NSE4 Authentication and VPN Practice Test 3 — 15 Questions

Question 1

A network administrator wants to implement two-factor authentication for SSL VPN users using FortiToken. The users are already authenticated against an LDAP server. Which configuration step is required to enforce two-factor authentication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a user group that uses LDAP as the authentication server and enable FortiToken two-factor authentication in the group settings. FortiGate requires a user group to combine LDAP authentication with FortiToken two-factor authentication. By creating a user group that uses LDAP as the authentication server and enabling FortiToken in the group settings, the FortiGate will first authenticate the user against LDAP and then prompt for a FortiToken code as the second factor. This is the standard method to enforce two-factor authentication for SSL VPN users without creating duplicate local users.

Answer

Create a local user with the same username as the LDAP user and assign a FortiToken to that local user

Answer

Configure the SSL VPN portal to require FortiToken and set the authentication server to LDAP

Answer

Set the SSL VPN authentication method to 'certificate' and use FortiToken as second factor

Question 2

You run the CLI command 'diagnose vpn ike gateway list' and see that an IPsec VPN gateway is in 'up' state with 'initiator' mode, but no Phase 2 selectors are established. What is the most likely cause?

Accepted Answer

The local and remote Phase 2 selectors (proxy IDs) do not match. When an IPsec VPN gateway is in 'up' state with 'initiator' mode but no Phase 2 selectors are established, it indicates that IKE Phase 1 (main mode or aggressive mode) has completed successfully, but Phase 2 (quick mode) negotiation has failed. The most common cause for Phase 2 failure is a mismatch in the Phase 2 selectors (proxy IDs), which define the local and remote subnets to be encrypted. FortiGate uses these selectors to match traffic and establish the IPsec SA; if they do not align between peers, the Phase 2 negotiation will not complete.

Answer

The Phase 2 proposal parameters (encryption, authentication) do not match between peers

Answer

The remote gateway is not responding to IKE packets

Answer

The IPsec interface is down

Question 3

A FortiGate administrator is configuring IPsec VPN between two sites. The Phase 1 negotiation fails with the error 'no proposal chosen'. Which two settings must match on both VPN peers?

Accepted Answer

Encryption algorithm and authentication algorithm. The 'no proposal chosen' error during IPsec Phase 1 negotiation indicates that the two VPN peers cannot agree on a common set of security parameters for the IKE (Internet Key Exchange) SA. The encryption algorithm (e.g., AES-256, 3DES) and authentication algorithm (e.g., SHA-256, MD5) are mandatory components of the Phase 1 proposal; if they do not match on both peers, the IKE negotiation fails immediately.

Answer

Pre-shared key and local ID

Answer

Dead peer detection interval and retry count

Answer

Remote gateway IP and Phase 2 selectors

Question 4

An administrator configures FSSO (Fortinet Single Sign-On) with Active Directory polling. Users report that their web traffic is being blocked by the firewall even though they are logged into the domain. Which CLI command can the administrator use to verify the FSSO login status for a specific user?

Accepted Answer

diagnose debug authd fsso list. The command 'diagnose debug authd fsso list' displays the current FSSO login status for all users, including the Fortinet Single Sign-On (FSSO) session information such as username, IP address, and group membership. This command queries the authentication daemon (authd) which maintains the FSSO user database, allowing the administrator to verify if a specific user is authenticated and which firewall policies apply. It directly addresses the scenario where users are logged into the domain but web traffic is blocked, as it confirms whether the FSSO polling has successfully registered the user's login.

Answer

diagnose user fsso poll user <username>

Answer

diagnose wad user list

Answer

diagnose test authserver ldap

Question 5

Which IPsec VPN mode is typically used when the VPN peer has a dynamic public IP address?

Accepted Answer

Aggressive mode. Aggressive mode is used in IPsec IKE phase 1 when the VPN peer has a dynamic public IP address because it allows the initiator to send its identity and authentication data in the first packet, enabling the responder to identify the peer without requiring a reverse DNS lookup or static IP. This mode reduces the number of exchanges from six (Main mode) to three, which is essential when the peer's IP address is not known in advance, as in many remote-access or dynamic-IP site-to-site scenarios.

Answer

Quick mode

Answer

IKEv2

Answer

Main mode

Question 6

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The Phase 1 status shows 'down'. Which TWO commands can help diagnose the issue? (Choose TWO.)

Accepted Answer

diagnose debug application ike -1. Option C, `diagnose debug application ike -1`, is correct because it enables verbose real-time debugging of the IKE (Internet Key Exchange) daemon, which is exactly the process responsible for negotiating Phase 1 (IKE SA) and will reveal why the negotiation is failing. Option E, `diagnose vpn ike log-filter`, is correct because it configures the log filter that scopes the IKE debug output to the relevant remote gateway or interface, making the Phase 1 troubleshooting output usable rather than flooded with unrelated IKE events. Options A and D are not appropriate here: `diagnose npu np6 ipsec-sa list` inspects hardware-accelerated IPsec SAs on NP6 processors, which only exist after Phase 2 succeeds, and `diagnose vpn tunnel list` shows established tunnel/SA state rather than the Phase 1 negotiation failure. Option B, `diagnose sys session clear`, merely flushes the session table and does not provide any diagnostic information about IKE Phase 1.

