ZTNA Basic Components: Rule and Application Gateway
A FortiGate admin wants to implement ZTNA to secure access to an internal application. Which TWO components are required for a basic ZTNA configuration?
Quick Answer
The answer is a ZTNA rule and a ZTNA application gateway. These two components form the core of a basic ZTNA configuration because the rule defines the access criteria—such as user identity and device posture—while the application gateway acts as a proxy that intercepts and forwards traffic to the internal application, ensuring no direct network-level access is granted. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how ZTNA shifts from IP-based to identity-based access, often appearing in scenario-based questions where you must distinguish between a standard firewall policy and a ZTNA rule. A common trap is confusing the application gateway with a VPN gateway; remember that ZTNA uses a proxy policy, not a tunnel. To recall the pair, think “Rule sets the who, Gateway handles the how.”
⚠ Common exam trap
It's easy for candidates to confuse ZTNA with traditional VPN solutions and incorrectly assume that an IPsec tunnel or a static route is required, when in fact ZTNA relies on application-layer gateways and policy rules without a full network tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A ZTNA rule (policy) that specifies access conditions
Option C is correct because a ZTNA rule (policy) is the enforcement point on the FortiGate that defines the access conditions—such as user/device identity, posture tags, and application—that must be met before traffic is allowed to the protected resource. Option D is correct because the ZTNA application gateway (configured as a ZTNA server with a virtual host, real server, and access proxy) is the component that publishes the internal application and brokers the client connection through the FortiGate. Options A, B, and E are not required for a basic ZTNA configuration: FortiClient EMS is only needed for advanced posture/tag-based checks, an IPsec VPN tunnel is a separate remote-access method rather than a ZTNA requirement, and a static route is ordinary routing that does not constitute a ZTNA component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A FortiClient EMS server
Why it's wrong here
A FortiClient EMS server manages endpoint compliance and telemetry for ZTNA posture checks, but it is not a mandatory component for a basic ZTNA configuration; the fundamental requirement is a FortiGate with a ZTNA access proxy and a ZTNA rule that verifies device identity via certificate or token. This option is tempting because FortiClient EMS is essential for advanced ZTNA features like real-time posture assessment and automated policy enforcement in a full endpoint-control deployment, where it would be the correct choice alongside the FortiGate.
- ✗
An IPsec VPN tunnel to the client
Why it's wrong here
ZTNA uses per-session, identity-based tunnels established by the FortiClient with EMS, not a site-to-site or dial-up IPsec tunnel. It is tempting because IPsec does encrypt remote access, and would be correct for traditional remote-access VPN where network-level reachability, not application-level brokering, is the goal.
- ✓
A ZTNA rule (policy) that specifies access conditions
Why this is correct
The ZTNA rule defines the access conditions — source, user or device posture, and protected application — that the FortiGate evaluates before granting access. Without this policy, no enforcement decision occurs, so it is essential alongside the application gateway.
- ✓
A ZTNA application gateway
Why this is correct
The ZTNA application gateway is the enforcement point that proxies access to the protected internal application, validating device and user context. It pairs with the ZTNA rule, which supplies the access conditions the gateway enforces.
- ✗
A static route to the application server
Why it's wrong here
ZTNA brokers access through the FortiGate proxy and access proxy policies; a static route to the application server provides reachability but no identity verification or per-application authorisation. It is tempting because routing is genuinely needed for the FortiGate to reach the server, but it is not one of the two required ZTNA components.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)
easy- A.IPsec VPN tunnel
- ✓ B.ZTNA proxy (application gateway)
- C.Captive portal
- ✓ D.ZTNA rule (policy) on the FortiGate
- ✓ E.Access proxy (or application) configuration
Why B: The ZTNA proxy (application gateway) is the core component that terminates client connections and forwards them to internal applications after verifying device and user identity. It acts as a reverse proxy, enforcing access policies before allowing any traffic to reach the protected resource. Without this gateway, the FortiGate cannot mediate ZTNA connections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.