Knowledge + Practice

CCNA Advanced VPN and Zero Trust Questions

75 of 184 questions · Page 1/3 · Advanced VPN and Zero Trust · Answers revealed

Practice these questions Domain overview All questions

1

Multi-Selectmedium

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites (Site A and Site B) connect to a central hub. The administrator wants to ensure that if the primary peer for a site goes down, traffic automatically fails over to the backup peer. Which TWO settings must be configured on the hub's phase1?

Select 2 answers

A.Set 'auto-negotiate' to 'enable'

B.Set 'dpd' to 'on-demand'

C.Set 'aggregate-ipsec' to 'round-robin'

D.Set 'peer-options' to include both peers with 'priority'

E.Set 'failover' to 'enable'

AnswersD, E

Why this answer

Multi-peer VPN requires configuring 'peer-options' with multiple peer IPs and priorities, and enabling 'failover' on the phase1 interface to allow automatic switching to the backup peer if the primary goes down.

Practice this question →

2

MCQmedium

A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?

A.The phase2 lifetime is set to 3600 seconds, causing rekey failures

B.The phase1 lifetime is too short, causing frequent renegotiation

C.The VPN tunnel is not configured to use NAT traversal

D.The DPD (Dead Peer Detection) timeout is triggered every 30 minutes

AnswerD

If DPD retry timeout is set to a value that results in the peer being declared dead after 30 minutes, the tunnel will be torn down and re-established.

Why this answer

The VPN tunnel drops every 30 minutes, which matches a typical DPD (Dead Peer Detection) timeout interval. DPD is used to verify that the remote peer is still reachable; if no response is received within the DPD timeout (default often 30 minutes), the tunnel is torn down. The phase2 lifetime of 3600 seconds (1 hour) would cause rekey every hour, not 30 minutes.

The phase1 lifetime of 86400 seconds (24 hours) is long. Therefore, the most likely cause is a DPD timeout triggering every 30 minutes, making option D correct.

Practice this question →

3

Multi-Selectmedium

Which TWO of the following are required components for a Fortinet ZTNA solution? (Select two.)

Select 2 answers

A.FortiAuthenticator

B.FortiWeb

C.FortiAnalyzer

D.FortiGate

E.FortiClient EMS

AnswersD, E

FortiGate is the ZTNA gateway.

Why this answer

FortiGate is the enforcement point in a ZTNA solution, acting as the ZTNA gateway that verifies device posture and user identity before granting access to protected applications. It terminates ZTNA tunnels from FortiClient and applies identity-based policies, making it a required component for traffic inspection and access control.

Exam trap

The trap here is that candidates often assume FortiAuthenticator is required because ZTNA involves identity, but FortiGate can handle authentication locally or via any SAML IdP, making FortiAuthenticator optional, not mandatory.

Practice this question →

4

MCQmedium

A FortiGate administrator needs to integrate with FortiNAC to enforce network access control for wired and wireless devices. The administrator wants FortiNAC to dynamically assign VLANs based on the device's security posture. Which FortiNAC feature enables this?

A.DHCP fingerprinting

B.NAC policies

C.RADIUS accounting

D.SNMP traps

AnswerB

NAC policies use device posture information to assign VLANs dynamically.

Why this answer

NAC policies define rules for device classification and VLAN assignment based on posture assessment results.

Practice this question →

5

MCQeasy

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is accessed via HTTPS. Which component must be configured on the FortiGate to act as a reverse proxy for the application?

A.FortiClient EMS

B.SSL-VPN portal

C.ZTNA proxy

D.ZTNA inline CASB

AnswerC

Why this answer

ZTNA proxy is the FortiGate feature that acts as a reverse proxy, terminating the client connection and initiating a new connection to the internal application. It enforces access policies based on identity and device posture.

Practice this question →

6

MCQhard

A FortiGate administrator configures a multi-peer IPsec VPN with two remote gateways for redundancy. The phase 1 configuration has 'set proposal aes256-sha256' and 'set dpd on-idle'. The tunnel is established but traffic fails over to the backup peer only after a long delay. What change would improve failover time?

A.Increase the phase 2 lifetime

B.Enable NAT traversal

C.Use IKEv1 instead of IKEv2

D.Change DPD mode to 'on-demand' and reduce retry count

AnswerD

On-demand sends DPD probes regularly regardless of traffic, enabling faster detection.

Why this answer

DPD on-idle sends probes only when there is no traffic. With DPD on-idle, failure detection can be slow. Changing to DPD on-demand (active probing) or reducing retry intervals speeds up failure detection.

Practice this question →

7

MCQeasy

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

A.Application control profile

B.ZTNA tags and posture checks

C.IPsec VPN with pre-shared key

D.Web filtering profile

AnswerB

ZTNA tags can reflect compliance status from EMS.

Why this answer

FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Practice this question →

8

MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGate devices. The tunnel is established, but traffic is not passing. Which configuration should the administrator check first?

A.Firewall policies

B.NAT traversal configuration

C.Static routes

D.Phase1 parameters

AnswerA

Firewall policies must explicitly permit the traffic between the IPsec interface and the destination zone.

Why this answer

When an IPsec VPN tunnel is established but traffic does not pass, the most common cause is missing or misconfigured firewall policies. Even with correct Phase 1 and Phase 2 settings, the FortiGate will not forward traffic between the tunnel interface and the destination network unless an explicit firewall policy permits it. This is because FortiGate uses a stateful inspection model where all traffic must be allowed by a policy, regardless of the VPN being up.

Exam trap

The trap here is that candidates assume a working Phase 1 and Phase 2 automatically allows traffic, but FortiGate requires explicit firewall policies to permit traffic through the tunnel, unlike some other vendors where the VPN configuration itself implies a permit.

How to eliminate wrong answers

Option B (NAT traversal configuration) is wrong because NAT traversal is only relevant when there is a NAT device between the VPN peers; if the tunnel is already established, NAT-T is likely working or not needed, and it does not block traffic flow. Option C (Static routes) is wrong because while routes are necessary for traffic to reach the tunnel interface, the tunnel being established indicates that routing is likely correct; the issue is that even with correct routes, traffic is dropped at the policy layer. Option D (Phase1 parameters) is wrong because if Phase 1 parameters were mismatched, the tunnel would not establish at all; the fact that the tunnel is up means Phase 1 negotiation succeeded.

Practice this question →

9

MCQhard

An administrator is troubleshooting a ZTNA issue where users are able to authenticate but the application access is still blocked. The ZTNA status on FortiClient shows 'Connected' but the application does not load. What is the MOST likely cause?

A.The user's FortiClient does not have the required ZTNA tags assigned

B.The ZTNA application is not configured with HTTPS

C.The FortiClient EMS server is not reachable from the FortiGate

D.The FortiGate is not configured with the correct ZTNA application gateway

AnswerA

ZTNA tags define access permissions. If the user's client lacks the required tags, the FortiGate blocks access even though the client is connected.

Why this answer

When users can authenticate and the ZTNA status shows 'Connected' on FortiClient, but the application still fails to load, the most likely cause is that the client lacks the required ZTNA tags. ZTNA tags are used by the FortiGate to enforce access policies; without the correct tags, the FortiGate will block the application traffic even though the tunnel is established. This scenario indicates a tag assignment or synchronization issue between FortiClient and EMS.

Exam trap

The trap here is that candidates assume a 'Connected' ZTNA status means full application access is granted, overlooking that ZTNA tags are the critical enforcer of granular access control beyond just tunnel establishment.

How to eliminate wrong answers

Option B is wrong because ZTNA applications can use any TCP-based protocol (e.g., HTTPS, SSH, RDP); HTTPS is not mandatory, and the issue is not protocol-specific. Option C is wrong because if the FortiClient EMS server were unreachable from the FortiGate, the ZTNA status would not show 'Connected' — the tunnel would fail to establish. Option D is wrong because if the FortiGate were not configured with the correct ZTNA application gateway, the user would not be able to authenticate or see a 'Connected' status; the gateway configuration is a prerequisite for the tunnel to form.

Practice this question →

10

MCQhard

During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?

A.The FortiGate's EMS connector is not syncing tag information in real-time

B.The user's IP address has changed and the tag is mapped to a different IP

C.The ZTNA rule is configured with the wrong application port

D.The device posture compliance check requires additional criteria not met

AnswerA

ZTNA tags are pulled from EMS periodically. If the connector hasn't synced recently, the FortiGate might still have old tag information for that device.

Why this answer

Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.

Practice this question →

11

MCQmedium

A company wants to use FortiGate as a SAML service provider (SP) for authenticating administrators to the FortiGate GUI. The identity provider (IdP) is Azure AD. After configuration, administrators are redirected to Azure AD login but receive an error that the SAML request is invalid. What is the most likely misconfiguration?

