NSE4 Authentication and VPN Practice Test 11 — 15 Questions

Question 1

A FortiGate admin is configuring a dial-up IPsec VPN for remote users. The users have dynamic IP addresses. Which Phase 1 configuration is appropriate?

Accepted Answer

Set the remote gateway to 'Dialup User' and enable an IP pool. For dial-up IPsec VPNs where remote users have dynamic IP addresses, the FortiGate cannot know the remote gateway IP in advance. Setting the remote gateway to 'Dialup User' allows the FortiGate to accept connections from any IP, and enabling an IP pool assigns a static internal IP to the remote user for routing and policy enforcement.

Answer

Disable XAuth authentication

Answer

Set the remote gateway to the user's IP address

Answer

Use aggressive mode with a group pre-shared key

Question 2

A FortiGate administrator notices that the IPsec VPN tunnel is established but traffic is not passing. The firewall policy allowing traffic from the remote subnet to the local subnet is in place. What is the MOST likely cause?

Accepted Answer

There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface. When an IPsec VPN tunnel is established but traffic fails to pass, the most common cause is the lack of a static route on the FortiGate for the remote subnet pointing to the tunnel interface. Even with a correct firewall policy, the FortiGate cannot forward traffic to the remote subnet without a route that directs packets into the VPN tunnel interface (e.g., 'tunnel.1'). This is a fundamental routing requirement for route-based VPNs, which are the default configuration on FortiGate.

Answer

The VPN tunnel is a policy-based VPN and the policy is incorrectly configured

Answer

The Phase 2 proposal includes PFS, but the remote side does not

Answer

The local firewall is blocking ICMP

Question 3

A FortiGate admin wants to implement ZTNA to secure access to an internal application. Which TWO components are required for a basic ZTNA configuration?

Accepted Answer

A ZTNA rule (policy) that specifies access conditions. A ZTNA rule (policy) is essential to define the access conditions, such as user identity, device posture, and source IP, that must be met before granting access to the internal application. This policy enforces the zero-trust principle of 'never trust, always verify' by evaluating these conditions in real time.

Answer

A FortiClient EMS server

Answer

An IPsec VPN tunnel to the client

Answer

A static route to the application server

Question 4

Which of the following best describes the purpose of a captive portal on a FortiGate?

Accepted Answer

To authenticate users before granting network access. A captive portal on a FortiGate intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a web-based login page. Once the user provides valid credentials (e.g., via local database, LDAP, or RADIUS), the FortiGate creates an authenticated session, allowing network access. This is a core mechanism for guest Wi-Fi or BYOD onboarding, not for remote access or encryption.

Answer

To provide secure remote access to internal resources

Answer

To encrypt traffic between sites

Answer

To block malware from entering the network

Question 5

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 has built-in support for NAT traversal and MOBIKE. IKEv2 offers built-in NAT traversal (NAT-T) and MOBIKE (RFC 4555) as core features, not optional extensions. This eliminates the need for separate RFC 3947 NAT-T configuration and allows seamless IP address changes during a VPN session, making it far more robust for mobile users and dynamic environments compared to IKEv1.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires aggressive mode

Answer

IKEv2 is only for route-based VPN

Question 6

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN. The hub has multiple Phase 2 selectors for each spoke. What is the recommended way to simplify configuration on the hub when adding new spokes?

Accepted Answer

Use a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote. Using a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote simplifies hub configuration because it allows the hub to accept traffic for any subnet from any spoke without needing to define specific selectors per spoke. This is recommended in hub-and-spoke topologies to avoid manual updates when adding new spokes, as the hub's Phase 2 configuration becomes generic and automatically matches all spoke traffic.

Answer

Configure each spoke in a separate VDOM

Answer

Use aggressive mode for Phase 1

Answer

Use policy-based VPN instead of route-based

Question 7

An administrator has configured an SSL VPN with tunnel mode and split tunneling enabled. However, remote users report that all internet traffic is going through the VPN tunnel. What is the MOST likely cause?

Accepted Answer

The client's routing table is set to route all traffic through the VPN. When split tunneling is enabled on the FortiGate SSL VPN portal, the FortiClient VPN software should only route traffic destined for the corporate network through the tunnel. If remote users report that all internet traffic is going through the VPN tunnel, the most likely cause is that the client's routing table has been configured to route all traffic (0.0.0.0/0) through the virtual adapter, overriding the split-tunneling rules. This can happen if the client is set to 'Route all traffic through VPN' in its settings, which forces a default route into the VPN interface regardless of the portal configuration.

Answer

The firewall policy allows traffic to the internet

Answer

The SSL VPN portal has 'split tunneling' disabled

Answer

The user has installed a root certificate

Question 8

An administrator is configuring a dial-up IPsec VPN for remote users. Which TWO settings are required on the FortiGate for the dial-up server? (Choose two.)

Accepted Answer

Set 'mode-cfg' to enable on Phase 1. 'mode-cfg' (Mode Config) enables the FortiGate to assign IP addresses and other network settings to remote VPN clients dynamically, which is essential for a dial-up IPsec VPN server. Option B is correct because setting 'peer type' to 'any' allows the FortiGate to accept connections from any remote peer without predefining a specific peer IP, which is required for a dial-up scenario where remote users have dynamic IP addresses.

Answer

Set 'aggressive mode' on Phase 1

Answer

Set 'auto-negotiate' to enable on Phase 2

Answer

Set 'pfs' to enable on Phase 2

Question 9

A network administrator wants to implement two-factor authentication for SSL VPN users using FortiToken. The users are already authenticated against an LDAP server. Which configuration step is required to enforce two-factor authentication?

