NSE4 Authentication and VPN — 20 Questions

Question 1

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The phase2 configuration does not specify the local and remote subnets to protect.. The phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.

Answer

The phase1 keylife is longer than the phase2 keylife, causing rekey issues.

Answer

The 'set net-device disable' prevents the tunnel from being used for routing.

Answer

The phase2 proposal does not match the phase1 proposal.

Question 2

Match each FortiGate VPN type to its characteristic.

Accepted Answer

IPsec VPN: Uses ESP/AH protocols for secure communication. Common FortiGate VPN types include IPsec (secure tunneling), SSL (web-based), PPTP (legacy, uses GRE), and L2TP (often with IPsec). Distractors swap protocol characteristics.

Answer

IPsec VPN: Uses TLS/SSL for secure web-based access

Answer

SSL VPN: Uses ESP/AH protocols for secure communication

Question 3

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is in SYN_SENT state and might be stuck due to no response from the server.. The output shows `proto_state=01`, which in Fortinet's session table corresponds to the TCP SYN_SENT state (the session is waiting for a SYN-ACK from the server). The `duration=3600` indicates the session has existed for 3600 seconds, but the `expire=3599` shows it has not yet been confirmed as established. This combination indicates the session is stuck in the SYN_SENT state, likely because the server is not responding, making option B correct.

Answer

The session is fully established and has been active for 3600 seconds.

Answer

The session has been idle for 3599 seconds and will expire soon.

Answer

The session is in FIN_WAIT state and is being closed.

Question 4

An administrator configures an SSL VPN portal with web mode and split tunneling enabled. Remote users can access internal web applications but cannot reach the internet through the VPN. What needs to be checked?

Accepted Answer

The firewall policy allowing internet traffic from the SSL VPN interface is missing or incorrect.. In web mode, the FortiGate proxies web requests. Internal web applications work because a firewall policy permits that traffic. Internet traffic from the SSL VPN web proxy must also be allowed by a firewall policy from the SSL VPN interface to the internet; if that policy is missing or incorrect, the FortiGate drops the requests. Split tunneling is a tunnel-mode feature and does not apply to web mode.

Answer

The remote user's browser does not support SSL VPN.

Answer

The split tunneling setting is disabled.

Answer

The SSL VPN portal is configured in web mode only; tunnel mode is required for internet access.

Question 5

An administrator needs to configure a hub-and-spoke IPsec VPN topology. Which TWO settings must be configured on the hub FortiGate to allow spokes to communicate with each other through the hub?

Accepted Answer

Set Phase 2 selectors to 0.0.0.0/0 on the hub's side.. Option B is correct because in a hub-and-spoke IPsec topology, the hub must use Phase 2 selectors of 0.0.0.0/0 (or otherwise include all spoke subnets) so that traffic destined to any spoke network is matched and encrypted by the hub's IPsec tunnel; this allows the hub to route and forward traffic between spokes without the selectors restricting the SA to a single subnet. Option E is correct because even with the tunnel up and selectors matching, FortiGate only forwards traffic between the spoke networks if firewall policies on the hub explicitly permit traffic from the spoke subnet(s) to the other spoke subnet(s) on the IPsec interfaces; without such policies, inter-spoke traffic is dropped by the implicit deny. Option A is incorrect because NAT on the hub's tunnel interface would hide spoke source addresses and break spoke-to-spoke reachability, which requires preserving the original spoke subnets. Option C is incorrect because DNS service on the hub is unrelated to forwarding IPsec traffic between spokes. Option D is incorrect because IKEv2 is not required for hub-and-spoke communication; IKEv1 or IKEv2 can both work as long as selectors and policies are configured correctly.

Answer

Enable NAT on the hub's tunnel interface.

Answer

Configure the hub as a DNS server for the spokes.

Answer

Configure IKEv2 instead of IKEv1 on all tunnels.

Question 6

A FortiGate administrator is troubleshooting an SSL VPN issue where users can authenticate but cannot access any internal resources. The SSL VPN status shows 'connected'. Which THREE commands or actions should be used to diagnose the problem?

