Courseiva
Advanced VPN and Zero TrusteasyMultiple ChoiceObjective-mapped

NSE7 Advanced VPN and Zero Trust Practice Question

A FortiGate is configured as a ZTNA proxy for a web application. Users report that after authenticating, they receive a '502 Bad Gateway' error. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The backend server is unreachable from the FortiGate.

The 502 Bad Gateway error indicates that the ZTNA proxy successfully received the request but could not get a valid response from the backend server. Therefore, the most likely cause is that the backend server is unreachable from the FortiGate (option A). The other options would result in different errors.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The backend server is unreachable from the FortiGate.

    Why this is correct

    Correct. A 502 Bad Gateway error means the ZTNA proxy (FortiGate) received the request but could not get a valid response from the backend server, indicating the backend is unreachable.

  • The ZTNA proxy is not configured with a valid SSL certificate.

    Why it's wrong here

    Incorrect. An invalid SSL certificate would result in a certificate error (e.g., 525 SSL handshake failed) or a browser warning, not a 502.

  • The user's device posture is not compliant.

    Why it's wrong here

    Incorrect. Non-compliant device posture would cause the ZTNA proxy to block the request, typically resulting in an access denied error (e.g., 403), not a 502.

  • The ZTNA rule is not using the correct source interface.

    Why it's wrong here

    Incorrect. Using the wrong source interface would cause connectivity issues or policy mismatches, but a 502 specifically points to backend unavailability.

About these practice questions

One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.