Courseiva

CCNA Advanced VPN and Zero Trust Questions

75 of 184 questions · Page 2/3 · Advanced VPN and Zero Trust · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQhard

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

A.Split tunneling settings
B.SSL VPN web portal settings
C.Firewall policy allowing ICMP
D.DNS server configuration
AnswerC

The firewall policy for SSL VPN traffic must permit ICMP protocol in addition to TCP/80 and TCP/443.

Why this answer

SSL VPN tunnels typically allow TCP-based traffic like HTTP/HTTPS to internal web servers, but ICMP (ping) is a separate protocol that requires explicit permission in the firewall policy. Without a firewall policy rule permitting ICMP from the SSL VPN interface to the internal network, the FortiGate will drop the ping requests, even though the tunnel is established and other traffic flows.

Exam trap

The trap here is that candidates assume split tunneling or DNS is the cause, but the real issue is that ICMP is a separate protocol that must be explicitly permitted in the firewall policy, unlike TCP-based web traffic.

How to eliminate wrong answers

Option A is wrong because split tunneling controls whether traffic to the internet goes through the VPN tunnel or directly, not the ability to ping internal servers; it does not affect ICMP traffic to internal resources. Option B is wrong because the SSL VPN web portal settings define the web-based interface and bookmarks for users, not the underlying firewall rules that govern ICMP or other protocols. Option D is wrong because DNS server configuration resolves hostnames to IP addresses, but the issue is that ping fails even when using the IP address, indicating a lack of ICMP permission rather than name resolution.

Practice this question →
77
MCQmedium

Refer to the exhibit. Users report that they cannot log in to the SSL VPN portal. The stats show 15 login failures with reason 'auth_fail'. What is the most likely cause?

A.The user 'user1' does not exist
B.The login-attempt-limit is too low
C.The encryption algorithm is set to low
D.The SSL VPN settings do not reference the user group
AnswerD

The configuration is missing 'set user-group' under config vpn ssl settings; thus no group is authorized for login, causing authentication failure.

Why this answer

The 'auth_fail' reason indicates that the authentication request was processed but rejected, typically because the SSL VPN portal is not configured to reference the user group that 'user1' belongs to. Without a group filter or group mapping in the SSL VPN settings, the FortiGate cannot match the user to any allowed group, causing the authentication to fail even if the user credentials are valid.

Exam trap

The trap here is that candidates often assume 'auth_fail' always means a wrong password or missing user, but Fortinet specifically uses 'auth_fail' to indicate a group mismatch when the user exists and the password is correct, testing your understanding of SSL VPN portal-to-group binding.

How to eliminate wrong answers

Option A is wrong because if 'user1' did not exist, the FortiGate would log a 'user not found' error, not 'auth_fail'; 'auth_fail' specifically indicates the user exists but the authentication was denied. Option B is wrong because a low login-attempt-limit would cause 'login-locked' or 'blocked' messages after exceeding attempts, not 'auth_fail' on each failure. Option C is wrong because the encryption algorithm setting (e.g., low, medium, high) affects the SSL cipher strength negotiated during the handshake, not the authentication phase; a mismatch would cause a connection failure, not an 'auth_fail' log.

Practice this question →
78
MCQeasy

An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration uses certificates for authentication. The admin sees the following log message: 'Certificate validation failed: unable to get local issuer certificate.' What is the most likely cause?

A.The peer's certificate has expired
B.The CA certificate that signed the peer's certificate is not imported on the FortiGate
C.The certificate revocation list (CRL) is not configured
D.The local certificate does not match the peer's expected CN
AnswerB

The error 'unable to get local issuer certificate' means the issuing CA is missing.

Why this answer

The error indicates that the FortiGate cannot find the CA certificate that issued the peer's certificate. The CA certificate must be imported and trusted on the FortiGate.

Practice this question →
79
MCQeasy

An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?

A.ZTNA inline CASB
B.NAC with FortiNAC
C.ZTNA tags with device posture checks
D.IPsec VPN with DPD
AnswerC

ZTNA tags can contain posture attributes like antivirus status. The FortiGate can check these tags in the access proxy rule to grant or deny access.

Why this answer

ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.

Practice this question →
80
MCQmedium

A FortiGate administrator configures SAML SSO with FortiGate as the Identity Provider (IdP). Users are redirected to the FortiGate login page, but after successful authentication, they are not redirected back to the service provider. What is a likely cause?

A.SAML authentication timeout is too short
B.The assertion consumer service URL is misconfigured on the FortiGate
C.The ACS URL on the service provider does not match the FortiGate's SAML settings
D.The SP certificate is not imported on the FortiGate
AnswerB

Why this answer

When FortiGate is the IdP, it must have the correct Assertion Consumer Service (ACS) URL to which the SAML response is sent after authentication. A mismatch prevents the redirect back to the SP.

Practice this question →
81
Multi-Selecthard

An administrator is configuring a hub-and-spoke ADVPN with IBGP as the overlay routing protocol. The hub is configured as a route reflector. Which two conditions must be met for a shortcut tunnel to be established between two spokes? (Choose TWO)

Select 2 answers
A.The hub must have a route to the spoke's subnet via the IPsec tunnel
B.The spokes must use overlapping IPsec proposal sets
C.The hub must have 'set auto-discovery-shortcut-mode both'
D.The spokes must be in the same VDOM
E.The spokes must have 'set auto-discovery-shortcut-mode client' enabled
AnswersA, E

The hub needs to have the route in its routing table to advertise to other spokes.

Why this answer

For shortcut tunnels to establish, the hub must send a shortcut offer to the spokes. This requires that the hub learns the route from one spoke via IBGP and reflects it to the other spoke. The spoke must also have auto-discovery-shortcut-mode enabled to accept the shortcut.

Additionally, the spokes must be able to communicate directly (no NAT between them).

Practice this question →
82
Multi-Selectmedium

A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)

Select 2 answers
A.Reduce the DPD retry interval to 3 seconds.
B.Increase the phase1 lifetime to 86400 seconds.
C.Change the IKE version to IKEv1.
D.Increase the phase2 rekey time to 8 hours.
E.Enable Dead Peer Detection (DPD) on the tunnel interface.
AnswersD, E

Longer rekey intervals reduce the frequency of rekeying, which can disrupt traffic.

Why this answer

Intermittent packet loss during stable VPN tunnels is often caused by frequent rekey events or DPD misconfiguration. Option D (increase phase2 rekey time to 8 hours) reduces the frequency of rekeying, minimizing packet loss during key regeneration. Option E (enable Dead Peer Detection on the tunnel interface) allows the FortiGate to detect peer failures more reliably without aggressive settings.

Option A (reduce DPD retry interval to 3 seconds) is too aggressive and can cause flapping on lossy links. Option B (increase phase1 lifetime) does not address the packet loss issue, as phase1 rekeying is less frequent. Option C (change to IKEv1) would reduce stability since IKEv2 is more robust and supports faster rekeying.

Exam trap

The trap here is that candidates often think reducing DPD intervals or increasing lifetimes always improves stability, but in reality, aggressive DPD can cause flapping on lossy links, and IKEv2 is inherently more stable than IKEv1 for VPN tunnels.

Practice this question →
83
MCQeasy

In FortiGate's ZTNA, what is the purpose of a 'ZTNA tag'?

A.To identify a device's compliance status and attributes for policy enforcement.
B.To mark packets for quality of service (QoS) prioritization.
C.To label network interfaces for traffic steering.
D.To assign a security level to application traffic.
AnswerA

Why this answer

ZTNA tags are dynamic attributes (e.g., OS type, antivirus status) assigned to devices based on posture checks. They are used in firewall policies to grant access based on device compliance, not for routing or QoS.

Practice this question →
84
Multi-Selectmedium

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Select 3 answers
A.Check if there is a route on the internal network pointing back to the VPN subnet
B.Ensure that NAT is disabled on the VPN policy
C.Increase the MTU on the VPN interface
D.Disable DPD on the VPN phase 1
E.Verify that the firewall policy allows traffic from the VPN IP pool to the internal network
AnswersA, B, E

Without a return route, responses can't reach the VPN clients.

Why this answer

If the internal network lacks a route back to the VPN subnet (e.g., 10.10.10.0/24), return traffic from internal resources will be dropped or misrouted, preventing remote users from accessing those resources even though the IPsec tunnel is established. This is a classic asymmetric routing issue where the FortiGate sends traffic to the internal network, but the internal router has no path back to the VPN client IPs.

Exam trap

The trap here is that candidates often focus on tunnel-level settings like MTU or DPD when the real issue is a missing return route or firewall policy, which are common misconfigurations in IPsec VPN deployments.

Practice this question →
85
MCQmedium

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

A.Static routes on spokes
B.IKEv1 with mode-config
C.GRE over IPsec
D.ADVPN with IKEv2
AnswerD

ADVPN uses IKEv2 to dynamically establish shortcut tunnels.

Why this answer

ADVPN (Auto Discovery VPN) enables shortcut tunnels between spokes after initial hub communication, allowing direct traffic.

