NSE4 Practice Test 28 — 15 Questions

Question 1

A FortiGate administrator wants to configure a dial-up IPsec VPN where remote users connect using VPN clients with pre-shared key authentication. The company has recently experienced a data breach where the PSK was compromised. What is the best method to improve security without changing all clients immediately?

Accepted Answer

Migrate to certificate-based authentication for Phase 1. Using certificate-based authentication (IKE with certificates) replaces the static PSK with dynamic per-device certificates. This provides stronger authentication and allows revocation of compromised certificates without affecting other clients. PSK is shared, so if compromised, all clients are vulnerable.

Answer

Switch to aggressive mode with a complex PSK

Answer

Enable XAuth with a second authentication factor using FortiToken

Answer

Increase the PSK length to 64 characters

Question 2

The output of 'diagnose debug application ike -1' shows 'no proposal chosen' for a Phase1 negotiation. Which action should the administrator take to resolve this?

Accepted Answer

Check and align the Phase1 encryption, authentication, and DH group settings. The error 'no proposal chosen' indicates that the local and remote gateways have no common Phase1 parameters (encryption, authentication, DH group, etc.). The administrator must review and match the Phase1 proposal settings.

Answer

Increase the Phase1 lifetime on both sides

Answer

Verify the pre-shared key is correct

Answer

Change the IKE version from v1 to v2

Question 3

A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)

Accepted Answer

Diffie-Hellman group mismatch (e.g., group 2 vs group 14). The error 'no proposal chosen' indicates that the local and remote IKE peers have no common Phase1 proposal. This can be caused by mismatched encryption, authentication, or Diffie-Hellman group. Lifetime mismatch usually results in a different error.

Answer

Pre-shared key mismatch

Answer

Lifetime mismatch (e.g., 86400 vs 3600)

Question 4

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 supports MOBIKE to handle IP address changes. IKEv2 is more resilient to network changes and supports MOBIKE (Mobility and Multihoming), which allows the VPN to survive IP address changes during a session, e.g., when a mobile client switches from Wi-Fi to cellular.

Answer

IKEv2 requires less CPU resources

Answer

IKEv2 provides built-in NAT traversal

Answer

IKEv2 supports only certificate authentication

Question 5

Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?

Accepted Answer

Tunnel mode. Tunnel mode creates a virtual interface on the client that provides full network access, similar to an IPsec VPN. Web mode only provides access to specific web applications through a browser portal.

Answer

Web mode

Answer

Split tunneling mode

Answer

Clientless mode

Question 6

An administrator configures an IPsec VPN with IKEv1 main mode. The remote peer reports that Phase 1 fails with a 'no proposal chosen' error. The local Phase 1 settings include: encryption AES128, authentication SHA1, DH group 2, lifetime 86400. Which remote peer setting is MOST likely causing the mismatch?

Accepted Answer

Remote peer uses AES256 instead of AES128. Main mode requires both sides to have matching parameters. A mismatch in any parameter causes 'no proposal chosen' error. The remote peer likely has AES256 instead of AES128.

Answer

Remote peer uses aggressive mode

Answer

Remote peer uses DH group 5 instead of group 2

Answer

Remote peer uses SHA256 instead of SHA1

Question 7

An administrator configures FSSO (Fortinet Single Sign-On) with Active Directory polling. Users report that their web traffic is being blocked by the firewall even though they are logged into the domain. Which CLI command can the administrator use to verify the FSSO login status for a specific user?

Accepted Answer

diagnose debug authd fsso list. The command 'diagnose debug authd fsso list' displays all FSSO users currently known to FortiGate, including their IP addresses and login state. This is the primary command to verify if the user is recognized by FSSO.

Answer

diagnose user fsso poll user <username>

Answer

diagnose wad user list

Answer

diagnose test authserver ldap

Question 8

A FortiGate administrator is configuring ZTNA for a web application. Which TWO components are required for a ZTNA configuration to function?

Accepted Answer

ZTNA rules. ZTNA requires ZTNA rules (to control access) and ZTNA tags (client posture assessment). The ZTNA gateway is part of the FortiGate, but the question asks for components. ZTNA tags are used to verify client compliance before granting access.

Answer

SSL VPN

Answer

IPsec VPN

Answer

Firewall policy

Question 9

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?

Accepted Answer

The hub is missing static routes to the spoke networks via the respective tunnel interfaces. In route-based VPNs, routes determine traffic flow. After a reboot, the hub may lose routes to the remote spoke networks unless they are statically configured or learned via dynamic routing. Option B is correct because static routes are needed on the hub to direct inter-spoke traffic through the appropriate tunnel interfaces.

