NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate is the SAML Service Provider (SP) for a ZTNA application. The IdP is Azure AD. After successful authentication, the user is redirected to the ZTNA proxy with a '403 Forbidden' error. The ZTNA rule has the correct groups allowed. What is the most likely missing configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SAML user group is not mapped to a FortiGate local group.
A 403 error after successful SAML authentication indicates the user was authenticated but not authorized. Since the ZTNA rule has the correct groups allowed, FortiGate cannot match the user to any allowed group. This requires mapping the SAML user group to a FortiGate local group via 'config user saml'. Option C is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IdP is not sending the user's group membership in the SAML assertion.
Why it's wrong here
If the IdP does not send group membership, FortiGate might still allow access if the rule is permissive, but the 403 specifically points to a group matching issue. The more common cause is the missing local group mapping.
- ✗
The ZTNA proxy certificate is not trusted by the browser.
Why it's wrong here
A certificate trust issue would cause a browser warning or error, not a 403 after successful authentication.
- ✓
The SAML user group is not mapped to a FortiGate local group.
Why this is correct
Correct. The SAML user group must be mapped to a FortiGate local group for group-based authorization in ZTNA rules.
- ✗
The FortiGate's clock is not synchronized with the IdP.
Why it's wrong here
Clock synchronization issues would cause SAML assertion validation failure during authentication, not a 403 after successful auth.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.