Accepted Answer

Check the firewall policies that match the SSL VPN interface.. Option B is correct because when SSL VPN users authenticate and show as connected but cannot reach internal resources, the most common cause is missing or misordered firewall policies that do not match the SSL VPN tunnel interface (ssl.root) and the assigned tunnel IP pool, so verifying matching policies is essential. Option D is correct because 'get router info routing-table' reveals whether the FortiGate has a valid route to the internal subnets being requested; without a proper route, return traffic cannot be forwarded and access fails even though the tunnel is up. Option E is correct because 'diagnose vpn ssl stat' displays SSL VPN session and tunnel statistics, confirming the user's assigned IP, tunnel status, and traffic counters, which helps pinpoint whether traffic is entering or leaving the tunnel. Option A is not appropriate because pinging 8.8.8.8 only tests the FortiGate's own internet reachability and does not diagnose internal resource access over the SSL VPN. Option C, while useful for deep SSL VPN daemon debugging, is not one of the three targeted diagnostic actions for this specific 'connected but no resource access' scenario and is typically reserved for deeper packet-level troubleshooting.

Answer

'execute ping 8.8.8.8'

Answer

'diagnose debug application sslvpn -1'

Question 7

A FortiGate administrator wants to enforce two-factor authentication for SSL VPN users. The organization uses FortiToken mobile tokens. What must be configured on the FortiGate to enable FortiToken authentication?

Accepted Answer

In the user group configuration, enable two-factor authentication and select 'FortiToken'. FortiGate natively supports FortiToken two-factor authentication directly in the user group configuration. By enabling two-factor authentication and selecting 'FortiToken' within the user group settings, the FortiGate will prompt SSL VPN users for both their password and a one-time password generated by the FortiToken mobile app, without requiring any external server.

Answer

Configure a RADIUS server to forward FortiToken requests

Answer

Set the SSL VPN portal to require client certificates

Answer

Install the FortiToken mobile app on the FortiGate

Question 8

A FortiGate administrator is configuring an SSL VPN tunnel mode for remote users. The administrator wants to ensure that only traffic destined for the corporate network (192.168.1.0/24) goes through the VPN, and all other traffic (e.g., internet) goes directly from the user's device. Which TWO configuration steps are required?

Accepted Answer

Configure the SSL VPN portal to push routes for 192.168.1.0/24 to the client. Option B is correct because in FortiGate SSL VPN tunnel mode, the portal must push the specific protected subnet route (192.168.1.0/24) to the client so the client's routing table knows to send only that corporate-bound traffic through the tunnel. Option C is correct because enabling split tunneling and limiting the destination routes to 192.168.1.0/24 is exactly what ensures internet-bound traffic bypasses the VPN and exits directly from the user's device. Options A and D are wrong because web-only/web mode does not provide full tunnel-mode IP routing for arbitrary corporate subnets. Option E is a necessary access control policy for allowing tunnel traffic to reach the corporate network, but it does not by itself achieve the selective routing behavior described, so it is not one of the two required steps for split tunneling.

Answer

Set the SSL VPN portal's 'tunnel mode' to 'web-only'

Answer

Disable 'tunnel mode' and use 'web mode' instead

Answer

Create a firewall policy on the FortiGate allowing traffic from the SSL VPN interface to the corporate network

Question 9

A network admin is configuring a hub-and-spoke VPN with three spokes. Which TWO statements are correct about route-based VPN in this topology?

Accepted Answer

Each spoke must have a route-based VPN interface configured to the hub. Option A is correct because in a route-based VPN, each spoke requires its own route-based VPN interface (e.g., a tunnel interface such as a VTI or IPsec interface) that terminates the tunnel to the hub, allowing routes to be bound to that interface. Option C is correct because route-based VPNs support dynamic routing protocols, and BGP is commonly used between the hub and each spoke to exchange and advertise routes over the tunnel interfaces, which is a key advantage over policy-based VPNs. Option B is incorrect because a single firewall policy cannot generically control traffic to all spokes; policies must reference the specific tunnel interfaces or zones, so separate policies (or interface/zone groupings) are typically needed per spoke. Option D is incorrect because aggressive mode is not required for a hub to accept multiple spokes; main mode works fine as long as the peers are properly identified (e.g., by distinct peer IDs or certificates). Option E is incorrect because spokes generally cannot all share the same Phase 1 configuration when using main mode with preshared keys, since each spoke needs a unique peer identity/gateway; they may share some parameters but not the full Phase 1 config.

Answer

A single firewall policy can control traffic to all spokes

Answer

Aggressive mode must be enabled for the hub to accept multiple spokes

Answer

All spokes can share the same Phase 1 configuration

Question 10

An administrator wants to enable two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Add the FortiToken to the user's account and enable 'fortitoken' in the user group. FortiToken two-factor authentication is enforced by enabling 'fortitoken' in the user group settings. The group must be added to the SSL VPN firewall policy.

Answer

Create a RADIUS server pointing to FortiAuthenticator

Answer

Set the authentication timeout to 60 seconds

Answer

Configure SSL VPN to use certificate authentication

Question 11

A FortiGate administrator is setting up a dial-up IPsec VPN for remote employees. Each employee uses a FortiClient. Which authentication method should be used to allow individual user identities?

