NSE7 Advanced VPN and Zero Trust Practice Question
Which of the following is a requirement for FortiGate to act as a SAML Identity Provider (IdP) for ZTNA?
⚠ Common exam trap
NSE7 often tests the confusion between IdP-side requirements and SP-side or transport-side requirements; the trap is selecting a plausible-sounding but non-essential item like a public IP or public CA certificate instead of the core identity and SAML configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A configured user database and SAML IdP settings
For a FortiGate to act as a SAML Identity Provider for ZTNA, it must have a configured user database (local or remote) and SAML IdP settings enabled, because SAML requires an identity source and IdP metadata to issue assertions. The FortiGate then generates IdP metadata that the SAML SP (such as FortiClient EMS or a ZTNA client) consumes. Without a user store and IdP configuration, no SAML assertions can be produced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A public IP address on the WAN interface
Why it's wrong here
FortiGate acting as a SAML IdP for ZTNA requires a certificate for signing assertions, not a public WAN IP address. A public IP is tempting because external SAML IdPs need internet reachability, but here FortiGate is the IdP and clients reach it internally, so WAN exposure is unnecessary and irrelevant to the requirement.
- ✓
A configured user database and SAML IdP settings
Why this is correct
Acting as a SAML IdP requires a local user database to authenticate users against, plus the SAML IdP settings defining entity ID, endpoints and signing certificate. Both are prerequisites for issuing assertions to ZTNA service providers.
- ✗
Integration with FortiClient EMS
Why it's wrong here
FortiClient EMS integration is not a prerequisite for FortiGate acting as a SAML IdP; that integration supports ZTNA posture and tagging, not SAML assertion signing. It is tempting because EMS features heavily in ZTNA deployments, yet the IdP role itself only needs SAML configuration and a signing certificate.
- ✗
An SSL certificate from a public CA
Why it's wrong here
A public CA certificate is not required; FortiGate can sign SAML assertions using a self-signed or private CA certificate trusted by the relying party. Public CA certificates are tempting because browser-facing SAML IdPs typically need publicly trusted TLS, but ZTNA SAML here relies on the configured certificate, not public trust chain.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.