NSE4 Authentication and VPN Practice Test 12 — 15 Questions

Question 1

An administrator is troubleshooting an IPsec VPN that uses aggressive mode. The VPN establishes successfully, but the administrator is concerned about security. Which statement is true regarding aggressive mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Aggressive mode transmits the identification in clear text. In aggressive mode, the IKE phase 1 exchange uses three messages instead of six, and the peer's identity (such as the IP address or FQDN) is transmitted in cleartext during the second message before the secure tunnel is established. This exposes the identity to eavesdropping, making it less secure than main mode, which encrypts the identity after the tunnel is set up. The administrator's concern is valid because aggressive mode sacrifices identity protection for faster negotiation.

Answer

Aggressive mode is more secure than main mode

Answer

Aggressive mode provides perfect forward secrecy (PFS) by default

Answer

Aggressive mode uses six messages instead of three

Question 2

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

Accepted Answer

It monitors AD logon events and sends user-IP mappings to the FortiGate. The FSSO collector agent polls Active Directory for security event logs to detect user logon events. It then maps the logged-on user to their IP address and sends this user-IP mapping to the FortiGate via the FSSO protocol (port 8000). This allows the FortiGate to enforce firewall policies based on user identity without requiring the user to authenticate directly to the FortiGate.

Answer

It acts as a RADIUS proxy between FortiGate and AD

Answer

It polls the FortiGate for user information

Answer

It directly authenticates users to the FortiGate

Question 3

An administrator runs 'diagnose vpn ssl stat' and sees 'tun-num: 5, clients: 0'. Users are unable to connect to the SSL VPN. The SSL VPN settings are correct and the certificate is valid. What could be the cause?

Accepted Answer

The SSL VPN is listening on a non-default port and users are connecting to the default port. The 'tun-num: 5, clients: 0' output indicates that the SSL VPN tunnel interface is up but no clients are connected. If the SSL VPN settings and certificate are correct, the most likely cause is a port mismatch: the FortiGate is configured to listen on a non-default port (e.g., 10443), but users are attempting to connect to the default SSL VPN port (443). This prevents the SSL handshake from completing, resulting in zero active clients.

Answer

The FortiGate has reached the maximum number of SSL VPN users allowed by the license

Answer

The SSL VPN certificate is not trusted by the client browsers

Answer

The SSL VPN portal is configured with 'limit-scan' scanning

Question 4

An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from the captive portal interface to the internet with the user group. A captive portal authenticates users but does not automatically grant network access. A firewall policy must explicitly allow traffic from the captive portal interface to the internet and include the authenticated user group as a source. Without this policy, even after successful authentication, traffic is dropped and users are not redirected to the internet.

Answer

The DNS server is not configured on the FortiGate

Answer

The captive portal timeout is set too low

Answer

The SSID is not configured with the captive portal security mode

Question 5

An administrator is configuring an IPsec VPN between two FortiGates using IKEv1. The tunnel must use main mode and support multiple subnets behind each gate. Which Phase2 settings are required to allow multiple subnets? (Choose two.)

Accepted Answer

Create multiple Phase2 selectors, each with different local and remote subnets. IKEv1 main mode requires that each pair of local and remote subnets be defined in its own Phase2 selector. This allows the VPN to establish separate security associations (SAs) for each subnet pair, enabling multiple subnets behind each FortiGate. Option E is also correct because using address objects that contain multiple subnets (e.g., a subnet group or address range) in a single Phase2 definition is a supported method to negotiate a single SA covering all those subnets, reducing the number of Phase2 selectors needed.

Answer

Set the Phase2 keylife to a higher value

Answer

Set the Phase2 proposal to include multiple encryption algorithms

Answer

Enable NAT traversal on the Phase2

Question 6

An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)

Accepted Answer

ZTNA proxy (application gateway). The ZTNA proxy (application gateway) is the core component that terminates client connections and forwards them to internal applications after verifying device and user identity. It acts as a reverse proxy, enforcing access policies before allowing any traffic to reach the protected resource. Without this gateway, the FortiGate cannot mediate ZTNA connections.

