NSE4 Authentication and VPN Practice Test 2 — 15 Questions

Question 1

An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?

Accepted Answer

FortiClient. FortiClient is the required endpoint component for ZTNA because it acts as the ZTNA agent on the client device, establishing a secure tunnel (via IPSec or SSL VPN) to the FortiGate and enforcing posture checks (e.g., OS version, antivirus status) before granting access. Without FortiClient, the FortiGate cannot verify the device's trust level or enforce ZTNA access policies at the endpoint.

Answer

FortiManager

Answer

FortiToken

Answer

FortiAnalyzer

Question 2

A FortiGate administrator is troubleshooting an SSL VPN issue where users can authenticate but cannot access any internal resources. The SSL VPN status shows 'connected'. Which THREE commands or actions should be used to diagnose the problem?

Accepted Answer

Check the firewall policies that match the SSL VPN interface.. Even after successful SSL VPN authentication and connection, traffic to internal resources is blocked if no firewall policy explicitly permits traffic from the SSL VPN interface (e.g., ssl.root) to the destination internal interface. The 'connected' status only confirms the tunnel is up, not that traffic is allowed through it.

Answer

'execute ping 8.8.8.8'

Answer

'diagnose debug application sslvpn -1'

Question 3

An organization uses LDAP authentication for firewall policies. Users complain that they are frequently prompted for credentials. Which TWO settings can reduce the frequency of authentication prompts?

Accepted Answer

Increase the authentication timeout on the firewall policy.. Increasing the authentication timeout on the firewall policy (Option A) allows the firewall to cache the user's authentication state for a longer period, so users are not re-prompted for credentials as frequently when traffic matches that policy. Enabling single sign-on (SSO) authentication (Option C) leverages Kerberos or NTLM to automatically authenticate users based on their domain logon, eliminating repeated manual credential prompts.

Answer

Increase the idle timeout on the LDAP server.

Answer

Disable captive portal on the interface.

Answer

Use a longer password for LDAP accounts.

Question 4

An administrator receives a report that some users cannot authenticate via captive portal on a FortiGate. The captive portal is configured for firewall authentication. The administrator checks the authentication logs and sees 'Authentication failed: invalid credentials'. However, the users confirm they are entering the correct username and password. What is the MOST likely cause?

Accepted Answer

The users are not including the domain name in the username field. If the users are in a domain, the FortiGate expects the username in the format 'domain\username' or 'username@domain.com'. Entering just the username without the domain will cause authentication failure.

Answer

The captive portal interface is not configured with a valid certificate

Answer

The FortiGate's clock is out of sync with the LDAP server

Answer

The LDAP server is not reachable from the FortiGate

Question 5

Which authentication method allows a FortiGate to transparently authenticate users based on their Active Directory login events without prompting for credentials?

Accepted Answer

FSSO (Fortinet Single Sign-On). Fortinet Single Sign-On (FSSO) allows FortiGate to transparently authenticate users by collecting login events from Active Directory domain controllers. It uses the NetAPI or a polling mechanism to capture user logon events without requiring any user interaction or credential prompts, enabling seamless identity-based policy enforcement.

Answer

RADIUS authentication

Answer

Local database authentication

Answer

LDAP authentication

Question 6

A FortiGate admin is troubleshooting an IPsec VPN tunnel that fails to establish. The remote site uses aggressive mode. The local FortiGate is configured for main mode. The admin sees 'no proposal chosen' in the IKE debug. What is the MOST likely cause?

Accepted Answer

The IKE mode (main vs aggressive) does not match between peers. The 'no proposal chosen' error in IKE debug indicates a mismatch in the IKE parameters proposed by the peers. Since the remote site uses aggressive mode and the local FortiGate is configured for main mode, the IKE mode mismatch prevents the peers from agreeing on a proposal. IKE main mode and aggressive mode use different packet formats and exchange sequences, so they cannot negotiate a common proposal even if all other parameters match.

Answer

The pre-shared key is incorrect

Answer

The local firewall is blocking UDP port 500

Answer

The Phase 2 encryption algorithm is not supported

Question 7

A FortiGate administrator wants to enforce two-factor authentication for SSL VPN users. The organization uses FortiToken mobile tokens. What must be configured on the FortiGate to enable FortiToken authentication?

Accepted Answer

In the user group configuration, enable two-factor authentication and select 'FortiToken'. FortiGate natively supports FortiToken two-factor authentication directly in the user group configuration. By enabling two-factor authentication and selecting 'FortiToken' within the user group settings, the FortiGate will prompt SSL VPN users for both their password and a one-time password generated by the FortiToken mobile app, without requiring any external server.

Answer

Configure a RADIUS server to forward FortiToken requests

Answer

Set the SSL VPN portal to require client certificates

Answer

Install the FortiToken mobile app on the FortiGate

Question 8

A FortiGate administrator is configuring an SSL VPN tunnel mode for remote users. The administrator wants to ensure that only traffic destined for the corporate network (192.168.1.0/24) goes through the VPN, and all other traffic (e.g., internet) goes directly from the user's device. Which TWO configuration steps are required?

Accepted Answer

Configure the SSL VPN portal to push routes for 192.168.1.0/24 to the client. Pushing the route for 192.168.1.0/24 to the SSL VPN client tells the client's routing table to send traffic destined for that subnet through the VPN tunnel. Option C is correct because enabling split tunneling and specifying only 192.168.1.0/24 as a destination route ensures that only corporate traffic goes through the VPN, while all other traffic (e.g., internet) bypasses the tunnel and goes directly from the user's device.

