NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator configures a ZTNA access proxy rule to allow access to an internal application only if the user's device has the tag 'Compliant'. The tag is assigned by FortiClient EMS. However, a user with a compliant device is still blocked. The admin sees in the ZTNA logs that the tag is not being received. What should the administrator check FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the EMS connector is configured under Security Fabric > External Connectors
For ZTNA tags to be sent to FortiGate, the FortiClient must be registered with EMS and the EMS must be configured as an endpoint control connector on FortiGate. If the connector is missing or misconfigured, FortiGate cannot retrieve tags.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the FortiClient is connected to the internet
Why it's wrong here
While internet is needed for EMS communication, the immediate issue is FortiGate receiving tags; internet connectivity is a lower-level check.
- ✗
Confirm that the ZTNA rule is enabled and using the correct port
Why it's wrong here
Rule configuration is important but if tags are not received, the rule will not match even if enabled.
- ✗
Check if the application server is reachable from the FortiGate
Why it's wrong here
Server reachability is a separate issue; the tag not being received is the immediate problem.
- ✓
Ensure the EMS connector is configured under Security Fabric > External Connectors
Why this is correct
The Endpoint Control connector to EMS must be configured and authorized. Without this, FortiGate cannot receive any tags from EMS.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.