Answer

The firewall policies on the hub do not allow traffic between the spoke networks

Answer

The spokes have mismatched IKE versions

Answer

The hub's IPsec Phase1 is not configured for DPD

Question 10

During an SSL VPN tunnel mode connection, the client reports that they cannot access any internal resources, but the VPN connection is established. The FortiGate debug shows 'no matching policy'. The administrator has configured a policy allowing the SSL VPN interface to internal. What else must be configured?

Accepted Answer

Ensure the incoming interface of the policy is set to 'ssl.root' (or the SSL VPN interface). For SSL VPN tunnel mode, the FortiGate assigns an IP to the client from a tunnel IP pool. The policy must use the SSL VPN interface (e.g., ssl.root) as the source interface. If the policy uses a different interface, traffic will not match. Option C is correct.

Answer

Add the client's assigned IP to a local user group

Answer

Configure a static route on the FortiGate for the client's tunnel IP

Answer

Enable split tunneling on the SSL VPN portal

Question 11

An administrator runs 'diagnose vpn ssl stat' and sees 'tun-num: 5, clients: 0'. Users are unable to connect to the SSL VPN. The SSL VPN settings are correct and the certificate is valid. What could be the cause?

Accepted Answer

The SSL VPN is listening on a non-default port and users are connecting to the default port. The command shows tunnel interface created but no connected clients. Option A is a likely cause: if the SSL VPN portal has limit-scan or if the user group is restricted, users might be denied. But more common: if the firewall policy for SSL VPN is missing or misconfigured, users can't pass traffic. However, the debug shows no clients, suggesting authentication or network layer issue. Option B is plausible because if the listening port is changed, users might be connecting to the wrong port. Option C is also plausible but less typical. The most common cause in practice is a missing or misconfigured policy, but the question is tricky. I'll go with Option B as it directly affects connectivity.

Answer

The FortiGate has reached the maximum number of SSL VPN users allowed by the license

Answer

The SSL VPN certificate is not trusted by the client browsers

Answer

The SSL VPN portal is configured with 'limit-scan' scanning

Question 12

A network administrator configures an IPsec VPN between two FortiGates using IKEv1 main mode. The Phase 1 negotiation fails with the error 'no proposal chosen'. The administrator checks both sides and confirms the IKE version, encryption algorithm (AES256), authentication (SHA256), and Diffie-Hellman group (14) match. Which additional parameter is MOST likely mismatched?

Accepted Answer

Local and remote identifiers (local ID / remote ID). Main mode requires the local and remote identifiers to match or be correctly configured. Often the local ID (such as the IP address or FQDN) is mismatched, causing negotiation failure despite other parameters matching.

Answer

Pre-shared key

Answer

IKE version (IKEv2)

Answer

Phase 2 encryption algorithm

Question 13

An administrator runs 'diagnose vpn ike gateway list' on a FortiGate and sees the following output for a dial-up IPsec VPN:
gateway name: 'dialup'
  version: IKEv1
  mode: aggressive
  local IP: 203.0.113.1
  remote IP: 0.0.0.0
  state: up
  peers: 0
What does 'peers: 0' indicate?

Accepted Answer

No IPsec clients are currently connected. The 'peers' count shows how many clients are currently connected. A value of 0 means no clients have successfully completed Phase 1. The gateway is up (listening) but no peers have connected.

Answer

The remote IP should be set to a specific address

Answer

The gateway is in a down state

Answer

The Phase 2 proposals are mismatched

Question 14

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN with three spokes. Each spoke has a dial-up connection to the hub. The hub uses a dynamic DNS name. Which THREE settings are necessary on each spoke to establish the VPN?

Accepted Answer

The pre-shared key or certificate for authentication. For a dial-up IPsec VPN, each spoke needs the hub's public IP or FQDN as the remote gateway. Authentication can be via pre-shared key or certificate. The spoke must also have a Phase 2 proposal that matches the hub's configuration.

Answer

A static route on the spoke for the hub's local networks

Answer

NAT enabled on the spoke tunnel interface

Question 15

An administrator is configuring a hub-and-spoke IPsec VPN with a FortiGate as the hub. The spokes must be able to communicate with each other through the hub. Which THREE settings must be enabled on the hub FortiGate?

Accepted Answer

Enable 'arp-response' on the phase1 interface. For spoke-to-spoke traffic to pass through the hub, the hub must have ARP reply enabled (so it responds for the remote spokes' IPs on its phase1 interface), must add the spoke subnets to its routing table, and must have 'add-route' disabled on the hub's phase1 interfaces to prevent automatic route creation that conflicts with manual routes.

Answer

Set 'mode-cfg' to enable on the hub phase1

Answer

Enable 'auto-discovery-sender' on the hub

Answer

Enable 'add-route' on each phase1 interface