NSE7 Advanced VPN and Zero Trust Practice Question
Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ZTNA access proxy
ZTNA (Zero Trust Network Access) uses device posture checks to evaluate endpoint security before granting access to applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web filtering profile
Why it's wrong here
Web filtering controls URL access, not endpoint posture.
- ✗
SSL VPN portal
Why it's wrong here
SSL VPN provides network-level access; it does not inherently check device posture.
- ✗
IPsec phase 1 configuration
Why it's wrong here
IPsec phase 1 handles authentication and encryption parameters, not endpoint posture.
- ✓
ZTNA access proxy
Why this is correct
ZTNA access proxy enforces access based on device posture and user identity.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?
easy- A.Application control profile
- ✓ B.ZTNA tags and posture checks
- C.IPsec VPN with pre-shared key
- D.Web filtering profile
Why B: FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.
Variation 2. An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?
easy- A.ZTNA inline CASB
- B.NAC with FortiNAC
- ✓ C.ZTNA tags with device posture checks
- D.IPsec VPN with DPD
Why C: ZTNA uses tags to indicate device posture. The FortiGate or FortiClient EMS can check for antivirus status and include that information in the device's posture tag. The ZTNA access proxy rule can then require that tag for access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.