NSE4 Authentication and VPN Practice Test 2 — 15 Questions

Question 1

An administrator wants to configure two-factor authentication for SSL VPN users. Which TWO components must be configured? (Choose two.)

Accepted Answer

SSL VPN portal configured with 'require two-factor authentication'. Option A is correct because enabling 'require two-factor authentication' on the SSL VPN portal is the setting that actually enforces two-factor authentication for SSL VPN logins, so without it the portal would only perform single-factor authentication. Option C is correct because FortiToken must be assigned to the user to serve as the second authentication factor, providing the one-time password that complements the user's password. Option B is incorrect because a captive portal is used for guest or pre-authentication web access and is unrelated to SSL VPN two-factor authentication. Option D is incorrect because a RADIUS server configured for one-time passwords is not a required component when using FortiToken as the second factor. Option E is incorrect because IPsec Phase 1 authentication set to 'signature' applies to IPsec VPN certificate authentication, not SSL VPN two-factor authentication.

Answer

Captive portal enabled

Answer

RADIUS server configured for one-time passwords

Answer

IPsec Phase 1 authentication set to 'signature'

Question 2

A captive portal is configured on a FortiGate to authenticate users before allowing internet access. Users report that after entering credentials, they are redirected to the original website, but then they cannot access other sites. What is the most likely issue?

Accepted Answer

The user is not a member of the required user group specified in the firewall policy. The most likely issue is that the user is not a member of the required user group specified in the firewall policy. After successful authentication, the FortiGate applies the policy that matches the user's group; if the user is not in the correct group, they may be allowed initial access but then blocked from further sites due to policy mismatch.

Answer

The captive portal is using a self-signed certificate causing browser warnings

Answer

The DNS server is not configured on the FortiGate

Answer

The session timeout is set too low

Question 3

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. Which two additional diagnostics should the administrator run to isolate the issue?

Accepted Answer

diagnose sys session filter and diagnose sys session list. Option A is correct because 'diagnose sys session filter' combined with 'diagnose sys session list' lets the administrator inspect the FortiGate session table for the VPN traffic, confirming whether sessions are being created, matched against the correct policy, and forwarded through the tunnel rather than dropped. Option C is correct because 'diagnose debug application ike -1' enables verbose IKE debug output, which is essential for verifying Phase 1/Phase 2 negotiation details, selectors, and any IKE-level mismatch even when the tunnel shows as up. Option B is not appropriate because checking system memory does not isolate a traffic-forwarding problem in an established tunnel. Option D is not appropriate because 'diagnose netlink interface list' shows interface/kernel netlink information, not IPsec policy or session behavior. Option E is not appropriate because ping-options and ping only test basic reachability and do not reveal why traffic is failing inside an up tunnel.

Answer

diagnose hardware sysinfo memory

Answer

diagnose netlink interface list

Answer

execute ping-options source and execute ping

Question 4

A company wants to implement SSL VPN split tunneling to allow remote users to access both internal resources and the internet directly. Which three configurations are required on the FortiGate?

Accepted Answer

Configure a firewall policy allowing the SSL VPN interface to the internet interface with NAT enabled. Option B is correct because split tunneling still requires a firewall policy from the SSL VPN interface (ssl.root) to the internet-facing interface with NAT enabled so that remote users' internet-bound traffic can be forwarded and translated. Option C is correct because split tunneling is defined by routing policies in the SSL VPN settings that specify which destination subnets are sent through the tunnel, while all other traffic goes directly to the internet. Option E is correct because split tunneling must be enabled in the SSL VPN tunnel-mode client configuration (for example, via the 'set split-tunnel enable' setting) for the FortiGate to honor the routing policies and allow direct internet access. Option A is not required because the SSL VPN interface is a logical tunnel interface and does not need its own public IP address; the public IP is already bound to the WAN interface used for SSL VPN termination. Option D is incorrect because a static route sending all traffic through the SSL VPN tunnel would defeat split tunneling by forcing all traffic into the tunnel instead of allowing direct internet access.

Answer

Assign a public IP address to the SSL VPN interface

Answer

Configure a static route on the FortiGate to send all traffic through the SSL VPN tunnel

Question 5

An administrator is configuring Active Directory polling for FSSO. Which two components must be set up correctly for FSSO to work?

Accepted Answer

A firewall policy that allows LDAP traffic from FortiGate to the domain controller. Option D is correct because in Active Directory polling mode the FortiGate must query the domain controller directly over LDAP (TCP 389, or LDAPS 636), so a firewall policy permitting LDAP traffic from the FortiGate to the domain controller is required for the polling to succeed. Option E is correct because FSSO in AD polling mode requires the FSSO collector agent to be installed on a Windows server that is a member of the domain, where it reads the domain controller's security event log and communicates user logon information to the FortiGate. Option A is not required, since FSSO uses Windows domain authentication and event log monitoring rather than RADIUS. Option B is not required, as FSSO polling uses LDAP/RPC over the network and does not depend on an IPsec tunnel. Option C is not required, because FSSO identifies users through their domain logon sessions and does not consume FortiToken licenses.

