NSE4 Practice Test 29 — 15 Questions

Question 1

An administrator runs 'diagnose debug application sslvpn -1' on a FortiGate and sees the following output: 'SSLVPN_ERROR:ERR_AUTH_FAIL' for a user. The user is in an LDAP group and has the correct password. What is the MOST likely cause?

Accepted Answer

The user is not a member of the required LDAP group. ERR_AUTH_FAIL indicates authentication failure despite correct credentials. The group membership is likely the issue; the user may not be a member of the required group, or the group filter is misconfigured.

Answer

The SSL VPN certificate is expired

Answer

The LDAP server is unreachable

Answer

The user account is locked out

Question 2

You run the CLI command 'diagnose vpn ike gateway list' and see that an IPsec VPN gateway is in 'up' state with 'initiator' mode, but no Phase 2 selectors are established. What is the most likely cause?

Accepted Answer

The local and remote Phase 2 selectors (proxy IDs) do not match. The Phase 1 shows up, meaning IKE SA is established. But Phase 2 is down. Common causes include mismatched proxy IDs (Phase 2 selectors), firewall policies not matching, or firewall rules blocking IPsec traffic. The output indicates Phase 1 is up, so the issue is at Phase 2.

Answer

The Phase 2 proposal parameters (encryption, authentication) do not match between peers

Answer

The remote gateway is not responding to IKE packets

Answer

The IPsec interface is down

Question 3

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The Phase 1 status shows 'down'. Which TWO commands can help diagnose the issue? (Choose TWO.)

Accepted Answer

diagnose debug application ike -1. The commands 'diagnose vpn ike log-filter' filters IKE logs, and 'diagnose debug application ike -1' enables detailed IKE debug output. These are standard for troubleshooting IPsec VPN issues.

Answer

diagnose npu np6 ipsec-sa list

Answer

diagnose sys session clear

Answer

diagnose vpn tunnel list

Question 4

A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?

Accepted Answer

The user is not a member of the configured user group. Captive portal authentication requires the user to be a member of a user group that is referenced in the firewall policy. If the LDAP user is not in the configured group (or the group is not properly mapped to an LDAP query), authentication will fail.

Answer

The captive portal is using HTTP instead of HTTPS

Answer

The captive portal interface is not in the same VDOM as the LDAP server

Answer

The LDAP server requires TLS and FortiGate is using plain LDAP

Question 5

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Accepted Answer

A RADIUS server object with IP address and shared secret. To use RADIUS, the FortiGate must define the RADIUS server with its IP and secret, and then create a user group that references that RADIUS server.

Answer

A PKI certificate for the RADIUS server

Answer

An FSSO connector

Answer

A local user account for each RADIUS user

Question 6

A company requires two-factor authentication for SSL VPN access. They already have an LDAP server for user credentials. Which TWO components are necessary to implement this?

Accepted Answer

FortiToken hardware or mobile tokens. FortiToken provides the second factor (OTP). The LDAP server provides the first factor (password). The FortiGate acts as the authenticator.

Answer

FortiAuthenticator

Answer

RADIUS server

Answer

Certificate Authority (CA)

Question 7

A FortiGate administrator is troubleshooting an IPsec VPN that is dropping traffic intermittently. The administrator runs 'diagnose vpn ike log' and sees many 'DPD' messages. Which THREE conditions could cause frequent DPD (Dead Peer Detection) retransmissions? (Choose three.)

Accepted Answer

High network latency causing DPD timeouts. DPD failures indicate the remote peer is not responding. Common causes: network congestion, a firewall blocking IKE packets, or the remote peer going down.

Answer

Mismatched IKE version

Answer

Incorrect Phase 2 proxy IDs

Question 8

You receive an alert that a user's FortiToken synchronization is off. You need to resynchronize the token. Which CLI command achieves this?

Accepted Answer

execute fortitoken-resync . The command 'execute fortitoken-resync ' is used to resynchronize a FortiToken with the FortiGate. This updates the token's seed and counter.

Answer

diagnose user fortitoken resync <token-serial>

Answer

config user fortitoken edit <token-serial> set status activate

Answer

execute fortitoken-update <token-serial>

Question 9

An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from the captive portal interface to the internet with the user group. Captive portal requires a firewall policy that permits traffic from the interface where the captive portal is enabled to the destination (internet), with authentication enabled. Option A is correct because without a policy allowing the traffic, the authentication succeeds but traffic is blocked.

Answer

The DNS server is not configured on the FortiGate

Answer

The captive portal timeout is set too low

Answer

The SSID is not configured with the captive portal security mode

Question 10

An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?

Accepted Answer

A firewall policy is required to permit traffic between the interfaces. In a route-based VPN, the tunnel interface is part of a zone or has its own security policy. Without a firewall policy allowing traffic from the local subnet to the remote subnet via the tunnel interface, traffic will be dropped.

Answer

NAT must be disabled on the tunnel interface

Answer

The tunnel interface must be added to a zone

Answer

The Phase 2 proposal must include the correct local and remote subnets

Question 11

An administrator is troubleshooting an SSL VPN connection. Users can connect and authenticate, but they cannot access any internal resources. The firewall policy allows the SSL VPN interface to the internal network. Which THREE commands or configuration checks should the administrator use to diagnose the issue?

Accepted Answer

'get router info routing-table all' to verify routes. To diagnose SSL VPN issues, the admin should check the routing table to ensure traffic is routed correctly, check the SSL VPN session list to see if sessions are established, and verify that the correct firewall policy is matching traffic.

Answer

'execute ping from ssl.root to internal IP'

Answer

'diagnose debug application sslvpn -1' to enable debug logging

Question 12

A FortiGate is configured with an IPsec VPN to a remote site using IKEv1. The VPN tunnel goes down intermittently. The admin runs 'diagnose vpn ike gateway list' and sees 'state=UP' but no Phase2 selectors. What is the most likely cause?

Accepted Answer

Mismatched Phase2 parameters between the local and remote gateways. The command shows the IKE gateway is up (Phase1 complete) but no Phase2 selectors, meaning Phase2 has not been established or has failed. Option A is correct because mismatched Phase2 parameters (e.g., encryption, hash, or proxy IDs) are the most common cause of Phase2 failure.

Answer

The firewall policy allowing IPsec traffic is misconfigured

Answer

The remote gateway has a different PSK

Answer

Dead Peer Detection (DPD) is disabled

Question 13

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode only provides access to web-based applications through a portal. To allow non-web traffic like ping or RDP, the VPN type must be changed to tunnel mode, which creates a virtual interface and routes all traffic.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 14

An administrator is troubleshooting an IPsec VPN that uses aggressive mode. The VPN establishes successfully, but the administrator is concerned about security. Which statement is true regarding aggressive mode?

Accepted Answer

Aggressive mode transmits the identification in clear text. In IKEv1 aggressive mode, the pre-shared key is transmitted in a hashed form but the identity is sent in clear text during Phase1. This makes it less secure than main mode, which protects the identity.

Answer

Aggressive mode is more secure than main mode

Answer

Aggressive mode provides perfect forward secrecy (PFS) by default

Answer

Aggressive mode uses six messages instead of three

Question 15

A FortiGate administrator wants to authenticate VPN users against an existing Active Directory server. The administrator creates a user group referencing a remote LDAP server and configures the firewall policy to authenticate using that group. However, users report authentication failures. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag test authserver ldap '. The LDAP connectivity must be verified before any user authentication can work. The diagnose test command is the quickest way to validate the LDAP server connection.

Answer

Verify the user group configuration

Answer

Restart the FortiGate

Answer

Check the LDAP server's firewall rules