NSE7 Advanced VPN and Zero Trust Practice Question
During a routine audit, a FortiGate administrator discovers that all traffic from a specific user group is being denied by a firewall policy. The policy uses a ZTNA rule that requires the device tag 'Compliant'. The administrator checks the user's device in EMS and sees it is tagged as 'Compliant'. However, the traffic is still denied. What could be the problem?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGate's EMS connector is not syncing tag information in real-time
Even if the tag exists, the FortiGate may not have updated tag information from EMS or the session may have been established before the tag was applied. Option A is correct because the FortiGate must re-evaluate tags for new connections; if the EMS connector is not syncing or the session is cached with old tags, it may deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The FortiGate's EMS connector is not syncing tag information in real-time
Why this is correct
ZTNA tags are pulled from EMS periodically. If the connector hasn't synced recently, the FortiGate might still have old tag information for that device.
- ✗
The user's IP address has changed and the tag is mapped to a different IP
Why it's wrong here
Tags are typically mapped to device IDs, not IPs; IP changes shouldn't affect tag association.
- ✗
The ZTNA rule is configured with the wrong application port
Why it's wrong here
Wrong port would cause the rule not to match at all, not deny with a tag mismatch.
- ✗
The device posture compliance check requires additional criteria not met
Why it's wrong here
If the device is tagged as 'Compliant', that tag should satisfy the rule's requirement. However, the rule might require multiple tags; but the stem says the rule requires 'Compliant' and the device has it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.