What are two functions of ZTNA? (Choose two.)

Zero Trust Network Access (ZTNA) operates on the principle of "never trust, always verify." A core function is to continuously assess the security posture of any device attempting to connect, using ZTNA tags to check for compliance with security policies (e.g., OS version, antivirus status). Another fundamental function is to enforce the principle of least privilege by granting access based on user identity and role. Access is granted to specific applications on a per-session basis, ensuring users only have the permissions necessary for their role.

A. ZTNA manages access through the client only. This is incorrect because Fortinet ZTNA supports both client-based access (via FortiClient) and clientless web-portal access for different use cases.
B. ZTNA manages access for remote users only. This is incorrect. The zero-trust model applies to all users and devices, regardless of whether they are on the corporate network or connecting remotely.

1. Fortinet. (2022). FortiOS 7.2.0 Administration Guide.

Page 1580

Section: ZTNA tags: "ZTNA tags are used to check the security posture of the endpoint device. FortiClient running on the endpoint sends security information to FortiGate

which is then matched against the ZTNA tags." (Supports Answer C)

Page 1583

Section: ZTNA rules: "The rules specify the user groups

ZTNA tags

and other criteria that must be met for access to be granted." (User groups are a form of role-based access

supporting Answer D)

Page 1579

Section: Introduction to ZTNA: "It is based on the principle of zero trust

where no user or device is trusted by default

whether they are inside or outside the network." (Refutes Answer B)

2. Fortinet. (2022). Zero Trust Network Access (ZTNA) Architecture Guide 7.2.

Page 6

Section: ZTNA principles: "Use least privileged access. Limit user access with just-in-time and just-enough-access (JIT/JEA)

risk-based adaptive polices

and data protection to help secure both data and productivity." (Supports Answer D)

Page 10

Section: ZTNA access modes: This section details both "ZTNA with FortiClient" and "Clientless ZTNA access (web mode)

" explicitly refuting the claim in Answer A.