NSE7 Advanced VPN and Zero Trust Practice Question
An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's device does not have the required ZTNA tags from EMS
A 403 Forbidden error in ZTNA typically indicates that the access control rule denied the request. This can happen if the device does not meet the required posture checks (ZTNA tags). Option B is correct because the ZTNA rule likely requires a specific tag that the device does not have, resulting in denial.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate firewall policy allowing ZTNA traffic is missing
Why it's wrong here
If the firewall policy is missing, traffic would be dropped, not result in a 403.
- ✓
The user's device does not have the required ZTNA tags from EMS
Why this is correct
ZTNA rules evaluate device posture via tags. If the device lacks the required tag (e.g., antivirus enabled), the rule denies access with a 403.
- ✗
The application server does not have a valid certificate
Why it's wrong here
The certificate issue would occur between FortiGate and the application, but the user would not see a 403; they would see connection errors or certificate warnings.
- ✗
The ZTNA proxy is configured with the wrong port for the application
Why it's wrong here
Wrong port would cause a connection timeout or refusal, not a 403.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.