Practice this question →
86
MCQhard

During a ZTNA deployment, an administrator notices that traffic from a specific internal application is being routed through the ZTNA gateway but is not reaching the destination server. The FortiGate policy allows the traffic, and the client has a valid ZTNA connection. What is the most likely cause of the issue?

A.The ZTNA proxy rule on the FortiGate is misconfigured, pointing to the wrong destination IP or port.
B.The client's FortiClient agent is not connected to the EMS server.
C.The destination server does not have internet connectivity.
D.The FortiGate policy is set to deny traffic from the client's subnet.
AnswerA

A misconfigured proxy rule would cause traffic to be sent to the wrong destination.

Why this answer

In a ZTNA deployment, the FortiGate acts as a reverse proxy for internal applications. If the ZTNA proxy rule is misconfigured with an incorrect destination IP or port, the FortiGate will forward the traffic to the wrong backend server or service, causing the connection to fail even though the client has a valid ZTNA connection and the firewall policy permits the traffic.

Exam trap

The trap here is that candidates often assume the issue is with the client's connectivity or the firewall policy, but the key is that a valid ZTNA connection and permissive policy do not guarantee correct proxy forwarding—the proxy rule itself must accurately point to the destination server.

How to eliminate wrong answers

Option B is wrong because the client already has a valid ZTNA connection, which requires the FortiClient agent to be connected to the EMS server for authentication and posture checks; if it were disconnected, the ZTNA connection would not be established. Option C is wrong because the destination server does not need internet connectivity; ZTNA traffic is proxied through the FortiGate, and the server only needs reachability from the FortiGate, not the public internet. Option D is wrong because the question explicitly states that the FortiGate policy allows the traffic, so a deny policy for the client's subnet would contradict that condition.

Practice this question →
87
Multi-Selectmedium

A FortiGate is configured as a ZTNA proxy. The administrator wants to ensure that only devices with a specific ZTNA tag assigned by FortiClient EMS are allowed to access the application. Which two configuration steps are required? (Choose two.)

Select 2 answers
A.Configure a firewall policy with the ZTNA proxy as destination and enable 'allow only ZTNA'
B.Create a firewall policy allowing all traffic to the ZTNA proxy
C.Enable 'set ztna-tag' on the FortiGate interface
D.Create a ZTNA access rule with a condition matching the tag
E.Import the ZTNA tag from EMS into FortiGate
AnswersD, E

Why this answer

To restrict access based on ZTNA tags, the tag must be imported from FortiClient EMS into FortiGate (option E) and then used in a ZTNA access rule condition that matches the tag (option D). This ensures only devices with the specific tag are allowed.

Practice this question →
88
MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

A.IKE debug is not enabled
B.The pre-shared key does not match
C.The tunnel name is misspelled in the filter
D.The remote gateway is unreachable
AnswerA

Why this answer

Without enabling IKE debug, the diagnose command will not show any output even if the tunnel is failing. The log-filter only filters the debug output; debug must be started first.

Practice this question →
89
MCQmedium

An administrator notices that after upgrading FortiOS, the ADVPN shortcut tunnels are no longer being established. The hub and spokes have the same ADVPN configuration as before. What is the most likely cause?

A.The spokes do not have routes to each other's networks via the hub
B.The IKE version changed to IKEv1
C.Dead Peer Detection (DPD) is disabled on the tunnel
D.The hub's ADVPN configuration was reset during upgrade
AnswerA

Shortcut tunnels are triggered when a spoke has traffic to another spoke's network but no direct route; if routing is not working (e.g., BGP not advertising), shortcuts won't be negotiated.

Why this answer

ADVPN shortcut tunnel initiation may require proper routing. If dynamic routing (e.g., BGP or OSPF) is not advertising the spoke networks to each other, spokes won't have routes to trigger shortcuts.

Practice this question →
90
MCQhard

During a ZTNA implementation, the administrator configures a ZTNA rule for an internal application but users cannot connect. The FortiGate policy is correct and the application is reachable from the FortiGate. What is the most likely misconfiguration?

A.The firewall policy is set to deny traffic from the ZTNA gateway.
B.The client does not have a route to the internal application.
C.The client's FortiClient agent is not authenticated.
D.The ZTNA rule's proxy destination IP or port is wrong.
AnswerD

The proxy must correctly forward to the internal server.

Why this answer

The ZTNA rule defines the mapping between the external proxy address and the internal application's actual IP and port. If the proxy destination IP or port is misconfigured, the FortiGate's ZTNA proxy cannot forward traffic to the correct internal server, even though the firewall policy and network connectivity are otherwise valid. This is a common misconfiguration when the internal application's IP or service port differs from what is specified in the ZTNA rule.

Exam trap

The trap here is that candidates often confuse ZTNA rule misconfiguration with firewall policy issues or client-side routing, but the exam specifically tests that the ZTNA rule's proxy destination must exactly match the internal application's IP and port for the proxy to forward traffic correctly.

How to eliminate wrong answers

Option A is wrong because the firewall policy for ZTNA must permit traffic from the ZTNA gateway (the proxy IP) to the internal application; a deny rule would explicitly block the proxy, but the question states the policy is correct. Option B is wrong because the client does not need a direct route to the internal application; in ZTNA, the client connects only to the FortiGate's external proxy IP, and the FortiGate handles routing to the internal application. Option C is wrong because while FortiClient authentication is required for ZTNA access, the question states users cannot connect despite a correct policy and reachable application, implying the authentication is likely successful; the issue is specifically with the ZTNA rule's proxy destination mapping.

Practice this question →
91
MCQeasy

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal web application. The current network uses FortiGate as the firewall. Which component is required to enforce ZTNA policies on the FortiGate?

A.FortiSandbox for content inspection
B.FortiAnalyzer for log analysis
C.FortiGate ZTNA proxy configuration
D.FortiAuthenticator for RADIUS authentication
AnswerC

The FortiGate acts as a ZTNA proxy/gateway that authenticates users and checks device posture before allowing access.

Why this answer

ZTNA on FortiGate requires the FortiGate to be configured as a ZTNA proxy (gateway) that intercepts traffic to internal applications and enforces access policies. Option C is correct because the FortiGate must have the ZTNA proxy configuration to act as the enforcement point. Options A, B, and D are not directly responsible for enforcing ZTNA policies; FortiSandbox is for sandboxing, FortiAnalyzer for logging, and FortiAuthenticator for authentication services, but the enforcement itself is done by the FortiGate ZTNA proxy.

Practice this question →
92
MCQeasy

An administrator wants to configure a multi-peer IPsec VPN where one FortiGate (hub) connects to multiple remote FortiGates (spokes) using a single phase 1 interface with dynamic IP addresses. Which configuration is required on the hub?

A.Set psksecret to a group password and enable XAuth
B.Set mode to aggressive and use pre-shared keys
C.Set type to static and configure each peer's IP in separate phase1
D.Set type to dynamic and set remote-gw 0.0.0.0
AnswerD

Dynamic type with remote-gw 0.0.0.0 allows any peer to initiate the tunnel.

Why this answer

To allow multiple peers to connect with dynamic IPs, the hub must use a phase 1 interface with mode-cfg enabled to assign IPs to clients and accept connections from any remote IP (set remote-gw 0.0.0.0). This is commonly called a dial-up VPN configuration.

Practice this question →
93
MCQmedium

An administrator is troubleshooting a ZTNA access issue. Remote users can connect to the FortiGate's ZTNA proxy, but when they try to access the internal application, they receive a 403 Forbidden error. The administrator has verified that the user is authenticated and the ZTNA rule is configured correctly. What is the most likely cause?

A.The FortiGate firewall policy allowing ZTNA traffic is missing
B.The user's device does not have the required ZTNA tags from EMS
C.The application server does not have a valid certificate
D.The ZTNA proxy is configured with the wrong port for the application
AnswerB

ZTNA rules evaluate device posture via tags. If the device lacks the required tag (e.g., antivirus enabled), the rule denies access with a 403.

Why this answer

A 403 Forbidden error in ZTNA typically indicates that the access control rule denied the request. This can happen if the device does not meet the required posture checks (ZTNA tags). Option B is correct because the ZTNA rule likely requires a specific tag that the device does not have, resulting in denial.

Practice this question →
94
MCQhard

A FortiGate is configured with FortiClient EMS to enforce ZTNA posture checks. The administrator finds that some Windows 10 clients are not reporting their antivirus status correctly, causing them to be blocked. However, the clients have antivirus installed and running. What is the most likely cause?

A.The FortiClient EMS connector is disabled on the endpoints
B.The clients are not connected to the corporate network
C.The antivirus definitions are outdated
D.FortiGate is using the wrong EMS tag
AnswerA

If the EMS connector is disabled, FortiClient cannot communicate posture information to the FortiGate.

Why this answer

FortiClient requires the EMS connector to be enabled and the correct compliance profile must be applied. If the antivirus status is not reported, the connector might be disabled or the profile not assigned.