Accepted Answer

Create a user group that uses LDAP as the authentication server and enable FortiToken two-factor authentication in the group settings. FortiGate requires a user group to combine LDAP authentication with FortiToken two-factor authentication. By creating a user group that uses LDAP as the authentication server and enabling FortiToken in the group settings, the FortiGate will first authenticate the user against LDAP and then prompt for a FortiToken code as the second factor. This is the standard method to enforce two-factor authentication for SSL VPN users without creating duplicate local users.

Answer

Create a local user with the same username as the LDAP user and assign a FortiToken to that local user

Answer

Configure the SSL VPN portal to require FortiToken and set the authentication server to LDAP

Answer

Set the SSL VPN authentication method to 'certificate' and use FortiToken as second factor

Question 10

You run the CLI command 'diagnose vpn ike gateway list' and see that an IPsec VPN gateway is in 'up' state with 'initiator' mode, but no Phase 2 selectors are established. What is the most likely cause?

Accepted Answer

The local and remote Phase 2 selectors (proxy IDs) do not match. When an IPsec VPN gateway is in 'up' state with 'initiator' mode but no Phase 2 selectors are established, it indicates that IKE Phase 1 (main mode or aggressive mode) has completed successfully, but Phase 2 (quick mode) negotiation has failed. The most common cause for Phase 2 failure is a mismatch in the Phase 2 selectors (proxy IDs), which define the local and remote subnets to be encrypted. FortiGate uses these selectors to match traffic and establish the IPsec SA; if they do not align between peers, the Phase 2 negotiation will not complete.

Answer

The Phase 2 proposal parameters (encryption, authentication) do not match between peers

Answer

The remote gateway is not responding to IKE packets

Answer

The IPsec interface is down

Question 11

A FortiGate administrator is configuring IPsec VPN between two sites. The Phase 1 negotiation fails with the error 'no proposal chosen'. Which two settings must match on both VPN peers?

Accepted Answer

Encryption algorithm and authentication algorithm. The 'no proposal chosen' error during IPsec Phase 1 negotiation indicates that the two VPN peers cannot agree on a common set of security parameters for the IKE (Internet Key Exchange) SA. The encryption algorithm (e.g., AES-256, 3DES) and authentication algorithm (e.g., SHA-256, MD5) are mandatory components of the Phase 1 proposal; if they do not match on both peers, the IKE negotiation fails immediately.

Answer

Pre-shared key and local ID

Answer

Dead peer detection interval and retry count

Answer

Remote gateway IP and Phase 2 selectors

Question 12

An administrator configures FSSO (Fortinet Single Sign-On) with Active Directory polling. Users report that their web traffic is being blocked by the firewall even though they are logged into the domain. Which CLI command can the administrator use to verify the FSSO login status for a specific user?

Accepted Answer

diagnose debug authd fsso list. The command 'diagnose debug authd fsso list' displays the current FSSO login status for all users, including the Fortinet Single Sign-On (FSSO) session information such as username, IP address, and group membership. This command queries the authentication daemon (authd) which maintains the FSSO user database, allowing the administrator to verify if a specific user is authenticated and which firewall policies apply. It directly addresses the scenario where users are logged into the domain but web traffic is blocked, as it confirms whether the FSSO polling has successfully registered the user's login.

Answer

diagnose user fsso poll user <username>

Answer

diagnose wad user list

Answer

diagnose test authserver ldap

Question 13

A FortiGate administrator wants to configure a dial-up IPsec VPN where remote users connect using VPN clients with pre-shared key authentication. The company has recently experienced a data breach where the PSK was compromised. What is the best method to improve security without changing all clients immediately?

Accepted Answer

Migrate to certificate-based authentication for Phase 1. Migrating to certificate-based authentication eliminates reliance on a static pre-shared key (PSK), which is inherently vulnerable to compromise. Certificates provide asymmetric cryptographic proof of identity, ensuring that even if a PSK is leaked, the attacker cannot authenticate without a valid certificate. This is the most robust long-term fix for PSK compromise in IPsec VPNs.

Answer

Switch to aggressive mode with a complex PSK

Answer

Enable XAuth with a second authentication factor using FortiToken

Answer

Increase the PSK length to 64 characters

Question 14

Which IPsec VPN mode is typically used when the VPN peer has a dynamic public IP address?

Accepted Answer

Aggressive mode. Aggressive mode is used in IPsec IKE phase 1 when the VPN peer has a dynamic public IP address because it allows the initiator to send its identity and authentication data in the first packet, enabling the responder to identify the peer without requiring a reverse DNS lookup or static IP. This mode reduces the number of exchanges from six (Main mode) to three, which is essential when the peer's IP address is not known in advance, as in many remote-access or dynamic-IP site-to-site scenarios.

Answer

Quick mode

Answer

IKEv2

Answer

Main mode

Question 15

What is the primary advantage of using route-based IPsec VPN over policy-based IPsec VPN?

Accepted Answer

Route-based VPN allows the use of dynamic routing protocols over the tunnel. Route-based IPsec VPNs create a virtual tunnel interface (e.g., `tunnel` or `ipsec` interface) that acts as a logical routing endpoint. This allows the tunnel to participate in dynamic routing protocols like OSPF or BGP, enabling automatic route advertisement and failover across the VPN. Policy-based VPNs, in contrast, rely on static security policies that match traffic based on source/destination addresses and ports, which cannot be dynamically updated by routing protocols.

Answer

Route-based VPN requires fewer firewall policies

Answer

Route-based VPN is easier to configure for hub-and-spoke

Answer

Route-based VPN supports higher encryption algorithms