Fortinet NSE7_ZTA-7.2 Fortinet NSE 7 - Zero Trust Access 7.2 Exam Practice Test

Answer : A, B

For on-fabric clients to access FortiAnalyzer using ZTNA tags, the following conditions must be met:

A) The on-fabric client should have FortiGate as its default gateway: This is essential to ensure that all client traffic is routed through FortiGate, where ZTNA policies can be enforced.

B) The ZTNA server must be configured on FortiGate: For ZTNA tags to be effectively used, the ZTNA server, which processes and enforces these tags, must be configured on the FortiGate appliance.

Configuring ZTNA tags and tagging rules

Synchronizing FortiClient ZTNA tags

FortiAnalyzer

Technical Tip: ZTNA Tags fail to synchronize between FortiClient and FortiGate

Answer : C

Given the output showing a real-time debug, the statement that describes the login failure is:

C) student is not part of the usergroup SSL_VPN_Users: The debug log contains a line that says 'fnbam_cert_check_group_list-checking group with name 'SSL_VPN_Users'' followed by 'peer_check_add_peer_check_student' and later 'RDN_match-Checking 'CN' val 'STUDENT' -- no match.' This suggests that the certificate presented has a common name (CN) of 'student', which does not match or is not authorized under the 'SSL_VPN_Users' group expected for successful authentication.

Answer : A, B, D

Fortinet ZTNA solution is a zero-trust network access approach that provides secure and granular access to applications hosted anywhere, for users working from anywhere. The three core products that are mandatory in the Fortinet ZTNA solution are:

FortiClient EMS: This is the central management console that orchestrates the ZTNA policies and provides visibility and control over the endpoints and devices. It also integrates with FortiAuthenticator for identity verification and FortiAnalyzer for reporting and analytics.

FortiClient: This is the endpoint agent that supports ZTNA, VPN, endpoint protection, and vulnerability scanning. It establishes encrypted tunnels with the ZTNA proxy on the FortiGate and provides device posture and single sign-on (SSO) capabilities.

FortiGate: This is the next-generation firewall that acts as the ZTNA proxy and enforces the ZTNA policies based on user identity, device posture, and application context. It also provides security inspection and threat prevention for the ZTNA traffic.

Answer : B, D

Certificate-based authentication is a method of verifying the identity of a device or user by using a digital certificate issued by a trusted authority. For ZTNA deployment, certificate-based authentication is used to ensure that only authorized devices and users can access the protected applications or resources.

B) The default action for empty certificates is block. This is true because ZTNA requires both device and user verification before granting access. If a device does not have a valid certificate issued by the ZTNA CA, it will be blocked by the ZTNA gateway. This prevents unauthorized or compromised devices from accessing the network.

D) Client certificate configuration is a mandatory component for ZTNA. This is true because ZTNA relies on client certificates to identify and authenticate devices. Client certificates are generated by the ZTNA CA and contain the device ID, ZTNA tags, and other information. Client certificates are distributed to devices by the ZTNA management server (such as EMS) and are used to establish a secure connection with the ZTNA gateway.

A) FortiGate signs the client certificate submitted by FortiClient. This is false because FortiGate does not sign the client certificates. The client certificates are signed by the ZTNA CA, which is a separate entity from FortiGate. FortiGate only verifies the client certificates and performs certificate actions based on the ZTNA tags.

C) Certificate actions can be configured only on the FortiGate CLI. This is false because certificate actions can be configured on both the FortiGate GUI and CLI. Certificate actions are the actions that FortiGate takes based on the ZTNA tags in the client certificates. For example, FortiGate can allow, block, or redirect traffic based on the ZTNA tags.

1: Technical Tip: ZTNA for Corporate hosts with SAML authentication and FortiAuthenticator as IDP

2: Zero Trust Network Access - Fortinet

Answer : D

The method used to install a passive agent on an endpoint is:

D) Installed by user or deployment tools: Passive agents are typically installed on endpoints either manually by users or automatically through deployment tools used by the organization.

The other options do not accurately describe the installation of passive agents:

A) Deployed by using a login/logout script: This is not the standard method for deploying passive agents.

B) Agent is downloaded from Playstore: This is more relevant for mobile devices and does not represent the general method for passive agent installation.

C) Agent is downloaded and run from captive portal: This method is not typically used for installing passive agents.

FortiNAC Agent Deployment Guide.

Installation Methods for Passive Agents in FortiNAC.

Answer : A

They are quarantined and placed in the remediation VLAN. This is a standard practice in network access control systems where non-compliant or disabled hosts are isolated in a VLAN where they can be remediated or reviewed.

Answer : B, D, E

To prevent direct host-to-host communication at layer 2 and use only FortiGate to inspect all the VLAN traffic, an administrator must configure:

B) Block intra-VLAN traffic in the VLAN interface settings: This setting prevents direct communication between hosts within the same VLAN, forcing traffic to be routed through FortiGate for inspection.

D) Configure static routes to allow subnets: By setting up static routes, the administrator ensures that traffic between different subnets is correctly routed through the FortiGate for inspection and policy enforcement.

E) Configure a firewall policy to allow the desired traffic between hosts: Firewall policies on the FortiGate will dictate what traffic is permitted between hosts, ensuring that only authorized traffic is allowed.

The other options are not typically required for this setup:

A) Configure proxy ARP to allow traffic: Proxy ARP is not necessary for this scenario as it involves answering ARP requests on behalf of another host, which is not relevant to blocking intra-VLAN traffic.

C) Add the VLAN interface to a software switch: This would create a switch-like environment on the FortiGate, which is counterproductive to the goal of preventing direct host-to-host communication at layer 2.

FortiGate VLAN Configuration Guide.

Blocking Intra-VLAN Communication in FortiGate.