Answer

A RADIUS server configured for user authentication

Answer

An IPsec tunnel between FortiGate and the domain controller

Answer

FortiToken license for each user

Question 6

An SSL VPN user connects via web mode but cannot access internal resources. The admin checks the SSL VPN settings: tunnel mode is disabled, split tunneling is enabled, and the user's realm is configured correctly. What is the MOST likely cause?

Accepted Answer

No port forwarding rules are configured in the SSL VPN portal. In SSL VPN web mode, the FortiGate acts as a reverse proxy and only exposes resources that are explicitly defined as bookmarks or port-forwarding entries in the SSL VPN portal. Since tunnel mode is disabled, users cannot route arbitrary traffic to internal subnets; they can only reach resources published through the portal. Therefore, the absence of port forwarding rules means no internal resources are reachable, matching the symptom.

Answer

Split tunneling is blocking internal routes

Answer

The user's browser does not support WebSocket

Answer

The user's client certificate is expired

Question 7

A FortiGate is configured with FSSO to poll Active Directory for user logon events. Users report that their logins are not being detected. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag debug fsso poll' to verify the collector agent status. The 'diag debug fsso poll' command directly checks the communication status between the FortiGate and the FSSO collector agent. This is the first logical step to verify whether the collector agent is successfully polling Active Directory for logon events, which is the root cause of undetected logins.

Answer

Recreate all firewall policies

Answer

Disable and re-enable FSSO

Answer

Restart the FortiGate firewall

Question 8

A FortiGate admin is configuring a dial-up IPsec VPN for remote users. The users have dynamic IP addresses. Which Phase 1 configuration is appropriate?

Accepted Answer

Set the remote gateway to 'Dialup User' and enable an IP pool. For dial-up IPsec VPNs where remote users have dynamic IP addresses, the FortiGate cannot know the remote gateway IP in advance. Setting the remote gateway to 'Dialup User' allows the FortiGate to accept connections from any IP, and enabling an IP pool assigns a static internal IP to the remote user for routing and policy enforcement.

Answer

Disable XAuth authentication

Answer

Set the remote gateway to the user's IP address

Answer

Use aggressive mode with a group pre-shared key

Question 9

A FortiGate administrator notices that the IPsec VPN tunnel is established but traffic is not passing. The firewall policy allowing traffic from the remote subnet to the local subnet is in place. What is the MOST likely cause?

Accepted Answer

There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface. When an IPsec VPN tunnel is established but traffic fails to pass, the most common cause is the lack of a static route on the FortiGate for the remote subnet pointing to the tunnel interface. Even with a correct firewall policy, the FortiGate cannot forward traffic to the remote subnet without a route that directs packets into the VPN tunnel interface (e.g., 'tunnel.1'). This is a fundamental routing requirement for route-based VPNs, which are the default configuration on FortiGate.

Answer

The VPN tunnel is a policy-based VPN and the policy is incorrectly configured

Answer

The Phase 2 proposal includes PFS, but the remote side does not

Answer

The local firewall is blocking ICMP

Question 10

A FortiGate admin is troubleshooting an IPsec VPN where Phase 1 is up but Phase 2 fails to establish. Which TWO diagnostic commands would provide the most relevant information?

Accepted Answer

diagnose vpn tunnel list. Option B, `diagnose vpn tunnel list`, is correct because it displays the current state of IPsec tunnels, including Phase 1 and Phase 2 selectors, SPIs, and status, which directly shows whether Phase 2 SAs are established or failing. Option E, `diagnose vpn ike log`, is correct because it captures real-time IKE negotiation messages (including Phase 2 QUICK_MODE exchanges, proposals, and error notifications) that reveal why Phase 2 fails, such as mismatched selectors, proposals, or PFS settings. Option A, `diagnose debug application ike -1`, is not among the marked answers and, while it can enable IKE debug output, it is not the specific command requested here for Phase 2 troubleshooting. Option C, `diagnose netlink interface list`, only shows kernel network interface details and is irrelevant to IPsec Phase 2 negotiation. Option D, `diagnose sys session list`, displays firewall session entries and does not expose IKE or IPsec SA negotiation details needed to diagnose Phase 2 failures.