A.The IdP's entity ID or SSO URL is incorrectly entered on FortiGate

B.The FortiGate's SP entity ID does not match the Azure AD application's identifier

C.The administrator's account is not synchronized with Azure AD

D.The certificate used for signing is not trusted by the IdP

AnswerA

If the IdP entity ID or SSO URL is wrong, the SAML request will be considered invalid by the IdP.

Why this answer

As an SP, FortiGate must be configured with the correct IdP entity ID and SSO URL. If the IdP entity ID is incorrect, the IdP rejects the SAML request.

Practice this question →

12

Multi-Selectmedium

An administrator is deploying ZTNA with FortiClient EMS to secure access to a corporate web application. Which THREE components are required for a successful ZTNA deployment? (Choose three.)

Select 3 answers

A.FortiSandbox for threat analysis

B.FortiClient EMS server

C.FortiClient installed on endpoint devices

D.FortiGate configured as ZTNA access proxy

E.FortiAnalyzer for logging

AnswersB, C, D

EMS manages compliance rules, ZTNA tags, and pushes policies to FortiClient.

Why this answer

FortiClient EMS (Endpoint Management Server) is the central management and policy distribution point for ZTNA. It manages endpoint compliance, pushes ZTNA tags, and provides real-time telemetry to FortiGate, enabling dynamic access control based on device posture and user identity.

Exam trap

The trap here is that candidates often assume FortiSandbox or FortiAnalyzer are mandatory for ZTNA, but FortiSandbox is only needed for file inspection in advanced threat scenarios and FortiAnalyzer is purely for logging, neither of which are core to the ZTNA control plane.

Practice this question →

13

MCQhard

A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?

A.set auto-negotiate enable; set dh-group 14

B.set pfs enable; set dhgrp 14

C.set proposal aes256-sha256 dh-group 14

D.set pfs enable; set dh-group 14

AnswerB

This correctly enables PFS and sets the Diffie-Hellman group to 14.

Why this answer

To enable PFS with DH group 14 on the phase 2 proposal, the correct CLI command is 'set pfs enable' and 'set dhgrp 14'. The command 'set proposal aes256-sha256' defines encryption/integrity, not PFS. The other options do not set PFS correctly.

Practice this question →

14

MCQhard

A FortiGate is configured with an IPsec VPN that uses certificate-based authentication. The VPN fails to establish. The administrator checks the phase1 debug and sees the message: 'no suitable certificate found'. What is the most likely cause?

A.The peer's certificate is not trusted

B.The certificate revocation list (CRL) is outdated

C.The CA certificate is missing

D.The local certificate is not imported or does not match the certificate name

AnswerD

The FortiGate needs a local certificate with a subject that matches the local ID; otherwise it cannot present a certificate.

Why this answer

The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.

Exam trap

The trap here is that candidates often confuse 'no suitable certificate found' with trust or revocation issues, but the error specifically points to a missing or mismatched local certificate, not problems with the peer's certificate or CA chain.

How to eliminate wrong answers

Option A is wrong because 'no suitable certificate found' refers to the local certificate not being found or matching, not the peer's certificate trust; a lack of trust in the peer's certificate would produce a different error like 'certificate validation failed' or 'untrusted certificate'. Option B is wrong because an outdated CRL would cause a certificate validation failure (e.g., 'certificate revoked' or 'CRL not checked'), not a failure to find a suitable local certificate. Option C is wrong because a missing CA certificate would prevent validation of the peer's certificate, resulting in a trust-related error, not the 'no suitable certificate found' message which is about the local certificate selection.

Practice this question →

15

Multi-Selectmedium

A FortiGate administrator is configuring NAC (Network Access Control) integration with FortiNAC. The goal is to control access for wired clients based on device compliance. Which TWO configurations are required on the FortiGate to support this integration?

Select 2 answers

A.Configure a RADIUS server pointing to FortiNAC.

B.Create a security group tag (SGT) mapping.

C.Enable '802.1x' authentication on the interface.

D.Enable 'nac-policy' on the switch-facing interface.

E.Set the 'nac-mode' to 'global-vlan' under the interface.

AnswersA, D

Why this answer

To integrate FortiGate with FortiNAC, two configurations are needed: first, a RADIUS server pointing to FortiNAC (A) must be configured on the FortiGate so it can query device compliance status from FortiNAC. Second, the 'nac-policy' option must be enabled on the FortiGate interface that connects to the switch (D). This allows the FortiGate to apply NAC-based access policies to wired clients.

Options B (security group tag mapping) and C (802.1x on the interface) are not required on the FortiGate for this integration; 802.1x is typically handled by the switch. Option E (nac-mode to global-vlan) is not a standard setting for this scenario.

Practice this question →

16

Multi-Selecthard

A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?

Select 3 answers

A.Check the FortiGate's antivirus update status

B.Verify that FortiClient can reach the ZTNA gateway's IP and port

C.Examine the ZTNA access proxy rule to ensure the application mapping is correct

D.Reboot the FortiClient computer

E.Verify that the application server is reachable from the FortiGate (e.g., ping or telnet)

AnswersB, C, E

Network connectivity between FortiClient and the ZTNA gateway is fundamental.

Why this answer

To diagnose a ZTNA connection issue where FortiClient reports 'Connection refused' but the ZTNA gateway is correctly configured, the administrator should:

Verify that FortiClient can reach the ZTNA gateway's IP and port (option B): This ensures the client can establish a connection to the gateway itself. If the gateway is unreachable, the client cannot initiate the ZTNA tunnel.

Examine the ZTNA access proxy rule to ensure the application mapping is correct (option C): The access proxy rule defines which internal application the gateway forwards traffic to. Incorrect mapping (e.g., wrong IP, port, or protocol) would cause the gateway to reject or misroute the connection.

Verify that the application server is reachable from the FortiGate (option E): Even if the client can reach the gateway and the mapping is correct, the gateway must be able to reach the actual application server. Use ping or telnet from the FortiGate to confirm network connectivity to the server.

Options A (antivirus update status) and D (reboot FortiClient) are not directly relevant to this ZTNA connectivity issue. The FortiClient reports 'Connection refused', which typically points to network or configuration problems, not antivirus updates or client software state.

Practice this question →

17

MCQmedium

A FortiGate is configured as a SAML service provider (SP) for user authentication. Users report they are redirected to the identity provider (IdP) for authentication, but after successful login, they are not allowed access to the requested resource. What is the MOST likely cause?

A.The FortiGate is configured as an IdP instead of SP

B.SAML single logout is enabled and causing session termination

C.The IdP certificate is not trusted by the FortiGate

D.The SAML user group is not configured with the correct IdP attribute mapping

AnswerD

Without proper group mapping, the FortiGate cannot assign the user to a group, and the firewall policy requiring that group will deny access.

Why this answer

After SAML authentication, the FortiGate must have a matching user group and firewall policy that allows traffic from authenticated users. If the IdP sends the correct attributes but the FortiGate does not have a group mapping or policy, access will be denied.

Practice this question →

18

Multi-Selectmedium

A FortiGate administrator is configuring a hub-and-spoke ADVPN with BGP. The hub has multiple spokes. Which TWO configuration steps are REQUIRED on the hub FortiGate for shortcut tunnels to be established between spokes?

Select 2 answers

A.Configure BGP to redistribute connected or static routes to the spokes

B.Enable 'set auto-discovery-receiver' on the hub's phase1 interface

C.Enable 'set auto-discovery-sender' on the hub's phase1 interface

D.Disable DPD on the hub's phase1 interface

E.Set the IKE version to IKEv1 on the hub

AnswersA, C

Without route redistribution, spokes will not learn about other spoke subnets, so shortcut tunnels would have no traffic to trigger.

Why this answer

For ADVPN shortcut tunnels, the hub must enable auto-discovery sender and must also advertise the spoke routes to other spokes. Without route advertisement, spokes cannot know about each other's networks.

Practice this question →

19

Multi-Selecthard

A FortiGate administrator is troubleshooting an IPsec VPN that uses IKEv2 with certificate authentication. The VPN fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the gateway state is 'IKE_INIT'. Which three possible causes should the administrator investigate? (Choose three.)

Select 3 answers

A.The certificate of the remote peer is not trusted by the local FortiGate

B.The pre-shared key is incorrect

C.The phase 1 proposal (encryption, hash, DH group) does not match

D.The phase 2 proxy ID is incorrect

E.The remote peer's certificate has expired

AnswersA, C, E

Certificate validation failure would cause IKE to stay in INIT.

