NSE4 Authentication and VPN Practice Test 3 — 15 Questions

Question 1

A FortiGate administrator wants to authenticate VPN users against an existing LDAP server. The administrator creates an LDAP user group on the FortiGate. What additional configuration is REQUIRED to use this group for IPsec VPN authentication?

Accepted Answer

In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication. Option B is correct. The user group must be referenced in the IPsec Phase 1 authentication settings, specifically under 'Peer Options' or 'User Authentication' (depending on FortiOS version). Typically, this is done by setting 'xauthtype' to 'auto' or 'psk' and selecting the user group under 'usrgrp'.

Answer

Enable LDAP over TLS (LDAPS) on the FortiGate

Answer

Assign the LDAP user group to a firewall policy

Answer

Configure a RADIUS server as an intermediate proxy between FortiGate and LDAP

Question 2

An administrator receives a report that some users cannot authenticate via captive portal on a FortiGate. The captive portal is configured for firewall authentication. The administrator checks the authentication logs and sees 'Authentication failed: invalid credentials'. However, the users confirm they are entering the correct username and password. What is the MOST likely cause?

Accepted Answer

The users are not including the domain name in the username field. Option C is correct. If the users are in a domain, the FortiGate expects the username in the format 'domain\username' or 'username@domain.com'. Entering just the username without the domain will cause authentication failure.

Answer

The captive portal interface is not configured with a valid certificate

Answer

The FortiGate's clock is out of sync with the LDAP server

Answer

The LDAP server is not reachable from the FortiGate

Question 3

A FortiGate administrator is configuring an SSL VPN web mode portal. The administrator wants users to access only a specific internal web application (https://internal-app.company.local) and nothing else. Which SSL VPN setting should be configured to achieve this?

Accepted Answer

Under the SSL VPN portal, configure 'URL Access' to allow only https://internal-app.company.local. Option D is correct. In web mode, 'URL Access' allows the administrator to specify which URLs users can access. By adding only the desired application URL, the administrator restricts access to that application only.

Answer

In the SSL VPN portal, set the default bookmark to the application URL

Answer

Configure a firewall policy that allows traffic only to the application's IP address

Answer

Enable split tunneling under the SSL VPN settings

Question 4

A FortiGate administrator is configuring a route-based IPsec VPN between two FortiGate devices. After setting up the tunnel and firewall policies, traffic does not flow. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. 'get router info routing-table all' shows routes on both sides. However, pings from the local network to the remote network fail. What is the MOST likely cause?

Accepted Answer

The firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. Option A is correct. For route-based VPN, traffic must be allowed by the policy that has the VPN interface as the destination interface. If the policy's source and destination are reversed (e.g., source internal, destination internal instead of source internal, destination VPN), traffic will be dropped.

Answer

The pre-shared key is incorrect

Answer

The remote FortiGate's static route points to the wrong local subnet

Answer

The Phase 2 proposal uses different encryption algorithms on each side

Question 5

Which authentication method allows a FortiGate to transparently authenticate users based on their Active Directory login events without prompting for credentials?

Accepted Answer

FSSO (Fortinet Single Sign-On). Option B is correct. Fortinet Single Sign-On (FSSO) captures AD login events (via polling or agent) and maps them to users on the FortiGate, enabling transparent authentication for firewall policies.

Answer

RADIUS authentication

Answer

Local database authentication

Answer

LDAP authentication

Question 6

A FortiGate admin is troubleshooting an IPsec VPN tunnel that fails to establish. The remote site uses aggressive mode. The local FortiGate is configured for main mode. The admin sees 'no proposal chosen' in the IKE debug. What is the MOST likely cause?

Accepted Answer

The IKE mode (main vs aggressive) does not match between peers. Option D is correct. IKE mode (main vs aggressive) must match between peers. If one side uses main mode and the other aggressive mode, Phase 1 will fail with 'no proposal chosen' because the IKE exchange format differs.

Answer

The pre-shared key is incorrect

Answer

The local firewall is blocking UDP port 500

Answer

The Phase 2 encryption algorithm is not supported

Question 7

A FortiGate administrator wants to enforce two-factor authentication for SSL VPN users. The organization uses FortiToken mobile tokens. What must be configured on the FortiGate to enable FortiToken authentication?

Accepted Answer

In the user group configuration, enable two-factor authentication and select 'FortiToken'. Option A is correct. FortiToken requires that two-factor authentication is enabled for the user group. This is typically done by setting the 'two-factor' option to 'fortitoken' in the user group configuration or in the authentication rule.

Answer

Configure a RADIUS server to forward FortiToken requests

Answer

Set the SSL VPN portal to require client certificates

Answer

Install the FortiToken mobile app on the FortiGate

Question 8

A FortiGate administrator is configuring ZTNA to secure access to an internal application. The administrator creates a ZTNA access proxy and a ZTNA rule. However, users connecting from the internet receive a 403 Forbidden error. The administrator verifies that the users are authenticated and the application is reachable. What is the MOST likely cause?

