NSE7 Advanced VPN and Zero Trust Practice Question
An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a ZTNA policy that includes the 'Compliant' tag as a required condition
To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL deep inspection on the firewall policy
Why it's wrong here
SSL inspection may be needed for CASB but not for tag-based access control.
- ✓
Create a ZTNA policy that includes the 'Compliant' tag as a required condition
Why this is correct
The ZTNA policy defines which tags are required for access.
- ✓
Create a ZTNA access proxy for the internal application
Why this is correct
The access proxy handles the reverse proxy to the internal application.
- ✗
Import the FortiClient EMS certificate to FortiGate
Why it's wrong here
Certificate import may be needed for communication but not for tag enforcement.
- ✗
Configure a firewall policy with source set to the EMS connector
Why it's wrong here
Firewall policies do not directly reference ZTNA tags; ZTNA policy handles that.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.