Answer

IPsec VPN tunnel

Answer

Captive portal

Question 7

A FortiGate administrator wants to authenticate VPN users against an existing Active Directory server. The administrator creates a user group referencing a remote LDAP server and configures the firewall policy to authenticate using that group. However, users report authentication failures. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag test authserver ldap '. The `diag test authserver ldap` command directly tests LDAP authentication against the specified server, username, and password, isolating whether the FortiGate can successfully bind and authenticate the user. This is the fastest way to determine if the issue lies with the LDAP server connectivity, credentials, or configuration, rather than with the user group or policy. Since the administrator has already created the group and policy, the first logical step is to verify the fundamental authentication path before examining higher-level configurations.

Answer

Verify the user group configuration

Answer

Restart the FortiGate

Answer

Check the LDAP server's firewall rules

Question 8

An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?

Accepted Answer

The remote network in Phase 2 is set to 10.0.0.0/8. The most likely cause is that the remote network (client subnet) in the Phase 2 configuration on the VPN gateway is set to 10.0.0.0/8 instead of the correct value (0.0.0.0/0) for dial-up clients. Since Phase 1 succeeds, authentication and encryption settings are correct. The 'no proposal chosen' error in Phase 2 indicates a traffic selector mismatch: the server expects the client's IP to be within the 10.0.0.0/8 range, but the client's actual IP typically falls outside that subnet. Therefore, the Phase 2 negotiation fails.

Answer

The remote network in Phase 2 is set to 0.0.0.0/0

Answer

The Phase 1 encryption algorithm is mismatched

Answer

The authentication type requires EAP instead of certificate

Question 9

A FortiGate is configured with FSSO (Fortinet Single Sign-On) to authenticate users from Active Directory. Users are logging in to their domain-joined computers, but the FortiGate does not see the user sessions. The polling connector is configured correctly. What is the MOST likely reason?

Accepted Answer

DNS resolution for the Domain Controller is failing. The polling connector relies on the FortiGate communicating with the Domain Controller (DC) to retrieve user logon events. If DNS resolution for the DC fails, the FortiGate cannot resolve the DC's hostname to an IP address, preventing the polling connector from establishing the necessary LDAP or NetAPI connections to collect user session data. This is the most likely cause because the polling connector is configured correctly, but network-level name resolution is a prerequisite for any communication.

Answer

The FSSO agent is not installed on the Domain Controller

Answer

The user group filter is too restrictive

Answer

The FortiGate is not in the same subnet as the users

Question 10

An administrator wants to configure SSL VPN web mode to allow remote users to access a specific internal web application without installing any client software. Which authentication method is required?

Accepted Answer

Any supported authentication method (local, LDAP, RADIUS, certificates). SSL VPN web mode on FortiGate allows remote users to access internal web applications through a browser without client software. FortiGate supports multiple authentication methods for web mode, including local users, LDAP, RADIUS, and certificate-based authentication, so any supported method can be used. There is no requirement for a specific authentication type, making option D correct.

Answer

Certificate-based authentication only

Answer

No authentication is required for web mode

Answer

Two-factor authentication with FortiToken is mandatory

Question 11

An administrator runs 'diagnose vpn ike gateway list' on a FortiGate and sees the following output for a dial-up IPsec VPN:
gateway name: 'dialup'
  version: IKEv1
  mode: aggressive
  local IP: 203.0.113.1
  remote IP: 0.0.0.0
  state: up
  peers: 0
What does 'peers: 0' indicate?

Accepted Answer

No IPsec clients are currently connected. In the output of 'diagnose vpn ike gateway list', the 'peers' field shows the number of active IPsec tunnels (Phase 1 SAs) currently established through that gateway. A value of '0' means no remote clients have successfully completed IKE negotiation and are connected. Since the gateway state is 'up', it is ready to accept connections, but no clients are currently associated with it.