Practice this question →
95
MCQeasy

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is hosted on a server with IP 10.1.1.100. Which component acts as the intermediary between users and the application in FortiGate ZTNA?

A.FortiClient EMS
B.ZTNA agent on the application server
C.ZTNA proxy on FortiGate
D.ZTNA tags assigned to the application server
AnswerC

FortiGate acts as a ZTNA gateway, hosting the proxy that terminates user connections and forwards to internal apps.

Why this answer

FortiGate ZTNA uses a reverse proxy to forward user connections to internal applications. Users connect to the proxy, which verifies identity and posture before proxying traffic to the application server.

Practice this question →
96
MCQeasy

What is the purpose of Dead Peer Detection (DPD) in an IPsec VPN?

A.Detect loss of connectivity to the remote VPN peer
B.Detect if the VPN tunnel is using the correct encryption algorithm
C.Detect duplicate IP addresses on the network
D.Detect packet loss over the VPN tunnel
AnswerA

DPD monitors the liveness of the remote VPN peer. If the peer becomes unreachable, DPD detects it and the tunnel can be torn down.

Why this answer

DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

Practice this question →
97
MCQhard

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

A.The internal application is not responding to the proxy request.
B.The ZTNA proxy idle timeout is set to a lower value than the global timeout.
C.The internal application has a 5-second timeout.
D.The client's FortiClient is not receiving the ZTNA tags.
AnswerB

The proxy idle timeout can be configured separately and may be shorter.

Why this answer

The ZTNA proxy has its own idle timeout setting that operates independently of the global timeout. Even though the global timeout is set to 30 minutes, if the per-proxy idle timeout is configured to a lower value (e.g., 30 seconds), the proxy will terminate the session after that idle period, logging 'ZTNA session timeout'. This explains why the connection fails after a few seconds despite the long global timeout.

Exam trap

The trap here is that candidates assume 'ZTNA session timeout' refers to the global timeout value, overlooking that the ZTNA proxy has its own independent idle timeout that defaults to a much shorter interval.

How to eliminate wrong answers

Option A is wrong because if the internal application were not responding, the FortiGate would log a different error such as 'connection refused' or 'upstream timeout', not a 'ZTNA session timeout'. Option C is wrong because a 5-second timeout on the internal application would cause an upstream timeout or 504 error, not a ZTNA session timeout, and the log message specifically points to the proxy's idle timeout. Option D is wrong because if FortiClient were not receiving ZTNA tags, the user would not be able to access the ZTNA gateway at all; the issue occurs after successful gateway access, ruling out tag delivery problems.

Practice this question →
98
MCQhard

A FortiGate administrator runs the following command on a FortiGate and sees the output: diagnose sys session filter dport 443 diagnose sys session list proto=6 proto_state=01 duration=3600 expire=3599 What does this output indicate about the session?

A.The session is in SYN_SENT state; the three-way handshake is incomplete
B.The session has been terminated due to inactivity
C.The session is a UDP session
D.The session is fully established and has been active for 3600 seconds
AnswerA

proto_state=01 corresponds to TCP SYN_SENT, meaning the session is waiting for SYN-ACK.

Why this answer

proto_state=01 indicates TCP SYN_SENT state, meaning the session has not completed three-way handshake.

Practice this question →
99
MCQhard

You run 'diagnose vpn ike gateway list' on a FortiGate hub and see the following output for a spoke connection: IKE SA state: ESTABLISHED, IPsec SA state: UP, but the spoke cannot route traffic to other spokes. The ADVPN shortcut tunnel is not being established. What is the MOST likely cause?

A.DPD is not configured on the hub
B.The hub has a static route for the spoke subnet pointing to the tunnel interface
C.The spoke's phase2 proposal does not match the hub's proposal
D.The spoke is using a different IKE version than the hub
AnswerB

When the hub has a static route for a spoke subnet, it becomes the next hop for traffic between spokes, preventing shortcut establishment. ADVPN requires the hub to not have static routes for spoke subnets; it should rely on dynamic routing to propagate routes but not as a next-hop.

Why this answer

In ADVPN, the hub must not include static routes for the spoke subnets, otherwise the spokes will use the hub as next-hop and not attempt shortcut establishment. The hub should use dynamic routing (BGP/OSPF) to propagate routes but not install a route with a next-hop of the hub itself for other spoke subnets. Option B is correct.

Practice this question →
100
MCQhard

A FortiGate is configured with ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing credit card numbers. Which ZTNA inline CASB feature should be used?

A.Web filter profile
B.Data leak prevention (DLP) profile
C.Antivirus profile
D.Application control profile
AnswerB

DLP can detect sensitive data like credit card numbers and block or log the action.

Why this answer

ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Practice this question →
101
MCQmedium

A FortiGate administrator configures a hub-and-spoke VPN with OSPF routing. The spoke FortiGates are learning routes from the hub, but inter-spoke traffic is being routed through the hub instead of using shortcut tunnels. What configuration is missing on the hub to allow ADVPN shortcut establishment?

A.Set the VPN interface type to 'tunnel' instead of 'vlan'
B.Disable route redistribution from OSPF into the VPN tunnel interface on the hub
C.Enable 'auto-discovery-sender' on the hub and 'auto-discovery-forwarder' on spokes
D.Configure a static route for inter-spoke traffic on the hub
AnswerB

If the hub redistributes routes between spokes, traffic will always go through hub. ADVPN requires that OSPF does not redistribute; shortcuts are triggered by IKE.

Why this answer

For ADVPN to work, the hub must have 'auto-discovery-sender' enabled and also must not redistribute spoke routes back to other spokes in a way that prevents shortcut. Typically, the hub should not redistribute OSPF routes learned from one spoke into another; ADVPN relies on IKE shortcuts.

Practice this question →
102
MCQeasy

Which feature in FortiOS enables a FortiGate to act as a proxy for client-initiated connections to internal applications without requiring a VPN client, by verifying device posture and user identity?

A.IPsec VPN with XAuth authentication
B.SSL VPN with web mode portal
C.FortiGate's explicit web proxy
D.ZTNA (Zero Trust Network Access) proxy
AnswerD

Why this answer

ZTNA proxy provides application-level access without full network connectivity, enforcing identity and posture checks. IPsec and SSL VPN give full network access. Explicit proxy is for web traffic only.

Practice this question →
103
MCQmedium

A FortiGate administrator is configuring a site-to-site IPsec VPN with IKEv2. The remote peer supports multiple proposals. The administrator wants to ensure that the VPN tunnel uses AES256-GCM for encryption and SHA256 for integrity. Which configuration setting should be used to enforce this preference?

A.Set the 'proposal' list with AES256-GCM and SHA256 as the first entry
B.Enable 'set proposal-mode strict'
C.Use IKEv2 rekey to change the proposal after initial handshake
D.Configure a phase2 selectors with the exact traffic of interest
AnswerA

The order of proposals defines priority; the first matching proposal is selected. Placing AES256-GCM/SHA256 first ensures it is preferred.

Why this answer

In IKEv2, the proposal order determines the preference. The first matching proposal is used. To enforce AES256-GCM and SHA256, the administrator should set those as the first proposal in the phase1 and phase2 configuration.

Practice this question →
104
MCQeasy

An administrator needs to configure a site-to-site IPsec VPN with a remote FortiGate that has a dynamic IP address. Which phase1 parameter must be set to support this?

A.Enable Perfect Forward Secrecy (PFS)
B.Enable NAT traversal
C.Use certificate-based authentication
D.Set mode to aggressive and use a pre-shared key
AnswerD

Aggressive mode allows the responder to initiate without knowing the peer IP; pre-shared key is used for authentication.

Why this answer

When the remote FortiGate has a dynamic IP address, the local FortiGate cannot initiate the VPN because it does not know the remote peer's IP. Setting the phase1 mode to aggressive and using a pre-shared key allows the remote peer to initiate the connection by sending its identity (ID) in the first exchange, enabling the local FortiGate to identify and authenticate the peer without requiring a static IP address for the remote side.

Exam trap

The trap here is that candidates often confuse NAT traversal (which handles NAT devices) with the need for a dynamic IP peer, or they assume certificate-based authentication alone solves the issue, but the key requirement is the ability to identify the peer without a known IP address, which aggressive mode enables.

How to eliminate wrong answers

Option A is wrong because Perfect Forward Secrecy (PFS) is a phase2 parameter that ensures that if a private key is compromised, past session keys are not exposed; it does not address dynamic IP peer identification. Option B is wrong because NAT traversal is used to handle IPsec packets traversing NAT devices by encapsulating them in UDP, not to support a peer with a dynamic IP address. Option C is wrong because certificate-based authentication can be used with either main or aggressive mode, but it does not solve the problem of a dynamic IP peer; aggressive mode with a pre-shared key is specifically required to allow the peer to initiate without a known IP.

Practice this question →
105
MCQmedium

A FortiGate is configured with a ZTNA access proxy rule for a web application. The administrator wants to enforce that only devices with a specific FortiClient tag (e.g., 'Compliant') can access the application. Where is this tag-based access control configured?

