2024年更新のNSE 7 Network Security Architectが有効なNSE7_ZTA-7.2問題集を無料提供しています
最新のFast2test NSE7_ZTA-7.2のPDF問題集をダウンロードしちゃおう：https://jp.fast2test.com/NSE7_ZTA-7.2-premium-file.html（32問題と解答)
質問 # 19
Exhibit.
An administrator has to provide on-fabric clients with access to FortiAnalyzer using ZTNA tags Which two conditions must be met to achieve this task? (Choose two.)
- A. The IP/MAC based firewall policy must be configured on FortiGate
- B. The ZTNA server must be configured on FortiGate
- C. The on-fabric client should have FortiGate as its default gateway
- D. The ZTNArule must be configured on FortiClient
正解：B、C
解説：
For on-fabric clients to access FortiAnalyzer using ZTNA tags, the following conditions must be met:
A: The on-fabric client should have FortiGate as its default gateway: This is essential to ensure that all client traffic is routed through FortiGate, where ZTNA policies can be enforced.
B: The ZTNA server must be configured on FortiGate: For ZTNA tags to be effectively used, the ZTNA server, which processes and enforces these tags, must be configured on the FortiGate appliance.
References :=
Configuring ZTNA tags and tagging rules
Synchronizing FortiClient ZTNA tags
FortiAnalyzer
Technical Tip: ZTNA Tags fail to synchronize between FortiClient and FortiGate
質問 # 20
Which three statements are true about zero-trust telemetry compliance1? (Choose three.)
- A. FortiClient EMS creates dynamic policies using ZTNAtags
- B. ZTNA tags are configured in FortiClient,based on criteria such as certificates and the logged in domain
- C. FortiOS provides network access to the endpoint based on the zero-trust tagging rules
- D. FortiChent checks the endpoint using the ZTNAtags provided by FortiClient EMS
- E. FortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS
正解：A、C、D
解説：
In the context of zero-trust telemetry compliance, the three true statements are:
A: FortiClient EMS creates dynamic policies using ZTNA tags: FortiClient EMS utilizes ZTNA (Zero Trust Network Access) tags to create dynamic policies based on the telemetry it receives from endpoints.
B: FortiClient checks the endpoint using the ZTNA tags provided by FortiClient EMS: FortiClient on the endpoint uses the ZTNA tags from FortiClient EMS to determine compliance with the specified security policies.
D: FortiOS provides network access to the endpoint based on the zero-trust tagging rules: FortiOS, the operating system running on FortiGate devices, uses the zero-trust tagging rules to make decisions on network access for endpoints.
The other options are not accurate in this context:
C: ZTNA tags are configured in FortiClient, based on criteria such as certificates and the logged-in domain: ZTNA tags are typically configured and managed in FortiClient EMS, not directly in FortiClient.
E: FortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS: While FortiClient EMS does process telemetry data, the direct sending of endpoint information to FortiOS is not typically described in this manner.
References:
Zero Trust Telemetry in Fortinet Solutions.
FortiClient EMS and FortiOS Integration for ZTNA.
質問 # 21
An administrator has to configure LDAP authentication tor ZTNA HTTPS access proxy Which authentication scheme can the administrator apply1?
- A. Digest
- B. Basic
- C. NTLM
- D. Form-based
正解：D
解説：
LDAP (Lightweight Directory Access Protocol) authentication for ZTNA (Zero Trust Network Access) HTTPS access proxy is effectively implemented using a Form-based authentication scheme. This approach allows for a secure, interactive, and user-friendly means of capturing credentials. Form-based authentication presents a web form to the user, enabling them to enter their credentials (username and password), which are then processed for authentication against the LDAP directory. This method is widely used for web-based applications, making it a suitable choice for HTTPS access proxy setups in a ZTNA framework.References:FortiGate Security 7.2 Study Guide, LDAP Authentication configuration sections.
質問 # 22
exhibit.
User student is not able to log in to SSL VPN
Given the output showing a real-time debug: which statement describes the login failure?
- A. CN does not match the user peer configuration
- B. Unable to verify chain of trust for the peer certificate
- C. student is not part of the usergroup SSL_VPN_Users.
- D. Client certificate has expired
正解：C
解説：
Given the output showing a real-time debug, the statement that describes the login failure is:
C: student is not part of the usergroup SSL_VPN_Users: The debug log contains a line that says
"fnbam_cert_check_group_list-checking group with name 'SSL_VPN_Users'" followed by
"peer_check_add_peer_check_student" and later "RDN_match-Checking 'CN' val 'STUDENT' -- no match." This suggests that the certificate presented has a common name (CN) of 'student', which does not match or is not authorized under the 'SSL_VPN_Users' group expected for successful authentication.
質問 # 23
Which three core products are mandatory in the Fortinet ZTNA solution'' {Choose three.)
- A. FortiClient EMS
- B. FortiClient
- C. FortiToken
- D. FortiGate
- E. FortiAuthenticator
正解：A、B、D
解説：
Fortinet ZTNA solution is a zero-trust network access approach that provides secure and granular access to applications hosted anywhere, for users working from anywhere. The three core products that are mandatory in the Fortinet ZTNA solution are:
FortiClient EMS: This is the central management console that orchestrates the ZTNA policies and provides visibility and control over the endpoints and devices. It also integrates with FortiAuthenticator for identity verification and FortiAnalyzer for reporting and analytics.
