checks who and what the endpoint is, and the proxy policy handles how traffic is inspected.
⚠ Common exam trap
Many exam-takers confuse ZTNA's proxy-based architecture with VPN-based access, leading candidates to incorrectly select IPsec or policy-based tunnel options, when ZTNA actually requires a proxy firewall policy and a separate ZTNA rule for endpoint verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A proxy-based firewall policy
ZTNA on FortiGate requires a proxy-based firewall policy to intercept and inspect application-layer traffic. This policy type enables the FortiGate to act as a reverse proxy, terminating TLS connections and enforcing access control based on user identity and device posture before forwarding traffic to the internal application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A firewall policy using IPsec VPN
Why it's wrong here
ZTNA does not require IPsec.
- ✗
A FortiGate in transparent mode
Why it's wrong here
ZTNA can work in NAT/route mode; transparent mode is not required.
- ✗
A policy-based IPsec tunnel
Why it's wrong here
Not required for ZTNA.
- ✓
A proxy-based firewall policy
Why this is correct
ZTNA uses proxy-based inspection to apply access rules.
- ✓
A ZTNA rule that verifies endpoint identity and posture
Why this is correct
ZTNA rules define access based on identity and posture.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?
medium- A.FortiManager
- B.FortiToken
- ✓ C.FortiClient
- D.FortiAnalyzer
Why C: FortiClient is the required endpoint component for ZTNA because it acts as the ZTNA agent on the client device, establishing a secure tunnel (via IPSec or SSL VPN) to the FortiGate and enforcing posture checks (e.g., OS version, antivirus status) before granting access. Without FortiClient, the FortiGate cannot verify the device's trust level or enforce ZTNA access policies at the endpoint.
Variation 2. What is the purpose of a ZTNA (Zero Trust Network Access) tag on a FortiGate?
easy- A.To enable SNMP monitoring on the device
- B.To assign static IP addresses to clients
- ✓ C.To mark devices or users with attributes used in security policies
- D.To tag firewall policies for logging purposes
Why C: ZTNA tags are user- or device-specific attributes (e.g., 'OS=Windows', 'Compliant=true') that FortiGate applies to endpoints after posture assessment. These tags can then be referenced in firewall policies to enforce granular, identity-aware access control, which is the core of Zero Trust Network Access.
Variation 3. In Fortinet ZTNA, what is the primary purpose of the ZTNA access proxy component?
easy- A.To act as a forward proxy for web traffic
- B.To provide load balancing for multiple FortiGates
- ✓ C.To proxy connections to internal applications after authentication and device verification
- D.To terminate IPsec VPN tunnels
Why C: The ZTNA access proxy is the core component that mediates user access to internal applications. It intercepts client requests, enforces authentication and device posture checks (via FortiClient telemetry), and then proxies the connection to the protected application. This ensures no direct network access is granted; all traffic must pass through the proxy, which validates trust before forwarding.
Variation 4. An organization wants to implement ZTNA (Zero Trust Network Access) on their FortiGate. Which TWO components are essential for ZTNA? (Select two.)
easy- ✓ A.Client certificates for device posture verification
- ✓ B.Identity Provider (IdP) for user authentication
- C.A dedicated VPN tunnel
- D.A static IP address for the client
- E.A RADIUS server for two-factor authentication
Why A: Client certificates are essential for ZTNA because they enable device posture verification, ensuring that only trusted and compliant devices can access protected resources. FortiGate uses client certificates to validate the device's identity and health status before granting access, which is a core principle of Zero Trust.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.