NSE4 Authentication and VPN Practice Test 11 — 15 Questions

Question 1

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?

Accepted Answer

The hub is missing static routes to the spoke networks via the respective tunnel interfaces. In route-based VPNs, routes determine traffic flow. After a reboot, the hub may lose routes to the remote spoke networks unless they are statically configured or learned via dynamic routing. Option B is correct because static routes are needed on the hub to direct inter-spoke traffic through the appropriate tunnel interfaces.

Answer

The firewall policies on the hub do not allow traffic between the spoke networks

Answer

The spokes have mismatched IKE versions

Answer

The hub's IPsec Phase1 is not configured for DPD

Question 2

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode only provides access to web-based applications through a portal. To allow non-web traffic like ping or RDP, the VPN type must be changed to tunnel mode, which creates a virtual interface and routes all traffic.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 3

The output of 'diagnose debug application ike -1' shows 'no proposal chosen' for a Phase1 negotiation. Which action should the administrator take to resolve this?

Accepted Answer

Check and align the Phase1 encryption, authentication, and DH group settings. The error 'no proposal chosen' indicates that the local and remote gateways have no common Phase1 parameters (encryption, authentication, DH group, etc.). The administrator must review and match the Phase1 proposal settings.

Answer

Increase the Phase1 lifetime on both sides

Answer

Verify the pre-shared key is correct

Answer

Change the IKE version from v1 to v2

Question 4

A FortiGate administrator needs to authenticate VPN users against an LDAP server. What is the primary purpose of the 'CN=,OU=,DC=' distinguished name (DN) configured in the LDAP server settings?

Accepted Answer

It specifies the bind user credentials to connect to the LDAP server. The DN is used to bind to the LDAP server for user authentication and to search for users. It identifies the user object that FortiGate uses to authenticate.

Answer

It is used to encrypt LDAP communication

Answer

It defines the IP address of the LDAP server

Answer

It specifies the base DN for searching users

Question 5

During an SSL VPN tunnel mode connection, the client reports that they cannot access any internal resources, but the VPN connection is established. The FortiGate debug shows 'no matching policy'. The administrator has configured a policy allowing the SSL VPN interface to internal. What else must be configured?

Accepted Answer

Ensure the incoming interface of the policy is set to 'ssl.root' (or the SSL VPN interface). For SSL VPN tunnel mode, the FortiGate assigns an IP to the client from a tunnel IP pool. The policy must use the SSL VPN interface (e.g., ssl.root) as the source interface. If the policy uses a different interface, traffic will not match. Option C is correct.

Answer

Add the client's assigned IP to a local user group

Answer

Configure a static route on the FortiGate for the client's tunnel IP

Answer

Enable split tunneling on the SSL VPN portal

Question 6

An administrator is troubleshooting an IPsec VPN that uses aggressive mode. The VPN establishes successfully, but the administrator is concerned about security. Which statement is true regarding aggressive mode?

Accepted Answer

Aggressive mode transmits the identification in clear text. In IKEv1 aggressive mode, the pre-shared key is transmitted in a hashed form but the identity is sent in clear text during Phase1. This makes it less secure than main mode, which protects the identity.

Answer

Aggressive mode is more secure than main mode

Answer

Aggressive mode provides perfect forward secrecy (PFS) by default

Answer

Aggressive mode uses six messages instead of three

Question 7

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

Accepted Answer

It monitors AD logon events and sends user-IP mappings to the FortiGate. The FSSO collector agent monitors Active Directory for user logon events (via NetAPI or security event logs) and sends this information to the FortiGate, allowing it to map users to IP addresses.

Answer

It acts as a RADIUS proxy between FortiGate and AD

Answer

It polls the FortiGate for user information

Answer

It directly authenticates users to the FortiGate

Question 8

An administrator runs 'diagnose vpn ssl stat' and sees 'tun-num: 5, clients: 0'. Users are unable to connect to the SSL VPN. The SSL VPN settings are correct and the certificate is valid. What could be the cause?

