NSE7 Advanced VPN and Zero Trust Practice Question
Which FortiGate feature allows an administrator to define a granular policy based on the security posture of the endpoint device, such as OS version, antivirus status, and disk encryption, before granting access to a protected application?
⚠ Common exam trap
NSE7 often tests the distinction between ZTNA access proxy and other FortiGate features, leading candidates to confuse it with SSL VPN or web filtering for endpoint posture enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ZTNA access proxy
FortiGate ZTNA access proxy enables granular policy enforcement based on endpoint security posture, such as OS version, antivirus status, and disk encryption. It acts as a reverse proxy that evaluates ZTNA tags (derived from endpoint posture) before granting access to protected applications, aligning with zero-trust principles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Web filtering profile
Why it's wrong here
Web filtering profiles classify URLs and apply category-based allow or block actions; they inspect traffic content, not endpoint OS version, antivirus or encryption state. Endpoint posture enforcement needs FortiClient EMS compliance rules, which this profile cannot supply.
- ✗
SSL VPN portal
Why it's wrong here
The SSL VPN portal serves web or tunnel access after authentication; it does not itself evaluate endpoint posture such as OS version or antivirus state. Host-check posture assessment belongs to FortiClient EMS and compliance rules, which gate access before the portal grants entry.
- ✗
IPsec phase 1 configuration
Why it's wrong here
IPsec phase 1 negotiates IKE parameters — encryption, authentication and DH group — between peers; it carries no endpoint posture data. Posture checks require FortiClient EMS compliance enforcement, so phase 1 cannot gate access on antivirus or disk encryption status.
- ✓
ZTNA access proxy
Why this is correct
ZTNA access proxy evaluates endpoint posture — OS version, antivirus state, disk encryption — before granting application access, enforcing zero-trust checks per session. It satisfies the granular, posture-based policy requirement that conventional firewall rules cannot express.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?
easy- A.Application control profile
- ✓ B.ZTNA tags and posture checks
- C.IPsec VPN with pre-shared key
- D.Web filtering profile
Why B: FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.
Variation 2. An administrator wants to enforce that only devices with antivirus software installed and running can access a sensitive application via ZTNA. Which ZTNA feature should be used to verify this requirement?
easy- A.ZTNA inline CASB
- B.NAC with FortiNAC
- ✓ C.ZTNA tags with device posture checks
- D.IPsec VPN with DPD
Why C: ZTNA tags with device posture checks allow the FortiGate to evaluate the security posture of the endpoint, including whether antivirus software is installed and running. These tags are then used in firewall policies to grant or deny access to sensitive applications based on compliance. This directly enforces the requirement.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.