FortiClient: This is the endpoint agent that supports ZTNA, VPN, endpoint protection, and vulnerability scanning. It establishes encrypted tunnels with the ZTNA proxy on the FortiGate and provides device posture and single sign-on (SSO) capabilities.
FortiGate: This is the next-generation firewall that acts as the ZTNA proxy and enforces the ZTNA policies based on user identity, device posture, and application context. It also provides security inspection and threat prevention for the ZTNA traffic.
References := Zero Trust Network Access (ZTNA) - Fortinet, Zero-Trust Network Access Solution | Fortinet, and Fortinet ZTNA | Fortinet Case Study.
質問 # 24
What are two functions of NGFW in a ZTA deployment? (Choose two.)
- A. Device discovery and profiling
- B. Packet Inspection
- C. Acts as segmentation gateway
- D. Endpoint vulnerability management
正解：A、C
解説：
NGFW stands for Next-Generation Firewall, which is a network security device that provides advanced features beyond the traditional firewall, such as application awareness, identity awareness, threat prevention, and integration with other security tools. ZTA stands for Zero Trust Architecture, which is a security model that requires strict verification of the identity and context of every request before granting access to network resources. ZTA assumes that no device or user can be trusted by default, even if they are connected to a corporate network or have been previously verified.
In a ZTA deployment, NGFW can perform two functions:
Acts as segmentation gateway: NGFW can act as a segmentation gateway, which is a device that separates different segments of the network based on security policies and rules. Segmentation can help isolate and protect sensitive data and applications from unauthorized or malicious access, as well as reduce the attack surface and contain the impact of a breach. NGFW can enforce granular segmentation policies based on the identity and context of the devices and users, as well as the applications and services they are accessing. NGFW can also integrate with other segmentation tools, such as software-defined networking (SDN) and microsegmentation, to provide a consistent and dynamic segmentation across the network.
Device discovery and profiling: NGFW can also perform device discovery and profiling, which are processes that identify and classify the devices that are connected to the network, as well as their attributes and behaviors. Device discovery and profiling can help NGFW to apply the appropriate security policies and rules based on the device type, role, location, health, and activity. Device discovery and profiling can also help NGFW to detect and respond to anomalous or malicious devices that may pose a threat to the network.
References: =
Some possible references for the answer and explanation are:
What is a Next-Generation Firewall (NGFW)? | Fortinet : What is Zero Trust Network Access (ZTNA)? | Fortinet : Zero Trust Architecture Explained: A Step-by-Step Approach : The Most Common NGFW Deployment Scenarios : Sample Configuration for Post vWAN Deployment
質問 # 25
Which statement is true about disabled hosts on FortiNAC?
- A. They are placed in the authentication VLAN to reauthenticate
- B. They are placed in the dead end VLAN
- C. They are marked as unregistered rogue devices
- D. They are quarantined and placed in the remediation VLAN
正解：B
解説：
According to the FortiNAC documentation1, disabled hosts are placed in the dead end VLAN, which is a special VLAN that isolates them from the production network. This is done to prevent unauthorized or compromised hosts from accessing network resources or spreading malware. The dead end VLAN must be configured in the AP model or the SSID configuration, and the state must be enforced23. Disabled hosts can be enabled again by the administrator or by reauthenticating through the FortiNAC portal. References := 1:
Enable or disable hosts | FortiNAC 9.4.0 - Fortinet Documentation 2: Technical Tip: Disabled wireless hosts not isolated - FortiNAC 3: Technical Tip: Disabled wired hosts not isolated - FortiNAC
質問 # 26
Which factor is a prerequisite on FortiNAC to add a Layer 3 router to its inventory?
- A. Allow HTTPS access from the router to the FortiNAC ethO IP address
- B. Allow FTP access to the FortiNAC database from the router
- C. SNMP or CLI access to the router to carry out remote tasks
- D. The router responding to ping requests from the FortiNAC eth1 IP address
正解：C
解説：
FortiNAC uses SNMP or CLI to communicate with network devices such as routers and switches. To add a Layer 3 router to its inventory, FortiNAC needs to have SNMP or CLI access to the router to perform remote tasks such as polling, VLAN assignment, and port shutdown. Without SNMP or CLI access, FortiNAC cannot manage the router or its ports. Therefore, SNMP or CLI access is a prerequisite for adding a Layer 3 router to FortiNAC's inventory. References := https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/105927/inventor
https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/344098/l3-polling
質問 # 27
Which three methods can you use to trigger layer 2 polling on FortiNAC? (Choose three)
- A. Polling using API
- B. Polling scripts
- C. Scheduled tasks
- D. Link traps
- E. Manual polling
正解：B、C、E
解説：
To trigger layer 2 polling on FortiNAC, the three methods are:
A: Polling scripts: These are scripts configured within FortiNAC to actively poll the network at layer 2 to gather information about connected devices.
