NSE4 Authentication and VPN Practice Test 11 — 15 Questions

Question 1

A FortiGate administrator wants to configure a dial-up IPsec VPN where remote users connect using VPN clients with pre-shared key authentication. The company has recently experienced a data breach where the PSK was compromised. What is the best method to improve security without changing all clients immediately?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Migrate to certificate-based authentication for Phase 1. Migrating to certificate-based authentication eliminates reliance on a static pre-shared key (PSK), which is inherently vulnerable to compromise. Certificates provide asymmetric cryptographic proof of identity, ensuring that even if a PSK is leaked, the attacker cannot authenticate without a valid certificate. This is the most robust long-term fix for PSK compromise in IPsec VPNs.

Answer

Switch to aggressive mode with a complex PSK

Answer

Enable XAuth with a second authentication factor using FortiToken

Answer

Increase the PSK length to 64 characters

Question 2

A FortiGate administrator configures an SSL VPN web mode portal. Users can access internal web applications but cannot access internal file shares via SMB. What is the most likely reason?

Accepted Answer

Web mode does not support the SMB protocol; users must use tunnel mode to access fileshares. SSL VPN web mode operates as a reverse proxy, translating HTTP/HTTPS traffic only. SMB (Server Message Block) is a non-web protocol that requires direct network-layer connectivity, which web mode cannot provide. Tunnel mode creates a virtual network interface that allows any IP-based protocol, including SMB, to traverse the VPN. Therefore, the correct solution is to use tunnel mode for file share access.

Answer

The SSL VPN policy does not allow SMB traffic

Answer

The fileserver requires client certificates for authentication

Answer

The firewall policy for SSL VPN is configured with the wrong interface

Question 3

You receive an alert that a user's FortiToken synchronization is off. You need to resynchronize the token. Which CLI command achieves this?

Accepted Answer

execute fortitoken-resync . The correct command to resynchronize a FortiToken on a FortiGate is `execute fortitoken-resync `. This CLI command triggers the token to synchronize its time-based one-time password (TOTP) seed with the FortiGate, correcting drift caused by clock skew or battery depletion. Options A, B, and C either use incorrect syntax, perform a different function, or do not exist in the FortiOS CLI.

Answer

diagnose user fortitoken resync <token-serial>

Answer

config user fortitoken edit <token-serial> set status activate

Answer

execute fortitoken-update <token-serial>

Question 4

In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?

Accepted Answer

Create a separate IPsec VPN between each spoke pair. In a hub-and-spoke IPsec VPN topology, spoke sites cannot communicate directly by default. To enable direct spoke-to-spoke communication, the most straightforward configuration change is to create separate IPsec VPN tunnels between each spoke pair. While ADVPN (Auto Discovery VPN) with dynamic routing is a more efficient method, it is not listed as an option. Option D directly establishes the required tunnels, allowing traffic to bypass the hub for spoke-to-spoke traffic. Other options are insufficient: Option A only adds routes for the hub, Option B only propagates routes without establishing direct tunnels, and Option C forces traffic through the hub.

Answer

Set the 'add-route' option to 'enable' on the spoke Phase 1 settings

Answer

Configure dynamic routing (BGP) on all sites and enable route exchange

Answer

Add static routes on the hub pointing to each spoke's subnet via the respective tunnels

Question 5

What is the primary advantage of using route-based IPsec VPN over policy-based IPsec VPN?

Accepted Answer

Route-based VPN allows the use of dynamic routing protocols over the tunnel. Route-based IPsec VPNs create a virtual tunnel interface (e.g., `tunnel` or `ipsec` interface) that acts as a logical routing endpoint. This allows the tunnel to participate in dynamic routing protocols like OSPF or BGP, enabling automatic route advertisement and failover across the VPN. Policy-based VPNs, in contrast, rely on static security policies that match traffic based on source/destination addresses and ports, which cannot be dynamically updated by routing protocols.

Answer

Route-based VPN requires fewer firewall policies

Answer

Route-based VPN is easier to configure for hub-and-spoke

Answer

Route-based VPN supports higher encryption algorithms

Question 6

A FortiGate administrator is troubleshooting an SSL VPN connection issue. Users can connect but cannot access internal resources. The administrator checks the SSL VPN policy and confirms it allows access to the internal subnet. What should the administrator check next?

Accepted Answer

Verify that the firewall policy between the SSL VPN interface and the internal network allows the traffic. Even if the SSL VPN policy permits access to the internal subnet, traffic must still traverse a firewall policy from the SSL VPN interface (e.g., ssl.root) to the internal network interface. Without an explicit firewall policy allowing the traffic, the FortiGate will drop the packets, preventing resource access. This is a common oversight because the SSL VPN policy only controls tunnel establishment and route injection, not the actual forwarding of traffic between zones.

Answer

Check the routing table on the FortiGate for the internal subnet

Answer

Ensure the users have the correct client software installed

Answer

Check the FortiGate's DNS settings

Question 7

A FortiGate administrator is configuring ZTNA for a web application. Which TWO components are required for a ZTNA configuration to function?

Accepted Answer

ZTNA rules. ZTNA rules are the core policy mechanism that defines access control for ZTNA applications, specifying which users and devices can access which resources based on identity and device posture. Without ZTNA rules, the FortiGate cannot enforce the granular, identity-based access decisions that ZTNA requires.

