NSE4 Practice Test 27 — 15 Questions

Question 1

A FortiGate admin configures a remote user for SSL VPN tunnel mode. The user can connect but cannot access resources on the internal network. The admin checks the SSL VPN settings: tunnel mode enabled, split tunneling disabled. What is the issue?

Accepted Answer

The firewall policy from the SSL VPN interface to the internal network is missing or incorrectly configured. When split tunneling is disabled, all traffic goes through the tunnel. The internal resources may not be reachable if the VPN interface's IP pool addresses are not routed correctly or if firewall policies on the FortiGate do not allow traffic from the tunnel interface.

Answer

The user's FortiClient is outdated

Answer

The SSL certificate is expired

Answer

The user's client software is not configured to route all traffic through the tunnel

Question 2

An administrator has configured an SSL VPN with tunnel mode and split tunneling enabled. However, remote users report that all internet traffic is going through the VPN tunnel. What is the MOST likely cause?

Accepted Answer

The client's routing table is set to route all traffic through the VPN. Split tunneling routes only specific subnets through the tunnel and other traffic directly. If the routing table is set to route all traffic (0.0.0.0/0) via the SSL VPN interface, split tunneling is effectively disabled.

Answer

The firewall policy allows traffic to the internet

Answer

The SSL VPN portal has 'split tunneling' disabled

Answer

The user has installed a root certificate

Question 3

An administrator is configuring a dial-up IPsec VPN for remote users. Which TWO settings are required on the FortiGate for the dial-up server? (Choose two.)

Accepted Answer

Set 'mode-cfg' to enable on Phase 1. A dial-up server must have a Phase 1 configuration that allows multiple peers (mode-cfg or aggressive mode) and a Phase 2 that uses 0.0.0.0/0 or dynamic selectors. Additionally, an IP pool is often used to assign addresses.

Answer

Set 'aggressive mode' on Phase 1

Answer

Set 'auto-negotiate' to enable on Phase 2

Answer

Set 'pfs' to enable on Phase 2

Question 4

A FortiGate administrator is troubleshooting an SSL VPN connection issue. Users can connect but cannot access internal resources. The administrator checks the SSL VPN policy and confirms it allows access to the internal subnet. What should the administrator check next?

Accepted Answer

Verify that the firewall policy between the SSL VPN interface and the internal network allows the traffic. Even if the SSL VPN policy is correct, the traffic must also be permitted by the firewall policies between the SSL VPN interface and the internal network. A common mistake is not having a firewall policy that allows traffic from the SSL VPN interface (e.g., ssl.root) to the internal network.

Answer

Check the routing table on the FortiGate for the internal subnet

Answer

Ensure the users have the correct client software installed

Answer

Check the FortiGate's DNS settings

Question 5

A FortiGate administrator is configuring RADIUS authentication for firewall users. Which THREE steps are required to complete the configuration? (Select THREE.)

Accepted Answer

Configure a firewall policy with the user group set in 'users/groups'. To configure RADIUS authentication, you must define the RADIUS server, create a user group that references the RADIUS server, and then configure a firewall policy that uses that user group for authentication. The RADIUS server itself needs to be accessible, but the configuration steps on FortiGate are these three.

Answer

Import the RADIUS server certificate into FortiGate

Answer

Enable 'set auth-type radius' on the interface

Question 6

Which of the following is a benefit of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 is more robust to network changes and supports MOBIKE. IKEv2 is more resilient to network changes and supports MOBIKE, which allows the VPN to survive IP address changes.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires fewer firewall rules

Answer

IKEv2 uses a single UDP port 500

Question 7

You run the following CLI command on a FortiGate: 'diagnose vpn ike config list'. The output includes: 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0'. What does this indicate?

Accepted Answer

The Phase 2 configuration is using 10.0.1.0/24 as local subnet and 192.168.1.0/24 as remote subnet. The command shows IKE configuration for Phase 2 selectors. The 'src' and 'dst' represent the local and remote subnets that will be protected by the VPN tunnel.

Answer

The firewall policy is allowing traffic from 10.0.1.0/24 to 192.168.1.0/24

Answer

The Phase 1 configuration is using 10.0.1.0/24 as local address

Answer

The tunnel is in dial-up mode with dynamic remote subnet

Question 8

A FortiGate administrator is configuring IPsec VPN between two sites. The Phase 1 negotiation fails with the error 'no proposal chosen'. Which two settings must match on both VPN peers?

Accepted Answer

Encryption algorithm and authentication algorithm. The proposal (encryption and authentication algorithms) and the Diffie-Hellman group must match between peers for Phase 1 to succeed. These are the key parameters negotiated during Phase 1.

