In a FortiGate ZTNA configuration, the FortiGate itself functions as an access proxy, mediating all connections to protected resources. A ZTNA firewall policy is a specific type of proxy policy that defines the rules for this access. It specifies which users and devices (identified by ZTNA tags) are permitted to access specific applications (represented by ZTNA server objects). When a client connects, the traffic is handled by the access proxy, which then consults the ZTNA firewall policy to make an access decision.

A. The firewall policy does not redirect the request; the client connection is already terminated at the FortiGate access proxy based on ZTNA server settings.

C. The ZTNA server object, which maps external FQDNs to internal servers, is defined separately and used as the destination in the firewall policy.

D. The policy uses ZTNA tags as one of several criteria, but it also relies on user identity, source/destination, and other parameters, not "only" tags.

1. FortiOS 7.4 Administration Guide, "ZTNA", p. 1003. "The ZTNA rule is a proxy policy..." and "The FortiGate... functions as a ZTNA proxy".

2. Fortinet Certified Professional - Security Operations Study Guide for FortiOS 7.4, "ZTNA", p. 289. "ZTNA rules are proxy policies that are configured on FortiGate to allow or deny traffic."

ZTNA tags are created and managed in FortiClient EMS. EMS evaluates endpoint posture (OS, patch level, running processes, etc.), assigns the appropriate tag, and shares those tags with connected FortiGate devices through the Security Fabric connector. FortiGate and its Access Proxy then reference the EMS-defined tags when enforcing ZTNA and firewall policies.

A. FortiClient only reports telemetry and receives tags; it does not create them.

B. FortiGate consumes tag information but cannot define or edit tags.

D. The Access Proxy enforces ZTNA policies but has no tagging mechanism.

1. FortiClient EMS 7.0 Administration Guide, “Configuring ZTNA Tags”, p.178-180.

2. FortiOS 7.2 Administration Guide, “Using EMS tags in firewall policies”, p.3110-3112.

FortiClient EMS assigns policies to endpoints based on priority, starting with the lowest number (highest priority). EMS evaluates policies in ascending order of their priority number. The first policy that matches the endpoint's group membership is applied, and the evaluation stops. In this case, the endpoint is in the trainingAD group. EMS first checks the "Sales" policy (Priority 1) but finds no match. It then checks the "Training" policy (Priority 2), which matches the trainingAD group. Therefore, the "Training" policy is applied.

B. Both the Sales and Training policies because their priority is higher than the Default policy. Only a single endpoint policy can be active on an endpoint at any given time.

C. The Default policy because it has the highest priority. The Default policy has the highest number (10), which signifies the lowest priority. It is a catch-all policy.

D. The sales policy. The endpoint is not a member of the SalesAD group, so the "Sales" policy criteria are not met.

FortiClient EMS 7.4 Administration Guide, "Endpoints," page 61, "Policy assignment and priority." The guide states, "EMS checks policies in order of priority, from lowest number to highest number. EMS assigns the first matching policy to the endpoint."

In a multitenant FortiClient EMS deployment, the Settings Administrator role is restricted to the Global site. It can configure system-wide settings and view logs but cannot switch to, or manage, any tenant sites, satisfying the “global-only” access requirement.

A. Tenant administrator – limited to its own tenant site, no access to Global site.

C. Standard administrator – access is granted per specific tenant(s); not confined to Global site.

D. Global administrator – has full Global plus all tenant-site access, not “global-only”.

1. FortiClient EMS 7.2 Administration Guide, “Managing administrators” → Table 15 “Administrator roles”, pp. 54-55.

2. Fortinet KB Article 84603, “How administrator roles work in multitenant EMS”, para. 2-3.

In a Fortinet Security Fabric environment, roles are distributed. FortiClient EMS acts as the Policy Administration and Decision Point, defining compliance rules and assigning Zero Trust tags to endpoints. The FortiClient agent on the endpoint reports its status and acts as the Policy Information Point. The FortiGate acts as the Policy Enforcement Point. It receives the ZTNA tags from EMS and uses them in ZTNA rules and firewall policies to dynamically grant or deny access to network resources, thereby enforcing compliance.

A. FortiClient reports its compliance status to EMS but does not enforce network access control policies on the FortiGate; it is the agent being monitored.

B. FortiClient EMS defines the rules and assigns tags but does not sit in the data path to block or allow traffic to corporate resources.

D. FortiAnalyzer is a logging and analytics platform; it collects data and provides reports but does not actively enforce security policies in real-time.

1. FortiClient EMS 7.2 Administration Guide, Page 258, "Zero Trust Tags". The guide explains, "FortiClient EMS sends endpoint information including ZTNA tags to FortiGate. You can use ZTNA tags on FortiGate to enforce dynamic access control."

2. FortiGate ZTNA Deployment Guide 7.2, Page 10, "ZTNA configuration overview". The guide shows that ZTNA rules are configured on the FortiGate to check for tags and enforce access.