NSE7 Advanced VPN and Zero Trust Practice Question
An administrator deploys ZTNA with FortiGate as the access proxy for internal web applications. Users authenticate through FortiClient EMS, and device posture checks must be enforced before access is granted. A user with a compliant laptop can reach the application, but when the same user connects from a personal device that fails the posture check, the connection is still allowed. The administrator verifies the ZTNA rule is enabled and the EMS connector is up. Which configuration element is most likely missing to enforce device posture?
⚠ Common exam trap
The trap here is assuming that successful EMS connector registration automatically enforces posture, when the policy must explicitly match an EMS device tag.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ZTNA rule does not reference a device posture tag in the source or policy match criteria.
ZTNA posture enforcement on FortiGate depends on matching EMS-synchronized device tags within the access proxy policy. Authentication alone only proves identity; it does not prove device health. When the policy lacks a posture tag match, every authenticated user is authorized regardless of endpoint compliance. Adding the appropriate EMS tag to the policy match criteria ensures non-compliant devices are denied even though they authenticate successfully.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate is not configured with a valid SSL certificate for the ZTNA access proxy.
Why it's wrong here
A missing or invalid SSL certificate would cause browser trust warnings or TLS handshake failures, but the scenario states the user successfully reaches the application from a compliant laptop. Certificate problems affect connectivity and trust, not posture-based authorization decisions, so this cannot explain why a non-compliant device is still granted access.
- ✗
The ZTNA rule is missing a schedule object, allowing access outside business hours.
Why it's wrong here
A schedule object controls when a policy is active, not whether posture is checked. Even with a correct schedule, the policy would still allow the non-compliant personal device during active hours. The scenario describes a posture enforcement gap, not a time-based access issue, so the schedule is unrelated to the observed behaviour.
- ✗
The EMS connector is configured with the wrong port number for FortiClient EMS communication.
Why it's wrong here
An incorrect EMS connector port would prevent tag synchronization entirely, meaning even the compliant laptop would likely fail to match posture. Since the compliant laptop works, tag delivery is functioning. The issue is not transport of EMS data but the absence of a posture tag reference in the ZTNA policy match, which is the enforcement point.
- ✓
The ZTNA rule does not reference a device posture tag in the source or policy match criteria.
Why this is correct
ZTNA posture enforcement requires the access proxy policy to match on a device posture tag synchronized from FortiClient EMS. Without referencing the EMS-issued tag in the policy, the FortiGate cannot differentiate compliant from non-compliant endpoints, so all authenticated users are treated equally and the personal device is permitted despite failing posture.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.