NSE4 Authentication and VPN Practice Test 3 — 15 Questions

Question 1

You run 'diagnose debug application ike -1' and see the following output: 'Initiator: no acceptable proposal'. What is the MOST likely cause of this error?

Accepted Answer

The Phase 1 encryption or hash algorithm is mismatched. The error 'no acceptable proposal' indicates that the IKE Phase 1 negotiation failed because the two VPN peers could not agree on a common set of security parameters. This is most commonly caused by a mismatch in the encryption algorithm (e.g., AES128 vs AES256) or the hash algorithm (e.g., SHA1 vs SHA256) configured on the FortiGate versus the remote peer. The pre-shared key is not checked until after Phase 1 completes, so it would not cause this specific error.

Answer

The pre-shared key is incorrect

Answer

The remote gateway is not reachable

Answer

The firewall policy is blocking UDP port 500

Question 2

In Fortinet ZTNA, what is the primary purpose of the ZTNA access proxy component?

Accepted Answer

To proxy connections to internal applications after authentication and device verification. The ZTNA access proxy is the core component that mediates user access to internal applications. It intercepts client requests, enforces authentication and device posture checks (via FortiClient telemetry), and then proxies the connection to the protected application. This ensures no direct network access is granted; all traffic must pass through the proxy, which validates trust before forwarding.

Answer

To act as a forward proxy for web traffic

Answer

To provide load balancing for multiple FortiGates

Answer

To terminate IPsec VPN tunnels

Question 3

An admin needs to configure an SSL VPN for remote users that only provides access to specific internal applications, not full network access. What feature should be configured?

Accepted Answer

Split tunneling. Split tunneling (Option C) is the correct feature because it allows the SSL VPN to route only traffic destined for specific internal applications through the encrypted tunnel, while all other traffic goes directly to the internet. This meets the requirement of providing access to specific internal applications without granting full network access, as split tunneling uses routing policies to selectively forward traffic based on destination IP addresses or application ports.

Answer

Full tunneling

Answer

Client certificate authentication

Answer

Web mode portal

Question 4

An administrator configures an LDAP user group for firewall authentication. Users are able to authenticate, but the FortiGate does not retrieve group membership information. What is likely misconfigured?

Accepted Answer

The LDAP bind account does not have permission to read group attributes. The LDAP bind account must have sufficient permissions to read the memberOf or group membership attributes from the directory. If the bind account can authenticate users but cannot query group membership, the FortiGate will not be able to enforce policies based on LDAP groups. This is the most common cause when authentication succeeds but group information is missing.

Answer

The LDAP server's IP address is incorrect

Answer

SSL is not enabled for LDAP

Answer

The FortiGate is not joined to the domain

Question 5

An administrator is troubleshooting an SSL VPN connection. Users can connect but cannot access internal resources. Which TWO commands would help diagnose the issue?

Accepted Answer

get router info routing-table. The 'get router info routing-table' command displays the FortiGate's routing table, which is essential for verifying that the FortiGate has a route to the internal resources the SSL VPN users are trying to access. If the route is missing or incorrect, traffic from the SSL VPN tunnel will not be forwarded to the internal network. Option B is correct because 'diagnose vpn ssl list' shows active SSL VPN sessions, including the assigned virtual IP (VIP) and tunnel interface, which helps confirm that the user is properly connected and has received an IP address from the correct address pool.

Answer

diagnose vpn ike status

Answer

execute ping 8.8.8.8

Answer

diagnose debug application dnsproxy

Question 6

A FortiGate is configured with FSSO and Active Directory polling. Users report that they are frequently prompted for authentication even though they are logged into the domain. Which THREE possible causes should the administrator investigate?

Accepted Answer

The user's IP address has changed and the FortiGate still has a stale mapping. FSSO with Active Directory polling relies on the FortiGate maintaining a mapping between a user's domain logon and their IP address. If the user's IP address changes (e.g., due to DHCP lease renewal or moving to a different subnet) and the FortiGate still holds the old mapping, the firewall will not recognize the user as authenticated, prompting re-authentication. This is a common issue in dynamic IP environments where the FortiGate's polling interval may not immediately detect the change.

Answer

The FortiToken server is overloaded

Answer

The captive portal is enabled on the policy

Question 7

A network admin is configuring a hub-and-spoke VPN with three spokes. Which TWO statements are correct about route-based VPN in this topology?

Accepted Answer

Each spoke must have a route-based VPN interface configured to the hub. In a hub-and-spoke route-based VPN, each spoke must have its own route-based VPN interface (e.g., an IPsec virtual tunnel interface) configured to the hub because the tunnel endpoints are unique per spoke. This allows the hub to maintain separate Phase 2 security associations (SAs) and routing entries for each spoke, enabling independent encrypted tunnels.

Answer

A single firewall policy can control traffic to all spokes

Answer

Aggressive mode must be enabled for the hub to accept multiple spokes

Answer

All spokes can share the same Phase 1 configuration

Question 8

An administrator wants to enable two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Add the FortiToken to the user's account and enable 'fortitoken' in the user group. FortiToken two-factor authentication is enforced by enabling 'fortitoken' in the user group settings. The group must be added to the SSL VPN firewall policy.