A.In the FortiClient EMS policy
B.In the firewall policy that permits traffic from the ZTNA gateway to the application
C.In the SSL inspection profile
D.In the ZTNA access proxy rule under the ZTNA gateway configuration
AnswerD

The access proxy rule includes conditions such as device tags (e.g., Compliant) to determine if access is allowed.

Why this answer

In FortiGate ZTNA, device posture tags from FortiClient are evaluated in the ZTNA access proxy rule under the ZTNA gateway configuration. The administrator configures the tag match condition directly in the access proxy rule, not in a firewall policy, SSL profile, or EMS policy. Therefore, option D is correct.

Practice this question →
106
MCQeasy

An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?

A.FortiNAC Collector
B.FortiNAC Profiler
C.FortiNAC Enforcement Engine
D.FortiNAC Portal
AnswerC

The Enforcement Engine applies the policy actions (e.g., quarantine) based on compliance state.

Why this answer

FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.

Practice this question →
107
MCQmedium

A FortiGate administrator configures a ZTNA access proxy rule to allow access to an internal application only if the user's device has the tag 'Compliant'. The tag is assigned by FortiClient EMS. However, a user with a compliant device is still blocked. The admin sees in the ZTNA logs that the tag is not being received. What should the administrator check FIRST?

A.Verify that the FortiClient is connected to the internet
B.Confirm that the ZTNA rule is enabled and using the correct port
C.Check if the application server is reachable from the FortiGate
D.Ensure the EMS connector is configured under Security Fabric > External Connectors
AnswerD

The Endpoint Control connector to EMS must be configured and authorized. Without this, FortiGate cannot receive any tags from EMS.

Why this answer

For ZTNA tags to be sent to FortiGate, the FortiClient must be registered with EMS and the EMS must be configured as an endpoint control connector on FortiGate. If the connector is missing or misconfigured, FortiGate cannot retrieve tags.

Practice this question →
108
MCQmedium

You run the following command on a FortiGate: 'diagnose vpn ike gateway list' and see that the DPD status for a VPN peer is 'dead'. What does this indicate?

A.The remote peer has been manually disconnected from the network
B.The VPN tunnel is still up but the peer is not responding to DPD messages
C.The IKE SA is still active but the IPsec SA has expired
D.The VPN peer has been detected as unreachable and the tunnel is considered down
AnswerD

DPD status 'dead' means the peer is not responding, so FortiGate marks the tunnel as down.

Why this answer

DPD (Dead Peer Detection) is used to check the liveness of a VPN peer. 'Dead' means the peer is not responding to DPD messages, indicating the tunnel is down.

Practice this question →
109
MCQeasy

An administrator wants to enforce that only managed FortiClient endpoints with up-to-date antivirus and a specific OS version can access a sensitive internal network via IPsec VPN. Which feature should be used to achieve this?

A.ZTNA tags
B.FortiNAC
C.SAML SSO
D.FortiClient EMS compliance enforcement
AnswerD

FortiClient EMS allows the administrator to define compliance rules and enforce them during VPN connection.

Why this answer

FortiClient EMS can enforce compliance rules such as requiring up-to-date antivirus and specific OS version. When a FortiClient connects to the FortiGate VPN, the FortiGate can check the endpoint's posture via FortiClient EMS and apply a matching firewall policy.

Practice this question →
110
MCQhard

A FortiGate administrator configures a ZTNA rule with inline CASB to control access to a SaaS application. Users can access the application but the CASB controls are not being applied. What is the most likely reason?

A.The firewall policy is configured for flow-based inspection
B.SSL inspection is not enabled
C.The CASB profile is not applied to the ZTNA rule
D.The SaaS application is not supported by FortiGate CASB
AnswerA

Inline CASB requires proxy-based inspection; flow-based mode bypasses CASB processing.

Why this answer

Inline CASB requires a proxy-based firewall policy that intercepts traffic to the SaaS application. If the policy is using flow-based inspection, CASB will not be invoked. Inline CASB works only with proxy-based inspection.

Practice this question →
111
Multi-Selecteasy

An administrator wants to enforce that only devices with the latest antivirus signatures and a corporate disk encryption solution can access a sensitive application via ZTNA. Which two FortiClient EMS components must be configured? (Choose two.)

Select 2 answers
A.Device posture checks
B.VPN tunnels
C.SAML SSO
D.ZTNA tags
AnswersA, D

Device posture checks verify compliance criteria like AV signatures and encryption.

Why this answer

ZTNA tags define compliance requirements, and device posture checks evaluate endpoint security state. Together they enable conditional access based on endpoint compliance.

Practice this question →
112
Drag & Dropmedium

Drag and drop the steps to configure a FortiGate as a DHCP server into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence to configure a FortiGate as a DHCP server is: first select the interface that will serve DHCP, then enable DHCP on that interface, set the IP address scope (range), configure additional options such as default gateway and DNS servers, and finally apply the configuration. This order ensures dependencies are met and the configuration is valid.

Practice this question →
113
MCQeasy

An administrator wants to ensure that FortiGate validates the identity of the remote VPN peer using a certificate during IKEv2 phase 1. Which authentication method should the administrator select in the IPsec phase 1 configuration?

A.Aggressive mode
B.Pre-shared key
C.EAP
D.Signature (RSA)
AnswerD

Signature authentication uses digital certificates to verify identity.

Why this answer

IKEv2 supports certificate-based authentication (RSA signature) for peer identity verification.

Practice this question →
114
MCQmedium

A FortiGate is configured as a SAML identity provider (IdP) for a partner's SaaS application (SP). Users authenticate via FortiGate's local user database. The administrator successfully tests the SAML flow, but after some time, users are prompted to re-authenticate frequently. What is the most likely cause?

A.The FortiGate's SAML service provider certificate has expired
B.The SAML assertion lifetime is configured too short
C.The FortiGate's clock is not synchronized with NTP
D.The SP is using HTTP-POST binding instead of redirect
AnswerB

The assertion lifetime controls how long the SAML assertion is valid. If set too low, users need to re-authenticate when it expires.

Why this answer

SAML assertions have a validity period. If the IdP (FortiGate) sets a short assertion lifetime or the SP's session timeout is shorter, users will be prompted to re-authenticate. The most common cause is the assertion lifetime being too short.

Practice this question →
115
MCQhard

An administrator is configuring ZTNA inline CASB for a SaaS application. The goal is to block upload of files containing credit card numbers. Which configuration components are required?

A.Use FortiClient to enforce DLP on endpoints
B.Configure an IPsec VPN between FortiGate and the SaaS provider
C.Configure a ZTNA application with a CASB profile and SSL inspection
D.Configure a web filter profile with DLP sensor
AnswerC

CASB requires the proxy to decrypt traffic and apply CASB policies.

Why this answer

ZTNA inline CASB uses a ZTNA proxy with SSL inspection and a CASB profile that includes a data leak prevention (DLP) rule to detect credit card numbers.

Practice this question →
116
Multi-Selecthard

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

Select 3 answers
A.NAT traversal is enabled on all gateways
B.Spokes are configured with 'set auto-discovery' enabled
C.IKEv1 is used for the spoke-to-hub tunnels
D.The hub's phase2 configuration has 'auto-negotiate' enabled
E.The hub's phase2 configuration includes 'add-route'
AnswersB, D, E

Spokes need auto-discovery to accept shortcut proposals.

Why this answer

ADVPN shortcut tunnels require: IKEv2 (not IKEv1), auto-negotiate enabled on the hub phase2, and the hub's phase2 must have 'add-route' set to enable route injection. NAT traversal is automatically handled by IKEv2.

Practice this question →
117
MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

A.The firewall policies are not configured to allow traffic through the tunnel
B.The phase 2 proposal (encryption, authentication, etc.) does not match between peers
C.The pre-shared key on both sides does not match
D.The interface MTU is set too low
AnswerB

Phase 2 negotiations fail if the proposal is mismatched, leading to no IPsec SA.

Why this answer

IKE SA established but no IPsec SA indicates that phase 2 parameters are misconfigured or the proposal is not matching.

Practice this question →
118
MCQhard

An administrator configures a hub-and-spoke ADVPN with FortiGate at the hub and multiple remote sites. After setup, spokes establish shortcuts directly. However, traffic between two spokes consistently goes through the hub even though shortcuts should exist. Running 'diagnose npu np6 ipsec peercache' shows no shortcut entries. What is the MOST likely reason?

A.The spokes are not running BGP over the ADVPN tunnels.
B.The firewall policies on the spokes do not allow shortcut traffic.
C.Shortcut tunnels are disabled on the hub phase1 configuration.
D.The network processor (NP6) is not enabled for IPsec acceleration.
AnswerA

Why this answer

In a hub-and-spoke ADVPN, BGP is required to propagate the spoke's private IP addresses (used as tunnel endpoints) across the overlay network. Without BGP, spokes do not learn each other's tunnel IPs, so they cannot initiate shortcut tunnels. The 'diagnose npu np6 ipsec peercache' command shows no shortcut entries because the shortcut negotiation never starts.

