NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that FortiClient can reach the ZTNA gateway's IP and port
To diagnose a ZTNA connection issue where FortiClient reports 'Connection refused' but the ZTNA gateway is correctly configured, the administrator should: 1. Verify that FortiClient can reach the ZTNA gateway's IP and port (option B): This ensures the client can establish a connection to the gateway itself. If the gateway is unreachable, the client cannot initiate the ZTNA tunnel. 2. Examine the ZTNA access proxy rule to ensure the application mapping is correct (option C): The access proxy rule defines which internal application the gateway forwards traffic to. Incorrect mapping (e.g., wrong IP, port, or protocol) would cause the gateway to reject or misroute the connection. 3. Verify that the application server is reachable from the FortiGate (option E): Even if the client can reach the gateway and the mapping is correct, the gateway must be able to reach the actual application server. Use ping or telnet from the FortiGate to confirm network connectivity to the server. Options A (antivirus update status) and D (reboot FortiClient) are not directly relevant to this ZTNA connectivity issue. The FortiClient reports 'Connection refused', which typically points to network or configuration problems, not antivirus updates or client software state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the FortiGate's antivirus update status
Why it's wrong here
Antivirus updates are unrelated to ZTNA connectivity.
- ✓
Verify that FortiClient can reach the ZTNA gateway's IP and port
Why this is correct
Network connectivity between FortiClient and the ZTNA gateway is fundamental.
- ✓
Examine the ZTNA access proxy rule to ensure the application mapping is correct
Why this is correct
The proxy rule defines the mapping from external to internal; misconfiguration can cause refusal.
- ✗
Reboot the FortiClient computer
Why it's wrong here
Rebooting is a last resort; not a diagnostic step.
- ✓
Verify that the application server is reachable from the FortiGate (e.g., ping or telnet)
Why this is correct
If the FortiGate cannot reach the application server, it cannot proxy traffic.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.