NSE4 Practice Test 26 — 15 Questions

Question 1

A network administrator wants to implement two-factor authentication for SSL VPN users using FortiToken. The users are already authenticated against an LDAP server. Which configuration step is required to enforce two-factor authentication?

Accepted Answer

Create a user group that uses LDAP as the authentication server and enable FortiToken two-factor authentication in the group settings. For two-factor authentication, FortiGate requires a user group with the LDAP server as the primary authentication, and then enabling FortiToken two-factor authentication on that group. This allows the user to first authenticate via LDAP (password) and then provide a FortiToken code.

Answer

Create a local user with the same username as the LDAP user and assign a FortiToken to that local user

Answer

Configure the SSL VPN portal to require FortiToken and set the authentication server to LDAP

Answer

Set the SSL VPN authentication method to 'certificate' and use FortiToken as second factor

Question 2

What is the primary purpose of configuring split tunneling on an SSL VPN?

Accepted Answer

To allow the remote client to access both the corporate network and the Internet simultaneously without routing all traffic through the VPN. Split tunneling allows the remote client to route only traffic destined for the corporate network through the VPN tunnel, while Internet-bound traffic goes directly to the Internet. This reduces bandwidth load on the VPN and improves performance.

Answer

To provide two-factor authentication for the VPN connection

Answer

To encrypt all traffic from the remote client, including Internet traffic

Answer

To enable the use of client certificates for authentication

Question 3

Which IPsec VPN mode is typically used when the VPN peer has a dynamic public IP address?

Accepted Answer

Aggressive mode. Aggressive mode allows the initiator to send its identity and proposed parameters in the first packet, which is needed when the responder does not know the initiator's IP address (e.g., dial-up VPN). Main mode requires the responder to know the initiator IP beforehand.

Answer

Quick mode

Answer

IKEv2

Answer

Main mode

Question 4

An administrator has configured LDAP authentication on a FortiGate. When testing the LDAP connectivity, the test succeeds. However, users cannot authenticate through the captive portal. What is a possible cause?

Accepted Answer

The user group is not configured to use the LDAP server. Even if LDAP connectivity is successful, the user group must be configured to use the LDAP server. Also, the firewall policy must have the LDAP user group as the allowed user.

Answer

The captive portal is disabled

Answer

The LDAP server is not reachable from the captive portal interface

Answer

The LDAP server's SSL certificate is expired

Question 5

A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)

Accepted Answer

Static routes for each branch's subnet pointing to the respective VPN interface. To allow spoke-to-spoke communication without hub, the hub must have routes to both spokes, Phase 2 selectors to allow traffic between spokes, and a firewall policy permitting inter-spoke traffic.

Answer

Enable 'forward traffic' in Phase 1 settings

Answer

Disable anti-replay on all tunnels

Question 6

A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?

Accepted Answer

Web mode only allows access to specific bookmarks configured in the portal. Web mode provides clientless access only to bookmarked web applications. To access other internal resources, tunnel mode (with a virtual adapter) is required.

Answer

The user must be authenticated via LDAP

Answer

The user has not installed the FortiClient VPN plugin

Answer

The SSL VPN policy is missing a security profile

Question 7

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. Which two additional diagnostics should the administrator run to isolate the issue?

Accepted Answer

diagnose sys session filter and diagnose sys session list. To isolate traffic issues, check firewall policies that apply to the tunnel interface and verify Phase 2 selectors match the traffic. The routing table is also relevant but diagnostics focus on VPN specifics.

Answer

diagnose hardware sysinfo memory

Answer

diagnose netlink interface list

Answer

execute ping-options source and execute ping

Question 8

An SSL VPN user connects via web mode but cannot access internal resources. The admin checks the SSL VPN settings: tunnel mode is disabled, split tunneling is enabled, and the user's realm is configured correctly. What is the MOST likely cause?

Accepted Answer

No port forwarding rules are configured in the SSL VPN portal. In web mode, access to internal resources requires proper port forwarding rules within the SSL VPN portal. Without them, the user can only access resources explicitly listed.

Answer

Split tunneling is blocking internal routes

Answer

The user's browser does not support WebSocket

Answer

The user's client certificate is expired

Question 9

An administrator runs 'diagnose vpn ike config' and sees the output includes 'P2 proposals: aes128-sha256, aes256-sha1'. What does this indicate?