Exam trap

The trap here is that candidates often assume shortcut tunnels are automatically established once ADVPN is configured, overlooking the critical requirement of a dynamic routing protocol (BGP) to exchange tunnel endpoint addresses between spokes.

How to eliminate wrong answers

Option B is wrong because firewall policies on spokes control traffic forwarding, not the establishment of shortcut tunnels; if shortcuts are not formed, traffic will be forwarded via the hub regardless of policies. Option C is wrong because shortcut tunnels are enabled by default on the hub phase1 configuration, and disabling them would prevent all shortcut creation, but the question states shortcuts should exist, implying the hub configuration is correct. Option D is wrong because NP6 IPsec acceleration is a hardware offload feature that affects performance, not the control-plane logic of shortcut tunnel establishment.

Practice this question →
119
Multi-Selectmedium

A FortiGate administrator needs to configure a hub-and-spoke ADVPN with OSPF as the routing protocol over the VPN tunnels. Which TWO steps are required on the hub FortiGate to enable shortcut tunnels?

Select 2 answers
A.Set 'add-route' to 'disable' on the phase2 configuration.
B.Enable 'shortcut' option under the phase2 configuration.
C.Enable 'auto-discovery-sender' on the hub's phase1 configuration.
D.Enable 'auto-discovery-receiver' on the hub's phase1 configuration.
E.Configure OSPF network type as 'broadcast' on the hub's tunnel interface.
AnswersB, C

Why this answer

Enabling the 'shortcut' option under the phase2 configuration on the hub FortiGate allows the hub to advertise shortcut tunnel capabilities to spoke devices. This is essential for establishing direct spoke-to-spoke tunnels in an ADVPN setup, as it triggers the dynamic negotiation of shortcut paths when traffic patterns warrant them.

Exam trap

The trap here is that candidates often confuse the roles of 'auto-discovery-sender' and 'auto-discovery-receiver', mistakenly enabling the receiver on the hub instead of the sender, which would prevent the hub from initiating shortcut offers to spokes.

Practice this question →
120
MCQhard

In a hub-and-spoke ADVPN deployment, the spoke FortiGates are configured with IKEv2 and the hub has ADVPN enabled. After initial setup, spokes communicate through the hub. The administrator wants to enable shortcut tunnels so that spokes can directly communicate. What additional configuration is required on the spokes?

A.Enable 'set auto-discovery-sender' on the spoke's phase 1 interface
B.Enable 'set add-route' on the hub's phase 1 configuration
C.Set 'set dpd retrycount' to a higher value on the spoke
D.Configure a static route on the spoke pointing to the hub
AnswerA

The spoke must be configured as auto-discovery sender to initiate shortcut tunnels.

Why this answer

In ADVPN, shortcut tunnels allow spokes to communicate directly without traversing the hub. For spokes to initiate shortcut setup, they must have 'set auto-discovery-sender' enabled on the phase 1 interface to the hub. This setting allows the spoke to send route information to other spokes via the hub, enabling the hub to assist in shortcut negotiation.

Practice this question →
121
MCQeasy

An organization uses FortiClient EMS to enforce compliance on endpoints. They want to ensure that only devices with updated antivirus definitions can access the corporate VPN. Which FortiClient configuration should be applied?

A.Create a compliance rule in FortiClient EMS to check antivirus definitions
B.Use a firewall policy to block traffic from non-compliant devices
C.Configure a ZTNA tag that requires updated antivirus
D.Enable CASB in the ZTNA proxy
AnswerA

EMS allows creating compliance rules that check endpoint posture parameters like antivirus version.

Why this answer

Compliance rules in FortiClient EMS check endpoint posture, such as antivirus status. The rule can be configured to require up-to-date antivirus definitions before allowing VPN access.

Practice this question →
122
MCQhard

An administrator runs the following command on a FortiGate and sees the output: diagnose sys session filter dport 443 diagnose sys session list proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The TCP handshake has not completed; the client sent SYN and is waiting for SYN-ACK
B.The session is fully established and has been idle for 1 hour
C.The session is in FIN_WAIT state and is closing
D.The session is using UDP protocol
AnswerA

proto_state=01 is TCP SYN_SENT state, indicating the initial SYN has been sent but no SYN-ACK received.

Why this answer

The output shows `proto=6` (TCP) and `proto_state=01`, which in FortiGate's session table indicates a TCP SYN_SENT state. The session has been active for 3600 seconds (1 hour) with 3599 seconds remaining, meaning the client sent a SYN but never received a SYN-ACK, so the TCP three-way handshake is incomplete. This is why option A is correct.

Exam trap

The trap here is that candidates often assume `proto_state=01` means an established session because they see a non-zero duration and expire time, but FortiGate uses a different numbering scheme than standard TCP state diagrams.

How to eliminate wrong answers

Option B is wrong because a fully established TCP session would show `proto_state=02` (ESTABLISHED), not `01`, and an idle session would still show established state. Option C is wrong because a FIN_WAIT state would be indicated by `proto_state=04` or `05` (FIN_WAIT_1 or FIN_WAIT_2), not `01`. Option D is wrong because `proto=6` explicitly indicates TCP (protocol 6), not UDP (protocol 17).

Practice this question →
123
MCQmedium

A FortiGate is configured as a ZTNA proxy for an internal web application. The client's device posture check fails due to an outdated antivirus definition. The administrator wants to block access but still display a warning page. Which ZTNA access rule action should be used?

A.set action block
B.set action redirect
C.set action authenticate
D.set action allow
AnswerA

Block action denies access; combined with a warning portal configuration, the user sees a warning.

Why this answer

ZTNA access rules can block or allow with optional warning. 'Allow with warning' is not available; to show a warning while blocking, the action should be 'Block' with a redirect to a warning portal.

Practice this question →
124
MCQeasy

A multinational company uses FortiGate devices as VPN gateways to connect its headquarters (HQ) and branch offices via IPsec VPN tunnels. The company is migrating its remote access solution from IPsec VPN to SSL VPN using FortiClient. Currently, 500 remote users connect via IPsec VPN with pre-shared keys and XAuth authentication. The migration must be seamless with minimal downtime, and users must continue to authenticate using their existing Active Directory credentials. The SSL VPN portal must provide access to internal web applications and some legacy TCP-based applications that do not support HTTP. The security team requires that all traffic between remote users and the internal network be encrypted and that the SSL VPN use a certificate from a public CA to avoid certificate warnings on client devices. The IT team wants to use FortiToken for two-factor authentication (2FA) for all VPN users. Which of the following is the most appropriate course of action to meet all requirements?

A.Configure SSL VPN with a self-signed certificate and use the local password database for authentication. Enable FortiToken and configure the portal to provide both web and TCP forwarding applications.
B.Deploy SSL VPN with a public CA certificate, configure LDAP authentication against Active Directory, enable FortiToken for 2FA, and create a split-tunneling policy that uses both SSL VPN web mode and tunnel mode via FortiClient.
C.Set up SSL VPN with a public CA certificate, use LDAP for authentication, but do not enable FortiToken because it would require a separate token per user.
D.Create a new IPsec VPN configuration using certificate-based authentication and FortiToken, and gradually move users to the new IPsec VPN.
AnswerB

This meets all requirements: appropriate authentication, public CA, 2FA, and access to both web and legacy TCP applications.

Why this answer

It meets all requirements: a public CA certificate avoids client certificate warnings, LDAP authentication against Active Directory allows seamless credential reuse, FortiToken provides the required 2FA, and combining SSL VPN web mode (for web apps) with tunnel mode via FortiClient (for legacy TCP applications) ensures full coverage. This approach minimizes downtime by migrating users gradually without changing their authentication backend.

Exam trap

The trap here is that candidates may think SSL VPN cannot handle non-HTTP applications, but FortiClient's tunnel mode with split tunneling or full tunneling can encapsulate any TCP/UDP traffic, making it suitable for legacy applications.

How to eliminate wrong answers

Option A is wrong because a self-signed certificate would cause certificate warnings on client devices, violating the requirement to avoid such warnings, and using the local password database does not integrate with existing Active Directory credentials. Option C is wrong because it explicitly disables FortiToken, failing the two-factor authentication requirement; the statement that FortiToken requires a separate token per user is incorrect—FortiToken can be assigned per user via the FortiGate or FortiAuthenticator. Option D is wrong because it proposes continuing with IPsec VPN instead of migrating to SSL VPN, and certificate-based authentication does not address the need for SSL VPN portal access to web and legacy TCP applications.

Practice this question →
125
Multi-Selectmedium

An administrator needs to configure a FortiGate to act as a SAML identity provider (IdP) for a third-party cloud application (SP). Which TWO settings must be configured on the FortiGate to function as an IdP?

Select 2 answers
A.LDAP server configuration
B.SAML IdP user group
C.Service provider configuration with ACS URL and entity ID
D.SP metadata import
E.SSL VPN portal
AnswersB, C

Defines the users that can authenticate via SAML.

