NSE4 Practice Test 21 — 15 Questions

Question 1

A network administrator configures an IPsec VPN between two FortiGate devices. Phase 1 completes successfully, but Phase 2 fails to establish. The administrator runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the MOST likely cause?

Accepted Answer

The Phase 2 local and remote subnets do not match on both ends. Option C is correct. A proposal mismatch in Phase 2 indicates that the Phase 2 selectors (local/remote subnets, protocol, port) or the SA proposal parameters (encryption, authentication, PFS) do not match between the two peers.

Answer

The IKE version is mismatched (IKEv1 vs IKEv2)

Answer

The pre-shared key is incorrect

Answer

The firewall policies are blocking IKE traffic on UDP port 500

Question 2

Which authentication method allows a FortiGate to transparently authenticate users based on their Active Directory login events without prompting for credentials?

Accepted Answer

FSSO (Fortinet Single Sign-On). Option B is correct. Fortinet Single Sign-On (FSSO) captures AD login events (via polling or agent) and maps them to users on the FortiGate, enabling transparent authentication for firewall policies.

Answer

RADIUS authentication

Answer

Local database authentication

Answer

LDAP authentication

Question 3

A FortiGate admin is configuring a hub-and-spoke IPsec VPN. The hub has multiple phase 2 configurations for each spoke. The spokes can communicate with the hub but not with each other. The admin wants to allow spoke-to-spoke traffic through the hub. Which configuration change is required on the hub?

Accepted Answer

Modify the Phase 2 selectors on the hub to include both spoke subnets and add firewall policies allowing traffic between the spoke networks. Option C is correct. For spoke-to-spoke traffic to pass through the hub, the hub must have firewall policies allowing traffic between the spoke networks, and the Phase 2 selectors on the hub must include both spoke subnets (or use 0.0.0.0/0 to allow all traffic).

Answer

Change the IPsec mode from policy-based to route-based

Answer

Enable 'add-route' on the hub's Phase 1 settings

Answer

Configure a static route on each spoke pointing to the other spoke's subnet via the tunnel

Question 4

An admin is configuring a dial-up IPsec VPN for remote users. The users will connect from various public IP addresses. Which Phase 1 configuration is required for the FortiGate to accept connections from unknown remote gateways?

Accepted Answer

Set the remote gateway to 0.0.0.0. The remote gateway IP must be set to 0.0.0.0 to accept connections from any IP address, which is typical for dial-up VPN.

Answer

Enable aggressive mode

Answer

Configure a static route to the remote users' subnet

Answer

Set the remote gateway to a specific IP address

Question 5

A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?

Accepted Answer

Enable 'add-route' on the hub Phase 2. In hub-and-spoke, the hub needs Phase 2 selectors that cover the spoke subnets, and the spokes need static routes pointing to the hub for other spoke subnets. Additionally, enabling 'add-route' on the hub can help, but the key is proper Phase 2 configuration.

Answer

Set the hub as the default gateway on each spoke

Answer

Use policy-based VPN instead of route-based

Answer

Configure NAT on the hub

Question 6

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

Accepted Answer

Phase 2 encryption or authentication algorithms do not match on both sides.. This error indicates that the Phase 2 proposals (encryption, authentication, etc.) do not match between the two peers. Phase 1 succeeded, so the IKE parameters are compatible; the issue lies in the Phase 2 settings.

Answer

The firewall policy allowing IPsec traffic is missing.

Answer

The remote gateway IP address is unreachable.

Answer

The pre-shared key is incorrect.

Question 7

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Accepted Answer

The FSSO collector agent service is not running.. FSSO relies on polling the domain controllers or using a collector agent to capture user logon events. If the DC polling fails or the collector agent is not working, FortiGate cannot correlate the user, so it prompts for authentication.

Answer

The users are not members of the FSSO group.

Answer

The firewall policy uses 'All Users' instead of a specific group.

Answer

The FortiGate's LDAP server is unreachable.

Question 8

A FortiGate administrator wants to authenticate VPN users against an existing LDAP server. The administrator creates an LDAP user group on the FortiGate. What additional configuration is REQUIRED to use this group for IPsec VPN authentication?

Accepted Answer

In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication. Option B is correct. The user group must be referenced in the IPsec Phase 1 authentication settings, specifically under 'Peer Options' or 'User Authentication' (depending on FortiOS version). Typically, this is done by setting 'xauthtype' to 'auto' or 'psk' and selecting the user group under 'usrgrp'.

