What are two advantages of using zero-trust tags? (Choose two.)

Zero-trust tags are fundamental to Fortinet's ZTNA framework. Their primary advantage is enabling dynamic, posture-based access control. Tags are assigned to endpoints by FortiClient EMS based on a variety of security posture checks (such as OS version, running processes, or domain membership). This tag, representing the endpoint's security state, is then used in ZTNA rules on the FortiGate or FortiSASE PoP. These rules explicitly use the tags to grant or deny access to specific protected network resources, thereby enforcing the zero-trust principle of "never trust, always verify."

C. Zero-trust tags can be used to create multiple endpoint profiles which can be applied to different endpoints: This is incorrect. The relationship is reversed; endpoint profiles in FortiClient EMS contain the rules that assign zero-trust tags to endpoints, not the other way around.

D. Zero-trust tags can be used to allow secure web gateway (SWG) access: This is not a primary advantage. While tags can be used in firewall policies, their specific and defining purpose within the FortiSASE architecture is for ZTNA rules governing access to private applications, not for general SWG policies.

1. FortiSASE Administration Guide: In the "ZTNA for SaaS" section

it states

"ZTNA rules define the users and user groups that can access a server

the ZTNA tags that must be present on the endpoint to access the server..." This directly supports option A.

2. FortiClient EMS Administration Guide: Under "Zero Trust Tags

" the documentation explains

"You can configure ZTNA tagging rules to check endpoints for security posture and apply tags to endpoints that match the configured criteria." This directly supports option B.

3. Fortinet Zero Trust Network Access (ZTNA) Architecture Guide: The guide details the workflow: "FortiClient EMS...applies tags to endpoints based on their security posture... The FortiGate ZTNA access proxy enforces ZTNA policies by checking device identity and security posture tags." This confirms that tags represent posture (supporting B) and are used for enforcement (supporting A).