Why this answer

The IKE_INIT state indicates phase 1 has not completed. Possible causes include the remote peer's certificate not being trusted (A), phase 1 proposal mismatch (C), and the remote peer's certificate having expired (E). Note that with IKEv2 certificate authentication, a pre-shared key (B) is not used, and phase 2 proxy ID mismatch (D) would not cause phase 1 failure.

Practice this question →

20

MCQeasy

A FortiGate is configured as a SAML service provider (SP) for SSO. Users authenticate via an external IdP. After successful authentication, the FortiGate should enforce a firewall policy based on the user's group membership. Which FortiGate setting must be enabled to receive group information from the IdP?

A.Enable 'Require IdP Certificate Validation'

B.Create a separate firewall policy for each user

C.Enable 'Auto-Provision Users' on FortiGate

D.Configure the 'user-group' attribute in the SAML SP settings

AnswerD

FortiGate allows mapping of group membership from a SAML attribute. The administrator must specify which attribute (e.g., group) carries the group information.

Why this answer

To receive group membership information from the IdP, the FortiGate SAML SP must be configured with the correct SAML attribute that carries the user group data. This is done by setting the 'user-group' attribute (or equivalent) in the SAML SP configuration. When the IdP sends a SAML assertion containing that attribute, FortiGate maps it to the user's group membership, enabling group-based firewall policies.

Option D is correct because it explicitly references configuring the 'user-group' attribute in the SAML SP settings.

Practice this question →

21

MCQmedium

An administrator configures a ZTNA proxy rule to allow access to an internal application. Users can connect to the FortiGate ZTNA gateway but receive a '403 Forbidden' error. Which step should the administrator take to resolve the issue?

A.Disable the 'require ZTNA tag' option on the proxy rule

B.Check that the ZTNA proxy rule's action is set to 'accept' and the correct tags are specified

C.Ensure the application is reachable from the FortiGate with a ping

D.Verify that the application's firewall policy has an SSL inspection profile applied

AnswerB

The proxy rule controls access based on tags. Missing tags cause forbidden errors.

Why this answer

A 403 error on ZTNA typically indicates that the user's device does not have the required ZTNA tags. The administrator must ensure the FortiClient has the correct tags assigned based on compliance.

Practice this question →

22

MCQeasy

Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?

A.Web filtering profile

B.SSL VPN portal

C.IPsec phase 1 configuration

D.ZTNA access proxy

AnswerD

ZTNA access proxy enforces access based on device posture and user identity.

Why this answer

ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.

Practice this question →

23

MCQmedium

A FortiGate administrator configures a hub-and-spoke ADVPN with OSPF over the VPN overlay. Spoke routers receive the OSPF default route from the hub, but cannot reach subnets behind other spokes. What configuration is missing?

A.IKEv2 is configured instead of IKEv1

B.The spokes have 'set auto-discovery-receiver enable' configured

C.OSPF is not configured to redistribute connected or static routes on the spokes

D.The hub has 'set auto-discovery-sender enable' configured

AnswerC

Each spoke must redistribute its local subnets into OSPF so the hub and other spokes learn them. Without redistribution, the hub only knows its own directly connected networks.

Why this answer

In a hub-and-spoke ADVPN with OSPF, spoke routers receive the default route from the hub but cannot reach subnets behind other spokes because OSPF does not automatically advertise the spoke’s local networks into the VPN overlay. The missing configuration is redistribution of connected or static routes into OSPF on the spokes, which is required for the hub to learn those subnets and propagate them to other spokes via the OSPF database.

Exam trap

The trap here is that candidates assume OSPF automatically advertises all connected interfaces, but in an overlay VPN, the spoke’s LAN interfaces are not part of the OSPF process unless explicitly redistributed.

How to eliminate wrong answers

Option A is wrong because IKEv2 vs IKEv1 is irrelevant to OSPF route propagation; ADVPN works with both IKE versions. Option B is wrong because 'set auto-discovery-receiver enable' is used on the hub, not on spokes, and its absence does not prevent spoke-to-spoke reachability via the hub. Option D is wrong because 'set auto-discovery-sender enable' is configured on spokes to initiate shortcut tunnels, but the issue here is missing OSPF route advertisement, not ADVPN tunnel establishment.

Practice this question →

24

MCQmedium

A company uses FortiClient EMS for endpoint compliance and ZTNA tag assignment. An administrator wants to enforce that only endpoints with a ZTNA tag 'Compliant' can access a specific internal application through ZTNA. Which configuration is required on the FortiGate?

A.Create a ZTNA access proxy and a ZTNA policy that references the 'Compliant' tag

B.Add a firewall policy with source set to the tag object

C.Configure an SSL VPN portal and assign the tag as a group

D.Configure a security policy with FortiClient endpoint control

AnswerA

ZTNA access proxy and policy are used to publish applications; the policy can require specific tags.

Why this answer

ZTNA access proxy policies combine a firewall policy with ZTNA rules. The tag condition is defined in the ZTNA policy, which specifies the required ZTNA tags to allow access.

Practice this question →

25

Multi-Selecthard

An administrator wants to implement ZTNA inline CASB to control access to a SaaS application (e.g., Office 365). Which three components are required for this setup? (Choose THREE)

Select 3 answers

A.FortiClient EMS for device posture and tag assignment

B.FortiGate with ZTNA proxy enabled

C.FortiNAC for network access control

D.A VPN tunnel between FortiGate and the SaaS provider

E.A ZTNA rule configured as an access proxy for the SaaS application

AnswersA, B, E

EMS provides device compliance and tags.

Why this answer

ZTNA inline CASB requires FortiGate as an inline proxy, FortiClient EMS for device posture and identity, and a ZTNA rule that proxies traffic to the SaaS application. Additionally, SSL deep inspection is required to decrypt and inspect traffic.

Practice this question →

26

MCQhard

A FortiGate administrator receives an error during IPsec VPN configuration: 'Certificate validation failed: certificate uses weak key.' The admin is using a PKI certificate with RSA 2048-bit key. The FortiGate firmware is up-to-date. What is the MOST likely reason for this error?

A.The certificate has expired or is not yet valid.

B.The certificate's private key is not imported on the FortiGate.

C.The FortiGate has a security policy that rejects certificates with keys less than 3072 bits.

D.The certificate authority is not trusted by the FortiGate.

AnswerC

Why this answer

In recent FortiOS versions, a security hardening setting may require minimum RSA key size of 3072 bits. RSA 2048 is considered weak by some compliance standards and may be blocked by the 'weak key' validation check. The admin can adjust the setting or use a stronger key.

Practice this question →

27

Drag & Dropmedium

Drag and drop the steps to configure a FortiGate VDOM in multi-VDOM mode into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enable VDOM mode globally, then create and assign interfaces, then configure each VDOM, then resource allocation.

Practice this question →

28

MCQhard

A FortiGate administrator observes the following CLI output from 'diagnose vpn ike gateway list': vd: root/0 name: VPN_TO_HUB version: IKEv2 status: up mode: main DPD: on ... Number of IPsec tunnels: 1 name: phase2_tunnel status: up inbound: 0 bytes outbound: 0 bytes The tunnel shows up but no traffic is passing. What is the MOST likely cause?

A.Firewall policies are not configured to permit traffic through the VPN tunnel

B.Dead Peer Detection is disabled

C.The phase1 proposal is mismatched

D.The tunnel is in 'down' status

AnswerA

Without policies, traffic is dropped, resulting in zero bytes.

Why this answer

The output shows the IKE gateway is up but the IPsec tunnel has zero traffic. This often indicates a policy or routing misconfiguration. The most common cause is missing firewall policies to allow traffic through the tunnel.

Practice this question →

29

Multi-Selectmedium

A FortiGate is configured as the SAML Identity Provider (IdP) for a cloud application. The administrator wants to enforce device compliance as part of authentication. Which THREE steps must be taken?

Select 3 answers

A.Enable 'require-device-compliance' in the SAML IdP settings

B.Configure a ZTNA tag for compliance

C.Create a firewall policy allowing SAML traffic

D.Set up a VPN tunnel to the cloud application

E.Integrate FortiClient EMS with the FortiGate

AnswersA, B, E

Why this answer

To enforce device compliance during SAML authentication, the FortiGate IdP must have device compliance enabled, integrate with FortiClient EMS to receive posture data, and use ZTNA tags to define compliance requirements.

Practice this question →

30

Multi-Selectmedium

A FortiGate administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which TWO components must be configured on FortiGate to enable ZTNA access?

Select 2 answers

A.A ZTNA proxy policy

B.A firewall policy to allow traffic from ZTNA proxy to internal servers

C.A ZTNA proxy (gateway) configuration

D.A ZTNA tag on the application server

E.FortiClient EMS registration on FortiGate

AnswersA, C

The proxy policy defines which users and devices can access which applications based on tags.

