Courseiva
Advanced VPN and Zero TrusthardMultiple SelectObjective-mapped

NSE7 Advanced VPN and Zero Trust Practice Question

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Create a ZTNA policy that includes the 'Compliant' tag as a required condition

To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Enable SSL deep inspection on the firewall policy

    Why it's wrong here

    SSL inspection may be needed for CASB but not for tag-based access control.

  • Create a ZTNA policy that includes the 'Compliant' tag as a required condition

    Why this is correct

    The ZTNA policy defines which tags are required for access.

  • Create a ZTNA access proxy for the internal application

    Why this is correct

    The access proxy handles the reverse proxy to the internal application.

  • Import the FortiClient EMS certificate to FortiGate

    Why it's wrong here

    Certificate import may be needed for communication but not for tag enforcement.

  • Configure a firewall policy with source set to the EMS connector

    Why it's wrong here

    Firewall policies do not directly reference ZTNA tags; ZTNA policy handles that.

About these practice questions

One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.