Answer

Create a RADIUS server pointing to FortiAuthenticator

Answer

Set the authentication timeout to 60 seconds

Answer

Configure SSL VPN to use certificate authentication

Question 9

Which IPsec VPN mode uses IP addresses and ports to define interesting traffic, and requires a separate security policy for each tunnel?

Accepted Answer

Policy-based VPN. Policy-based VPN (B) is correct because it defines interesting traffic using source/destination IP addresses and ports, and each tunnel requires a separate security policy to specify which traffic should be encrypted. This contrasts with route-based VPNs, which use virtual interfaces and routing tables to determine traffic, allowing a single policy to handle multiple tunnels.

Answer

Hub-and-spoke VPN

Answer

Dial-up VPN

Answer

Route-based VPN

Question 10

What is the primary purpose of the captive portal feature on a FortiGate?

Accepted Answer

To provide a web-based authentication interface for users connecting through a firewall policy. The captive portal feature on a FortiGate provides a web-based authentication interface that intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a login page. Once the user successfully authenticates (e.g., via local database, LDAP, or RADIUS), the FortiGate dynamically creates a firewall authentication entry, allowing the user's traffic to pass according to the configured firewall policy. This is the primary purpose: to enforce user-based access control through a browser-based authentication mechanism.

Answer

To monitor bandwidth usage per user

Answer

To block all traffic from unknown IP addresses

Answer

To enable SSL VPN connections

Question 11

You have a hub-and-spoke IPsec VPN with 10 spokes. The central FortiGate (hub) has 10 phase2 selectors, one for each spoke. You need to add a new spoke. What is the MOST efficient way to configure the hub?

Accepted Answer

Configure a route-based VPN and use dynamic routing protocols to advertise routes. A route-based VPN with dynamic routing (e.g., BGP or OSPF) is the most efficient approach because it eliminates the need to manually add a new phase2 selector for each new spoke. The hub can automatically learn the spoke's routes via the dynamic routing protocol, and the single phase2 selector (0.0.0.0/0) covers all traffic, simplifying configuration and scaling. This design also supports redundancy and load balancing across multiple spokes without reconfiguring the hub.

Answer

Add another phase2 selector for the new spoke

Answer

Replace all phase2 selectors with a single policy-based VPN

Answer

Use a single phase2 selector with 0.0.0.0/0.0.0.0 for all spokes

Question 12

After upgrading FortiOS, an IPsec VPN tunnel fails to come up. The diagnose output shows 'negotiation failed: no acceptable proposal'. The remote peer is a third-party device. Which step should you take first?

Accepted Answer

Check the phase1 and phase2 proposal settings on both ends to ensure they match. The 'no acceptable proposal' error indicates a mismatch in the Internet Key Exchange (IKE) parameters between the FortiGate and the remote peer. Since the remote peer is a third-party device, the most common cause is a misalignment in phase1 (IKE) or phase2 (IPsec) settings such as encryption algorithm, authentication method, Diffie-Hellman group, or lifetime. Option D is correct because verifying and aligning these proposals on both ends is the standard first step to resolve proposal mismatches.

Answer

Change the IKE version to IKEv2

Answer

Disable dead peer detection on the FortiGate

Answer

Reboot the remote peer

Question 13

An admin wants users to authenticate once via AD and have their network access controlled without repeated logins. Which feature should be used?

Accepted Answer

FSSO with Active Directory polling. FSSO with Active Directory polling allows users to authenticate once at Windows logon, and FortiGate polls the AD domain controllers to capture authentication events. This enables transparent network access control without repeated logins, as the user's identity and group memberships are mapped to firewall policies automatically.

Answer

Local user authentication

Answer

Captive portal with LDAP

Answer

SSL VPN with certificate authentication

Question 14

A FortiGate administrator is troubleshooting an SSL VPN issue where remote users cannot access internal resources after successful authentication. Which TWO steps should the admin take to resolve the issue? (Select two.)

Accepted Answer

Verify that a firewall policy exists allowing traffic from the SSL VPN interface to the internal network. After successful SSL VPN authentication, traffic from the remote user must be permitted by a firewall policy that allows traffic from the SSL VPN interface (e.g., ssl.root) to the destination internal network interface. Without this policy, packets are dropped even if authentication succeeds. Option C is correct because the FortiGate must have a route back to the SSL VPN client IP pool (or the client's virtual IP) in its routing table; if the return route is missing, the FortiGate cannot forward reply traffic to the remote user, causing asymmetric routing and connectivity failure.

Answer

Increase the authentication timeout

Answer

Restart the FortiGate

Answer

Disable the SSL VPN portal

Question 15

A company sets up a hub-and-spoke IPsec VPN where all spokes must communicate through the hub. The hub uses policy-based IPsec. Which THREE configurations are required on the hub to allow spoke-to-spoke traffic? (Select three.)

Accepted Answer

Separate phase2 selectors defining traffic between each pair of spokes. In a hub-and-spoke policy-based IPsec VPN, the hub must have separate phase2 selectors for each spoke-to-spoke traffic flow because policy-based VPNs define encryption domains per pair of subnets. Without these selectors, the hub cannot match spoke-to-spoke traffic to a specific IPsec SA, and the traffic will be dropped or sent unencrypted.

Answer

Configure IKEv2 instead of IKEv1

Answer

Enable NAT on the hub for spoke-to-spoke traffic