Free Fortinet NSE 7 – Zero Trust Access 7.2 Exam NSE7_ZTA-7.2 Exam Practice Test

Which one of the supported communication methods does FortiNAC use for initial device identification during discovery?

• LLDP
• SNMP
• API
• SSH

Which statement is true regarding a FortiClient quarantine using FortiAnalyzer playbooks?

• FortiGate sends a notification to FortiClient EMS to quarantine the endpoint
• FortiAnalyzer discovers malicious activity in the logs and notifies FortiGate
• FortiAnalyzer sends an API to FortiClient EMS to quarantine the endpoint
• FortiClient sends logs to FortiAnalyzer

Which three statements are true about zero-trust telemetry compliance1? (Choose three.)FortiClient EMS creates dynamic policies using ZTNAtagsFortiChent checks the endpoint using the ZTNAtags provided by FortiClient EMSZTNA tags are configured in FortiClient, based on criteria such as certificates and the logged in domainFortiOS provides network access to the endpoint based on the zero-trust tagging rulesFortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS

What are two functions of NGFW in a ZTA deployment? (Choose two.)

• Acts as segmentation gateway
• Endpoint vulnerability management
• Device discovery and profiling
• Packet Inspection

Which two statements are true regarding certificate-based authentication for ZTNA deployment? (Choose two.)FortiGate signs the client certificate submitted by FortiClient.The default action for empty certificates is blockCertificate actions can be configured only on the FortiGate CLIClient certificate configuration is a mandatory component for ZTNA

• This is true because ZTNA relies on client certificates to identify and authenticate devices. Client certificates are generated by the ZTNA CA and contain the device ID, ZTNA tags, and other information. Client certificates are distributed to devices by the ZTNA management server (such as EMS) and are used to establish a secure connection with the ZTNA gateway.
• FortiGate signs the client certificate submitted by FortiClient. This is false because FortiGate does not sign the client certificates. The client certificates are signed by the ZTNA CA, which is a separate entity from FortiGate. FortiGate only verifies the client certificates and performs certificate actions based on the ZTNA tags.
• Certificate actions can be configured only on the FortiGate CLI. This is false because certificate actions can be configured on both the FortiGate GUI and CLI. Certificate actions are the actions that FortiGate takes based on the ZTNA tags in the client certificates. For example, FortiGate can allow, block, or redirect traffic based on the ZTNA tags.
• Reference :=
• 1: Technical Tip: ZTNA for Corporate hosts with SAML authentication and FortiAuthenticator as IDP
• 2: Zero Trust Network Access - Fortinet

FortiNAC has alarm mappings configured for MDM compliance failure, and FortiClient EMS is added as a MDM connector When an endpoint is quarantined by FortiClient EMS, what action does FortiNAC perform?

• The host is isolated in the registration VLAN
• The host is marked at risk
• The host is forced to authenticate again
• The host is disabled

Which configuration is required for FortiNAC to perform an automated incident response based on the FortiGate traffic?

• FortiNAC should be added as a participant in the Security Fabric
• FortiNAC requires read-write SNMP access to FortiGate.
• FortiNAC should be configured as a syslog server on FortiGate
• FortiNAC requires HTTPS access to FortiGate for API calls

Which method is used to install passive agent on an endpoint?

• Deployed by using a login/logout script
• Agent is downloaded from Playstore
• Agent is downloaded and run from captive portal
• Installed by user or deployment tools

Which three methods can you use to trigger layer 2 polling on FortiNAC? (Choose three)

• Polling scripts
• Link traps
• Manual polling
• Scheduled tasks
• Polling using API

Which three core products are mandatory in the Fortinet ZTNA solution'' {Choose three.)

• FortiClient EMS
• FortiClient
• FortiToken
• FortiGate
• FortiAuthenticator