Why this answer

ZTNA requires a proxy policy to define access rules and a ZTNA proxy/gateway to terminate user connections. Tags and EMS are configured separately.

Practice this question →

31

MCQhard

An administrator configures ZTNA inline CASB to control access to a SaaS application. The goal is to block uploads of files with credit card numbers. The administrator configures a CASB profile with a DLP rule for credit card numbers. However, uploads are not being blocked. What is the most likely reason?

A.The CASB profile is not applied to the ZTNA policy

B.SSL inspection is not enabled for the traffic

C.The DLP rule is configured to monitor instead of block

D.The SaaS application is not supported by CASB

AnswerB

Without SSL deep inspection, the DLP engine sees only encrypted content and cannot detect credit card numbers.

Why this answer

Inline CASB requires the traffic to be decrypted via SSL inspection; otherwise, the DLP engine cannot inspect the content of encrypted HTTPS traffic.

Practice this question →

32

MCQhard

A multinational corporation is implementing ZTNA for remote access to a critical internal application hosted on a server with IP 10.0.1.200:8443. The FortiGate is deployed at the edge with WAN IP 203.0.113.50. The administrator configures a ZTNA rule with proxy destination 10.0.1.200:8443, a firewall policy allowing traffic from the ZTNA gateway to the internal server, and a VIP for port forwarding for testing. However, remote users report that they can establish a ZTNA connection to the gateway but the application page fails to load, showing a blank page after a long delay. The FortiGate logs show no errors, and the debug output indicates that the proxy successfully forwarded the request to 10.0.1.200:8443 and received a response. The internal server team confirms the application is working correctly for on-site users. What is the most likely cause?

A.The ZTNA proxy is not configured to support HTTPS.

B.The internal server is not reachable from the FortiGate.

C.The client's ZTNA tags are expired.

D.The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally.

AnswerD

This causes partial page loading or blank pages.

Why this answer

The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally. When the ZTNA proxy forwards the request to the internal server, the server responds with HTML content that references internal resources (e.g., images, scripts, or links) using private IP addresses (like 10.0.1.200) or internal DNS names. The remote client cannot resolve or reach these internal addresses, causing the page to load partially or display a blank page after a delay, even though the initial proxy connection and response are successful.

Exam trap

The trap here is that candidates see the proxy successfully forwarding and receiving a response and assume the issue is network connectivity or proxy configuration, overlooking the fact that the application's embedded content (hardcoded IPs/hostnames) can break the client-side rendering even when the initial proxy transaction succeeds.

How to eliminate wrong answers

Option A is wrong because the ZTNA proxy is configured with a proxy destination of 10.0.1.200:8443, which implies HTTPS (port 8443 is commonly used for HTTPS), and the debug output confirms the proxy successfully forwarded the request and received a response, indicating HTTPS support is present. Option B is wrong because the debug output explicitly states the proxy forwarded the request to 10.0.1.200:8443 and received a response, proving the internal server is reachable from the FortiGate. Option C is wrong because if the client's ZTNA tags were expired, the client would not be able to establish a ZTNA connection to the gateway at all; the question states remote users can establish the connection, so tags are valid.

Practice this question →

33

MCQeasy

A FortiGate administrator wants to use PKI certificates for IPsec VPN authentication instead of pre-shared keys. Which phase1 parameter must be set to 'signature' to enable certificate-based authentication?

A.set authmethod signature

B.set cert-validation enable

C.set ike-version 2

D.set peer-id certificate

AnswerA

This configures the IKE phase1 to use certificate authentication.

Why this answer

The IKE peer authentication method is controlled by the 'authmethod' parameter. Setting it to 'signature' enables RSA signature-based authentication using certificates.

Practice this question →

34

MCQeasy

A FortiGate administrator wants to integrate ZTNA with FortiClient EMS to control access to an internal application based on device posture. The admin has configured a ZTNA tag in EMS for 'AntiVirus enabled' and created a ZTNA rule in FortiGate. What additional configuration is required on the FortiGate to enforce access based on the ZTNA tag?

A.Configure SSL VPN to authenticate users and assign tags

B.Install a client certificate on each FortiClient from the FortiGate

C.Enable ZTNA inline CASB in the antivirus profile

D.Configure the FortiGate as an EMS connector and import the tag

AnswerD

The FortiGate must connect to EMS to receive tag definitions and assign them to users/devices. Then ZTNA rules can reference the tag.

Why this answer

For FortiGate ZTNA integration with EMS, the FortiGate must be configured as an EMS connector to import ZTNA tags. These tags are then used in firewall policies to enforce access based on device posture. Option D is correct because the connector enables the FortiGate to receive tags from EMS.

Option A is incorrect because SSL VPN is not required for ZTNA; ZTNA uses client certificates or other methods. Option B is incorrect because client certificates are not installed from FortiGate for ZTNA; EMS handles certificate distribution. Option C is incorrect because inline CASB is a different feature and not related to ZTNA tag enforcement.

Practice this question →

35

MCQeasy

An organization is designing a Zero Trust Network Access solution with Fortinet. They want to ensure that only devices with up-to-date antivirus software can access sensitive applications. Which component is responsible for enforcing this requirement?

A.FortiAnalyzer

B.FortiClient EMS

C.FortiAuthenticator

D.FortiGate ZTNA gateway

AnswerB

FortiClient EMS applies compliance rules and tags devices accordingly.

Why this answer

FortiClient EMS is the correct component because it manages endpoint compliance policies, including antivirus status. It enforces the requirement by checking that devices have up-to-date antivirus software before issuing a ZTNA access token, which the FortiGate ZTNA gateway then validates to grant access.

Exam trap

The trap here is that candidates often confuse the FortiGate ZTNA gateway as the sole enforcement point, overlooking that FortiClient EMS is the component responsible for performing the actual endpoint posture check and issuing the compliance token.

How to eliminate wrong answers

Option A is wrong because FortiAnalyzer is a logging and analytics platform, not an enforcement point for endpoint compliance; it cannot check or enforce antivirus status on devices. Option C is wrong because FortiAuthenticator handles identity and authentication (e.g., RADIUS, LDAP), not endpoint posture checks like antivirus version. Option D is wrong because the FortiGate ZTNA gateway enforces access decisions based on tokens and policies, but it relies on FortiClient EMS to provide the endpoint compliance verification; the gateway itself does not directly check antivirus status.

Practice this question →

36

Multi-Selecteasy

Which TWO of the following can be used to authenticate users in a ZTNA connection? (Select two.)

Select 2 answers

A.LDAP authentication

B.FortiToken

C.IPsec authentication

D.SAML authentication

E.Certificate authentication

AnswersD, E

SAML is supported for SSO.

Why this answer

In a ZTNA connection, authentication can be performed using SAML (Security Assertion Markup Language) because it enables federated identity management and single sign-on (SSO), allowing the FortiGate to verify user identity via an external identity provider (IdP) without direct password handling. Certificate authentication is also valid because ZTNA leverages client certificates (X.509) to establish mutual TLS (mTLS) between the user device and the FortiGate, ensuring device identity and trust before granting access.

Exam trap

The trap here is that candidates often confuse authentication methods used in traditional VPNs (like LDAP or FortiToken) with the identity-centric methods required for ZTNA, forgetting that ZTNA mandates integration with an IdP or certificate-based trust rather than direct password or token verification.

Practice this question →

37

MCQmedium

A healthcare provider is deploying ZTNA to secure access to an internal electronic health records (EHR) system. The EHR system is composed of multiple web services running on different ports behind a load balancer with IP 10.0.10.100. The load balancer listens on ports 443, 8443, and 9090. The administrator configures a single ZTNA rule with proxy destination 10.0.10.100:443, expecting that the other ports will be accessed via the same rule. However, users report that they can only access the service on port 443; connections to ports 8443 and 9090 fail. The FortiGate logs show that requests to other ports are being dropped. What should the administrator do to resolve this?

A.Configure the load balancer to redirect all traffic to port 443.

B.Configure the ZTNA gateway to allow all ports to the load balancer.

C.Create separate ZTNA rules for each port (8443 and 9090).

D.Ask users to change the port in their browser to 443.

AnswerC

ZTNA rules are port-specific.

Why this answer

Each ZTNA rule maps to a single proxy destination port. The rule configured with proxy destination 10.0.10.100:443 only forwards traffic for that specific port. To access services on ports 8443 and 9090, separate ZTNA rules must be created for each port, each with its own proxy destination and access proxy configuration.

Exam trap

The trap here is that candidates assume a single ZTNA rule with a destination IP will automatically forward traffic to all ports on that IP, overlooking that ZTNA rules are port-specific and require separate rules for each service port.

