NSE4 Authentication and VPN Practice Test 10 — 15 Questions

Question 1

An admin needs to authenticate remote users connecting via SSL VPN. The users are in an Active Directory domain. Which authentication method should be configured on the FortiGate to allow users to log in with their domain credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LDAP server. LDAP (Lightweight Directory Access Protocol) allows FortiGate to directly query the Active Directory domain controller to authenticate users with their domain credentials. This method validates the username and password against the AD database without requiring an additional RADIUS server or local user accounts, making it the most straightforward choice for SSL VPN authentication with domain users.

Answer

Local user database

Answer

RADIUS server

Answer

FSSO

Question 2

You run the command 'diagnose vpn ike log filter name vpn1' and then 'diagnose vpn ike log filter type phase1'. The log shows: 'IKEv1 exchange:f4470f07:00000000: responder: main mode: received IKE_SA_INIT (aggressive mode not allowed)'. What is the problem?

Accepted Answer

The responder is configured for main mode only, but the initiator is sending aggressive mode. The log message 'aggressive mode not allowed' indicates the responder (FortiGate) is configured to accept only main mode IKE phase1 negotiations, but the initiator sent an aggressive mode request. This mismatch causes the responder to reject the IKE_SA_INIT message, as aggressive mode is disabled by default or explicitly set to main mode only in the phase1 configuration.

Answer

The initiator is using IKEv2 while the responder uses IKEv1

Answer

The pre-shared key is wrong

Answer

The phase1 proposal is incompatible

Question 3

A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?

Accepted Answer

The FSSO collector agent settings for VDOM2. In a multi-VDOM FSSO setup with Active Directory polling, each VDOM requires its own FSSO collector agent configuration to map domain users to the correct VDOM. Since VDOM1 works but VDOM2 does not, the most likely cause is that the FSSO collector agent settings for VDOM2 are missing or misconfigured, such as the collector agent IP, port, or shared secret. This is the first item to verify because FSSO polling relies on per-VDOM agent communication to deliver user-to-IP mappings.

Answer

The DNS resolution for the domain controller in VDOM2

Answer

The firewall policy ordering in VDOM2

Answer

The LDAP server configuration in VDOM2

Question 4

You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?

Accepted Answer

There is no firewall policy allowing traffic from ssl.root to the internal network. The user can authenticate and reach the SSL VPN portal, which indicates that the SSL VPN tunnel itself is established and authentication is successful. However, the inability to ping or access internal resources despite being authenticated points to a missing firewall policy that explicitly permits traffic from the SSL VPN interface (ssl.root) to the internal network. Without this policy, the FortiGate will drop all traffic from the SSL VPN tunnel, even though the user is logged in.

Answer

Client certificate authentication is required but not provided

Answer

Split tunneling is disabled

Answer

The SSL VPN realm is not configured correctly

Question 5

A FortiGate administrator is setting up a dial-up IPsec VPN for remote employees. Each employee uses a FortiClient. Which authentication method should be used to allow individual user identities?

Accepted Answer

Certificate-based authentication using local or CA-issued certificates. For dial-up IPsec VPNs where each remote user must be uniquely identified, certificate-based authentication (option B) is the correct method. Certificates bind a user's identity to a cryptographic key pair, allowing the FortiGate to authenticate each individual user independently, unlike a shared PSK which cannot distinguish between users.

Answer

Pre-shared key (PSK) for each user

Answer

IKEv2 with EAP

Answer

Aggressive mode with PSK

Question 6

A network administrator has configured an IPsec VPN between two FortiGate devices. The Phase 1 proposal includes AES256-SHA256-DH14. The Phase 2 proposal includes AES128-SHA1. The VPN tunnel fails to establish. Which of the following is the MOST likely cause?

Accepted Answer

The Phase 2 proposal does not match between the two devices. The Phase 2 proposal must match exactly between both VPN endpoints for IPsec to establish. Here, the local device uses AES128-SHA1, but the remote device likely expects a different combination (e.g., AES256-SHA256 or another algorithm), causing the IKE negotiation to fail after Phase 1 completes. Even though Phase 1 succeeded with AES256-SHA256-DH14, the mismatch in Phase 2 prevents the IPsec SA from being created.

Answer

The Phase 1 proposal is too strong and the remote FortiGate does not support DH14

Answer

The VPN policy has not been configured on the remote FortiGate

Answer

The pre-shared key is incorrect

Question 7

An administrator runs 'diagnose debug application ike -1' and sees the following output:
ike 0:come to x.x.x.x:500, IKEv1, cookie 123456789abcdef0
ike 0:incoming IKE packet: src y.y.y.y:500, dst x.x.x.x:500, len 456
ike 0:send IKE packet: src x.x.x.x:500, dst y.y.y.y:500, len 456
ike 0:phase 1 negotiation failed due to time out.
What is the likely cause?

Accepted Answer

A firewall rule is blocking UDP 500/4500 between the peers. The output shows that the IKE packet is being sent and received (no proposal mismatch or interface down), but the negotiation fails due to a timeout. This indicates that the packet is leaving the local FortiGate but the response is not arriving back, which is classic behavior when a firewall (or ACL) between the peers is blocking UDP 500 or 4500. The timeout occurs because the remote peer never receives the initial packet or the local peer never receives the reply, preventing any IKE exchange from completing.