Accepted Answer

The Phase 2 encryption and authentication algorithms. This output shows the Phase 2 proposals configured on the VPN tunnel. It lists the encryption and authentication algorithms that will be offered to the peer.

Answer

The Diffie-Hellman groups for Phase 2

Answer

The Phase 1 encryption settings

Answer

The lifetime settings for the VPN tunnel

Question 10

An administrator wants to use FortiToken two-factor authentication for SSL VPN users. In addition to configuring the user's FortiToken, which setting must be enabled on the firewall policy to force two-factor authentication?

Accepted Answer

Enable 'Two-factor authentication' on the user group that the policy references. Two-factor authentication is enabled by setting the authentication method to require both password and FortiToken. The 'Two-factor authentication' option must be enabled on the user group or user, not the policy itself.

Answer

Set the 'auth type' to 'token' on the SSL VPN portal

Answer

Enable 'Two-factor authentication' on the firewall policy

Answer

Configure a FortiToken server object

Question 11

What is the primary advantage of using route-based IPsec VPN over policy-based IPsec VPN?

Accepted Answer

Route-based VPN allows the use of dynamic routing protocols over the tunnel. Route-based VPN uses a virtual IPsec interface, allowing dynamic routing protocols to be used. This simplifies configuration and management of complex topologies, whereas policy-based VPN requires static policies for each subnet pair.

Answer

Route-based VPN requires fewer firewall policies

Answer

Route-based VPN is easier to configure for hub-and-spoke

Answer

Route-based VPN supports higher encryption algorithms

Question 12

A FortiGate is configured with IPsec VPN using IKEv2 and a policy-based tunnel. The remote subnet is 10.0.2.0/24, and the local subnet is 192.168.1.0/24. The tunnel is up, but traffic from 192.168.1.0/24 to 10.0.2.0/24 fails. The administrator checks the firewall policy and sees a policy allowing traffic from the local interface (port1) to the remote interface (virtual ipsec interface) with the action set to IPSEC. What is the most likely missing configuration?

Accepted Answer

The firewall policy's source or destination addresses are not correctly set to the local and remote subnets. Policy-based VPNs require a firewall policy that matches the traffic and has the action set to IPSEC. However, the 'incoming interface' must be the internal interface (port1) and 'outgoing interface' the tunnel interface. The description suggests both are correct, but the missing piece is that the 'source' and 'destination' addresses in the policy must match the local and remote subnets. The policy likely uses all addresses or incorrect subnets.

Answer

IKEv2 does not support policy-based VPNs

Answer

The tunnel interface is not assigned to the correct VDOM

Answer

The Phase 2 proposal does not match the remote subnet

Question 13

A captive portal is configured on a FortiGate to authenticate users before allowing internet access. Users report that after entering credentials, they are redirected to the original website, but then they cannot access other sites. What is the most likely issue?

Accepted Answer

The user is not a member of the required user group specified in the firewall policy. After authentication, the FortiGate must allow the user's traffic based on the firewall policy. If the policy uses the authenticated user group but the user is not in any group, traffic is blocked. Additionally, the captive portal policy must be separate from the internet access policy.

Answer

The captive portal is using a self-signed certificate causing browser warnings

Answer

The DNS server is not configured on the FortiGate

Answer

The session timeout is set too low

Question 14

Which of the following is a characteristic of route-based IPsec VPN compared to policy-based IPsec VPN?

Accepted Answer

Route-based VPN can use dynamic routing protocols like OSPF. Route-based VPNs use a virtual tunnel interface (e.g., port1.0) that supports dynamic routing protocols, whereas policy-based VPNs rely on firewall policies with IPSEC action and static selectors.

Answer

Route-based VPN is only supported in IKEv1

Answer

Route-based VPN requires Phase 2 selectors to match both local and remote subnets

Answer

Route-based VPN uses firewall policies with IPsec action

Question 15

An administrator is configuring Active Directory polling for FSSO. Which two components must be set up correctly for FSSO to work?

Accepted Answer

A firewall policy that allows LDAP traffic from FortiGate to the domain controller. FSSO requires the FortiGate to have an FSSO agent (or collector agent) that can poll the domain controllers for logon events, and the FortiGate must have LDAP configured to resolve usernames to groups, and the polling must be enabled.

Answer

A RADIUS server configured for user authentication

Answer

An IPsec tunnel between FortiGate and the domain controller

Answer

FortiToken license for each user