How to eliminate wrong answers

Option A is wrong because redirecting all traffic to port 443 would break the intended functionality of the separate web services running on ports 8443 and 9090, and the load balancer is not designed to redirect traffic arbitrarily. Option B is wrong because the ZTNA gateway does not support a wildcard 'allow all ports' configuration; ZTNA rules require explicit proxy destination IP and port pairs. Option D is wrong because asking users to change the port in their browser does not address the underlying ZTNA rule limitation; the gateway would still drop connections to ports not defined in the rule.

Practice this question →

38

MCQeasy

In a Fortinet ZTNA deployment, which component is responsible for forwarding decrypted traffic to the internal application server after the FortiGate proxy has performed SSL inspection?

A.FortiClient EMS

B.ZTNA proxy on FortiGate

C.IPsec VPN tunnel

D.FortiNAC

AnswerB

The ZTNA proxy terminates the client connection and creates a new connection to the server.

Why this answer

ZTNA proxy receives client requests, performs SSL inspection, and forwards the decrypted traffic to the internal server.

Practice this question →

39

MCQmedium

A network administrator is troubleshooting an ADVPN deployment. Spoke FortiGates can communicate with the hub, but shortcut tunnels between spokes are not being established. The administrator verifies that IKE and IPsec settings are correct on all devices. What is the MOST likely cause?

A.Dead Peer Detection (DPD) is disabled on the hub

B.The hub's phase2 configuration has 'auto-negotiate' disabled

C.The hub's phase1 configuration has 'auto-negotiate' disabled

D.The spokes have different IKE versions configured

AnswerB

Without auto-negotiate, the hub will not propose shortcut tunnels to spokes.

Why this answer

In ADVPN, shortcut tunnels require IKEv2 with the 'add-route' option and auto-negotiate. If the hub's phase2 configuration does not have 'auto-negotiate' enabled, it will not initiate shortcut tunnels.

Practice this question →

40

Multi-Selecthard

A company is deploying ZTNA to protect an internal application. They want to ensure that only users with devices that have disk encryption enabled and the latest OS patches can access the application. Which THREE components must be configured to achieve this?

Select 3 answers

A.FortiNAC for network admission control

B.IPsec VPN to encrypt traffic between client and FortiGate

C.FortiClient on the endpoint device

D.FortiGate ZTNA access proxy with tag-based rules

E.FortiClient EMS to define compliance policies and assign tags

AnswersC, D, E

FortiClient collects device posture information such as disk encryption status and OS patch level.

Why this answer

To enforce device posture requirements like disk encryption and OS patch level, you need FortiClient on the device to report posture, FortiClient EMS to define compliance policies and generate tags, and FortiGate ZTNA proxy to check those tags before granting access.

Practice this question →

41

Multi-Selectmedium

A FortiGate administrator is troubleshooting a scenario where remote users can connect to the VPN but cannot access internal resources. The VPN policy is configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Select 2 answers

A.Verify that the routing table on the FortiGate includes the remote networks

B.Check the firewall policy to ensure it allows traffic from the VPN to internal networks

C.Restart the IKE daemon on the FortiGate

D.Disable NAT on the VPN policy

E.Increase the DPD retry count

AnswersA, B

Without routes to the remote networks, traffic will not be forwarded through the tunnel.

Why this answer

Check routing and firewall policies. If the tunnel is up but traffic is not forwarded, routing may be missing or firewall policies may be blocking or not matching.

Practice this question →

42

MCQhard

Refer to the exhibit. A tunnel interface is configured with IP 10.0.1.1/30 and remote-ip 10.0.1.2/30. The phase2 defines src-subnet as 10.0.1.0/30 and dst-subnet as 10.0.2.0/30. What is the most likely problem with this configuration?

A.The phase2 src-subnet includes the tunnel interface IP

B.The remote gateway is set to a static IP but the peer might be dynamic

C.The tunnel interface is missing the 'ip' command

D.The phase2 dst-subnet overlaps with the remote gateway

AnswerA

The tunnel interface IP (10.0.1.1) is inside the src-subnet (10.0.1.0/30), which is incorrect. The src-subnet should be the local LAN subnet, not the tunnel subnet.

Why this answer

The phase2 src-subnet is set to 10.0.1.0/30, which includes the tunnel interface IP 10.0.1.1/30. In IPsec VPN configurations, the phase2 selector must not include the tunnel interface IP itself because the tunnel interface is used for routing encapsulated traffic; including it can cause routing loops or prevent the tunnel from establishing correctly. The correct src-subnet should be the protected internal network behind the FortiGate, not the tunnel subnet.

Exam trap

The trap here is that candidates often confuse the tunnel interface subnet with the protected local subnet, assuming the phase2 selectors should match the tunnel IPs, when in fact they must specify the actual internal networks behind the VPN gateways.

How to eliminate wrong answers

Option B is wrong because the question does not provide any information about the peer being dynamic; the remote-ip is statically configured, and a static peer is valid. Option C is wrong because the tunnel interface is configured with an IP address (10.0.1.1/30), which implies the 'ip' command is present; the issue is not a missing command. Option D is wrong because the phase2 dst-subnet (10.0.2.0/30) does not overlap with the remote gateway (10.0.1.2/30); they are on different subnets, so no overlap exists.

Practice this question →

43

Multi-Selectmedium

A FortiGate is configured as a ZTNA proxy for an internal application. Users authenticate via SAML with FortiGate as the IdP. The administrator wants to enforce that only devices with a valid ZTNA tag can access the application. Which TWO configurations are required?

Select 2 answers

A.Install a client certificate on each device for authentication.

B.Configure FortiClient EMS to push compliance tags to FortiGate.

C.Set the ZTNA proxy to require FortiClient on the client device.

D.Create a ZTNA rule with tag conditions.

E.Enable ZTNA tags on the firewall policy that permits access to the application.

AnswersD, E

Correct. A ZTNA rule with tag conditions is required to specify which ZTNA tags are permitted for access to the application.

Why this answer

To enforce that only devices with a valid ZTNA tag can access the application, two configurations are required: creating a ZTNA rule with tag conditions (D) and enabling ZTNA tags on the firewall policy that permits access (E). The ZTNA rule defines which tags are allowed, and the firewall policy must have ZTNA tags enabled to apply the rule. Option B (configuring EMS to push tags) is a prerequisite but not an enforcement configuration; options A and C are not required since SAML handles authentication and FortiClient is not mandatory on the proxy itself.

Practice this question →

44

Multi-Selecteasy

A company is deploying ZTNA to replace their legacy VPN. They want to ensure that only users with a valid certificate and compliant antivirus can access the internal application. Which TWO components are required on the FortiGate for this deployment?

Select 2 answers

A.ZTNA proxy rule with access proxy

B.Dynamic routing protocol (BGP)

C.Firewall policy with ZTNA tags matching

D.SSL-VPN portal

E.IPsec phase1 with certificate authentication

AnswersA, C

Why this answer

ZTNA uses a proxy rule (access proxy) to publish the application, and a firewall policy that references ZTNA tags and the access proxy to enforce access based on identity and posture.

Practice this question →

45

MCQeasy

A FortiGate administrator wants to use Fortinac for network access control. Which of the following is the PRIMARY function of Fortinac in a network?

A.Perform deep packet inspection on all traffic

B.Act as a VPN concentrator for remote access

C.Provide network access control by enforcing policies based on device identity and posture

D.Provide a cloud-based sandbox for malware analysis

AnswerC

FortiNAC's core function is NAC: controlling network access based on device identity, compliance, and user role.

Why this answer

FortiNAC is Fortinet's Network Access Control (NAC) solution. Its primary function is to provide visibility, control, and automated response for endpoints based on identity and posture, enabling policy enforcement for network access. Option C correctly describes this.

Practice this question →

46

MCQmedium

A FortiGate administrator is using FortiNAC to enforce network access control for wired endpoints. The administrator wants to quarantine any endpoint that fails antivirus compliance. Which action should be configured in the FortiNAC policy to achieve this?

A.Disable the switch port

B.Send a SNMP trap to the admin

C.Assign the endpoint to a quarantine VLAN

D.Block the MAC address at the switch port

AnswerC

This is the standard method to isolate non-compliant endpoints while allowing limited remediation access.

Why this answer

FortiNAC policies can enforce compliance by moving endpoints to a quarantine VLAN or applying a quarantine ACL. The typical action is to place the endpoint in a quarantine VLAN where access is restricted.

Practice this question →

47

MCQmedium

A FortiGate administrator configures SAML SSO with FortiGate as the Service Provider (SP) and an external IdP. Users report that they are prompted for credentials repeatedly without successful authentication. What is the most likely cause?

