NSE7 Advanced VPN and Zero Trust Practice Question
An administrator wants to enforce that only devices with up-to-date antivirus software can access corporate resources via ZTNA. Which FortiClient feature should be used to enforce this requirement?
⚠ Common exam trap
NSE7 often tests the distinction between authentication (VPN) and posture-based authorization (ZTNA tags) — candidates incorrectly assume a VPN tunnel enforces endpoint compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ZTNA tags
ZTNA tags in FortiClient are dynamic posture attributes (such as antivirus status, OS patch level, and domain membership) that FortiGate/FortiClient EMS uses to make zero-trust access decisions. By tagging endpoints based on their antivirus being up-to-date, the administrator can enforce a policy that only tagged devices are allowed to reach corporate resources. This is the core mechanism Fortinet uses for ZTNA posture-based access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPN tunnel
Why it's wrong here
A VPN tunnel encrypts and carries traffic to a gateway; it performs no endpoint posture check of antivirus currency, so it cannot gate ZTNA access on that condition. It tempts administrators associating remote access with tunnels. VPN tunnel would be correct for site-to-site or remote encrypted connectivity without posture requirements.
- ✗
Web filter
Why it's wrong here
Web filter categorises and blocks URLs and web content; it holds no telemetry on endpoint antivirus version or definition freshness, so it cannot enforce that condition for ZTNA. It tempts administrators wanting to restrict browsing. Web filter would be correct for blocking malicious or inappropriate websites.
- ✗
Application firewall
Why it's wrong here
Application firewall controls which applications may run or reach the network, not whether endpoint antivirus definitions are current, so it cannot gate ZTNA access on antivirus status. It tempts administrators seeking endpoint control. Application firewall would be correct for blocking unauthorised or vulnerable applications on managed endpoints.
- ✓
ZTNA tags
Why this is correct
ZTNA tags carry the endpoint's compliance posture, including antivirus status, from FortiClient to the FortiGate. The access proxy then evaluates these tags in firewall policy, so only devices with current antivirus satisfy the stem's requirement to reach corporate resources.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.