NSE4 Authentication and VPN Practice Test 12 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting an SSL VPN connection issue. Users can connect but cannot access internal resources. The administrator checks the SSL VPN policy and confirms it allows access to the internal subnet. What should the administrator check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the firewall policy between the SSL VPN interface and the internal network allows the traffic. Even if the SSL VPN policy permits access to the internal subnet, traffic must still traverse a firewall policy from the SSL VPN interface (e.g., ssl.root) to the internal network interface. Without an explicit firewall policy allowing the traffic, the FortiGate will drop the packets, preventing resource access. This is a common oversight because the SSL VPN policy only controls tunnel establishment and route injection, not the actual forwarding of traffic between zones.

Answer

Check the routing table on the FortiGate for the internal subnet

Answer

Ensure the users have the correct client software installed

Answer

Check the FortiGate's DNS settings

Question 2

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The Phase 1 status shows 'down'. Which TWO commands can help diagnose the issue? (Choose TWO.)

Accepted Answer

diagnose debug application ike -1. The 'diagnose debug application ike -1' command enables real-time IKE (Internet Key Exchange) debugging, which is essential for troubleshooting Phase 1 failures. This command captures IKEv1/v2 negotiation messages, including proposals, pre-shared key mismatches, and authentication errors, directly showing why the tunnel is down.

Answer

diagnose npu np6 ipsec-sa list

Answer

diagnose sys session clear

Answer

diagnose vpn tunnel list

Question 3

An administrator wants to use Active Directory credentials to authenticate firewall administrators. Which authentication server type should be configured on the FortiGate?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it directly integrates with Microsoft Active Directory to authenticate firewall administrators using their existing AD credentials. FortiGate can bind to an LDAP server to verify username and password pairs, making it the native protocol for AD authentication without requiring additional services or translation layers.

Answer

TACACS+

Answer

FSSO

Answer

RADIUS

Question 4

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 5

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

Accepted Answer

It monitors AD logon events and sends user-IP mappings to the FortiGate. The FSSO collector agent polls Active Directory for security event logs to detect user logon events. It then maps the logged-on user to their IP address and sends this user-IP mapping to the FortiGate via the FSSO protocol (port 8000). This allows the FortiGate to enforce firewall policies based on user identity without requiring the user to authenticate directly to the FortiGate.

Answer

It acts as a RADIUS proxy between FortiGate and AD

Answer

It polls the FortiGate for user information

Answer

It directly authenticates users to the FortiGate

Question 6

An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from the captive portal interface to the internet with the user group. A captive portal authenticates users but does not automatically grant network access. A firewall policy must explicitly allow traffic from the captive portal interface to the internet and include the authenticated user group as a source. Without this policy, even after successful authentication, traffic is dropped and users are not redirected to the internet.

Answer

The DNS server is not configured on the FortiGate

Answer

The captive portal timeout is set too low

Answer

The SSID is not configured with the captive portal security mode

Question 7

A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)

Accepted Answer

Diffie-Hellman group mismatch (e.g., group 2 vs group 14). The 'No proposal chosen' error indicates that the IKE SA parameters proposed by the initiator do not match any configured proposal on the responder. Since the error occurs during Phase 1, mismatches in mandatory parameters like Diffie-Hellman group, authentication method (hash algorithm), and encryption algorithm will directly cause this failure, as these are negotiated as part of the SA payload.

Answer

Pre-shared key mismatch

Answer

Lifetime mismatch (e.g., 86400 vs 3600)

Question 8

A network administrator configures an IPsec VPN between two FortiGates using IKEv1 main mode. The Phase 1 negotiation fails with the error 'no proposal chosen'. The administrator checks both sides and confirms the IKE version, encryption algorithm (AES256), authentication (SHA256), and Diffie-Hellman group (14) match. Which additional parameter is MOST likely mismatched?

Accepted Answer

Local and remote identifiers (local ID / remote ID). In IKEv1 main mode, the Phase 1 negotiation includes an exchange of identity (ID) payloads after the Diffie-Hellman exchange. If the local or remote identifiers (local ID / remote ID) do not match what is expected on the peer, the FortiGate will reject the proposal with a 'no proposal chosen' error, even if all other Phase 1 parameters (encryption, authentication, DH group, IKE version) are identical. The pre-shared key is verified later in Phase 1 (during authentication), so a mismatch there would cause a different error (e.g., 'authentication failed'), not 'no proposal chosen'.

Answer

Pre-shared key

Answer

IKE version (IKEv2)

Answer

Phase 2 encryption algorithm

Question 9

An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?