Why this answer

The FortiGate requires a SAML IdP user group to define which users are allowed to authenticate via SAML. This group is referenced in the SAML IdP configuration to control access and map attributes to the service provider. Without it, the IdP cannot determine which users to authenticate or how to release attributes.

Exam trap

The trap here is that candidates confuse the roles of IdP and SP, assuming metadata import (option D) is needed for the IdP, when in fact it is the SP that imports the IdP's metadata, not the other way around.

Practice this question →
126
MCQmedium

An administrator configures OSPF over an IPsec VPN tunnel between two FortiGates. The OSPF adjacency does not form. The tunnel is up and ping works between the loopback interfaces used for OSPF. What is the MOST likely issue?

A.OSPF is not enabled on the tunnel interface.
B.The OSPF network type on the tunnel interface is set to point-to-point but the remote side is broadcast.
C.The MTU on the tunnel interface is too large for OSPF packets.
D.The firewall policy allowing OSPF traffic (protocol 89) over the tunnel is missing.
AnswerD

Why this answer

Even if the tunnel is up, OSPF packets (protocol 89) must be explicitly permitted by a firewall policy on the tunnel. Without that policy, OSPF Hellos are dropped and adjacency fails. Network type mismatch can also cause issues, but the most common is missing policy.

Practice this question →
127
Multi-Selectmedium

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Select 2 answers
A.FortiClient EMS is added as a security fabric connector
B.The ZTNA proxy rule includes a condition for required ZTNA tags
C.SSL deep inspection is enabled on the firewall policy
D.A local user database is configured for authentication
E.FortiGate is configured as a SAML IdP
AnswersA, B

This allows FortiGate to retrieve tags from EMS.

Why this answer

To use compliance tags, FortiGate must have EMS configured as a fabric connector and the ZTNA proxy rule must reference the tags.

Practice this question →
128
MCQhard

A FortiGate is the SAML Service Provider (SP) for a ZTNA application. The IdP is Azure AD. After successful authentication, the user is redirected to the ZTNA proxy with a '403 Forbidden' error. The ZTNA rule has the correct groups allowed. What is the most likely missing configuration?

A.The IdP is not sending the user's group membership in the SAML assertion.
B.The ZTNA proxy certificate is not trusted by the browser.
C.The SAML user group is not mapped to a FortiGate local group.
D.The FortiGate's clock is not synchronized with the IdP.
AnswerC

Correct. The SAML user group must be mapped to a FortiGate local group for group-based authorization in ZTNA rules.

Why this answer

A 403 error after successful SAML authentication indicates the user was authenticated but not authorized. Since the ZTNA rule has the correct groups allowed, FortiGate cannot match the user to any allowed group. This requires mapping the SAML user group to a FortiGate local group via 'config user saml'.

Option C is correct.

Practice this question →
129
MCQmedium

An administrator configures a ZTNA gateway with inline CASB to monitor SaaS applications. Users report that access to Salesforce is blocked. The administrator reviews the ZTNA proxy rule and sees that inline CASB is enabled with a 'monitor-only' action. What is the MOST likely reason for the block?

A.The inline CASB profile is set to 'block' for Salesforce
B.The ZTNA proxy rule does not have SSL inspection enabled
C.FortiClient EMS is not assigning the required ZTNA tags
D.A separate application control profile is blocking Salesforce
AnswerD

Application control can block SaaS apps independently.

Why this answer

Inline CASB with 'monitor-only' should not block traffic. The block may be due to a separate application control or web filtering profile applied on the policy.

Practice this question →
130
Matchingmedium

Match each SD-WAN component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Physical or virtual interface in SD-WAN zone

Group of interfaces with same role

Defines traffic steering policy

Service Level Agreement for link quality

Monitors link latency, jitter, and packet loss

Why these pairings

Correct matches: SD-WAN Rule → traffic steering; Performance SLA → link quality monitoring; Virtual-WAN-Link → interface grouping. Common confusions mix these roles.

Practice this question →
131
MCQmedium

A company's FortiGate is configured with multiple IPsec VPN tunnels to branch offices. One tunnel keeps dropping and re-establishing every few minutes. The logs show 'IPsec SA negotiation failed' with error 'proposal mismatch'. What is the most likely cause?

A.Dead Peer Detection (DPD) configured too aggressively
B.Mismatched encryption or authentication algorithms between the two VPN peers
C.NAT-Traversal (NAT-T) not enabled
D.Pre-shared key mismatch
AnswerB

Proposal mismatch directly indicates algorithms or parameters don't match.

Why this answer

The error 'proposal mismatch' directly indicates that the two IPsec peers cannot agree on the security parameters for the IKE or IPsec SA. This occurs when the encryption algorithm (e.g., AES256 vs. AES128), authentication algorithm (e.g., SHA256 vs.

SHA1), Diffie-Hellman group, or lifetime values do not match between the FortiGate and the remote peer. The tunnel drops and re-establishes because the negotiation fails, and the FortiGate retries with the same mismatched proposal, leading to repeated failures.

Exam trap

The trap here is that candidates often confuse 'proposal mismatch' with authentication failures (pre-shared key) or connectivity issues (NAT-T/DPD), but the specific log message 'proposal mismatch' is a direct indicator of cryptographic parameter disagreement, not a key or transport layer problem.

How to eliminate wrong answers

Option A is wrong because Dead Peer Detection (DPD) being too aggressive would cause the tunnel to be torn down due to missed keepalives, not a 'proposal mismatch' error; DPD failures generate 'DPD timeout' or 'peer not responding' logs. Option C is wrong because NAT-Traversal (NAT-T) not being enabled would cause issues with UDP encapsulation when a NAT device is present, but the error would be 'no response from peer' or 'NAT detection failed', not a proposal mismatch. Option D is wrong because a pre-shared key mismatch would cause an authentication failure during IKE Phase 1, resulting in 'authentication failed' or 'invalid pre-shared key' errors, not a proposal mismatch.

Practice this question →
132
MCQeasy

An administrator is configuring SSL VPN on FortiGate and wants to allow users to access internal applications via a web portal without installing any client software. Which SSL VPN mode should be used?

A.DTLS
B.Tunnel mode
C.Web mode
D.Split tunneling
AnswerC

Web mode provides clientless access through a web portal.

Why this answer

Web mode (option C) is correct because it enables users to access internal web applications through a FortiGate SSL VPN web portal using only a standard browser, with no client software installation required. The portal acts as a reverse proxy, translating HTTPS requests from the client to the internal application servers, making it ideal for clientless remote access.

Exam trap

The trap here is confusing 'Web mode' with 'Tunnel mode' because both are SSL VPN features, but only Web mode provides clientless access via a browser portal, whereas Tunnel mode always requires the FortiClient software to be installed.

How to eliminate wrong answers

Option A is wrong because DTLS (Datagram Transport Layer Security) is a protocol used to provide low-latency encryption for UDP-based traffic in SSL VPN tunnel mode, not a standalone SSL VPN mode for clientless web portal access. Option B is wrong because Tunnel mode requires the installation of the FortiClient SSL VPN client software on the user's device to create a virtual network interface and route all or specific traffic through the tunnel, which contradicts the requirement of no client software. Option D is wrong because Split tunneling is a routing configuration that determines whether traffic destined for the internet goes through the VPN tunnel or directly to the internet; it is not an SSL VPN mode and does not define how users access applications.

Practice this question →
133
Multi-Selecteasy

A FortiGate is acting as a SAML Service Provider (SP) for user authentication. Which TWO of the following are required for successful SAML SSO?

Select 2 answers
A.The FortiGate must have a static public IP address
B.The IdP's metadata must be imported to the FortiGate
C.The users must be in the same Active Directory domain as the FortiGate
D.A pre-shared key must be configured
E.The SP (FortiGate) must have a certificate for signing SAML requests
AnswersB, E

The metadata contains the IdP's entity ID, endpoints, and signing certificate, which FortiGate needs to trust and communicate.

Why this answer

For SAML SP configuration on a FortiGate, the IdP's metadata (including the IdP's certificate and endpoints) must be imported to establish trust (B). Additionally, the SP (FortiGate) must have a certificate for signing SAML requests and optionally for encryption (E). Options A, C, and D are not required for SAML SSO to function.

Practice this question →
134
Multi-Selectmedium

Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?

Select 3 answers
A.Proxy IDs (local and remote subnets) match on both sides
B.Firewall policies allow traffic between the subnets
C.Perfect Forward Secrecy (PFS) settings match if enabled
D.Phase2 proposals match between peers
E.NAT traversal is enabled on both sides
AnswersA, C, D

Phase2 uses proxy IDs to define interesting traffic; they must match.

Why this answer

IPsec Phase 2 uses Proxy IDs (local and remote subnets) to negotiate the security associations (SAs) that define which traffic is protected. If the proxy IDs do not match on both peers, the IKEv1 or IKEv2 Quick Mode exchange will fail, preventing the establishment of Phase 2 SAs. This is a fundamental requirement for matching traffic selectors in the IPsec SA negotiation.

