ZTNA Basic Components: Rule and Application Gateway
A FortiGate admin wants to implement ZTNA to secure access to an internal application. Which TWO components are required for a basic ZTNA configuration?
Quick Answer
The answer is a ZTNA rule and a ZTNA application gateway. These two components form the core of a basic ZTNA configuration because the rule defines the access criteria—such as user identity and device posture—while the application gateway acts as a proxy that intercepts and forwards traffic to the internal application, ensuring no direct network-level access is granted. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how ZTNA shifts from IP-based to identity-based access, often appearing in scenario-based questions where you must distinguish between a standard firewall policy and a ZTNA rule. A common trap is confusing the application gateway with a VPN gateway; remember that ZTNA uses a proxy policy, not a tunnel. To recall the pair, think “Rule sets the who, Gateway handles the how.”
⚠ Common exam trap
It's easy for candidates to confuse ZTNA with traditional VPN solutions and incorrectly assume that an IPsec tunnel or a static route is required, when in fact ZTNA relies on application-layer gateways and policy rules without a full network tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A ZTNA rule (policy) that specifies access conditions
A ZTNA rule (policy) is essential to define the access conditions, such as user identity, device posture, and source IP, that must be met before granting access to the internal application. This policy enforces the zero-trust principle of 'never trust, always verify' by evaluating these conditions in real time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A FortiClient EMS server
Why it's wrong here
A FortiClient EMS server manages endpoint compliance and telemetry for ZTNA posture checks, but it is not a mandatory component for a basic ZTNA configuration; the fundamental requirement is a FortiGate with a ZTNA access proxy and a ZTNA rule that verifies device identity via certificate or token. This option is tempting because FortiClient EMS is essential for advanced ZTNA features like real-time posture assessment and automated policy enforcement in a full endpoint-control deployment, where it would be the correct choice alongside the FortiGate.
- ✗
An IPsec VPN tunnel to the client
Why it's wrong here
ZTNA does not require IPsec VPN.
- ✓
A ZTNA rule (policy) that specifies access conditions
Why this is correct
The rule defines who can access the application.
- ✓
A ZTNA application gateway
Why this is correct
The gateway handles the ZTNA connections.
- ✗
A static route to the application server
Why it's wrong here
Routing is typically already in place.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)
easy- A.IPsec VPN tunnel
- ✓ B.ZTNA proxy (application gateway)
- C.Captive portal
- ✓ D.ZTNA rule (policy) on the FortiGate
- ✓ E.Access proxy (or application) configuration
Why B: The ZTNA proxy (application gateway) is the core component that terminates client connections and forwards them to internal applications after verifying device and user identity. It acts as a reverse proxy, enforcing access policies before allowing any traffic to reach the protected resource. Without this gateway, the FortiGate cannot mediate ZTNA connections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.