Accepted Answer

The remote network in Phase 2 is set to 10.0.0.0/8. The most likely cause is that the remote network (client subnet) in the Phase 2 configuration on the VPN gateway is set to 10.0.0.0/8 instead of the correct value (0.0.0.0/0) for dial-up clients. Since Phase 1 succeeds, authentication and encryption settings are correct. The 'no proposal chosen' error in Phase 2 indicates a traffic selector mismatch: the server expects the client's IP to be within the 10.0.0.0/8 range, but the client's actual IP typically falls outside that subnet. Therefore, the Phase 2 negotiation fails.

Answer

The remote network in Phase 2 is set to 0.0.0.0/0

Answer

The Phase 1 encryption algorithm is mismatched

Answer

The authentication type requires EAP instead of certificate

Question 10

An administrator runs 'diagnose vpn ike gateway list' on a FortiGate and sees the following output for a dial-up IPsec VPN:
gateway name: 'dialup'
  version: IKEv1
  mode: aggressive
  local IP: 203.0.113.1
  remote IP: 0.0.0.0
  state: up
  peers: 0
What does 'peers: 0' indicate?

Accepted Answer

No IPsec clients are currently connected. In the output of 'diagnose vpn ike gateway list', the 'peers' field shows the number of active IPsec tunnels (Phase 1 SAs) currently established through that gateway. A value of '0' means no remote clients have successfully completed IKE negotiation and are connected. Since the gateway state is 'up', it is ready to accept connections, but no clients are currently associated with it.

Answer

The remote IP should be set to a specific address

Answer

The gateway is in a down state

Answer

The Phase 2 proposals are mismatched

Question 11

A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?

Accepted Answer

The user is not a member of the configured user group. The most likely cause is that the user is not a member of the configured user group. In FortiGate, when LDAP authentication is used for a captive portal, the FortiGate first verifies the user's credentials against the LDAP server. Even if the credentials are valid, the FortiGate then checks whether the authenticated user belongs to a specific user group that is permitted to access the captive portal. If the user is not a member of that group, the authentication fails, even though the LDAP server itself accepts the credentials.

Answer

The captive portal is using HTTP instead of HTTPS

Answer

The captive portal interface is not in the same VDOM as the LDAP server

Answer

The LDAP server requires TLS and FortiGate is using plain LDAP

Question 12

An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?

Accepted Answer

A firewall policy is required to permit traffic between the interfaces. In a route-based IPsec VPN, even when Phase 1 and Phase 2 are up and a static route exists via the virtual tunnel interface, traffic will still be dropped unless a firewall policy explicitly permits it. FortiGate uses a stateful firewall, so a policy must allow traffic from the local interface to the tunnel interface (or vice versa) to forward packets. Without this policy, the FortiGate will not forward traffic between the subnets, even though the tunnel is established.

Answer

NAT must be disabled on the tunnel interface

Answer

The tunnel interface must be added to a zone

Answer

The Phase 2 proposal must include the correct local and remote subnets

Question 13

A FortiGate administrator is troubleshooting an SSL VPN connection issue. Users can connect but cannot access internal resources. The administrator checks the SSL VPN policy and confirms it allows access to the internal subnet. What should the administrator check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encryption algorithm (e.g., AES256 vs AES128). The 'no acceptable proposal' error during IKE Phase 1 indicates a mismatch in the security proposal parameters that the two peers exchange to establish the SA. The encryption algorithm (e.g., AES256 vs AES128) and Diffie-Hellman group (e.g., group 14 vs group 2) are both part of the Phase 1 proposal; if either differs between peers, the negotiation fails and the status resets to 'init'.

Answer

Pre-shared key

Answer

Phase 2 local and remote networks

Answer

IKE version (IKEv1 vs IKEv2)

Question 14

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Accepted Answer

A proxy-based firewall policy. ZTNA on FortiGate requires a proxy-based firewall policy to intercept and inspect application-layer traffic. This policy type enables the FortiGate to act as a reverse proxy, terminating TLS connections and enforcing access control based on user identity and device posture before forwarding traffic to the internal application.

Answer

A firewall policy using IPsec VPN

Answer

A FortiGate in transparent mode

Answer

A policy-based IPsec tunnel

Question 15

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Accepted Answer

A RADIUS server object with IP address and shared secret. A RADIUS server object defines the IP address and shared secret that the FortiGate uses to communicate with the RADIUS server for authentication requests. Option D is correct because a user group must reference the RADIUS server to map authenticated users to policies; without this group, the FortiGate cannot apply firewall rules based on RADIUS authentication.

Answer

A PKI certificate for the RADIUS server

Answer

An FSSO connector

Answer

A local user account for each RADIUS user