NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator is setting up a ZTNA rule to allow access to an internal application only for users who are members of the 'Finance' group in FortiClient EMS. The administrator has already configured the ZTNA server and access proxy. Which additional configuration is required on the FortiGate to enforce this group membership?
⚠ Common exam trap
A common mix-up: candidates confuse EMS tags with user groups; tags are for endpoint compliance, while user groups are for identity-based access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a user group on the FortiGate that maps to the Finance group in EMS and reference it in the ZTNA rule.
To enforce EMS group membership, the FortiGate must have a user group that is synchronized with the EMS Finance group. This is done by creating a user group with the EMS connector as the source and specifying the Finance group. The ZTNA rule then uses this user group as a source condition. This ensures that only users belonging to the Finance group in EMS are granted access, without manual user management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a user group on the FortiGate that maps to the Finance group in EMS and reference it in the ZTNA rule.
Why this is correct
To enforce EMS group membership, the FortiGate must have a user group that corresponds to the Finance group in EMS. This is typically done by creating a user group and selecting the EMS connector as the source, then specifying the Finance group. The ZTNA rule then references this user group as a source condition. This ensures that only users in the Finance group can access the application. This is the required configuration.
- ✗
Enable EMS tag synchronization and create a tag for the Finance group.
Why it's wrong here
EMS tag synchronization is used for endpoint compliance tags, not for user group membership. While tags can be used in ZTNA rules, they represent endpoint attributes, not user groups. The Finance group is a user group, so it must be handled via a user group mapping, not a tag. Creating a tag for the Finance group would not correctly enforce user group membership. Thus, this option is not correct.
- ✗
Create a firewall address object for the Finance group and reference it in the ZTNA rule.
Why it's wrong here
Firewall address objects represent IP addresses or subnets, not user groups. The Finance group is a user group defined in FortiClient EMS or on the FortiGate. Referencing an address object would not enforce group membership; it would only match traffic based on IP. To enforce group membership, the administrator must use a user group in the ZTNA rule, not an address object. Therefore, this option is incorrect.
- ✗
Add the Finance group as a local user group on the FortiGate and manually add each user.
Why it's wrong here
Adding a local user group and manually adding users would not leverage the EMS group membership. The administrator wants to enforce membership based on the Finance group in EMS. Manual local users would require separate maintenance and would not automatically reflect EMS group changes. The correct approach is to map the EMS group to a FortiGate user group. Therefore, this option is not appropriate.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.