To meet the requirements of implementing device posture checks for remote endpoints and ensuring

that TCP traffic between the endpoints and protected servers is processed by FortiGate, the following

three setups are necessary:

Configure ZTNA tags on FortiGate (Option A):

ZTNA (Zero Trust Network Access) tags are used to define access control policies based on the

security posture of devices. By configuring ZTNA tags on FortiGate, administrators can enforce

granular access controls, ensuring that only compliant devices can access protected resources.

Configure FortiGate as a zero trust network access (ZTNA) access proxy (Option B):

FortiGate can act as a ZTNA access proxy, which allows it to mediate and secure connections

between remote endpoints and protected servers. This setup ensures that all TCP traffic passes

through FortiGate, enabling inspection and enforcement of security policies.

Configure ZTNA servers and ZTNA policies on FortiGate (Option C):

To enable ZTNA functionality, administrators must define ZTNA servers (the protected resources) and

create ZTNA policies on FortiGate. These policies determine how traffic is routed, inspected, and

controlled based on device posture and user identity.

Here’s why the other options are incorrect:

D . Configure private access policies on FortiSASE with ZTNA: While FortiSASE supports ZTNA, the

requirement specifies that TCP traffic must be processed by FortiGate. Configuring private access

policies on FortiSASE would route traffic through FortiSASE instead of FortiGate, which does not meet

the stated requirements.

E . Sync ZTNA tags from FortiSASE to FortiGate: Synchronizing ZTNA tags is unnecessary in this

scenario because the focus is on FortiGate processing the traffic. The tags can be directly configured

on FortiGate without involving FortiSASE.

Reference:

Fortinet FCSS FortiSASE Documentation - Zero Trust Network Access (ZTNA) Deployment

FortiGate Administration Guide - ZTNA Configuration

================