Exam trap

The trap here is that candidates often confuse firewall policy requirements with Phase 2 negotiation requirements, mistakenly thinking that firewall policies must allow traffic before Phase 2 can establish, when in fact Phase 2 only requires matching proxy IDs, proposals, and PFS settings.

Practice this question →
135
MCQmedium

A company uses FortiGate ZTNA to provide remote access to an internal web application. The application requires client certificates for authentication. The administrator has configured the ZTNA rule to use certificate authentication. However, users report that they are prompted for credentials repeatedly. What is the most likely cause?

A.The user's password has expired.
B.The ZTNA rule is configured to use SAML authentication instead.
C.The client certificate is not trusted by the FortiGate.
D.The FortiClient EMS server is not reachable from the client.
AnswerC

An untrusted certificate causes authentication failures.

Why this answer

When a ZTNA rule is configured for certificate authentication, the FortiGate must trust the client certificate's issuing CA. If the CA certificate is not imported into the FortiGate's trusted CA list, the certificate chain validation fails, causing the authentication to be rejected and the client to be repeatedly prompted for credentials. This is the most common cause of repeated credential prompts in certificate-based ZTNA setups.

Exam trap

The trap here is that candidates often assume repeated credential prompts are caused by password issues or SAML misconfiguration, but in a certificate-based ZTNA rule, the root cause is almost always a trust issue with the client certificate's CA on the FortiGate.

How to eliminate wrong answers

Option A is wrong because a password expiration would not cause repeated credential prompts in a certificate-based authentication scenario; certificate authentication does not rely on user passwords. Option B is wrong because if the ZTNA rule were configured to use SAML, the user would be redirected to a SAML IdP for authentication, not repeatedly prompted for credentials in the same manner as a failing certificate handshake. Option D is wrong because the FortiClient EMS server being unreachable would affect endpoint compliance and posture checks, but not the certificate authentication process itself; the repeated credential prompt is a direct result of certificate validation failure, not EMS connectivity.

Practice this question →
136
MCQmedium

An administrator configures FortiGate as a SAML identity provider (IdP) for a cloud application. The application (SP) initiates the login. Users are redirected to the FortiGate login page and authenticate successfully, but then receive an error from the SP. What is a common cause?

A.The SP's ACS (Assertion Consumer Service) URL is misconfigured on the FortiGate
B.The FortiGate's certificate is not trusted by the user's browser
C.The user's account is locked
D.The SAML attribute mapping is incorrect
AnswerA

If the ACS URL is wrong, the SP won't accept the assertion, causing an error after login.

Why this answer

When FortiGate is the IdP, it must be configured with the SP's ACS URL and entity ID. If these are incorrect, the SAML assertion is not accepted by the SP.

Practice this question →
137
Multi-Selecthard

A FortiGate is configured with two VPN tunnels to different remote sites. The administrator notices that traffic is not load-balanced across the tunnels; all traffic uses the first tunnel. The administrator wants to use ECMP (Equal Cost Multi-Path) routing. Which two actions are required? (Choose two.)

Select 2 answers
A.Set the same distance and priority for both static routes
B.Configure both tunnels to use the same IKE version
C.Set the same phase2 lifetime for both tunnels
D.Enable ECMP in the FortiGate's routing settings
AnswersA, D

For ECMP to work, routes must have equal administrative distance and priority.

Why this answer

ECMP requires that routes have the same distance and priority. Also, the administrator must enable ECMP in the routing settings. Option A and D are correct: set the same distance and priority for the static routes, and enable ECMP.

Note: ECMP is enabled by default in policy-based routing? Actually, for static routes, ECMP is automatically used when multiple routes have the same distance and priority. Option D is correct: enable ECMP in the routing settings (if not already). But the question asks for two actions.

So A and D.

Practice this question →
138
MCQhard

An administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA state is 'UP' but the IPsec SA state is 'DOWN'. The remote peer is a FortiGate. What is the most likely cause of this issue?

A.The pre-shared key is incorrect
B.The tunnel interface is down
C.The Phase2 parameters (encryption, authentication, proxy IDs) do not match between the peers
D.The firewall policy on the remote FortiGate is blocking UDP 500
AnswerC

Phase2 negotiations use separate parameters; if they mismatch, IPsec SA fails while IKE SA remains up.

Why this answer

If IKE is up but IPsec is down, the Phase2 parameters are not matching between peers. Common causes include mismatched encryption algorithms, proxy IDs, or lifetimes.

Practice this question →
139
Multi-Selecthard

A FortiGate is experiencing high CPU usage due to IPsec VPN traffic. The admin wants to offload cryptographic operations to the hardware. Which THREE conditions must be met for hardware acceleration to work? (Choose three.)

Select 3 answers
A.The FortiGate must have a compatible NP7 or CP9 processor
B.The IPsec phase 2 proposal must use encryption algorithms supported by the hardware accelerator (e.g., AES-GCM)
C.The VPN interface must be configured with 'set acceleration-mode ipsec'
D.The VPN tunnel must not be configured with features that disable offload, such as IPsec interface mode with kernel-version-dependent features
E.The firewall policy using the VPN interface must not have NAT enabled
AnswersA, B, D

Hardware acceleration requires specific processor models.

Why this answer

Hardware acceleration (CP8/CP9) requires specific conditions: supported encryption algorithms, no advanced features that disable offload, and the traffic must match a VPN policy that uses the hardware acceleration capable interface.

Practice this question →
140
MCQmedium

A company wants to deploy ZTNA to secure access to internal applications for remote employees. They have a FortiGate with a public IP and internal servers. Which deployment mode should they choose to minimize changes to existing firewall rules?

A.SSL VPN with ZTNA
B.IPsec VPN with ZTNA
C.Both proxy-based and IPsec VPN
D.Proxy-based ZTNA
AnswerD

Proxy-based ZTNA uses a single policy and does not require modifying existing rules.

Why this answer

Proxy-based ZTNA (Option D) is correct because it uses a forward proxy architecture that intercepts traffic at Layer 7, allowing the FortiGate to enforce ZTNA access policies without modifying existing firewall rules. The proxy terminates the client connection and initiates a new connection to the internal server, so no inbound port forwarding or firewall rule changes are needed for the internal servers.

Exam trap

The trap here is that candidates often assume any ZTNA deployment requires VPN tunnels (SSL or IPsec) and overlook the proxy-based mode, which is specifically designed to avoid firewall rule changes by operating at Layer 7 without tunnel overhead.

How to eliminate wrong answers

Option A is wrong because SSL VPN with ZTNA still requires traditional VPN tunnel termination and typically needs firewall rules to allow the VPN traffic and forward it to internal servers, which contradicts the goal of minimizing changes to existing firewall rules. Option B is wrong because IPsec VPN with ZTNA also requires tunnel configuration and firewall rules to permit IPsec traffic and route it to internal servers, adding complexity rather than minimizing rule changes. Option C is wrong because combining both proxy-based and IPsec VPN introduces unnecessary complexity and still requires firewall rule modifications for the IPsec VPN component, failing to achieve the minimal-change objective.

Practice this question →
141
MCQmedium

An administrator is deploying ZTNA for a legacy application that uses a fixed IP address and port. Which ZTNA component is responsible for securely proxying traffic from the user to the application without exposing the application's actual network location?

A.ZTNA access proxy
B.ZTNA inline CASB
C.IPsec VPN gateway
D.FortiClient EMS
AnswerA

The ZTNA access proxy sits between the user and the application, terminating the user's connection and establishing a secure connection to the application server.

Why this answer

The ZTNA proxy component acts as an intermediary, hiding the application server's IP address and providing secure access based on identity and posture.

Practice this question →
142
MCQmedium

A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites connect to a central hub. The administrator wants to ensure that if one remote site loses connectivity, the other site can still reach the hub. Which configuration is essential?

A.Use the same preshared key for both remote sites
B.Configure separate phase1 interfaces for each remote site
C.Enable auto-negotiation on all phase1 interfaces
D.Configure a single phase1 interface with multiple remote IPs
AnswerB

Each remote site requires its own phase1 configuration so that they operate independently. If one fails, the other remains up.

Why this answer

In a multi-peer IPsec VPN hub-and-spoke topology, each remote site must have its own phase1 interface to maintain independent security associations (SAs). If a single phase1 interface is shared, the loss of one remote peer can disrupt the SA state for all peers, potentially breaking connectivity for the other remote site. Configuring separate phase1 interfaces ensures that each remote site's VPN tunnel operates independently, so a failure at one site does not affect the other.

Exam trap

The trap here is that candidates often confuse 'multiple remote IPs on a single phase1' (which is for dynamic or dialup VPNs) with the need for independent tunnels, leading them to choose option D, but that design shares a single IKE SA and is not fault-tolerant for multi-peer scenarios.

How to eliminate wrong answers

Option A is wrong because using the same preshared key for both remote sites does not provide any resilience; it only simplifies authentication but does not isolate the SAs, so a failure at one site can still corrupt the shared SA state. Option C is wrong because auto-negotiation is a physical-layer feature for Ethernet interfaces, not applicable to IPsec phase1 interfaces, and does not address multi-peer isolation. Option D is wrong because a single phase1 interface with multiple remote IPs (a 'dialup' or 'aggregate' configuration) shares a single SA database; if one remote peer goes down, the phase1 interface may renegotiate or fail, potentially disrupting the other peer's tunnel.