Answer

diagnose npu np6 ipsec-sa list

Answer

diagnose sys session clear

Answer

diagnose vpn tunnel list

Question 7

An administrator needs to deploy two-factor authentication for SSL VPN users. The company uses FortiTokens. Which two steps are required to enable FortiToken for SSL VPN users? (Choose two.)

Accepted Answer

Configure two-factor authentication on the SSL VPN portal to require token code. FortiToken requires the user account to be associated with a FortiToken serial number, and the authentication method must be set to require token code along with password.

Answer

Install the FortiToken mobile app on the administrator's phone

Answer

Change the SSL VPN authentication scheme to RADIUS

Question 8

A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)

Accepted Answer

Diffie-Hellman group mismatch (e.g., group 2 vs group 14). The error 'No proposal chosen' means the two peers could not agree on a Phase 1 (IKE SA) proposal, which is built from encryption, authentication/hash, and Diffie-Hellman group parameters. Option A is correct because the DH group (e.g., group 2 vs group 14) is part of the Phase 1 proposal, and mismatched groups prevent the peers from agreeing on key exchange. Option D is correct because the authentication/hash algorithm (e.g., SHA1 vs SHA256) is a proposal attribute, so differing hashes cause the proposal to be rejected. Option E is correct because the encryption algorithm (e.g., AES128 vs AES256) is also a Phase 1 proposal attribute, and a mismatch means no common proposal exists. Option B is not part of the proposal negotiation; a PSK mismatch instead produces an authentication failure such as 'PSK authentication failed' or 'no matching gateway', not 'No proposal chosen'. Option C is also not a proposal-selection cause, since Phase 1 lifetime is negotiated separately and a lifetime difference does not prevent the IKE SA from being established.

Answer

Pre-shared key mismatch

Answer

Lifetime mismatch (e.g., 86400 vs 3600)

Question 9

A network administrator configures an IPsec VPN between two FortiGates using IKEv1 main mode. The Phase 1 negotiation fails with the error 'no proposal chosen'. The administrator checks both sides and confirms the IKE version, encryption algorithm (AES256), authentication (SHA256), and Diffie-Hellman group (14) match. Which additional parameter is MOST likely mismatched?

Accepted Answer

Local and remote identifiers (local ID / remote ID). In IKEv1 main mode, the Phase 1 negotiation includes an exchange of identity (ID) payloads after the Diffie-Hellman exchange. If the local or remote identifiers (local ID / remote ID) do not match what is expected on the peer, the FortiGate will reject the proposal with a 'no proposal chosen' error, even if all other Phase 1 parameters (encryption, authentication, DH group, IKE version) are identical. The pre-shared key is verified later in Phase 1 (during authentication), so a mismatch there would cause a different error (e.g., 'authentication failed'), not 'no proposal chosen'.

Answer

Pre-shared key

Answer

IKE version (IKEv2)

Answer

Phase 2 encryption algorithm

Question 10

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 supports MOBIKE to handle IP address changes. IKEv2's primary advantage over IKEv1 is its support for MOBIKE (Mobility and Multihoming, RFC 4555), which allows an IPsec VPN tunnel to survive IP address changes without re-establishing the entire security association. This is critical for mobile users who switch between networks (e.g., from Wi-Fi to cellular) or for failover scenarios where the public IP changes. IKEv1 lacks this capability and would require a full rekey, causing session disruption.

Answer

IKEv2 requires less CPU resources

Answer

IKEv2 provides built-in NAT traversal

Answer

IKEv2 supports only certificate authentication

Question 11

A FortiGate is configured for SSL VPN tunnel mode with split tunneling enabled. The administrator wants to ensure that traffic to the corporate DNS server (10.0.1.10) goes through the tunnel while all other traffic goes directly to the internet. Which THREE configuration steps are required?

Accepted Answer

Add the DNS server subnet (10.0.1.0/24) to the split tunneling destinations. Option D is correct because split tunneling must first be enabled in the SSL VPN portal configuration (config vpn ssl web portal, then set split-tunneling enable) for any routing decisions to be applied to the tunnel clients. Option A is correct because the corporate DNS server's subnet (10.0.1.0/24) must be listed in the split-tunneling routing destinations so the FortiGate pushes a route for that subnet to the client, forcing 10.0.1.10 through the tunnel. Option C is correct because the DNS server IP must also be specified in the SSL VPN settings as a split-tunneling destination (or included in the routing address list) so the client's DNS queries to 10.0.1.10 are routed via the tunnel rather than the local internet path. Option B is not required because NAT on the tunnel interface is unrelated to split-tunnel routing decisions and is not a prerequisite for directing specific subnets through the tunnel. Option E is not required because the FortiGate pushes the split-tunnel routes to the client automatically; manually adding a static route on the client is unnecessary and not part of the FortiGate configuration.

