NSE7 Advanced VPN and Zero Trust Practice Question
An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiGate ZTNA proxy configuration
ZTNA on FortiGate requires the FortiGate to be configured as a ZTNA proxy (gateway) that intercepts traffic to internal applications and enforces access policies. Option C is correct because the FortiGate must have the ZTNA proxy configuration to act as the enforcement point. Options A, B, and D are not directly responsible for enforcing ZTNA policies; FortiSandbox is for sandboxing, FortiAnalyzer for logging, and FortiAuthenticator for authentication services, but the enforcement itself is done by the FortiGate ZTNA proxy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FortiSandbox for content inspection
Why it's wrong here
Sandbox is for advanced threat detection, not ZTNA enforcement.
- ✗
FortiAnalyzer for log analysis
Why it's wrong here
FortiAnalyzer is not required for ZTNA enforcement.
- ✓
FortiGate ZTNA proxy configuration
Why this is correct
The FortiGate acts as a ZTNA proxy/gateway that authenticates users and checks device posture before allowing access.
- ✗
FortiAuthenticator for RADIUS authentication
Why it's wrong here
ZTNA can use SAML or other authentication, but FortiAuthenticator is not mandatory.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.