NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator is configuring a ZTNA rule to allow access to an internal web application only for users who authenticate with multi-factor authentication (MFA). The administrator has configured the ZTNA rule to require the 'MFA' tag from FortiClient EMS. However, users who have MFA enabled are still being denied access. What is the most likely reason?
⚠ Common exam trap
The trap here is assuming that MFA configuration on the endpoint automatically grants the tag, without verifying that the tag is synchronized to the FortiGate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'MFA' tag is not being synchronized from FortiClient EMS to the FortiGate.
ZTNA rules enforce access based on tags from FortiClient EMS. If the 'MFA' tag is not synchronized to the FortiGate, the rule cannot verify that the user has MFA, resulting in denial. The administrator must ensure the EMS connector is working and the tag is correctly assigned. Other options would produce different symptoms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The users are not using the correct SSL VPN client to connect.
Why it's wrong here
ZTNA does not require a specific SSL VPN client; it typically uses a web browser or the FortiClient with ZTNA features. The issue is not about the client but about the tag synchronization. If the client were incorrect, users would not be able to connect at all, or they would receive a different error. The symptom of being denied due to MFA tag suggests a tag issue, not a client issue.
- ✗
The ZTNA rule is not applied to the correct user group.
Why it's wrong here
If the rule were applied to the wrong user group, users in the correct group would not be affected, but the error would likely indicate a group mismatch, not an MFA tag issue. The scenario states that users with MFA are denied, implying the rule is applied to them but the MFA tag is not recognized. Therefore, the group configuration is less likely to be the cause.
- ✗
The ZTNA rule is configured to use the wrong authentication scheme.
Why it's wrong here
The authentication scheme for ZTNA is typically handled by the FortiGate's user authentication, not by the ZTNA rule itself. The ZTNA rule enforces access based on tags and policies. If the authentication scheme were wrong, users would not be able to authenticate at all, resulting in a different error. The issue is more likely related to the MFA tag not being correctly assigned or synchronized.
- ✓
The 'MFA' tag is not being synchronized from FortiClient EMS to the FortiGate.
Why this is correct
ZTNA relies on tags from FortiClient EMS to enforce compliance. If the 'MFA' tag is not synchronized, the FortiGate will not see that the user has MFA enabled, and the ZTNA rule will deny access. The administrator should verify that the EMS connector is properly configured and that the tag is being synchronized. This is a common issue when the EMS integration is not fully functional or when the tag is not correctly assigned in EMS.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.