NSE7 Advanced VPN and Zero Trust Practice Question
Which TWO of the following can be used to authenticate users in a ZTNA connection? (Select two.)
⚠ Common exam trap
It's easy for candidates to confuse authentication methods used in traditional VPNs (like LDAP or FortiToken) with the identity-centric methods required for ZTNA, forgetting that ZTNA mandates integration with an IdP or certificate-based trust rather than direct password or token verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML authentication
In a ZTNA connection, authentication can be performed using SAML (Security Assertion Markup Language) because it enables federated identity management and single sign-on (SSO), allowing the FortiGate to verify user identity via an external identity provider (IdP) without direct password handling. Certificate authentication is also valid because ZTNA leverages client certificates (X.509) to establish mutual TLS (mTLS) between the user device and the FortiGate, ensuring device identity and trust before granting access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LDAP authentication
Why it's wrong here
LDAP is a directory, not an authentication method per se; it can be used as a backend but the method is typically certificate or SAML.
- ✗
FortiToken
Why it's wrong here
FortiToken is for two-factor, not primary auth.
- ✗
IPsec authentication
Why it's wrong here
IPsec is not an authentication method for ZTNA.
- ✓
SAML authentication
Why this is correct
SAML is supported for SSO.
- ✓
Certificate authentication
Why this is correct
Certificates can authenticate devices/users.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.