NSE4 Authentication and VPN Practice Test 12 — 15 Questions

Question 1

An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?

Accepted Answer

The remote network in Phase 2 is set to 10.0.0.0/8. In dial-up VPN, the Phase 2 selector on the FortiGate must be set to 0.0.0.0/0 to accept traffic from any remote IP, or the specific remote subnet must match the user's assigned IP pool. If the remote network is set to anything other than 0.0.0.0/0, it may mismatch the client's proposal.

Answer

The remote network in Phase 2 is set to 0.0.0.0/0

Answer

The Phase 1 encryption algorithm is mismatched

Answer

The authentication type requires EAP instead of certificate

Question 2

A FortiGate is configured with FSSO (Fortinet Single Sign-On) to authenticate users from Active Directory. Users are logging in to their domain-joined computers, but the FortiGate does not see the user sessions. The polling connector is configured correctly. What is the MOST likely reason?

Accepted Answer

DNS resolution for the Domain Controller is failing. FSSO requires the FortiGate to resolve NetBIOS names to IP addresses. If DNS resolution fails, the FortiGate cannot correlate the user's login event with the IP address.

Answer

The FSSO agent is not installed on the Domain Controller

Answer

The user group filter is too restrictive

Answer

The FortiGate is not in the same subnet as the users

Question 3

An administrator wants to configure SSL VPN web mode to allow remote users to access a specific internal web application without installing any client software. Which authentication method is required?

Accepted Answer

Any supported authentication method (local, LDAP, RADIUS, certificates). SSL VPN web mode requires user authentication to grant access. The local database or remote authentication server (LDAP, RADIUS) must be used to authenticate users before they can access the web portal.

Answer

Certificate-based authentication only

Answer

No authentication is required for web mode

Answer

Two-factor authentication with FortiToken is mandatory

Question 4

An administrator runs 'diagnose vpn ike gateway list' on a FortiGate and sees the following output for a dial-up IPsec VPN:
gateway name: 'dialup'
  version: IKEv1
  mode: aggressive
  local IP: 203.0.113.1
  remote IP: 0.0.0.0
  state: up
  peers: 0
What does 'peers: 0' indicate?

Accepted Answer

No IPsec clients are currently connected. The 'peers' count shows how many clients are currently connected. A value of 0 means no clients have successfully completed Phase 1. The gateway is up (listening) but no peers have connected.

Answer

The remote IP should be set to a specific address

Answer

The gateway is in a down state

Answer

The Phase 2 proposals are mismatched

Question 5

A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?

Accepted Answer

The user is not a member of the configured user group. Captive portal authentication requires the user to be a member of a user group that is referenced in the firewall policy. If the LDAP user is not in the configured group (or the group is not properly mapped to an LDAP query), authentication will fail.

Answer

The captive portal is using HTTP instead of HTTPS

Answer

The captive portal interface is not in the same VDOM as the LDAP server

Answer

The LDAP server requires TLS and FortiGate is using plain LDAP

Question 6

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 supports MOBIKE to handle IP address changes. IKEv2 is more resilient to network changes and supports MOBIKE (Mobility and Multihoming), which allows the VPN to survive IP address changes during a session, e.g., when a mobile client switches from Wi-Fi to cellular.

Answer

IKEv2 requires less CPU resources

Answer

IKEv2 provides built-in NAT traversal

Answer

IKEv2 supports only certificate authentication

Question 7

An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?

Accepted Answer

A firewall policy is required to permit traffic between the interfaces. In a route-based VPN, the tunnel interface is part of a zone or has its own security policy. Without a firewall policy allowing traffic from the local subnet to the remote subnet via the tunnel interface, traffic will be dropped.

Answer

NAT must be disabled on the tunnel interface

Answer

The tunnel interface must be added to a zone

Answer

The Phase 2 proposal must include the correct local and remote subnets

Question 8

An administrator needs to configure two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Enable FortiToken on the user account and configure the authentication scheme to require token. FortiToken two-factor authentication requires the user account to have a FortiToken assigned. The user can then be required to enter a token code during authentication. The firewall policy itself must use an authentication scheme that enforces two-factor.

Answer

Enable two-factor authentication globally on the FortiGate

Answer

Install the FortiToken mobile app on the FortiGate

Answer

Create a separate firewall policy for token-based authentication

Question 9

A FortiGate administrator is troubleshooting an IPsec VPN that fails to establish. The Phase 1 status shows 'init' and then resets. The administrator runs 'diagnose debug application ike -1' and sees the message 'no acceptable proposal'. Which TWO parameters are MOST likely mismatched?

Accepted Answer

Encryption algorithm (e.g., AES256 vs AES128). The 'no acceptable proposal' error in Phase 1 indicates that the local and remote peers cannot agree on a set of parameters. The encryption algorithm and Diffie-Hellman group are common mismatched parameters.

Answer

Pre-shared key

Answer

Phase 2 local and remote networks

Answer

IKE version (IKEv1 vs IKEv2)

Question 10

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Accepted Answer

A proxy-based firewall policy. ZTNA requires a proxy-based policy that inspects traffic, and a ZTNA rule that defines the access conditions (tags, endpoint compliance, etc.).

Answer

A firewall policy using IPsec VPN

Answer

A FortiGate in transparent mode

Answer

A policy-based IPsec tunnel

Question 11

A FortiGate is configured for SSL VPN tunnel mode with split tunneling enabled. The administrator wants to ensure that traffic to the corporate DNS server (10.0.1.10) goes through the tunnel while all other traffic goes directly to the internet. Which THREE configuration steps are required?

Accepted Answer

Add the DNS server subnet (10.0.1.0/24) to the split tunneling destinations. For split tunneling with specific destinations routed through the VPN, the administrator must configure the SSL VPN settings to include the DNS server subnet in the split tunneling list, enable split tunneling, and ensure the firewall policy allows the traffic.

Answer

Disable NAT on the tunnel interface

Answer

Configure a static route on the client for 10.0.1.0/24 via the virtual adapter

Question 12

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Accepted Answer

A RADIUS server object with IP address and shared secret. To use RADIUS, the FortiGate must define the RADIUS server with its IP and secret, and then create a user group that references that RADIUS server.

Answer

A PKI certificate for the RADIUS server

Answer

An FSSO connector

Answer

A local user account for each RADIUS user

Question 13

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN with three spokes. Each spoke has a dial-up connection to the hub. The hub uses a dynamic DNS name. Which THREE settings are necessary on each spoke to establish the VPN?

Accepted Answer

The pre-shared key or certificate for authentication. For a dial-up IPsec VPN, each spoke needs the hub's public IP or FQDN as the remote gateway. Authentication can be via pre-shared key or certificate. The spoke must also have a Phase 2 proposal that matches the hub's configuration.

Answer

A static route on the spoke for the hub's local networks

Answer

NAT enabled on the spoke tunnel interface

Question 14

A network admin configures an IPsec VPN between two FortiGates using IKEv2. Phase 1 completes successfully, but Phase 2 fails to establish. The admin runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match. In IKEv2, Phase 2 proposals are negotiated separately from Phase 1. A proposal mismatch error indicates that the Phase 2 parameters (such as encryption algorithm, authentication algorithm, and PFS settings) do not match between the two peers.

Answer

The IKE version is not compatible

Answer

The Phase 2 selectors (local and remote subnets) are misconfigured

Answer

The pre-shared keys do not match

Question 15

An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?

Accepted Answer

LDAP. To authenticate users against an LDAP server, the administrator must create an LDAP server object and then create a user group that references that LDAP server. The group membership is typically based on LDAP group membership.

Answer

RADIUS

Answer

FSSO

Answer

Local