ZTNA operates on a principle of continuous verification. When FortiClient EMS detects a change in an endpoint's security posture (for example, antivirus is disabled), it updates the ZTNA tags for that device and notifies the FortiGate. The FortiGate then immediately re-evaluates all active sessions from that endpoint against the configured ZTNA policies. If the endpoint no longer meets the policy requirements due to the tag change, its active sessions are terminated.

A. They will be re-evaluated to match the endpoint policy: "Endpoint policy" is ambiguous. The re-evaluation happens against the ZTNA policy on the FortiGate access proxy.

B. They will be re-evaluated to match the firewall policy: While a ZTNA policy is a type of firewall policy, "ZTNA policy" is the more specific and correct term for this feature.

D. They will be re-evaluated to match the security policy: "Security policy" is a generic term. The specific policy type governing ZTNA access is the ZTNA policy.

- FortiOS 7.2 Administration Guide, "ZTNA" chapter, section "ZTNA session re-evaluation". It states, "When a ZTNA tag for an endpoint changes, FortiClient EMS notifies the FortiGate. The FortiGate then re-evaluates the ZTNA policy for any active connections from that endpoint. If the endpoint is no longer compliant with the policy, the connection is dropped."