NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator is configuring a route-based IPsec VPN to a cloud provider. The provider requires that only traffic for the 10.20.0.0/16 network be sent through the tunnel, and that the FortiGate present a specific local subnet of 192.168.10.0/24 as its source. The administrator wants to avoid policy-based VPN configuration. Which configuration approach correctly defines the traffic selectors for this route-based tunnel?
⚠ Common exam trap
The trap here is assuming that route-based tunnels ignore traffic selectors, when phase 2 proxy IDs are still negotiated and must match what the remote gateway expects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure phase 2 selectors with local address 192.168.10.0/24 and remote address 10.20.0.0/16, and add a static route for 10.20.0.0/16 pointing to the tunnel interface.
Route-based IPsec uses phase 2 selectors as proxy IDs and relies on routing to steer traffic into the tunnel interface. Configuring the local selector as 192.168.10.0/24 and the remote as 10.20.0.0/16 satisfies the provider, and a static route for 10.20.0.0/16 to the tunnel interface ensures only the intended destination is sent through the VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure phase 2 selectors with local address 192.168.10.0/24 and remote address 10.20.0.0/16, and add a static route for 10.20.0.0/16 pointing to the tunnel interface.
Why this is correct
For a route-based IPsec tunnel, the phase 2 selectors define the proxy IDs exchanged with the peer, while a static route directs matching traffic into the tunnel interface. Setting the local selector to 192.168.10.0/24 and the remote to 10.20.0.0/16 matches the cloud provider's requirement, and the route ensures only that destination is sent through the tunnel.
- ✗
Create a policy-based IPsec VPN with firewall policies referencing the tunnel and define the source and destination addresses in those policies.
Why it's wrong here
The administrator explicitly wants to avoid policy-based VPN configuration. Policy-based tunnels derive selectors from firewall policies rather than from a tunnel interface, which conflicts with the stated design goal. Although it could technically pass the required subnets, it does not follow the route-based approach requested and complicates routing and troubleshooting.
- ✗
Configure phase 2 selectors as 0.0.0.0/0 to 0.0.0.0/0 and rely on firewall policies to restrict traffic to the required subnets.
Why it's wrong here
Wildcard selectors are convenient but some cloud providers reject them or require explicit proxy IDs for the tunnel to come up. Even if the tunnel establishes, the provider expects specific selectors, so this configuration would likely fail negotiation or produce a mismatch. Firewall policies control permitted traffic but do not change the traffic selectors presented to the remote gateway.
- ✗
Set the tunnel interface IP to 192.168.10.1/24 and configure a route for 0.0.0.0/0 through the tunnel, allowing the provider to filter traffic.
Why it's wrong here
Assigning the local subnet to the tunnel interface and routing all traffic into it would send far more than the required 10.20.0.0/16 through the tunnel and does not define the proxy IDs the provider expects. This would likely break internet access and fail the provider's selector requirements. Traffic selectors belong in phase 2, not in interface addressing.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.