NSE7_ZTA-7.2 - Fortinet NSE 7 - Zero Trust Access 7.2

 In the context of zero-trust telemetry compliance, the three true statements are:

• A. FortiClient EMS creates dynamic policies using ZTNA tags: FortiClient EMS utilizes ZTNA (Zero Trust Network Access) tags to create dynamic policies based on the telemetry it receives from endpoints.
• B. FortiClient checks the endpoint using the ZTNA tags provided by FortiClient EMS: FortiClient on the endpoint uses the ZTNA tags from FortiClient EMS to determine compliance with the specified security policies.
• D. FortiOS provides network access to the endpoint based on the zero-trust tagging rules: FortiOS, the operating system running on FortiGate devices, uses the zero-trust tagging rules to make decisions on network access for endpoints.

The other options are not accurate in this context:

• C. ZTNA tags are configured in FortiClient, based on criteria such as certificates and the logged-in domain: ZTNA tags are typically configured and managed in FortiClient EMS, not directly in FortiClient.
• E. FortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS: While FortiClient EMS does process telemetry data, the direct sending of endpoint information to FortiOS is not typically described in this manner.

References:

• Zero Trust Telemetry in Fortinet Solutions.
• FortiClient EMS and FortiOS Integration for ZTNA.

To prevent direct host-to-host communication at layer 2 and use only FortiGate to inspect all the VLAN traffic, an administrator must configure:

• B. Block intra-VLAN traffic in the VLAN interface settings: This setting prevents direct communication between hosts within the same VLAN, forcing traffic to be routed through FortiGate for inspection.
• D. Configure static routes to allow subnets: By setting up static routes, the administrator ensures that traffic between different subnets is correctly routed through the FortiGate for inspection and policy enforcement.
• E. Configure a firewall policy to allow the desired traffic between hosts: Firewall policies on the FortiGate will dictate what traffic is permitted between hosts, ensuring that only authorized traffic is allowed.

The other options are not typically required for this setup:

• A. Configure proxy ARP to allow traffic: Proxy ARP is not necessary for this scenario as it involves answering ARP requests on behalf of another host, which is not relevant to blocking intra-VLAN traffic.
• C. Add the VLAN interface to a software switch: This would create a switch-like environment on the FortiGate, which is counterproductive to the goal of preventing direct host-to-host communication at layer 2.

References:

• FortiGate VLAN Configuration Guide.
• Blocking Intra-VLAN Communication in FortiGate.

To create a separate web filtering profile for off-fabric and on-fabric clients and push it to managed FortiClient devices in FortiClient EMS, the feature can be enabled in:

• A. Endpoint Policy: This is where administrators can define and manage different policies for FortiClient endpoints. These policies can include settings for web filtering, which can be customized for on-fabric and off-fabric scenarios.

The other options do not directly relate to the creation and management of web filtering profiles:

• B. ZTNA Connection Rules: These rules are more focused on access control and do not deal directly with web filtering profiles.
• C. System Settings: This section typically includes overall system configurations rather than specific policy definitions.
• D. On-fabric Rule Sets: While important for on-fabric configurations, they don't directly deal with web filtering profiles.

References:

• FortiClient EMS Administration Guide.
• Managing Endpoint Policies in FortiClient EMS.