C: Manual polling: This involves manually initiating a polling process from the FortiNAC interface to gather current network information.
D: Scheduled tasks: Polling can be scheduled as regular tasks within FortiNAC, allowing for automated, periodic collection of network data.
The other options are not standard methods for layer 2 polling in FortiNAC:
B: Link traps: These are more related to SNMP trap messages rather than layer 2 polling.
E: Polling using API: While APIs are used for various integrations, they are not typically used for initiating layer 2 polling in FortiNAC.
References:
FortiNAC Layer 2 Polling Documentation.
Configuring Polling Methods in FortiNAC.
質問 # 28
Exhibit.
Which statement is true about the configuration shown in the exhibit?
- A. default_ZTNARoot CA signs the FortiClient certificate for the SSL connectivity to FortiClient EMS
- B. It the FortiClient EMS server certificate is invalid, FortiClient connects silently.
- C. The domain that FortiClient is connecting to should match the domain to which the certificate is issued.
- D. The connection from FortiClient to FortiClient EMS uses TCP and TLS 1.2.
正解：D
解説：
The exhibit shows the EMS Settings where various configurations related to network security are displayed.
Option C is correct because, in the settings, it is indicated that HTTPS port is used (which operates over TCP) and SSL certificates are involved in securing the connection, implying the use of TLS for encryption and secure communication between FortiClient and FortiClient EMS.
Option A is incorrect because the domain that FortiClient is connecting to does not have to match the domain to which the certificate is issued. The certificate is issued by the ZTNA CA, which is a separate entity from the domain. The certificate only contains the device ID, ZTNA tags, and other information that are used to identify and authenticate the device.
Option B is incorrect because if the FortiClient EMS server certificate is invalid, FortiClient does not connect silently. Instead, it performs the Invalid Certificate Action that is configured in the settings. The Invalid Certificate Action can be set to block, warn, or allow the connection.
Option D is incorrect because default_ZTNARoot CA does not sign the FortiClient certificate for the SSL connectivity to FortiClient EMS. The FortiClient certificate is signed by the ZTNA CA, which is a different certificate authority from default_ZTNARoot CA. default_ZTNARoot CA is the EMS CA Certificate that is used to verify the identity of the EMS server.
References :=
[1]: Technical Tip: ZTNA for Corporate hosts with SAML authentication and FortiAuthenticator as IDP
[2]: Zero Trust Network Access - Fortinet
質問 # 29
Exhibit.
Which statement is true about the hr endpoint?
- A. The endpoint is a rogue device
- B. The endpoint is disabled
- C. The endpoint is unauthenticated
- D. The endpoint has been marked at risk
正解：D
解説：
Based on the exhibit showing the status of the hr endpoint, the true statement about this endpoint is:
D: The endpoint has been marked at risk: The "w" next to the host status for the 'hr' endpoint typically denotes a warning, indicating that the system has marked it as at risk due to some security policy violations or other concerns that need to be addressed.
The other options do not align with
the provided symbol "w" in the context of FortiNAC:
A: The endpoint is a rogue device: If the endpoint were rogue, we might expect a different symbol, often indicating a critical status or alarm.
B:The endpoint is disabled: A disabled status is typically indicated by a different icon or status indicator.
C: The endpoint is unauthenticated: An unauthenticated status would also be represented by a different symbol or status indication, not a "w".
質問 # 30
Which three statements are true about a persistent agent? (Choose three.)
- A. Agent is downloaded and run from captive portal
- B. Can be used for automatic registration and authentication
- C. Supports advanced custom scans and software inventory.
- D. Can apply supplicant configuration to a host
- E. Deployed by a login/logout script and is not installed on the endpoint
正解：B、C、D
解説：
A persistent agent is an application that works on Windows, macOS, or Linux hosts to identify them to FortiNAC Manager and scan them for compliance with an endpoint compliance policy. A persistent agent can support advanced custom scans and software inventory, apply supplicant configuration to a host, and be used for automatic registration and authentication. References := Persistent Agent Persistent Agent on Windows Using the Persistent Agent
質問 # 31
Which statement is true regarding a FortiClient quarantine using FortiAnalyzer playbooks?
- A. FortiClient sends logs to FortiAnalyzer
- B. FortiGate sends a notification to FortiClient EMS to quarantine the endpoint
- C. FortiAnalyzer sends an API to FortiClient EMS to quarantine the endpoint
- D. FortiAnalyzer discovers malicious activity in the logs and notifies FortiGate
正解：C
解説：
FortiAnalyzer playbooks are automated workflows that can perform actions based on triggers, conditions, and outputs. One of the actions that a playbook can perform is to quarantine a device by sending an API call to FortiClient EMS, which then instructs the FortiClient agent on the device to disconnect from the network. This can help isolate and contain a compromised or non-compliant device from spreading malware or violating policies. References := Quarantine a device from FortiAnalyzer playbooks Playbooks
質問 # 32
......
Fortinet NSE7_ZTA-7.2 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
実験された試験材料はNSE7_ZTA-7.2：https://jp.fast2test.com/NSE7_ZTA-7.2-premium-file.html