Fortinet NSE5_FCT-7.0 Exam Practice Test Instant Access

Question 1

An administrator configures ZTNA configuration on the FortiGate for remote users. Which statement is true about the firewall policy?

AIt enforces access control

BIt redirects the client request to the access proxy

CIt defines the access proxy

DIt applies security profiles to protect traffic

Answer : B

'The firewall policy matches and redirects client requests to the access proxy VIP' https://docs.fortinet.com/document/fortigate/7.0.0/new-features/194961/basic-ztna-configuration

Question 2

Refer to the exhibits.

Which shows the configuration of endpoint policies.

Based on the configuration, what will happen when someone logs in with the user account student on an endpoint in the trainingAD domain?

AFortiClient EMS will assign the Sales policy

BFortiClient EMS will assign the Training policy

CFortiClient EMS will assign the Default policy

DFortiClient EMS will assign the Training policy for on-fabric endpoints and the Sales policy for the off-fabric endpoint

Answer : B

Question 3

Refer to the exhibit.

Based on the FortiClient log details shown in the exhibit, which two statements are true? (Choose two.)

AThe filename is Unconfirmed 899290 .crdownload.

BThe file status is Quarantined

CThe filename is sent to ForuSandbox for further inspection.

DThe file location IS \??\D:\Users\.

Answer : A, B

Question 4

Which two statements are true about ZTNA? (Choose two.)

AZTNA provides role-based access

BZTNA manages access for remote users only

CZTNA manages access through the client only

DZTNA provides a security posture check

Answer : A, D

Question 5

Which component or device shares ZTNA tag information through Security Fabric integration?

AFortiClient EMS

BFortiGate

CFortiGate Access Proxy

DFortiClient

Answer : A

FortiClient EMS is the component that shares ZTNA tag information through Security Fabric integration. ZTNA tags are synchronized from FortiClient EMS as inputs for the FortiGate application gateway. They can be used in ZTNA policies as security posture checks to ensure certain security criteria are met. FortiClient EMS can share ZTNA tags across multiple devices in the Fabric, such as FortiGate, FortiManager, and FortiAnalyzer. FortiClient EMS can also share ZTNA tags across multiple VDOMs on the same FortiGate device.FortiClient EMS can be configured to control the ZTNA tag sharing behavior in the Fabric Devices settings1.

FortiGate is the device that enforces ZTNA policies using ZTNA tags. FortiGate can receive ZTNA tags from FortiClient EMS via Fabric Connector. FortiGate can also publish ZTNA services through the ZTNA portal, which allows users to access applications without installing FortiClient.FortiGate can also provide ZTNA inline CASB for SaaS application access control2.

FortiGate Access Proxy is a feature that enables FortiGate to act as a proxy for ZTNA traffic. FortiGate Access Proxy can be deployed in front of the application servers to provide ZTNA protection. FortiGate Access Proxy can also be deployed behind the application servers to provide ZTNA visibility.FortiGate Access Proxy can use ZTNA tags to identify and authenticate users and devices2.

FortiClient is the endpoint software that connects to ZTNA services. FortiClient can register ZTNA tags with FortiClient EMS based on the endpoint security posture. FortiClient can also use ZTNA tags to access ZTNA services published by FortiGate.FortiClient can also use ZTNA tags to access SaaS applications with ZTNA inline CASB2.

Technical Tip: Behavior of ZTNA Tags shared across multiple vdoms or multiple FortiGate firewalls in the Security Fabric connected to the same FortiClient EMS Server

Synchronizing FortiClient ZTNA tags

Zero Trust Network Access (ZTNA) to Control Application Access

Question 6

What does FortiClient do as a fabric agent? (Choose two.)

AProvides application inventory

BProvides IOC verdicts

CAutomates Responses

DCreates dynamic policies

Answer : A, C

Question 7

Why does FortiGate need the root CA certificate of FortiClient EMS?

ATo sign FortiClient CSR requests

BTo revoke FortiClient client certificates

CTo trust certificates issued by FortiClient EMS

DTo update FortiClient client certificates

Answer : C

FortiGate needs the root CA (Certificate Authority) certificate of FortiClient EMS in order to trust and validate certificates that are issued by FortiClient EMS. The root CA certificate acts as a trusted authority that verifies the authenticity and integrity of certificates issued by FortiClient EMS.

Fortinet NSE5_FCT-7.0 Fortinet NSE 5 - FortiClient EMS 7.0 Exam Practice Test