A.The SAML attribute mapping is incorrect

B.The FortiGate's clock is synchronized via NTP

C.The firewall policy does not allow SAML traffic

D.The IdP certificate is not imported or trusted on the FortiGate

AnswerD

FortiGate must trust the IdP's signing certificate to validate SAML responses; otherwise, authentication fails.

Why this answer

SAML SSO requires certificate trust. If the IdP certificate is not trusted by the FortiGate, the SAML assertion will not be validated, causing authentication failures. The clock skew is another common issue.

Practice this question →

48

MCQmedium

An administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees that both phase 1 and phase 2 are up. The policy allows traffic from both sides. What should the administrator check next?

A.Check the routing table for routes to the remote subnet

B.Increase the phase 2 keylife

C.Check the FortiGate's NTP status

D.Disable DPD

AnswerA

Routes are needed to send traffic into the tunnel.

Why this answer

Since both phases are up and policies are correct, the issue is likely routing. The administrator should verify that the correct routes are pointing to the VPN interface (tunnel interface) on both sides. Without proper routes, traffic will not be forwarded into the tunnel.

Practice this question →

49

MCQhard

An administrator has configured an OSPF overlay over an IPsec VPN between two FortiGates. The OSPF neighbors are established, but routes from one side are not being installed in the routing table on the other side. 'get router info ospf neighbor' shows FULL state. What is the most likely cause?

A.The IPsec tunnel is using transport mode instead of tunnel mode

B.The route's OSPF cost is higher than an existing route with a lower administrative distance

C.OSPF authentication is mismatched

D.The OSPF network type is not set to point-to-point

AnswerB

OSPF routes have an AD of 110. If a static route (AD 10) or other protocol has a lower AD, the OSPF route may not be installed.

Why this answer

Even though OSPF neighbors are FULL, routes may not be installed if they are not selected as best paths. One common reason is that the OSPF cost is higher than a static route or another routing protocol's metric. The other options would prevent neighbor from reaching FULL state.

Practice this question →

50

MCQeasy

An administrator wants to enforce that only devices with up-to-date antivirus software can access corporate resources via ZTNA. Which FortiClient feature should be used to enforce this requirement?

A.VPN tunnel

B.Web filter

C.Application firewall

D.ZTNA tags

AnswerD

Why this answer

ZTNA tags are used to define device posture requirements, such as antivirus status. FortiClient reports compliance, and the FortiGate uses these tags to allow or deny access.

Practice this question →

51

MCQeasy

An administrator wants to integrate FortiClient EMS with FortiGate for ZTNA. Which protocol must be allowed between FortiGate and FortiClient EMS?

A.HTTPS (TCP/443) [wrong]

B.LDAP (TCP/389) [wrong]

C.SNMP (UDP/161) [CORRECT]

D.Syslog (UDP/514) [wrong]

AnswerA

Correct. HTTPS (TCP/443) is the required protocol for FortiGate to communicate with FortiClient EMS for ZTNA.

Why this answer

For ZTNA integration, FortiGate communicates with FortiClient EMS over HTTPS (TCP/443) to exchange authentication and policy information. SNMP is not used for this purpose.

Practice this question →

52

MCQeasy

An administrator wants to enforce that only devices with corporate-owned certificates can establish an IPsec VPN tunnel. Which IPsec authentication method should be configured?

A.Pre-shared keys

B.Extended Authentication (XAuth)

C.Aggressive mode

D.X.509 certificates

AnswerD

X.509 certificates enable certificate-based authentication, ensuring only devices with the corporate certificate can connect.

Why this answer

X.509 certificates provide a strong, identity-based authentication mechanism that allows the VPN gateway to verify that only devices possessing a corporate-issued certificate can establish an IPsec tunnel. This method relies on a public key infrastructure (PKI) where the gateway validates the certificate chain and optionally checks certificate revocation lists (CRLs) or OCSP responses, ensuring that unauthorized devices without a valid corporate certificate are rejected.

Exam trap

The trap here is that candidates often confuse Extended Authentication (XAuth) with device authentication, but XAuth only authenticates the user, not the device, and is typically used as a secondary factor after PSK or certificate authentication, not as a standalone method for corporate-owned device enforcement.

How to eliminate wrong answers

Option A is wrong because pre-shared keys (PSK) use a shared secret that is not tied to device identity; any device with the same PSK can authenticate, making it impossible to enforce corporate-only device access. Option B is wrong because Extended Authentication (XAuth) is an additional user-based authentication layer (e.g., username/password) that runs after IKE Phase 1, but it does not authenticate the device itself and can be bypassed if the PSK or certificate is compromised. Option C is wrong because Aggressive mode is an IKE Phase 1 exchange mode that sends the identity in plaintext and is vulnerable to dictionary attacks; it does not provide device-level certificate enforcement and is less secure than Main mode.

Practice this question →

53

Multi-Selectmedium

An administrator is configuring a new branch office VPN using IKEv2 with PKI certificates. Which TWO steps are essential to ensure the VPN tunnel establishes successfully?

Select 2 answers

A.Set the phase 1 proposal to use AES-256-GCM only

B.Import the remote peer's certificate into the FortiGate's trusted CA list

C.Assign the local certificate to the phase 1 interface

D.Enable DPD on the phase 1 interface

E.Configure the phase 2 selector to include all traffic (0.0.0.0/0)

AnswersB, C

The FortiGate must trust the CA that signed the remote peer's certificate for validation.

Why this answer

For IKEv2 with PKI certificates, the remote peer's certificate must be validated against a trusted CA. Importing the CA certificate that signed the remote peer's certificate into the FortiGate's trusted CA list allows the FortiGate to build a valid certificate chain and authenticate the remote peer during IKEv2 phase 1. Without this, the certificate validation fails and the tunnel cannot establish.

Exam trap

The trap here is that candidates often confuse 'essential for establishment' with 'recommended for security or reliability,' leading them to select DPD or a specific encryption algorithm as required steps, when in fact only certificate trust and local certificate assignment are mandatory for PKI-based IKEv2 authentication.

Practice this question →

54

MCQeasy

An administrator wants to ensure that only devices with up-to-date antivirus software can access a sensitive application via ZTNA. Which FortiGate feature should be used to enforce this requirement?

A.ZTNA tags from FortiClient EMS

B.SSL deep inspection profile

C.Application control profile

D.AntiVirus profile on the firewall policy

AnswerA

Correct. ZTNA tags from FortiClient EMS allow the administrator to enforce device posture requirements like up-to-date antivirus for ZTNA access.

Why this answer

ZTNA tags from FortiClient EMS are used to enforce device posture requirements such as up-to-date antivirus software. FortiClient EMS assesses endpoint compliance and assigns tags, which FortiGate uses in ZTNA access policies to grant or deny access based on the tag. An AntiVirus profile on a firewall policy scans traffic content but does not directly check the device's antivirus status for ZTNA access.

Exam trap

Administrators might mistakenly think an AntiVirus profile on the policy can enforce device antivirus status, but it only scans traffic content. ZTNA tags from EMS are designed specifically for device posture verification.

Practice this question →

55

Matchingmedium

Match each Fortinet command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays CPU and memory usage

Packet flow debugging

Tests network connectivity

Displays entire configuration

Packet capture for troubleshooting

Why these pairings

Correct matches: 'get system performance' shows real-time performance statistics; 'diagnose debug application httpd' enables HTTP daemon debugging; 'execute ping' tests network connectivity; 'show system status' displays system summary. Common confusions include swapping the functions of 'get system performance' and 'execute ping'.

Practice this question →

56

MCQhard

You run 'diagnose vpn ike gateway list' and see the following: gateway name: HUB_GW version: IKEv2 state: UP mode: main local: 10.0.0.1:500 remote: 203.0.113.5:500 auth: psk dpd: on rekey: 86400 num_peers: 2 total_tunnels: 2 auto-discovery: enabled What does the 'auto-discovery: enabled' indicate about this VPN gateway?

A.The gateway will automatically create new phase2 selectors for any remote subnet

B.The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation

C.The gateway will automatically renegotiate IKEv2 keys before expiration

D.The gateway will discover other VPN gateways on the same network and form peer relationships

AnswerB

When auto-discovery is enabled on a gateway, it can act as an ADVPN hub, sending route information to spokes to allow direct spoke-to-spoke tunnels.

Why this answer

In an ADVPN setup, enabling auto-discovery on the hub allows it to send shortcut route advertisements to spokes, which then can establish direct tunnels. The output confirms the gateway is configured to participate in ADVPN as a hub or as a spoke that can initiate shortcuts.

Practice this question →

57

MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel between Site A (FortiGate) and Site B (third-party VPN peer). The tunnel fails to establish. On FortiGate, phase1 status shows 'up' but phase2 status remains 'down'. What is the MOST likely cause?