Answer

Set the SSL VPN portal's 'tunnel mode' to 'web-only'

Answer

Disable 'tunnel mode' and use 'web mode' instead

Answer

Create a firewall policy on the FortiGate allowing traffic from the SSL VPN interface to the corporate network

Question 9

A FortiGate administrator is troubleshooting an IPsec VPN between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees the following output:
IKE: phase 2 negotiation completed
IKE: IPsec SA up
What THREE possible causes should the administrator investigate?

Accepted Answer

Firewall policies on either FortiGate are not allowing traffic between the local and remote subnets. Even though the IPsec SA is up (phase 2 completed), traffic will not pass unless firewall policies explicitly permit traffic between the local and remote subnets. FortiGate requires a policy that allows the traffic and references the VPN tunnel interface as the outgoing interface.

Answer

The pre-shared key is incorrect

Answer

The IKE mode is set to aggressive mode on one side and main mode on the other

Question 10

A FortiGate administrator is configuring FSSO to authenticate users transparently. The FSSO collector agent is installed on a Windows server in the domain. Which TWO requirements must be met for FSSO to work correctly?

Accepted Answer

The FortiGate must be able to reach the FSSO collector agent on TCP port 8000 (or the configured port). The FortiGate must communicate with the FSSO collector agent over TCP port 8000 (or a custom port) to receive real-time user login/logoff events. This connection is essential for the FortiGate to map IP addresses to authenticated domain users and enforce identity-based firewall policies. Without this reachability, the FortiGate cannot obtain the necessary user-to-IP mappings from the collector agent.

Answer

The FortiGate must be a member of the Active Directory domain

Answer

The users must authenticate via captive portal at least once

Answer

The firewall policies must use FSSO groups directly without any user objects

Question 11

You are troubleshooting an IPsec VPN between two FortiGates. The Phase 1 is up, but Phase 2 is not coming up. You check the Phase 2 configuration on both sides. What is a common cause of this issue?

Accepted Answer

Mismatch in Phase 2 settings such as encryption algorithm, authentication algorithm, or PFS group. When Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in Phase 2 parameters. Phase 2 uses IPsec SA proposals that must match exactly on both sides, including encryption algorithm (e.g., AES256), authentication algorithm (e.g., SHA256), and Perfect Forward Secrecy (PFS) group (e.g., DH14). Even a single mismatch, such as one side using PFS and the other not, will prevent Phase 2 from establishing.

Answer

Firewall policy not allowing ESP traffic

Answer

Incorrect local or remote gateway IP

Answer

Mismatch in Phase 1 pre-shared key

Question 12

A FortiGate administrator wants to configure a captive portal to authenticate users before granting network access. Which authentication method is used by the captive portal?

Accepted Answer

Form-based authentication. FortiGate captive portals use form-based authentication by default, presenting a web page where users enter credentials (username/password) that are verified against a configured authentication server (e.g., LDAP, RADIUS, or local user database). This method is designed for HTTP/HTTPS interception and does not rely on network-layer or certificate-based mechanisms.

Answer

IPsec pre-shared key authentication

Answer

X.509 certificate authentication

Answer

NTLM authentication

Question 13

A FortiGate admin has configured FSSO (Fortinet Single Sign-On) using Active Directory polling. Users authenticate to the domain but when accessing the internet through the FortiGate, they are still prompted for credentials. What is the MOST likely cause?

Accepted Answer

The FortiGate is not polling the AD domain controllers. In FSSO with Active Directory polling, the FortiGate must be configured to poll the domain controllers to retrieve user logon events. If polling is not set up or fails, the FortiGate will not have the user-to-IP mapping, and thus cannot bypass authentication for domain users, causing them to be prompted for credentials when accessing the internet.

Answer

The users are using non-Windows machines

Answer

The firewall policy does not have FSSO authentication enabled

Answer

The FortiGate is not joined to the domain

Question 14

Which authentication server type can be used with FortiGate to authenticate remote VPN users with two-factor authentication using FortiTokens?

Accepted Answer

RADIUS. RADIUS is the correct authentication server type because it supports two-factor authentication with FortiTokens, including the ability to forward token challenges (e.g., one-time passwords) between FortiGate and the RADIUS server. FortiGate acts as a RADIUS client, sending authentication requests to a RADIUS server that validates both the user's primary credentials and the FortiToken OTP, enabling secure remote VPN access.

Answer

POP3

Answer

LDAP

Answer

TACACS+

Question 15

An admin is configuring a dial-up IPsec VPN for remote users. The users will connect from various public IP addresses. Which Phase 1 configuration is required for the FortiGate to accept connections from unknown remote gateways?

Accepted Answer

Set the remote gateway to 0.0.0.0. For a dial-up IPsec VPN where remote users connect from dynamic public IP addresses, the FortiGate must be configured to accept connections from any remote gateway. Setting the remote gateway to 0.0.0.0 (or 0.0.0.0/0) in Phase 1 tells the FortiGate to accept IKE negotiation from any source IP, which is essential for dial-up scenarios. This is the standard method to allow unknown remote gateways to initiate the VPN tunnel.

Answer

Enable aggressive mode

Answer

Configure a static route to the remote users' subnet

Answer

Set the remote gateway to a specific IP address