Practice this question →
143
MCQhard

An administrator runs the following CLI command on a FortiGate and sees the output below: diagnose vpn ike gateway list vd: root/0 name: REMOTE_GW vrf: 0 version: 2 state: UP IKE SA: created 1s ago 1.2.3.4:500->5.6.7.8:500 What is the most likely explanation for the IKE SA being created only 1 second ago?

A.The remote peer changed its IP address
B.DPD detected a dead peer and renegotiated
C.The phase 2 SA expired and triggered phase 1 rekey
D.The VPN tunnel was just configured or a configuration change was applied
AnswerD

Recent creation time indicates the SA was just negotiated, typical after applying config changes or restarting IKE.

Why this answer

The IKE SA was recently created, suggesting a previous SA was deleted and a new one established. This often happens after configuration changes or a restart of IKE negotiation.

Practice this question →
144
MCQhard

An administrator is configuring FortiClient EMS to enforce compliance for remote users. The requirement is that all remote devices must have disk encryption enabled. The administrator has created a compliance rule in EMS that checks for 'Full Disk Encryption' and set the action to 'Block'. However, users with unencrypted drives are still able to connect to the VPN. What is the most likely missing configuration?

A.The FortiClient telemetry is not sending compliance status
B.The compliance rule is not enabled on the FortiGate via ZTNA tag
C.The VPN policy on the FortiGate does not require compliance check
D.The compliance rule is not assigned to a FortiClient configuration profile
AnswerD

In EMS, compliance rules must be part of a configuration profile that is assigned to endpoints. Without assignment, the rule is not enforced.

Why this answer

In FortiClient EMS, compliance rules are enforced only when they are added to a configuration profile that is assigned to endpoints. The rule itself is just a definition; it must be included in a profile that is deployed to clients. Without being assigned to a profile, the rule is not applied, so unencrypted devices are not blocked.

Option D correctly identifies this missing step.

Practice this question →
145
MCQmedium

A network administrator has configured an IPsec VPN between two FortiGates using IKEv2 with pre-shared keys. The tunnel establishes successfully, but after a few minutes, traffic stops passing through. The administrator runs 'diagnose vpn ike log' and sees 'DPD timeout' messages. What is the most likely cause of this issue?

A.The remote FortiGate is behind a NAT device without proper NAT-T configuration
B.The IPsec phase2 proposal is mismatched, causing rekey failures
C.The IKE SA lifetime is set too long, causing the tunnel to expire
D.The local FortiGate's DPD interval is set too low, causing false positives
AnswerA

NAT-T is required when one peer is behind NAT. Without it, DPD packets may be dropped, causing the tunnel to be considered dead.

Why this answer

DPD timeout indicates that the remote peer is not responding to Dead Peer Detection probes. The most common cause is a misconfigured firewall on the path dropping UDP 500 or 4500 packets, or NAT keepalive issues if NAT is involved. Option A is correct because if the remote FortiGate is behind a NAT device without proper NAT-T configuration, the DPD packets may be dropped or not reach the peer, causing the timeout.

Practice this question →
146
MCQhard

An administrator configures Multi-Peer VPN (MPVPN) on a FortiGate aggregator. The aggregator has two phase1 configurations for the same remote subnet but different peers. The aggregator's routing table shows both peers as next hops. The administrator notices that traffic between the aggregator and the remote subnet is load-balanced across both peers. What is the cause?

A.The MPVPN feature automatically load-balances traffic across all active peers.
B.The phase1 configurations have the same proposal settings, causing implicit load balancing.
C.The aggregator has two static routes with equal cost to the remote subnet.
D.The remote peers are both advertising the same subnet via BGP with equal metrics.
AnswerC

Why this answer

The administrator configured two static routes with equal administrative distance and cost to the remote subnet, each pointing to a different peer. This causes ECMP (Equal-Cost Multi-Path) routing, which load-balances traffic across both peers. MPVPN itself does not automatically load-balance; it relies on the underlying routing table to determine next-hop selection.

Exam trap

The trap here is that candidates confuse the MPVPN feature's ability to manage multiple peers with automatic load balancing, when in fact load balancing is a routing-layer function that must be explicitly configured via ECMP static or dynamic routes.

How to eliminate wrong answers

Option A is wrong because MPVPN does not automatically load-balance traffic across all active peers; it requires explicit routing configuration (e.g., ECMP static routes or dynamic routing with equal metrics) to achieve load balancing. Option B is wrong because identical phase1 proposal settings do not cause implicit load balancing; phase1 parameters only affect IKE negotiation and tunnel establishment, not traffic distribution. Option D is wrong because the scenario does not mention BGP; the routing table shows both peers as next hops, which is consistent with static routes, not BGP advertisements with equal metrics.

Practice this question →
147
MCQmedium

A FortiGate administrator wants to integrate FortiClient EMS to enforce compliance before granting VPN access. The FortiGate is the SSL VPN gateway. Which configuration is required on the FortiGate to use FortiClient's posture check?

A.Add the FortiClient EMS server as a telemetry source and create a ZTNA tag based on posture data.
B.Configure the FortiGate as a SAML IdP for FortiClient EMS.
C.Configure FortiClient EMS as a user group server and assign it to the SSL VPN portal.
D.Enable 'compliance check' under SSL VPN settings and specify the EMS IP address.
AnswerA

Why this answer

FortiClient EMS sends posture data to FortiGate via telemetry. The admin must define ZTNA tags for conditions (e.g., antivirus running) and use those tags in firewall policies or SSL VPN permissions. There is no direct 'compliance check' setting in SSL VPN; it's done via ZTNA.

Practice this question →
148
MCQmedium

An administrator is configuring a FortiGate as a SAML Identity Provider (IdP) for a third-party service provider. Which of the following is REQUIRED for the FortiGate IdP configuration?

A.The SP's metadata must be imported as a firewall address
B.User accounts must be synchronized with an LDAP server
C.A certificate for signing SAML assertions
D.A pre-shared key between FortiGate and the SP
AnswerC

The IdP must have a certificate to sign SAML responses. This certificate is trusted by the SP.

Why this answer

When FortiGate acts as a SAML IdP, it must sign SAML assertions to prove their authenticity to the SP. A certificate is required for this signing, as the SP will validate the assertion using the IdP's public key. Without a signing certificate, the SAML response cannot be cryptographically verified, breaking the trust model defined in the SAML 2.0 specification.

Exam trap

The trap here is that candidates confuse SAML's asymmetric signing requirement with symmetric pre-shared keys used in VPNs, or assume that external user synchronization is mandatory, when in fact local users or other identity stores suffice.

How to eliminate wrong answers

Option A is wrong because SP metadata is imported as a SAML service provider object, not as a firewall address; firewall addresses are used for network policies, not SAML identity federation. Option B is wrong because user accounts can be defined locally on the FortiGate or via other identity sources such as RADIUS or FSSO; LDAP synchronization is not mandatory for SAML IdP operation. Option D is wrong because SAML uses asymmetric cryptography (X.509 certificates) for signing and optionally encryption, not a pre-shared key; a PSK is used in protocols like IPsec or IKE, not in SAML.

Practice this question →
149
Multi-Selecthard

An administrator configures ZTNA with FortiClient EMS. The goal is to restrict access to an internal application based on device posture. The administrator configures a ZTNA tag for 'Compliant' that checks antivirus and OS patch status. Which TWO additional steps are required on the FortiGate to enforce access based on this tag?

Select 2 answers
A.Enable SSL deep inspection on the firewall policy
B.Create a ZTNA policy that includes the 'Compliant' tag as a required condition
C.Create a ZTNA access proxy for the internal application
D.Import the FortiClient EMS certificate to FortiGate
E.Configure a firewall policy with source set to the EMS connector
AnswersB, C

The ZTNA policy defines which tags are required for access.

Why this answer

To use ZTNA tags, the administrator must configure a ZTNA access proxy to publish the application and a ZTNA policy that references the tag to grant access.

Practice this question →
150
MCQmedium

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

A.The IKEv2 proposal includes an incompatible encryption algorithm
B.The local certificate is not associated with the phase1 interface
C.The remote peer's certificate is not signed by the imported CA
D.The CA certificate is not configured for peer certificate validation
AnswerD

The phase1 must include a reference to the CA certificate (via 'set ca-cert' or 'set certificate-peer') to validate the peer's certificate. Without this, the FortiGate does not know which CA to trust.

Why this answer

For certificate-based authentication, the FortiGate must be configured to verify the peer's certificate against the trusted CA. Option D is correct because the peer's certificate must be validated, and if the CA certificate is not properly referenced in the phase1 configuration (e.g., 'set certificate-peers' or 'set enforcesecrets'), validation fails.

Practice this question →
← PreviousPage 2 of 3 · 184 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Advanced VPN and Zero Trust questions.

Start 20-question session