Accepted Answer

The ZTNA rule requires a specific client posture tag that the users' devices do not have. Option B is correct. ZTNA rules evaluate the client's posture (e.g., antivirus, OS patch level). If the client does not meet the required posture tags, the connection is denied with a 403 error.

Answer

The firewall policy allowing traffic to the application is placed after a deny-all policy

Answer

The application's IP address is not included in the ZTNA access proxy's destination

Answer

The ZTNA access proxy does not have a valid SSL certificate

Question 9

An administrator runs 'diagnose debug application fnbamd -1' on a FortiGate to troubleshoot authentication issues. The output shows that the FortiGate successfully contacts the LDAP server but the user authentication fails. What does this indicate?

Accepted Answer

The user's password is incorrect or the user account is locked. Option D is correct. The debug output shows successful communication with the LDAP server, meaning the bind user has proper privileges. The authentication failure indicates that the user's credentials are incorrect or the user does not exist in the LDAP database.

Answer

The LDAP server is unreachable

Answer

The LDAP bind user password is incorrect

Answer

The LDAP schema does not match what FortiGate expects

Question 10

A FortiGate admin is configuring a hub-and-spoke IPsec VPN. The hub has multiple phase 2 configurations for each spoke. The spokes can communicate with the hub but not with each other. The admin wants to allow spoke-to-spoke traffic through the hub. Which configuration change is required on the hub?

Accepted Answer

Modify the Phase 2 selectors on the hub to include both spoke subnets and add firewall policies allowing traffic between the spoke networks. Option C is correct. For spoke-to-spoke traffic to pass through the hub, the hub must have firewall policies allowing traffic between the spoke networks, and the Phase 2 selectors on the hub must include both spoke subnets (or use 0.0.0.0/0 to allow all traffic).

Answer

Change the IPsec mode from policy-based to route-based

Answer

Enable 'add-route' on the hub's Phase 1 settings

Answer

Configure a static route on each spoke pointing to the other spoke's subnet via the tunnel

Question 11

A FortiGate administrator is configuring an SSL VPN tunnel mode for remote users. The administrator wants to ensure that only traffic destined for the corporate network (192.168.1.0/24) goes through the VPN, and all other traffic (e.g., internet) goes directly from the user's device. Which TWO configuration steps are required?

Accepted Answer

Configure the SSL VPN portal to push routes for 192.168.1.0/24 to the client. Options B and C are correct. Split tunneling must be enabled to allow direct internet access. Additionally, the routing rules (or destination routes) must specify that only the corporate subnet is routed through the VPN tunnel.

Answer

Set the SSL VPN portal's 'tunnel mode' to 'web-only'

Answer

Disable 'tunnel mode' and use 'web mode' instead

Answer

Create a firewall policy on the FortiGate allowing traffic from the SSL VPN interface to the corporate network

Question 12

A FortiGate administrator is troubleshooting an IPsec VPN between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees the following output:
IKE: phase 2 negotiation completed
IKE: IPsec SA up
What THREE possible causes should the administrator investigate?

Accepted Answer

Firewall policies on either FortiGate are not allowing traffic between the local and remote subnets. Options A, C, and E are correct. The tunnel is up, so Phase 1 and Phase 2 are fine. Common causes for traffic not passing include incorrect firewall policies, routing issues, or NAT traversal problems if traffic is being NATed before hitting the tunnel.

Answer

The pre-shared key is incorrect

Answer

The IKE mode is set to aggressive mode on one side and main mode on the other

Question 13

A FortiGate administrator is configuring FSSO to authenticate users transparently. The FSSO collector agent is installed on a Windows server in the domain. Which TWO requirements must be met for FSSO to work correctly?

Accepted Answer

The FortiGate must be able to reach the FSSO collector agent on TCP port 8000 (or the configured port). Options A and C are correct. The FortiGate must be able to communicate with the collector agent, and the collector agent must have access to Active Directory to monitor login events. Additionally, the FortiGate's firewall policies must use user groups based on FSSO authentication.

Answer

The FortiGate must be a member of the Active Directory domain

Answer

The users must authenticate via captive portal at least once

Answer

The firewall policies must use FSSO groups directly without any user objects

Question 14

You are troubleshooting an IPsec VPN between two FortiGates. The Phase 1 is up, but Phase 2 is not coming up. You check the Phase 2 configuration on both sides. What is a common cause of this issue?

Accepted Answer

Mismatch in Phase 2 settings such as encryption algorithm, authentication algorithm, or PFS group. Phase 2 parameters must match exactly. If there is a mismatch in encryption, authentication, or PFS settings, Phase 2 will fail. Option A is the most common cause.

Answer

Firewall policy not allowing ESP traffic

Answer

Incorrect local or remote gateway IP

Answer

Mismatch in Phase 1 pre-shared key

Question 15

A FortiGate administrator wants to configure a captive portal to authenticate users before granting network access. Which authentication method is used by the captive portal?

Accepted Answer

Form-based authentication. Captive portal uses form-based authentication where users enter credentials in a web page. It does not use NTLM or machine authentication by default.

Answer

IPsec pre-shared key authentication

Answer

X.509 certificate authentication

Answer

NTLM authentication