Accepted Answer

Certificate-based authentication using local or CA-issued certificates. For dial-up IPsec VPNs where each remote user must be uniquely identified, certificate-based authentication (option B) is the correct method. Certificates bind a user's identity to a cryptographic key pair, allowing the FortiGate to authenticate each individual user independently, unlike a shared PSK which cannot distinguish between users.

Answer

Pre-shared key (PSK) for each user

Answer

IKEv2 with EAP

Answer

Aggressive mode with PSK

Question 12

A network administrator has configured an IPsec VPN between two FortiGate devices. The Phase 1 proposal includes AES256-SHA256-DH14. The Phase 2 proposal includes AES128-SHA1. The VPN tunnel fails to establish. Which of the following is the MOST likely cause?

Accepted Answer

The Phase 2 proposal does not match between the two devices. The Phase 2 proposal must match exactly between both VPN endpoints for IPsec to establish. Here, the local device uses AES128-SHA1, but the remote device likely expects a different combination (e.g., AES256-SHA256 or another algorithm), causing the IKE negotiation to fail after Phase 1 completes. Even though Phase 1 succeeded with AES256-SHA256-DH14, the mismatch in Phase 2 prevents the IPsec SA from being created.

Answer

The Phase 1 proposal is too strong and the remote FortiGate does not support DH14

Answer

The VPN policy has not been configured on the remote FortiGate

Answer

The pre-shared key is incorrect

Question 13

An administrator has configured an SSL VPN. Remote users can connect and authenticate but cannot access internal resources. The SSL VPN policy allows all traffic from the SSL VPN interface to internal servers. What is the MOST likely missing configuration?

Accepted Answer

The firewall policy allowing traffic from SSL VPN interface to internal network is missing. The most likely missing configuration is a firewall policy that explicitly permits traffic from the SSL VPN interface (e.g., ssl.root) to the internal network. Even with an SSL VPN policy allowing traffic, FortiGate requires a separate firewall policy to control and allow the decrypted traffic to reach internal resources. Without this policy, packets are dropped by the implicit deny rule.

Answer

The remote user's client does not support split tunneling

Answer

The authentication timeout is too short

Answer

The SSL VPN portal does not have the correct bookmark configured

Question 14

An administrator needs to configure a site-to-site IPsec VPN where both sites have dynamic public IP addresses. Which IKE mode should be used?

Accepted Answer

Aggressive mode. When both ends of a site-to-site IPsec VPN have dynamic public IP addresses, Aggressive mode (IKEv1) is required because it allows the VPN peers to exchange identities and authentication information in fewer packets, enabling the VPN to be established without knowing the peer's IP address in advance. Unlike Main mode, Aggressive mode does not require the responder to have a pre-configured IP address for the initiator, making it suitable for dynamic IP scenarios.

Answer

IKEv2 without mode

Answer

Dial-up mode

Answer

Main mode

Question 15

A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)

Accepted Answer

Static routes for each branch's subnet pointing to the respective VPN interface. Option B is correct because the hub FortiGate must have static routes for each branch subnet pointing to the corresponding IPsec VPN interface so it knows how to reach each spoke network and can forward inter-branch traffic. Option C is correct because the Phase 2 selectors on the hub must include both branch subnets in a single proposal, allowing the hub to accept and match traffic between the two branch subnets rather than only between hub and branch subnets. Option E is correct because a firewall policy permitting traffic between the VPN interfaces is required for the hub to allow the inter-branch packets to pass through instead of being dropped by the implicit deny. Option A is not required because 'forward traffic' in Phase 1 is not a standard FortiGate setting needed for this scenario. Option D is not required because disabling anti-replay is not necessary and would weaken security; anti-replay can remain enabled on the tunnels.

Answer

Enable 'forward traffic' in Phase 1 settings

Answer

Disable anti-replay on all tunnels

Question 16

An administrator wants to configure two-factor authentication for SSL VPN users. Which TWO components must be configured? (Choose two.)

Accepted Answer

SSL VPN portal configured with 'require two-factor authentication'. Option A is correct because enabling 'require two-factor authentication' on the SSL VPN portal is the setting that actually enforces two-factor authentication for SSL VPN logins, so without it the portal would only perform single-factor authentication. Option C is correct because FortiToken must be assigned to the user to serve as the second authentication factor, providing the one-time password that complements the user's password. Option B is incorrect because a captive portal is used for guest or pre-authentication web access and is unrelated to SSL VPN two-factor authentication. Option D is incorrect because a RADIUS server configured for one-time passwords is not a required component when using FortiToken as the second factor. Option E is incorrect because IPsec Phase 1 authentication set to 'signature' applies to IPsec VPN certificate authentication, not SSL VPN two-factor authentication.