Answer

Disable NAT on the tunnel interface

Answer

Configure a static route on the client for 10.0.1.0/24 via the virtual adapter

Question 12

A company requires two-factor authentication for SSL VPN access. They already have an LDAP server for user credentials. Which TWO components are necessary to implement this?

Accepted Answer

FortiToken hardware or mobile tokens. Option B (FortiToken hardware or mobile tokens) is correct because two-factor authentication requires a second factor beyond the user's password, and FortiToken provides the one-time password (OTP) token that supplies that second factor for SSL VPN logins. Option E (LDAP server) is correct because the company already stores user credentials there, and the FortiGate must query the LDAP server as the primary authentication source to validate the username and password before prompting for the token OTP. Together, the LDAP server supplies the first factor (password) and FortiToken supplies the second factor (OTP), satisfying the two-factor requirement. Option A (FortiAuthenticator) is not strictly necessary since FortiToken can be validated directly by the FortiGate without a separate FortiAuthenticator appliance. Option C (RADIUS server) is not required because LDAP already serves as the credential store and RADIUS is only an alternative authentication protocol, not a mandatory component. Option D (Certificate Authority) is not required because certificate-based authentication is a different method and is not needed to implement token-based two-factor authentication.

Answer

FortiAuthenticator

Answer

RADIUS server

Answer

Certificate Authority (CA)

Question 13

An administrator is configuring a hub-and-spoke IPsec VPN with a FortiGate as the hub. The spokes must be able to communicate with each other through the hub. Which THREE settings must be enabled on the hub FortiGate?

Accepted Answer

Enable 'arp-response' on the phase1 interface. Option A is correct because enabling 'arp-response' on the hub's phase1 interface allows the hub to answer ARP requests on behalf of the remote spoke subnets, which is required for spoke-to-spoke traffic when the spokes' subnets are reachable through the same hub interface. Option B is correct because the hub must have static routes pointing to each spoke's local subnet via the corresponding IPsec tunnel interface so that traffic destined for one spoke can be forwarded out the correct tunnel. Option E is correct because enabling 'add-route' on each phase1 interface causes the FortiGate to automatically install a route to the remote protected subnet when the tunnel comes up, which is necessary for the hub to know how to reach the spoke networks. Option C is incorrect because 'mode-cfg' is used to assign virtual IP addresses to dial-up clients and is not required for spoke-to-spoke communication in a hub-and-spoke topology. Option D is incorrect because 'auto-discovery-sender' is used for ADVPN shortcut discovery, not for basic hub-and-spoke IPsec connectivity between spokes.

Answer

Set 'mode-cfg' to enable on the hub phase1

Answer

Enable 'auto-discovery-sender' on the hub

Question 14

An administrator is troubleshooting an SSL VPN connection. Users can connect and authenticate, but they cannot access any internal resources. The firewall policy allows the SSL VPN interface to the internal network. Which THREE commands or configuration checks should the administrator use to diagnose the issue?

Accepted Answer

'get router info routing-table all' to verify routes. Option B is correct because 'get router info routing-table all' verifies that the FortiGate has a valid route to the internal subnet; if no route exists, SSL VPN users authenticate but traffic cannot be forwarded to internal resources. Option D is correct because 'diagnose firewall policy list' confirms which firewall policy is actually matching the SSL VPN traffic, exposing issues such as policy ordering, wrong incoming interface (ssl.root), or missing services that would silently drop the traffic despite the apparent policy. Option E is correct because 'diagnose vpn ssl list' shows active SSL VPN sessions and their assigned tunnel IPs, confirming whether the user's session is established and which source address the firewall policy must match. Option A is not among the marked answers because 'execute ping from ssl.root' is not a valid FortiOS command syntax for sourcing a ping from the SSL VPN interface. Option C is not among the marked answers because 'diagnose debug application sslvpn -1' only debugs the SSL VPN daemon's connection/authentication handling, which is already working, and does not diagnose internal resource reachability.

Answer

'execute ping from ssl.root to internal IP'

Answer

'diagnose debug application sslvpn -1' to enable debug logging

Question 15

An administrator is configuring a FortiGate as a dial-up IPsec VPN server for remote users. The users will connect from various public IP addresses and use FortiClient. The administrator wants to ensure that only specific users can connect and that their assigned IP addresses are from a dedicated pool. Which two Phase 1 configuration settings are required to achieve this? (Choose two.)

Accepted Answer

Enable 'XAuth' and configure an authentication server.. To allow multiple remote users with dynamic IPs to connect, the Remote Gateway must be set to 'Dialup User'. To restrict access to specific users, XAuth must be enabled with an authentication server. Together, these settings ensure that only authenticated users can establish the VPN and that the FortiGate accepts connections from any public IP. IP pool assignment is handled in Phase 2, not Phase 1, but the question asks for Phase 1 settings.

Answer

Set the 'Mode' to 'Aggressive'.

Answer

Set the 'Mode' to 'Main' and enable 'NAT Traversal'.

Answer

Configure a 'Pre-shared Key' and enable 'Auto Key' (IKE).