Answer

Enable LDAP over TLS (LDAPS) on the FortiGate

Answer

Assign the LDAP user group to a firewall policy

Answer

Configure a RADIUS server as an intermediate proxy between FortiGate and LDAP

Question 9

A FortiGate administrator is configuring an SSL VPN tunnel mode for remote users. The administrator wants to ensure that only traffic destined for the corporate network (192.168.1.0/24) goes through the VPN, and all other traffic (e.g., internet) goes directly from the user's device. Which TWO configuration steps are required?

Accepted Answer

Configure the SSL VPN portal to push routes for 192.168.1.0/24 to the client. Options B and C are correct. Split tunneling must be enabled to allow direct internet access. Additionally, the routing rules (or destination routes) must specify that only the corporate subnet is routed through the VPN tunnel.

Answer

Set the SSL VPN portal's 'tunnel mode' to 'web-only'

Answer

Disable 'tunnel mode' and use 'web mode' instead

Answer

Create a firewall policy on the FortiGate allowing traffic from the SSL VPN interface to the corporate network

Question 10

A FortiGate administrator is configuring intrusion prevention (IPS) for a web server. The administrator wants to both block known exploits and detect anomalous traffic patterns. Which TWO features should be enabled? (Choose two.)

Accepted Answer

IPS signatures

Answer

Web filter

Answer

Antivirus

Answer

Application control

Question 11

A FortiGate administrator is troubleshooting a dial-up IPsec VPN where remote users can connect but traffic does not pass. The Phase 1 and Phase 2 status show 'up'. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. However, 'diagnose sys session list' shows no sessions for the remote user's IP. What is the MOST likely cause?

Accepted Answer

There is no firewall policy permitting traffic from the dial-up interface to the destination network. Option D is correct. Even though the VPN tunnel is up, if there is no firewall policy allowing traffic from the dial-up interface to the internal network, the traffic will be dropped silently.

Answer

The Phase 2 proposal uses AES256 but the remote client only supports AES128

Answer

The FortiGate's routing table does not have a route to the remote user's subnet

Answer

The remote user's FortiClient is blocking split tunneling

Question 12

A FortiGate admin is troubleshooting an IPsec VPN tunnel that fails to establish. The remote site uses aggressive mode. The local FortiGate is configured for main mode. The admin sees 'no proposal chosen' in the IKE debug. What is the MOST likely cause?

Accepted Answer

The IKE mode (main vs aggressive) does not match between peers. Option D is correct. IKE mode (main vs aggressive) must match between peers. If one side uses main mode and the other aggressive mode, Phase 1 will fail with 'no proposal chosen' because the IKE exchange format differs.

Answer

The pre-shared key is incorrect

Answer

The local firewall is blocking UDP port 500

Answer

The Phase 2 encryption algorithm is not supported

Question 13

You run 'diagnose debug application ike -1' and see the following output: 'Initiator: no acceptable proposal'. What is the MOST likely cause of this error?

Accepted Answer

The Phase 1 encryption or hash algorithm is mismatched. The 'no acceptable proposal' error indicates that the IKE proposal sent by the initiator does not match any proposal configured on the responder. This is a Phase 1 mismatch.

Answer

The pre-shared key is incorrect

Answer

The remote gateway is not reachable

Answer

The firewall policy is blocking UDP port 500

Question 14

A FortiGate is configured with FSSO and Active Directory polling. Users report that they are frequently prompted for authentication even though they are logged into the domain. Which THREE possible causes should the administrator investigate?

Accepted Answer

The user's IP address has changed and the FortiGate still has a stale mapping. Polling issues (A), logon event not sent (B), and stale IP mapping (C) are common causes. Option D is about FortiToken, which is not relevant to FSSO. Option E is for captive portal, not FSSO.

Answer

The FortiToken server is overloaded

Answer

The captive portal is enabled on the policy

Question 15

An admin needs to authenticate remote users connecting via SSL VPN. The users are in an Active Directory domain. Which authentication method should be configured on the FortiGate to allow users to log in with their domain credentials?

Accepted Answer

LDAP server. LDAP is the protocol used to authenticate against Active Directory. FortiGate can query AD via LDAP to validate user credentials.

Answer

Local user database

Answer

RADIUS server

Answer

FSSO