Refer to the exhibits.WiMO-Pro and Win7-Pro are endpoints from the same remote location. WiMO-Pro can access the internet though FortiSASE, while…

Based on the exhibits, Win7-Pro has been assigned the ZTNA tag FortiSASE-Non-Compliant. In FortiSASE, ZTNA tags are dynamically applied based on continuous device posture checks. The Secure Internet Access Policy is evaluated top-down. Policy ID 2 ("Non-Compliant") explicitly denies all internet traffic for any source carrying the FortiSASE-Non-Compliant tag. Because Win7-Pro's device posture triggered this specific tag, its internet traffic is actively blocked by Policy ID 2 before it can ever reach the permissive "Web Traffic" or "Allow-All" rules below it.

B. Win7-Pro cannot reach the FortiSASE SSL VPN gateway: The "Managed Endpoints" exhibit clearly shows the Management Connection for Win7-Pro is "Online," verifying successful communication with the gateway.

C. The Win7-Pro FortiClient version does not match the FortiSASE endpoint requirement: The exhibits lack the specific Zero Trust Tagging rules needed to definitively prove the FortiClient version mismatch is the exact trigger for the non-compliant tag.

D. Win-7 Pro has exceeded the total vulnerability detected threshold: Without viewing the configured ZTNA tagging rules, there is no evidence to confirm that 176 vulnerabilities explicitly exceed a defined threshold to apply the tag.

Fortinet, Inc. (2023). FortiSASE Administration Guide, "Endpoint Posture" section. Defines how continuous posture checks apply ZTNA tags dynamically to endpoints based on compliance rules.

Fortinet, Inc. (2023). FortiSASE Administration Guide, "Secure Internet Access (SIA)" section. Details the top-down evaluation of firewall policies and how ZTNA tags act as source criteria for Deny/Accept actions.