Answer

The remote FortiGate's Phase 1 proposal does not match

Answer

The pre-shared key is incorrect

Answer

The local FortiGate's external interface is down

Question 8

An administrator has configured an SSL VPN. Remote users can connect and authenticate but cannot access internal resources. The SSL VPN policy allows all traffic from the SSL VPN interface to internal servers. What is the MOST likely missing configuration?

Accepted Answer

The firewall policy allowing traffic from SSL VPN interface to internal network is missing. The most likely missing configuration is a firewall policy that explicitly permits traffic from the SSL VPN interface (e.g., ssl.root) to the internal network. Even with an SSL VPN policy allowing traffic, FortiGate requires a separate firewall policy to control and allow the decrypted traffic to reach internal resources. Without this policy, packets are dropped by the implicit deny rule.

Answer

The remote user's client does not support split tunneling

Answer

The authentication timeout is too short

Answer

The SSL VPN portal does not have the correct bookmark configured

Question 9

Which of the following FortiGate features allows users to authenticate using a one-time password generated by a mobile app?

Accepted Answer

FortiToken. FortiToken is Fortinet's two-factor authentication solution that generates one-time passwords (OTPs) via a mobile app (FortiToken Mobile) or hardware token. When a user authenticates, they must provide both their regular password and the current OTP from the FortiToken app, which is validated by the FortiGate against the token's seed record. This directly matches the question's requirement for OTP generation by a mobile app.

Answer

FSSO

Answer

LDAP

Answer

Captive portal

Question 10

An administrator wants to restrict SSL VPN access to only users who have a valid client certificate issued by the company's internal CA. Which setting should be configured?

Accepted Answer

Enable 'require client certificate' in the SSL VPN settings. The 'require client certificate' setting in the SSL VPN portal or interface configuration enforces mutual TLS (mTLS), where the FortiGate requests and validates a client certificate against the configured CA. This ensures that only users presenting a valid certificate issued by the company's internal CA can establish the SSL VPN tunnel, regardless of their authentication credentials.

Answer

Configure a firewall policy with identity-based authentication

Answer

Enable 'certificate-based authentication' in the user group

Answer

Import the users' public keys into the FortiGate

Question 11

A FortiGate administrator has configured a route-based IPsec VPN. After Phase 2 is up, traffic is not passing. The administrator verifies that the firewall policy allows traffic and the routes are correct. What should the administrator check next?

Accepted Answer

The static route uses the VPN interface as the outgoing interface. In a route-based IPsec VPN, traffic is routed to the VPN tunnel interface (e.g., 'to_remote'). Even if firewall policies and static routes exist, the static route must explicitly use the VPN interface as the outgoing interface. If the static route points to a different interface or a next-hop IP instead of the tunnel interface, the kernel will not forward traffic into the IPsec tunnel, causing Phase 2 to be up but no traffic to pass. This is a common misconfiguration that breaks the route-based VPN model.

Answer

The remote gateway's IP address is reachable

Answer

The pre-shared key is correct

Answer

The Phase 2 proposal includes the correct local and remote subnets

Question 12

A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)

Accepted Answer

Static routes for each branch's subnet pointing to the respective VPN interface. Static routes for each branch's subnet pointing to the respective VPN interface are required on the hub FortiGate so that the hub knows how to forward traffic destined for one branch's subnet out the correct IPsec tunnel to the other branch. Without these routes, the hub would have no path to the remote branch subnets and would drop the traffic, preventing direct branch-to-branch communication.

Answer

Enable 'forward traffic' in Phase 1 settings

Answer

Disable anti-replay on all tunnels

Question 13

Which authentication method allows FortiGate to authenticate users against an Active Directory domain without storing domain credentials locally?

Accepted Answer

LDAP authentication. LDAP authentication allows FortiGate to verify user credentials directly against an Active Directory domain controller without storing the domain passwords locally. The FortiGate sends a BIND request with the user's DN and password to the LDAP server, which validates the credentials and returns a success or failure response. This avoids local storage of domain credentials while still enabling centralized authentication.

Answer

FSSO polling

Answer

RADIUS authentication

Answer

Local user database

Question 14

A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?

Accepted Answer

Web mode only allows access to specific bookmarks configured in the portal. In SSL VPN web mode, the FortiGate acts as a proxy, granting access only to pre-configured bookmarks (URLs or applications) defined in the SSL VPN portal. Default portal settings do not include any bookmarks, so even after successful authentication, the user sees an empty portal and cannot reach internal resources. This is by design, as web mode does not provide full network-layer access like tunnel mode does.

Answer

The user must be authenticated via LDAP

Answer

The user has not installed the FortiClient VPN plugin

Answer

The SSL VPN policy is missing a security profile

Question 15

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. Which two additional diagnostics should the administrator run to isolate the issue?

Accepted Answer

diagnose sys session filter and diagnose sys session list. 'diagnose sys session filter' allows you to set filters (e.g., by source/destination IP or port) and 'diagnose sys session list' then displays the current session table entries matching those filters. Since the IPsec tunnel is up but traffic is not passing, the session table may show that traffic is being dropped or not matching the expected policies, helping isolate whether the issue is with policy routing, firewall rules, or session setup. Option C is also correct because 'diagnose debug application ike -1' enables detailed IKE debugging that can reveal post-establishment issues, such as rekey failures, phase 2 problems, or IPsec SA mismatches, which may not be apparent from the tunnel list alone. Both diagnostics are appropriate: A checks the data plane (session table), and C checks the control plane (IKE negotiation details).

Answer

diagnose hardware sysinfo memory

Answer

diagnose netlink interface list

Answer

execute ping-options source and execute ping