Answer

diagnose debug application ike -1

Answer

diagnose netlink interface list

Answer

diagnose sys session list

Question 11

An administrator configures an IPsec VPN with IKEv1 main mode. The remote peer reports that Phase 1 fails with a 'no proposal chosen' error. The local Phase 1 settings include: encryption AES128, authentication SHA1, DH group 2, lifetime 86400. Which remote peer setting is MOST likely causing the mismatch?

Accepted Answer

Remote peer uses AES256 instead of AES128. In IKEv1 Phase 1, the SA proposal must match on encryption algorithm, authentication hash, DH group, and lifetime. A mismatch in any of these parameters will cause the responder to reject the proposal with 'no proposal chosen'. Therefore, AES256 instead of AES128 (B), DH5 instead of DH2 (C), and SHA256 instead of SHA1 (D) are all plausible causes. There is no basis to designate one as 'most likely' without additional context.

Answer

Remote peer uses aggressive mode

Question 12

An administrator wants to use FortiToken two-factor authentication for SSL VPN users. In addition to configuring the user's FortiToken, which setting must be enabled on the firewall policy to force two-factor authentication?

Accepted Answer

Enable 'Two-factor authentication' on the user group that the policy references. FortiGate enforces two-factor authentication at the user or user-group level, not directly on the firewall policy. When a user is assigned a FortiToken, the 'Two-factor authentication' setting must be enabled on the user group object that the SSL VPN firewall policy references. This tells FortiGate to require both the user's password and a one-time password from the FortiToken before granting access.

Answer

Set the 'auth type' to 'token' on the SSL VPN portal

Answer

Enable 'Two-factor authentication' on the firewall policy

Answer

Configure a FortiToken server object

Question 13

An administrator has configured an SSL VPN with tunnel mode and split tunneling enabled. However, remote users report that all internet traffic is going through the VPN tunnel. What is the MOST likely cause?

Accepted Answer

The client's routing table is set to route all traffic through the VPN. When split tunneling is enabled on the FortiGate SSL VPN portal, the FortiClient VPN software should only route traffic destined for the corporate network through the tunnel. If remote users report that all internet traffic is going through the VPN tunnel, the most likely cause is that the client's routing table has been configured to route all traffic (0.0.0.0/0) through the virtual adapter, overriding the split-tunneling rules. This can happen if the client is set to 'Route all traffic through VPN' in its settings, which forces a default route into the VPN interface regardless of the portal configuration.

Answer

The firewall policy allows traffic to the internet

Answer

The SSL VPN portal has 'split tunneling' disabled

Answer

The user has installed a root certificate

Question 14

An administrator runs 'diagnose debug application sslvpn -1' on a FortiGate and sees the following output: 'SSLVPN_ERROR:ERR_AUTH_FAIL' for a user. The user is in an LDAP group and has the correct password. What is the MOST likely cause?

Accepted Answer

The user is not a member of the required LDAP group. The error 'ERR_AUTH_FAIL' in the SSL VPN debug output indicates that the authentication request was processed but the user failed an authorization check. Since the user has the correct password, the issue is not with credential validation but with group membership verification. FortiGate SSL VPNs enforce access policies based on group membership; if the user is not a member of the LDAP group specified in the SSL VPN policy, the authentication is rejected at the authorization stage, producing this specific error.

Answer

The SSL VPN certificate is expired

Answer

The LDAP server is unreachable

Answer

The user account is locked out

Question 15

An administrator is configuring a dial-up IPsec VPN for remote users. Which TWO settings are required on the FortiGate for the dial-up server? (Choose two.)

Accepted Answer

Set 'mode-cfg' to enable on Phase 1. For a dial-up IPsec VPN, the FortiGate must act as a server accepting connections from multiple remote peers whose IP addresses are unknown, so option B is correct: setting the Phase 1 'peer type' to 'any' allows the FortiGate to accept IKE negotiations from any remote gateway rather than a single fixed peer IP. Option A is also correct: enabling 'mode-cfg' on Phase 1 lets the FortiGate assign virtual IP addresses and other network parameters (such as DNS and split-tunnel settings) to the dial-up clients via the IKE configuration payload, which is essential for clients that have no static addressing. Option C is not required because aggressive mode is a negotiation mode choice, not a mandatory dial-up server setting, and it is typically avoided for security reasons. Option D is incorrect because 'auto-negotiate' is not a valid Phase 2 setting for this purpose; Phase 2 parameters are negotiated as part of the established Phase 1 tunnel. Option E is not required because PFS (perfect forward secrecy) is an optional Phase 2 hardening feature, not a prerequisite for dial-up operation.

Answer

Set 'aggressive mode' on Phase 1

Answer

Set 'auto-negotiate' to enable on Phase 2

Answer

Set 'pfs' to enable on Phase 2