A.The phase2 proposal (encryption, authentication, etc.) does not match.

B.The firewall policies at Site B are blocking UDP port 500.

C.The pre-shared key does not match on both sides.

D.The DPD settings are incompatible between the peers.

AnswerA

Why this answer

Phase1 being up indicates IKE SA is established. Phase2 down indicates IPsec SA negotiation failed, typically due to mismatched proposals (encryption, integrity, PFS) or traffic selector mismatch.

Practice this question →

58

MCQmedium

A ZTNA rule is configured to allow access to an internal application only if the client device has the ZTNA tag 'Compliant' and the user is authenticated via SAML. The FortiGate is acting as ZTNA proxy. A user successfully authenticates but the device is not tagged. What happens when the user tries to access the application?

A.The user is denied access

B.The FortiGate dynamically assigns the 'Compliant' tag to the device

C.The user is redirected to a device registration portal

D.The user is granted access because authentication succeeded

AnswerA

The ZTNA rule requires the tag; without it, access is blocked.

Why this answer

ZTNA rules can require both authentication and device posture (ZTNA tags). If the device tag is missing or does not match, the access will be denied. The user may see an access denied page or a generic error.

Practice this question →

59

MCQhard

An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?

A.Auto-discovery is not enabled on the spoke's phase1 configuration

B.The spoke's phase2 proposal includes a different encryption algorithm than the hub

C.The hub does not have a route to the spoke's local subnets

D.The spoke's VPN interface is not in the same VDOM as the hub

AnswerA

Auto-discovery must be enabled in the phase1 settings on both hub and spoke to allow shortcut negotiation. Without it, the spoke will not send or respond to shortcut requests.

Why this answer

In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.

Exam trap

The trap here is that candidates assume auto-discovery only needs to be enabled on the hub, overlooking that each spoke must also have it enabled in its phase1 configuration to participate in shortcut negotiation.

How to eliminate wrong answers

Option B is wrong because mismatched phase2 proposals (e.g., different encryption algorithms) would prevent the spoke from establishing the initial VPN tunnel with the hub, but the question states that the hub-and-spoke VPN is already working (spokes communicate via hub). The issue is specifically about shortcut tunnels not forming, not initial tunnel failure. Option C is wrong because the hub does not need a route to the spoke's local subnets for ADVPN shortcut establishment; the hub only needs routes to the spoke's tunnel IP addresses (or the spoke's public IPs) to forward ADVPN messages.

The spoke's local subnets are advertised via routing protocols (e.g., BGP or OSPF) and are not required for the hub to trigger shortcut negotiation. Option D is wrong because if the spoke's VPN interface were in a different VDOM than the hub, the spoke would not be able to establish any VPN tunnel with the hub at all, but the question implies the hub-and-spoke VPN is operational.

Practice this question →

60

Multi-Selecthard

Which TWO features are required to implement an always-on SSL VPN tunnel with FortiGate that automatically reconnects when the user's network changes?

Select 2 answers

A.Tunnel mode enabled

B.DTLS enabled

C.Auto-connect setting in FortiClient

D.Web mode portal

E.Split tunneling configured

AnswersA, C

Tunnel mode provides a virtual interface for always-on connectivity.

Why this answer

Tunnel mode is required for an always-on SSL VPN tunnel, as it encapsulates all traffic at the network layer (TUN) and maintains a persistent virtual interface on the client. This allows the VPN to stay active and automatically reconnect when the user's network changes, such as switching from Wi-Fi to cellular, without manual intervention.

Exam trap

The trap here is that candidates often confuse DTLS (which improves performance but is optional) with a requirement for always-on connectivity, or they mistakenly think split tunneling is needed for automatic reconnection, when in fact the core requirements are tunnel mode and the auto-connect client setting.

Practice this question →

61

Multi-Selecthard

An organization uses FortiNAC for network access control. They want to enforce that only corporate-managed devices with up-to-date patches can access the production VLAN. Which THREE components must be integrated or configured?

Select 3 answers

A.ZTNA proxy on FortiGate

B.FortiClient EMS with compliance rules

C.SNMP read/write community on network devices

D.IPsec VPN between FortiNAC and FortiGate

E.RADIUS authentication on switches

AnswersB, C, E

Why this answer

For NAC enforcement, FortiNAC typically uses SNMP to query switch port status and RADIUS to authenticate devices. FortiClient EMS provides endpoint compliance data that FortiNAC can use to determine access rights.

Practice this question →

62

MCQhard

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

A.The FortiGate does not have a valid PKI certificate for the ZTNA proxy

B.The user is not authenticated via SAML

C.The FortiClient EMS is not configured as an endpoint control source on the FortiGate

D.The ZTNA rule is using the wrong port number

AnswerC

The FortiGate must have EMS configured under Security Fabric > External Connectors > Endpoint Control. Without this, it cannot retrieve and verify tags from EMS.

Why this answer

ZTNA tags are assigned by FortiClient EMS based on device posture. If the FortiGate does not trust the EMS server or the tag names are mismatched, the tag check fails. The EMS must be configured as an endpoint control source and the tags must exactly match those defined in EMS.

Practice this question →

63

MCQmedium

A FortiGate is configured as a SAML service provider (SP) for ZTNA. Users authenticate via an external IdP. After authentication, users are not able to access applications even though the ZTNA proxy rule lists them. What should the administrator check FIRST?

A.The FortiClient EMS license is invalid

B.The application server is unreachable from FortiGate

C.The ZTNA proxy rule's allowed group does not include the user's group

D.The SAML IdP certificate is expired

AnswerC

After authentication, the user must be in an allowed group to access resources.

Why this answer

When using SAML, the FortiGate needs to map the SAML attributes (e.g., username) to a user group. If the user is not in the correct group, access will be denied.

Practice this question →

64

MCQeasy

An administrator is troubleshooting an IPsec VPN tunnel that connects a branch office to the main office. The tunnel is down. The administrator runs 'diagnose vpn ike gateway list' and sees the following output: IKE gateway: branch state: down DPD: enabled DPD retrycount: 3 DPD retryinterval: 10 What does the DPD configuration indicate?

A.The tunnel will be brought down immediately after the first DPD timeout

B.The tunnel will stay up indefinitely because DPD is disabled

C.The tunnel will be brought down after 3 unanswered DPD probes, each 10 seconds apart

D.DPD will send probes every 30 seconds

AnswerC

This is the correct interpretation of the DPD retrycount and retryinterval.

Why this answer

DPD (Dead Peer Detection) is configured with a retry count of 3 and a retry interval of 10 seconds. This means the FortiGate will send DPD probes every 10 seconds and after 3 consecutive failures (30 seconds total without response), it will consider the peer dead. The tunnel is currently down, likely because DPD detected the peer as unreachable.

Practice this question →

65

MCQmedium

A network administrator configured a hub-and-spoke ADVPN with IKEv2. Spoke sites can establish tunnels to the hub, but shortcut tunnels are not being created between spokes. What is the MOST likely cause?

A.Dead Peer Detection is disabled on the hub

B.Auto-discovery is disabled on the hub FortiGate

C.The spokes are using different IKE versions

D.The IKEv2 authentication method is not set to pre-shared key

AnswerB

Without auto-discovery enabled on the hub, it will not send route advertisements that trigger shortcut tunnel setup between spokes.

Why this answer

In a hub-and-spoke ADVPN with IKEv2, shortcut tunnels between spokes require auto-discovery to be enabled on the hub FortiGate. Auto-discovery allows the hub to exchange IKE information (including NAT-T and IP addresses) between spokes, enabling them to establish direct tunnels. When auto-discovery is disabled on the hub, the hub will not forward the necessary IKE messages (such as the IKE_AUTH exchange with the auto-discovery payload) to other spokes, preventing shortcut tunnel creation.

Exam trap

The trap here is that candidates often assume shortcut tunnels fail due to authentication or IKE version mismatches, but the core ADVPN mechanism specifically requires auto-discovery to be enabled on the hub to relay spoke-to-spoke information, a detail that is easy to overlook in configuration.

How to eliminate wrong answers

Option A is wrong because Dead Peer Detection (DPD) is used to detect loss of connectivity and does not affect the creation of shortcut tunnels; DPD can be disabled without preventing ADVPN shortcut establishment. Option C is wrong because the question explicitly states IKEv2 is configured, and all spokes must use the same IKE version (IKEv2) to participate in the ADVPN; different IKE versions would prevent the initial hub-spoke tunnel from forming, not just shortcut tunnels. Option D is wrong because the IKEv2 authentication method (e.g., pre-shared key, certificates) does not impact ADVPN shortcut tunnel creation; ADVPN works with any supported authentication method as long as the hub and spokes are properly configured.

