NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate is the hub of an IPsec VPN and also terminates SSL VPN for remote users. The administrator wants remote users to access internal resources only after the FortiGate validates the endpoint's compliance through FortiClient EMS, and wants the validation to happen before the user is placed in a VPN address pool. Which SSL VPN configuration element enforces endpoint compliance during the connection handshake?
⚠ Common exam trap
A common mix-up: candidates confuse strong authentication such as client certificates with endpoint posture validation, when only a host check policy can evaluate EMS compliance before address assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL VPN host check policy that references FortiClient EMS compliance tags.
Endpoint compliance before address assignment is enforced by the SSL VPN host check policy, which can reference FortiClient EMS compliance tags and runs during the connection handshake. It blocks or restricts non-compliant endpoints before they receive a VPN address, satisfying the requirement. Certificate and portal settings affect authentication and routing but not posture evaluation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL VPN settings with the 'Require Client Certificate' option enabled.
Why it's wrong here
Requiring a client certificate authenticates the device or user cryptographically, but it does not evaluate endpoint compliance such as antivirus status or OS patch level. A certificate can be valid on a non-compliant machine. This option strengthens authentication but does not satisfy the requirement to validate FortiClient EMS compliance before assigning the VPN address.
- ✓
SSL VPN host check policy that references FortiClient EMS compliance tags.
Why this is correct
A host check policy evaluates the endpoint's compliance, including FortiClient EMS tags, during the SSL VPN connection handshake before the user is assigned an address from the pool. If the endpoint fails the check, the FortiGate can deny or restrict access immediately. This directly enforces the requirement that compliance be validated before tunnel access is granted.
- ✗
SSL VPN realm configured with a custom authentication timeout.
Why it's wrong here
A realm groups authentication and portal settings for different user communities, and the timeout only controls how long an idle session persists. Neither setting evaluates endpoint posture or consults FortiClient EMS. The user would still be admitted to the address pool purely on credentials, so the compliance requirement would remain unmet.
- ✗
SSL VPN portal with split tunneling disabled.
Why it's wrong here
Disabling split tunneling controls which traffic is sent through the tunnel, not whether the endpoint is compliant. It has no mechanism to query FortiClient EMS or evaluate device tags during authentication. The user would still be placed in the address pool and granted access based on credentials alone, so compliance would never be checked before tunnel establishment.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.