NSE4 Authentication and VPN Practice Question
An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?
⚠ Common exam trap
Many exam-takers confuse FortiClient with FortiToken, assuming that MFA alone is sufficient for ZTNA, but ZTNA requires endpoint posture enforcement via FortiClient, not just authentication factors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiClient
FortiClient is the required endpoint component for ZTNA because it acts as the ZTNA agent on the client device, establishing a secure tunnel (via IPSec or SSL VPN) to the FortiGate and enforcing posture checks (e.g., OS version, antivirus status) before granting access. Without FortiClient, the FortiGate cannot verify the device's trust level or enforce ZTNA access policies at the endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FortiManager
Why it's wrong here
FortiManager is a centralized management platform for FortiGate devices, responsible for policy provisioning, firmware upgrades, and scale-out orchestration. It does not reside on end-user devices and cannot enforce ZTNA posture checks; instead, it administratively manages the FortiGate enforcement points that receive policies. While FortiManager may push ZTNA policy objects to FortiGates, it is not the client-side component that verifies device compliance or controls user-to-application access. Therefore, its role is management-plane, not endpoint enforcement.
- ✗
FortiToken
Why it's wrong here
FortiToken is a hardware or software OTP generator that provides two-factor authentication by requiring a one-time passcode at login. ZTNA demands continuous verification of both user identity and endpoint posture, but FortiToken only addresses the authentication factor once, without checking the device's compliance state (e.g., antivirus status, OS patches, disk encryption). It cannot enforce application-level access policies based on real-time device health, and it does not establish the secure session between the endpoint and the application. Thus, FortiToken is an auxiliary identity factor, not the endpoint enforcement agent.
- ✓
FortiClient
Why this is correct
FortiClient is the endpoint agent that performs the critical ZTNA posture assessment, checking for compliance criteria such as updated antivirus definitions, disk encryption, and approved software versions. It communicates this telemetry to a FortiGate or FortiEMS, which then issues a short-lived token only if the endpoint is compliant and the user identity is verified. When the user attempts to access a ZTNA-protected application, FortiClient presents that token, enabling the FortiGate to enforce granular access and maintain a secure connection. This makes FortiClient the mandatory client-side enforcement component that embodies ZTNA's continuous trust verification.
- ✗
FortiAnalyzer
Why it's wrong here
FortiAnalyzer is a log aggregation and reporting appliance that collects events from FortiGate, FortiClient, and other Fortinet products, providing security analytics and centralized visibility. It is a back-end system for post-hoc analysis and compliance reporting, not a client-side mechanism that participates in real-time access decisions. During a ZTNA request, FortiAnalyzer does not evaluate endpoint posture or issue access tokens; it only receives logs from the actual enforcement points. Therefore, its role is purely observational, not enforcement.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.