NSE7 Advanced VPN and Zero Trust Practice Question
An administrator is configuring an IPsec VPN on a FortiGate that will interoperate with a third-party peer. The peer requires the use of a specific encryption domain and does not support IKEv2. The administrator wants to ensure that only specific subnets are permitted through the tunnel, while all other traffic is excluded from the SA. Which configuration element on the FortiGate directly controls which traffic is selected for the IPsec tunnel?
⚠ Common exam trap
Many exam-takers confuse firewall policy address objects or routing with the phase 2 selector that actually defines the IPsec encryption domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The phase 2 selector, configured with the local and remote subnet pairs that match the peer's encryption domain.
The phase 2 selector is the configuration element that defines the encryption domain by specifying the local and remote subnet pairs permitted through the IPsec SA. It must match the third-party peer's required subnets. Firewall policies and routes influence forwarding and permission, but only the phase 2 selector determines which traffic is actually selected and encrypted for the tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The phase 2 selector, configured with the local and remote subnet pairs that match the peer's encryption domain.
Why this is correct
The phase 2 selector defines the interesting traffic for the IPsec SA. It specifies the local and remote subnet pairs that are permitted through the tunnel. If the selector does not match the peer's encryption domain, the tunnel may fail to establish or traffic may be dropped. Configuring the selector to match the peer's required subnets ensures only that traffic is encrypted and sent through the SA.
- ✗
The routing table entries that direct traffic to the IPsec interface.
Why it's wrong here
Routing determines where traffic is sent, but it does not define the encryption domain of the IPsec SA. Even if routes point to the tunnel interface, the phase 2 selector must still match the traffic for it to be encrypted. Routes are necessary for forwarding, but they are not the configuration element that specifies which subnets are included in the SA.
- ✗
The phase 1 proposal, which includes the encryption and authentication algorithms negotiated with the peer.
Why it's wrong here
The phase 1 proposal defines how the IKE SA is secured, including encryption, authentication, and DH group. It does not control which traffic is selected for the tunnel. While a mismatch in phase 1 will prevent the tunnel from establishing, the phase 1 proposal has no role in defining the encryption domain or the subnets permitted through the IPsec SA.
- ✗
The firewall address objects referenced in the policy that permits traffic from the local subnet to the remote subnet.
Why it's wrong here
Firewall address objects in a policy control whether traffic is allowed or denied, but they do not define the IPsec SA's encryption domain. The phase 2 selector is what determines which traffic is actually encrypted and sent through the tunnel. Address objects alone cannot influence the SA selectors negotiated with the peer, so they cannot satisfy the peer's encryption domain requirement.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.