Practice this question →

66

MCQmedium

A FortiGate administrator is configuring a multi-peer IPsec VPN (dial-up) for remote users. The administrator wants to assign different IP pools to different groups of users based on their authentication group. Which configuration is required?

A.Use the 'set ipv4-start-ip' parameter in the phase1 interface

B.Configure a separate phase1 interface for each user group with a different IP pool

C.Configure a single phase1 interface with multiple IP pools and use group matching in the firewall policy

D.Use RADIUS to assign IP addresses per user

AnswerB

Each dial-up phase1 can have its own IP pool; by assigning different groups to different phase1 configurations, different pools are used.

Why this answer

FortiGate can assign IP pools based on user groups when using IKE with XAuth or IKEv2. The 'set ipv4-dns-server' and 'set ipv4-exclude-range' are not group-based. The 'set user-group' in phase1 associates a group with the tunnel, but IP pool per group requires separate phase1 configurations or using 'set ipv4-start-ip' with group mapping.

Practice this question →

67

Multi-Selecthard

An administrator is troubleshooting an OSPF over IPsec VPN overlay. The OSPF neighbor state is stuck in EXSTART. The VPN tunnel is up. Which TWO issues could cause this?

Select 2 answers

A.IP fragmentation issue due to GRE/IPsec overhead

B.OSPF hello/dead interval mismatch

C.OSPF area ID mismatch

D.IPsec phase2 proposal mismatch

E.MTU mismatch on the tunnel interface

AnswersA, E

Why this answer

A stuck EXSTART state often indicates issues with the maximum transmission unit (MTU) or fragmentation, preventing OSPF packets from being exchanged properly. MTU mismatch or fragmentation due to encapsulation overhead can cause this.

Practice this question →

68

MCQmedium

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

A.Install a CA-signed certificate on FortiClient

B.Create a firewall policy from the WAN interface to the application server

C.Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application

D.Configure the application server to accept connections from FortiClient's IP range

AnswerC

The ZTNA gateway receives traffic from FortiClient and forwards it to the internal application. The access proxy rule defines the mapping and access control.

Why this answer

To allow FortiClient to forward traffic to the ZTNA gateway, the FortiGate must be configured as a ZTNA gateway with an access proxy rule that maps the application to a specific hostname and port. FortiClient then connects to the ZTNA gateway's proxy address, which forwards traffic to the internal application server. Option A is incorrect because a CA-signed certificate is not required for FortiClient; FortiGate can use a self-signed certificate for ZTNA.

Option B is incorrect because a firewall policy from WAN to the application server would bypass ZTNA and expose the server directly. Option D is incorrect because the application server does not need to trust FortiClient's IP range; ZTNA uses identity-based access, not IP-based.

Practice this question →

69

Multi-Selecthard

Which THREE of the following are valid methods to deliver ZTNA tags to FortiClient? (Select three.)

Select 3 answers

A.FortiClient configuration profiles

B.SNMP

C.DHCP options

D.FortiClient EMS

E.FortiGate ZTNA tag delivery

AnswersA, D, E

Profiles can include tag assignments.

Why this answer

FortiClient configuration profiles allow administrators to define and push ZTNA tags directly to FortiClient endpoints via the EMS-managed policy framework. This is a core method because tags are applied based on device posture and user identity, enabling granular access control without relying on network-layer attributes.

Exam trap

The trap here is that candidates often confuse network-layer provisioning methods (like DHCP options or SNMP) with application-layer tag delivery mechanisms, assuming any protocol that can carry data can deliver ZTNA tags, but only EMS, FortiClient profiles, and FortiGate ZTNA tag delivery are designed for this purpose.

Practice this question →

70

MCQeasy

An organization wants to implement Zero Trust Network Access (ZTNA) for remote users accessing an internal application. The application is hosted on a server that cannot have any client software installed. Which ZTNA deployment method is MOST appropriate?

A.FortiNAC with agent on the server

B.IPsec VPN with full tunnel

C.ZTNA proxy (reverse proxy) with FortiClient for posture

D.SSL VPN with web mode

AnswerC

In proxy mode, the FortiGate terminates the client connection and proxies it to the application server. The server does not require any software; all posture enforcement is on the client side via FortiClient.

Why this answer

ZTNA can be deployed in proxy-based or agent-based modes. For applications that cannot have a client software, the proxy-based method (where FortiGate acts as a reverse proxy) is ideal. The user's FortiClient can still provide posture data, but the application server does not need an agent.

Practice this question →

71

MCQmedium

An administrator needs to integrate FortiGate with FortiNAC for network access control. The goal is to dynamically quarantine endpoints that have out-of-date antivirus software. Which component is responsible for enforcing the quarantine on the network?

A.FortiNAC's Network Access Policy (NAP)

B.The RADIUS server used for 802.1X

C.FortiGate firewall policies with ZTNA tags

D.FortiClient EMS compliance rules

AnswerA

Correct. The Network Access Policy (NAP) in FortiNAC is the component that defines quarantine actions and enforces them on the network.

Why this answer

FortiNAC's Network Access Policy (NAP) defines the conditions and actions for enforcing network access. When an endpoint is found to have out-of-date antivirus, the NAP triggers a quarantine action, such as moving the endpoint to a quarantine VLAN or applying an ACL. This makes FortiNAC's NAP the component responsible for enforcing the quarantine on the network.

Other options: the RADIUS server handles authentication but not enforcement; FortiGate ZTNA tags are for zero trust access control; FortiClient EMS manages compliance but does not enforce network quarantine directly.

Practice this question →

72

Multi-Selecthard

An administrator is troubleshooting a ZTNA application access issue. Users can authenticate but cannot reach the internal application via the ZTNA proxy. The FortiGate's ZTNA rule uses a tag requiring 'OS Type = Windows' and 'Antivirus = running'. The device meets both conditions. Which THREE possible reasons could cause the access failure?

Select 3 answers

A.The ZTNA proxy's destination is pointing to the wrong internal IP or port.

B.The firewall policy for ZTNA traffic is not configured or is misordered.

C.The FortiGate's SSL certificate for the ZTNA proxy is not trusted by the client.

D.The user is not assigned the ZTNA tag in the FortiClient EMS portal.

E.The device does not have FortiClient installed.

AnswersA, B, C

Why this answer

The device meets the ZTNA tag conditions (OS Type=Windows, Antivirus=running), so D (tag assignment) and E (FortiClient installation) are not the cause. Access failure can occur if: A) the ZTNA proxy's destination points to the wrong internal IP or port, B) the firewall policy for ZTNA traffic is not configured or is misordered, or C) the FortiGate's SSL certificate for the ZTNA proxy is not trusted by the client. These are the three most common reasons when posture is satisfied.

Practice this question →

73

MCQeasy

A FortiGate administrator enables Dead Peer Detection (DPD) on an IPsec VPN tunnel. What is the primary purpose of DPD?

A.To dynamically adjust the tunnel MTU

B.To encrypt the IKE negotiation traffic

C.To automatically renegotiate the IKE SA before it expires

D.To detect when the remote peer is no longer reachable

AnswerD

DPD sends periodic messages to verify the peer is alive.

Why this answer

DPD is used to monitor the liveness of the remote peer. If the peer becomes unreachable, DPD detects it and can trigger a failover or tunnel teardown, ensuring traffic does not blackhole.

Practice this question →

74

MCQhard

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

A.The remote gateway's certificate is expired

B.The phase2 proposal is mismatched

C.Dead Peer Detection (DPD) retry interval is too short

D.The pre-shared key is incorrect

AnswerC

Aggressive DPD can cause false timeouts and tunnel flapping.

Why this answer

Tunnel flapping with IKEv2 is often due to DPD mismatches or aggressive DPD retry intervals. If DPD is configured with very short intervals, the tunnel may drop due to transient delays.

Practice this question →

75

Multi-Selectmedium

A company wants to provide external contractors with access to a specific internal web application without granting full network access. The solution must authenticate the user, verify device compliance, and log all access. Which three Fortinet features should be combined to meet these requirements? (Choose THREE)

Select 3 answers

A.FortiNAC

B.SSL deep inspection

C.ZTNA proxy

D.FortiClient EMS with compliance enforcement

E.IPsec VPN with XAuth

AnswersB, C, D

Deep inspection decrypts HTTPS traffic for logging and security scanning.

Why this answer

ZTNA provides application-specific access with authentication and logging. FortiClient EMS enforces device compliance (posture). SSL deep inspection is required for decryption to log content.

This combination meets all requirements.

Practice this question →

Page 1 of 3 · 184 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Advanced VPN and Zero Trust questions.

Start 20-question session