Accepted Answer

The SSL VPN is listening on a non-default port and users are connecting to the default port. The command shows tunnel interface created but no connected clients. Option A is a likely cause: if the SSL VPN portal has limit-scan or if the user group is restricted, users might be denied. But more common: if the firewall policy for SSL VPN is missing or misconfigured, users can't pass traffic. However, the debug shows no clients, suggesting authentication or network layer issue. Option B is plausible because if the listening port is changed, users might be connecting to the wrong port. Option C is also plausible but less typical. The most common cause in practice is a missing or misconfigured policy, but the question is tricky. I'll go with Option B as it directly affects connectivity.

Answer

The FortiGate has reached the maximum number of SSL VPN users allowed by the license

Answer

The SSL VPN certificate is not trusted by the client browsers

Answer

The SSL VPN portal is configured with 'limit-scan' scanning

Question 9

An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from the captive portal interface to the internet with the user group. Captive portal requires a firewall policy that permits traffic from the interface where the captive portal is enabled to the destination (internet), with authentication enabled. Option A is correct because without a policy allowing the traffic, the authentication succeeds but traffic is blocked.

Answer

The DNS server is not configured on the FortiGate

Answer

The captive portal timeout is set too low

Answer

The SSID is not configured with the captive portal security mode

Question 10

An administrator needs to deploy two-factor authentication for SSL VPN users. The company uses FortiTokens. Which two steps are required to enable FortiToken for SSL VPN users? (Choose two.)

Accepted Answer

Configure two-factor authentication on the SSL VPN portal to require token code. FortiToken requires the user account to be associated with a FortiToken serial number, and the authentication method must be set to require token code along with password.

Answer

Install the FortiToken mobile app on the administrator's phone

Answer

Change the SSL VPN authentication scheme to RADIUS

Question 11

An administrator is configuring an IPsec VPN between two FortiGates using IKEv1. The tunnel must use main mode and support multiple subnets behind each gate. Which Phase2 settings are required to allow multiple subnets? (Choose two.)

Accepted Answer

Create multiple Phase2 selectors, each with different local and remote subnets. To support multiple subnets, you can either configure multiple Phase2 selectors (one per subnet pair) or define the local/remote subnets in the Phase2 configuration. Modern FortiOS allows multiple subnets in a single Phase2. Option B is correct (multiple Phase2 entries), and Option D (using address objects with multiple addresses) is also correct.

Answer

Set the Phase2 keylife to a higher value

Answer

Set the Phase2 proposal to include multiple encryption algorithms

Answer

Enable NAT traversal on the Phase2

Question 12

A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)

Accepted Answer

Diffie-Hellman group mismatch (e.g., group 2 vs group 14). The error 'no proposal chosen' indicates that the local and remote IKE peers have no common Phase1 proposal. This can be caused by mismatched encryption, authentication, or Diffie-Hellman group. Lifetime mismatch usually results in a different error.

Answer

Pre-shared key mismatch

Answer

Lifetime mismatch (e.g., 86400 vs 3600)

Question 13

An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)

Accepted Answer

ZTNA proxy (application gateway). ZTNA requires a ZTNA proxy to protect the application, a ZTNA rule (policy) to define access criteria, and an access proxy (or application) that listens for incoming connections. Option A, C, and D are correct.

Answer

IPsec VPN tunnel

Answer

Captive portal

Question 14

A network administrator configures an IPsec VPN between two FortiGates using IKEv1 main mode. The Phase 1 negotiation fails with the error 'no proposal chosen'. The administrator checks both sides and confirms the IKE version, encryption algorithm (AES256), authentication (SHA256), and Diffie-Hellman group (14) match. Which additional parameter is MOST likely mismatched?

Accepted Answer

Local and remote identifiers (local ID / remote ID). Main mode requires the local and remote identifiers to match or be correctly configured. Often the local ID (such as the IP address or FQDN) is mismatched, causing negotiation failure despite other parameters matching.

Answer

Pre-shared key

Answer

IKE version (IKEv2)

Answer

Phase 2 encryption algorithm

Question 15

A FortiGate administrator wants to authenticate VPN users against an existing Active Directory server. The administrator creates a user group referencing a remote LDAP server and configures the firewall policy to authenticate using that group. However, users report authentication failures. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag test authserver ldap '. The LDAP connectivity must be verified before any user authentication can work. The diagnose test command is the quickest way to validate the LDAP server connection.

Answer

Verify the user group configuration

Answer

Restart the FortiGate

Answer

Check the LDAP server's firewall rules