NSE7 Advanced VPN and Zero Trust Practice Question
An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ZTNA proxy (reverse proxy) with FortiClient for posture
ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FortiNAC with agent on the server
Why it's wrong here
FortiNAC is for NAC, not ZTNA; it would require an agent on the server, which is not desired.
- ✗
IPsec VPN with full tunnel
Why it's wrong here
IPsec VPN gives full network access, not granular application access, and requires client software on the user device, not server.
- ✓
ZTNA proxy (reverse proxy) with FortiClient for posture
Why this is correct
In proxy mode, the FortiGate terminates the client connection and proxies it to the application server. The server does not require any software; all posture enforcement is on the client side via FortiClient.
- ✗
SSL VPN with web mode
Why it's wrong here
SSL VPN web mode still requires the server to be accessible and may need a client, but not ideal for ZTNA posture-based access.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.