Answer

SSL VPN

Answer

IPsec VPN

Answer

Firewall policy

Question 8

A FortiGate administrator is configuring RADIUS authentication for firewall users. Which THREE steps are required to complete the configuration? (Select THREE.)

Accepted Answer

Configure a firewall policy with the user group set in 'users/groups'. A firewall policy must reference the user group that uses the RADIUS server as its authentication source. Without this policy configuration, RADIUS-authenticated users cannot match the policy and will be denied access. The 'users/groups' field in the firewall policy is where the user group object is specified to enforce authentication-based access control.

Answer

Import the RADIUS server certificate into FortiGate

Answer

Enable 'set auth-type radius' on the interface

Question 9

A FortiGate is configured with an IPsec VPN to a remote site using IKEv1. The VPN tunnel goes down intermittently. The admin runs 'diagnose vpn ike gateway list' and sees 'state=UP' but no Phase2 selectors. What is the most likely cause?

Accepted Answer

Mismatched Phase2 parameters between the local and remote gateways. When 'diagnose vpn ike gateway list' shows the IKE gateway state as UP but no Phase2 selectors are present, it indicates that the IKE Phase1 (main mode or aggressive mode) has completed successfully, but the IPsec Phase2 (quick mode) negotiation has failed. The most common cause for this is a mismatch in Phase2 parameters such as encryption algorithm, authentication algorithm, or proxy IDs (local/remote subnets) between the local and remote gateways. Since the tunnel goes down intermittently, the Phase2 rekey may be failing due to these mismatches, causing the tunnel to drop until a successful renegotiation occurs.

Answer

The firewall policy allowing IPsec traffic is misconfigured

Answer

The remote gateway has a different PSK

Answer

Dead Peer Detection (DPD) is disabled

Question 10

An administrator wants to use Active Directory credentials to authenticate firewall administrators. Which authentication server type should be configured on the FortiGate?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it directly integrates with Microsoft Active Directory to authenticate firewall administrators using their existing AD credentials. FortiGate can bind to an LDAP server to verify username and password pairs, making it the native protocol for AD authentication without requiring additional services or translation layers.

Answer

TACACS+

Answer

FSSO

Answer

RADIUS

Question 11

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?

Accepted Answer

The hub is missing static routes to the spoke networks via the respective tunnel interfaces. In a hub-and-spoke route-based VPN, the hub uses tunnel interfaces for each spoke. After a reboot, the hub's routing table is cleared, and without static routes pointing to the spoke networks via the respective tunnel interfaces, the hub cannot forward traffic between spokes. Even though each spoke can reach the hub, inter-spoke traffic requires the hub to have explicit routes to the remote spoke networks, as dynamic routing protocols are not mentioned in this scenario.

Answer

The firewall policies on the hub do not allow traffic between the spoke networks

Answer

The spokes have mismatched IKE versions

Answer

The hub's IPsec Phase1 is not configured for DPD

Question 12

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 13

The output of 'diagnose debug application ike -1' shows 'no proposal chosen' for a Phase1 negotiation. Which action should the administrator take to resolve this?

Accepted Answer

Check and align the Phase1 encryption, authentication, and DH group settings. The 'no proposal chosen' error in Phase 1 IKE negotiation indicates that the two VPN peers cannot agree on a common set of security parameters (proposal). The administrator must check and align the Phase 1 settings, specifically the encryption algorithm, authentication method, and Diffie-Hellman group, because these are the mandatory parameters matched during the IKE SA negotiation. Option C directly addresses this by ensuring both sides use identical Phase 1 proposals.

Answer

Increase the Phase1 lifetime on both sides

Answer

Verify the pre-shared key is correct

Answer

Change the IKE version from v1 to v2

Question 14

A FortiGate administrator needs to authenticate VPN users against an LDAP server. What is the primary purpose of the 'CN=,OU=,DC=' distinguished name (DN) configured in the LDAP server settings?

Accepted Answer

It specifies the bind user credentials to connect to the LDAP server. The DN configured in the LDAP server settings on FortiGate specifies the bind user credentials (username and password) that the FortiGate uses to authenticate itself to the LDAP server before performing user searches. This bind DN is required because LDAP servers typically require a valid authenticated session to query the directory; the bind DN provides the necessary identity and privileges for the FortiGate to search for VPN users.

Answer

It is used to encrypt LDAP communication

Answer

It defines the IP address of the LDAP server

Answer

It specifies the base DN for searching users

Question 15

During an SSL VPN tunnel mode connection, the client reports that they cannot access any internal resources, but the VPN connection is established. The FortiGate debug shows 'no matching policy'. The administrator has configured a policy allowing the SSL VPN interface to internal. What else must be configured?

Accepted Answer

Ensure the incoming interface of the policy is set to 'ssl.root' (or the SSL VPN interface). The SSL VPN tunnel mode creates a virtual interface (typically named 'ssl.root' or 'ssl.VDOM') on the FortiGate. Even though the administrator configured a policy allowing the SSL VPN interface to internal, the incoming interface in the policy must explicitly be set to this SSL VPN interface. If it is set to a different interface (e.g., the physical WAN interface), the FortiGate will not match the traffic from the SSL VPN tunnel, resulting in the 'no matching policy' debug message.

Answer

Add the client's assigned IP to a local user group

Answer

Configure a static route on the FortiGate for the client's tunnel IP

Answer

Enable split tunneling on the SSL VPN portal