Answer

The remote IP should be set to a specific address

Answer

The gateway is in a down state

Answer

The Phase 2 proposals are mismatched

Question 12

A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?

Accepted Answer

The user is not a member of the configured user group. The most likely cause is that the user is not a member of the configured user group. In FortiGate, when LDAP authentication is used for a captive portal, the FortiGate first verifies the user's credentials against the LDAP server. Even if the credentials are valid, the FortiGate then checks whether the authenticated user belongs to a specific user group that is permitted to access the captive portal. If the user is not a member of that group, the authentication fails, even though the LDAP server itself accepts the credentials.

Answer

The captive portal is using HTTP instead of HTTPS

Answer

The captive portal interface is not in the same VDOM as the LDAP server

Answer

The LDAP server requires TLS and FortiGate is using plain LDAP

Question 13

An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?

Accepted Answer

A firewall policy is required to permit traffic between the interfaces. In a route-based IPsec VPN, even when Phase 1 and Phase 2 are up and a static route exists via the virtual tunnel interface, traffic will still be dropped unless a firewall policy explicitly permits it. FortiGate uses a stateful firewall, so a policy must allow traffic from the local interface to the tunnel interface (or vice versa) to forward packets. Without this policy, the FortiGate will not forward traffic between the subnets, even though the tunnel is established.

Answer

NAT must be disabled on the tunnel interface

Answer

The tunnel interface must be added to a zone

Answer

The Phase 2 proposal must include the correct local and remote subnets

Question 14

An administrator needs to configure two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Enable FortiToken on the user account and configure the authentication scheme to require token. FortiGate requires two-factor authentication to be enabled on the user account itself (via the 'Two-factor Authentication' field set to 'FortiToken') and then an authentication scheme must be configured that includes a 'Token' requirement. This ensures that the user must provide both their password and a one-time token from the FortiToken device or app during SSL VPN login.

Answer

Enable two-factor authentication globally on the FortiGate

Answer

Install the FortiToken mobile app on the FortiGate

Answer

Create a separate firewall policy for token-based authentication

Question 15

A FortiGate administrator is troubleshooting an IPsec VPN that fails to establish. The Phase 1 status shows 'init' and then resets. The administrator runs 'diagnose debug application ike -1' and sees the message 'no acceptable proposal'. Which TWO parameters are MOST likely mismatched?

Accepted Answer

Encryption algorithm (e.g., AES256 vs AES128). The IKE debug message 'no acceptable proposal' means the two peers could not agree on the Phase 1 (IKE SA) proposal parameters, which are negotiated during IKE SA establishment. Option D (encryption algorithm, e.g., AES256 vs AES128) is correct because the encryption algorithm is a Phase 1 proposal attribute, and if the local and remote FortiGates offer different encryption algorithms, no matching proposal exists and negotiation fails. Option E (Diffie-Hellman group, e.g., group 14 vs group 2) is also correct because the DH group is another Phase 1 proposal attribute; mismatched DH groups (modp2048/group 14 vs modp1024/group 2) prevent the peers from agreeing on a proposal. Option A (pre-shared key) is not the cause here because a PSK mismatch produces authentication failure messages (e.g., 'probable pre-shared key mismatch'), not 'no acceptable proposal'. Option B (Phase 2 local and remote networks) is a Phase 2 quick-mode/selector issue and would not generate a Phase 1 proposal rejection. Option C (IKE version) can cause negotiation problems, but a version mismatch typically shows different errors such as 'received IKEv2 packet on IKEv1 tunnel' or invalid version messages rather than the specific 'no acceptable proposal' text.

Answer

Pre-shared key

Answer

Phase 2 local and remote networks

Answer

IKE version (IKEv1 vs IKEv2)