Answer

Captive portal enabled

Answer

RADIUS server configured for one-time passwords

Answer

IPsec Phase 1 authentication set to 'signature'

Question 17

A captive portal is configured on a FortiGate to authenticate users before allowing internet access. Users report that after entering credentials, they are redirected to the original website, but then they cannot access other sites. What is the most likely issue?

Accepted Answer

The user is not a member of the required user group specified in the firewall policy. The most likely issue is that the user is not a member of the required user group specified in the firewall policy. After successful authentication, the FortiGate applies the policy that matches the user's group; if the user is not in the correct group, they may be allowed initial access but then blocked from further sites due to policy mismatch.

Answer

The captive portal is using a self-signed certificate causing browser warnings

Answer

The DNS server is not configured on the FortiGate

Answer

The session timeout is set too low

Question 18

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. Which two additional diagnostics should the administrator run to isolate the issue?

Accepted Answer

diagnose sys session filter and diagnose sys session list. Option A is correct because 'diagnose sys session filter' combined with 'diagnose sys session list' lets the administrator inspect the FortiGate session table for the VPN traffic, confirming whether sessions are being created, matched against the correct policy, and forwarded through the tunnel rather than dropped. Option C is correct because 'diagnose debug application ike -1' enables verbose IKE debug output, which is essential for verifying Phase 1/Phase 2 negotiation details, selectors, and any IKE-level mismatch even when the tunnel shows as up. Option B is not appropriate because checking system memory does not isolate a traffic-forwarding problem in an established tunnel. Option D is not appropriate because 'diagnose netlink interface list' shows interface/kernel netlink information, not IPsec policy or session behavior. Option E is not appropriate because ping-options and ping only test basic reachability and do not reveal why traffic is failing inside an up tunnel.

Answer

diagnose hardware sysinfo memory

Answer

diagnose netlink interface list

Answer

execute ping-options source and execute ping

Question 19

A company wants to implement SSL VPN split tunneling to allow remote users to access both internal resources and the internet directly. Which three configurations are required on the FortiGate?

Accepted Answer

Configure a firewall policy allowing the SSL VPN interface to the internet interface with NAT enabled. Option B is correct because split tunneling still requires a firewall policy from the SSL VPN interface (ssl.root) to the internet-facing interface with NAT enabled so that remote users' internet-bound traffic can be forwarded and translated. Option C is correct because split tunneling is defined by routing policies in the SSL VPN settings that specify which destination subnets are sent through the tunnel, while all other traffic goes directly to the internet. Option E is correct because split tunneling must be enabled in the SSL VPN tunnel-mode client configuration (for example, via the 'set split-tunnel enable' setting) for the FortiGate to honor the routing policies and allow direct internet access. Option A is not required because the SSL VPN interface is a logical tunnel interface and does not need its own public IP address; the public IP is already bound to the WAN interface used for SSL VPN termination. Option D is incorrect because a static route sending all traffic through the SSL VPN tunnel would defeat split tunneling by forcing all traffic into the tunnel instead of allowing direct internet access.

Answer

Assign a public IP address to the SSL VPN interface

Answer

Configure a static route on the FortiGate to send all traffic through the SSL VPN tunnel

Question 20

An administrator is configuring Active Directory polling for FSSO. Which two components must be set up correctly for FSSO to work?

Accepted Answer

A firewall policy that allows LDAP traffic from FortiGate to the domain controller. Option D is correct because in Active Directory polling mode the FortiGate must query the domain controller directly over LDAP (TCP 389, or LDAPS 636), so a firewall policy permitting LDAP traffic from the FortiGate to the domain controller is required for the polling to succeed. Option E is correct because FSSO in AD polling mode requires the FSSO collector agent to be installed on a Windows server that is a member of the domain, where it reads the domain controller's security event log and communicates user logon information to the FortiGate. Option A is not required, since FSSO uses Windows domain authentication and event log monitoring rather than RADIUS. Option B is not required, as FSSO polling uses LDAP/RPC over the network and does not depend on an IPsec tunnel. Option C is not required, because FSSO identifies users through their domain logon sessions and does not consume FortiToken licenses.

Answer

A RADIUS server configured for user authentication

Answer

An IPsec tunnel between FortiGate and the domain controller

Answer

FortiToken license for each user