Zero-trust tags are central to Fortinet's ZTNA solution. First, they represent the security posture of an endpoint, classifying it based on rules configured in FortiClient EMS (e.g., OS version, AV status). Second, these tags are used by the enforcement point (FortiSASE) in ZTNA and SWG policies as a dynamic criterion to explicitly allow or deny access to specific network resources or applications. This ensures continuous verification of the device state before granting access.

C. Zero-trust tags are applied by endpoint profiles; they do not create the profiles themselves. The relationship is the reverse of what is stated.

D. While tags can be used for SWG access, this is a specific instance of the broader principle described in option A ("access to network resources"). Option A is the more fundamental advantage.

1. FortiOS 7.4.0 ZTNA Guide, "ZTNA components", page 6. It states, "ZTNA rules on the FortiGate use these tags to grant or deny access to applications." This supports option A.

2. FortiClient EMS 7.2.3 Administration Guide, "Zero Trust Tags", page 118. It states, "Zero Trust tags allow you to classify endpoints based on a defined set of criteria." This supports that tags represent the determined security posture (Option B).