Answer

Pre-shared key and local ID

Answer

Dead peer detection interval and retry count

Answer

Remote gateway IP and Phase 2 selectors

Question 9

A FortiGate administrator configures an SSL VPN web mode portal. Users can access internal web applications but cannot access internal file shares via SMB. What is the most likely reason?

Accepted Answer

Web mode does not support the SMB protocol; users must use tunnel mode to access fileshares. Web mode provides clientless access via a web browser, supporting HTTP/HTTPS, but does not support native protocols like SMB (port 445). To access SMB shares, users need tunnel mode with a VPN client that can route all traffic.

Answer

The SSL VPN policy does not allow SMB traffic

Answer

The fileserver requires client certificates for authentication

Answer

The firewall policy for SSL VPN is configured with the wrong interface

Question 10

In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?

Accepted Answer

Configure dynamic routing (BGP) on all sites and enable route exchange. By default, hub-and-spoke only allows communication between spokes via the hub. To enable direct spoke-to-spoke, you need to add Phase 2 selectors with each other's subnets on the hub or configure dynamic routing (BGP/OSPF) to advertise routes between spokes. Another method is to use ADVPN (Auto Discovery VPN).

Answer

Set the 'add-route' option to 'enable' on the spoke Phase 1 settings

Answer

Add static routes on the hub pointing to each spoke's subnet via the respective tunnels

Answer

Create a separate IPsec VPN between each spoke pair

Question 11

A FortiGate is configured with FSSO (Fortinet Single Sign-On) to authenticate users from Active Directory. Users are logging in to their domain-joined computers, but the FortiGate does not see the user sessions. The polling connector is configured correctly. What is the MOST likely reason?

Accepted Answer

DNS resolution for the Domain Controller is failing. FSSO requires the FortiGate to resolve NetBIOS names to IP addresses. If DNS resolution fails, the FortiGate cannot correlate the user's login event with the IP address.

Answer

The FSSO agent is not installed on the Domain Controller

Answer

The user group filter is too restrictive

Answer

The FortiGate is not in the same subnet as the users

Question 12

A network admin configures an IPsec VPN between two FortiGates using IKEv2. Phase 1 completes successfully, but Phase 2 fails to establish. The admin runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match. In IKEv2, Phase 2 proposals are negotiated separately from Phase 1. A proposal mismatch error indicates that the Phase 2 parameters (such as encryption algorithm, authentication algorithm, and PFS settings) do not match between the two peers.

Answer

The IKE version is not compatible

Answer

The Phase 2 selectors (local and remote subnets) are misconfigured

Answer

The pre-shared keys do not match

Question 13

An administrator is troubleshooting an IPsec VPN between two FortiGates. Phase 1 is up but Phase 2 is down. The admin runs 'diagnose vpn ike log' and sees 'no matching proposal'. To resolve this issue, which TWO settings should be checked on both ends?

Accepted Answer

Phase 2 PFS (Perfect Forward Secrecy) group. Phase 2 parameters must match exactly, especially encryption algorithm and PFS settings. The proposal mismatch can also be caused by mismatched selectors (subnets), but the question asks for the two settings most directly related to the 'no matching proposal' error.

Answer

Phase 1 authentication method

Answer

Phase 2 local and remote subnets

Answer

Phase 1 encryption algorithm

Question 14

A FortiGate administrator notices that the IPsec VPN tunnel is established but traffic is not passing. The firewall policy allowing traffic from the remote subnet to the local subnet is in place. What is the MOST likely cause?

Accepted Answer

There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface. If the tunnel is up but no traffic passes, it could be due to routing misconfiguration, such as missing static routes for the remote subnet pointing to the VPN tunnel interface.

Answer

The VPN tunnel is a policy-based VPN and the policy is incorrectly configured

Answer

The Phase 2 proposal includes PFS, but the remote side does not

Answer

The local firewall is blocking ICMP

Question 15

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN. The hub has multiple Phase 2 selectors for each spoke. What is the recommended way to simplify configuration on the hub when adding new spokes?

Accepted Answer

Use a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote. Using a single Phase 2 with 0.0.0.0/0 as local/remote subnet allows the hub to accept all traffic without needing per-spoke Phase 2 selectors. But security-conscious admins often use specific selectors. The question asks for simplification; dynamic routing (BGP) is even better.

Answer

Configure each spoke in a separate VDOM

Answer

Use aggressive mode for Phase 1

Answer

Use policy-based VPN instead of route-based