Quick Answer

The answer is a firewall policy with ZTNA tags matching. This is correct because ZTNA on FortiGate requires two core components working together: an access proxy rule that publishes the internal application, and a firewall policy that references both the access proxy and ZTNA tags to enforce granular access decisions based on user identity and device posture, such as a valid certificate and compliant antivirus. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of how ZTNA replaces legacy VPNs by shifting from network-level to identity- and posture-based access control. A common trap is selecting only the access proxy rule, forgetting that the firewall policy with ZTNA tags is what actually enforces the conditional access. Remember the pairing: the access proxy publishes the app, but the firewall policy with ZTNA tags is the gatekeeper that checks the certificate and antivirus compliance.