NSE4 Authentication and VPN Practice Test 4 — 15 Questions

Question 1

An organization wants to implement ZTNA (Zero Trust Network Access) on their FortiGate. Which TWO components are essential for ZTNA? (Select two.)

Accepted Answer

Client certificates for device posture verification. Client certificates are essential for ZTNA because they enable device posture verification, ensuring that only trusted and compliant devices can access protected resources. FortiGate uses client certificates to validate the device's identity and health status before granting access, which is a core principle of Zero Trust.

Answer

A dedicated VPN tunnel

Answer

A static IP address for the client

Answer

A RADIUS server for two-factor authentication

Question 2

An administrator wants to allow remote users to access internal resources using a web browser without installing any client software. Which VPN type should be configured on the FortiGate?

Accepted Answer

SSL VPN web mode. SSL VPN web mode (option D) is correct because it provides clientless remote access to internal resources via a web browser, requiring no software installation. The FortiGate acts as a reverse proxy, translating HTTPS requests from the user's browser to internal HTTP/HTTPS servers, which matches the requirement for browser-only access without client software.

Answer

ZTNA access proxy

Answer

IPsec VPN with dial-up mode

Answer

SSL VPN tunnel mode

Question 3

A company uses Active Directory for user authentication. They want users to automatically authenticate to the FortiGate without entering credentials when accessing the internet. Which authentication method should the administrator configure?

Accepted Answer

FSSO with Active Directory polling. FSSO (Fortinet Single Sign-On) with Active Directory polling allows users to be automatically authenticated to the FortiGate based on their existing Windows domain login. The FortiGate polls the domain controllers for user logon events, mapping the user's IP address to their authenticated identity without requiring any additional credential entry. This meets the requirement of transparent internet access authentication.

Answer

LDAP authentication with captive portal

Answer

RADIUS authentication with PAP

Answer

Local user authentication

Question 4

An administrator is troubleshooting an IPsec VPN that fails to establish. The 'diagnose vpn ike log' shows 'initial contact received'. What does this message indicate?

Accepted Answer

The remote peer has restarted and cleared its security associations. In IPsec IKE (Internet Key Exchange), an 'initial contact' notification is sent by a peer to inform the other side that it has just restarted or cleared its security associations (SAs). This message tells the receiving peer to delete any existing SAs associated with that peer, allowing a fresh IKE negotiation to begin. Therefore, the message indicates the remote peer has restarted and cleared its SAs, not a configuration or NAT issue.

Answer

The pre-shared key is incorrect

Answer

The Phase 1 proposal is mismatched

Answer

A network address translation device is altering the IKE packets

Question 5

An administrator needs to configure a site-to-site IPsec VPN where both sites have dynamic public IP addresses. Which IKE mode should be used?

Accepted Answer

Aggressive mode. When both ends of a site-to-site IPsec VPN have dynamic public IP addresses, Aggressive mode (IKEv1) is required because it allows the VPN peers to exchange identities and authentication information in fewer packets, enabling the VPN to be established without knowing the peer's IP address in advance. Unlike Main mode, Aggressive mode does not require the responder to have a pre-configured IP address for the initiator, making it suitable for dynamic IP scenarios.

Answer

IKEv2 without mode

Answer

Dial-up mode

Answer

Main mode

Question 6

An administrator is configuring ZTNA on a FortiGate. The goal is to allow access to an internal web server only if the client device has a specific security posture (e.g., antivirus running). Which ZTNA component is responsible for verifying the client's security posture?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) is the ZTNA component that verifies the client's security posture by collecting endpoint telemetry (e.g., antivirus status, OS patch level) and enforcing compliance policies. The FortiGate queries FortiClient EMS via the FortiTelemetry protocol to determine if the client meets the required security posture before granting access. Without EMS, the FortiGate has no mechanism to assess endpoint health in a ZTNA flow.

Answer

ZTNA access proxy

Answer

IPsec VPN interface

Answer

SSL VPN portal

Question 7

An administrator has configured LDAP authentication on a FortiGate. When testing the LDAP connectivity, the test succeeds. However, users cannot authenticate through the captive portal. What is a possible cause?

Accepted Answer

The user group is not configured to use the LDAP server. The LDAP connectivity test succeeds, confirming the FortiGate can reach and bind to the LDAP server. However, for captive portal authentication to work, the user group must be explicitly configured to reference the LDAP server as its remote authentication source. Without this mapping, the FortiGate does not know to send authentication requests to the LDAP server, even though the LDAP server connection itself is functional.

Answer

The captive portal is disabled

Answer

The LDAP server is not reachable from the captive portal interface

Answer

The LDAP server's SSL certificate is expired

Question 8

An administrator is troubleshooting an IPsec VPN that is not passing traffic. The Phase 1 and Phase 2 are both up. Which TWO CLI commands can be used to verify the VPN tunnel status and traffic flow? (Choose two.)

Accepted Answer

diagnose vpn tunnel list. 'diagnose vpn tunnel list' displays the status of all IPsec VPN tunnels, including Phase 1 and Phase 2 security associations (SAs), their uptime, and the number of packets transmitted and received. This allows the administrator to verify that the tunnel is established and to check for any packet drops or errors that might indicate a traffic flow issue.

Answer

execute ping-options source

Answer

diagnose vpn ike config

Answer

diagnose netlink interface list

Question 9

An administrator wants to configure two-factor authentication for SSL VPN users. Which TWO components must be configured? (Choose two.)

Accepted Answer

SSL VPN portal configured with 'require two-factor authentication'. The SSL VPN portal must have 'require two-factor authentication' enabled to enforce that users provide both a primary password and a second factor (e.g., a FortiToken code) before gaining access. This setting ensures the FortiGate prompts for the token code during the SSL VPN login process.

Answer

Captive portal enabled

Answer

RADIUS server configured for one-time passwords

Answer

IPsec Phase 1 authentication set to 'signature'

Question 10

You run the following command on a FortiGate: diagnose vpn ike gateway list. The output shows a gateway with state=DOWN. What is the most likely cause?

Accepted Answer

The remote peer is not reachable or is blocking IKE traffic. The `state=DOWN` in the `diagnose vpn ike gateway list` output indicates that the IKE Phase 1 (main mode or aggressive mode) negotiation has failed or never completed. The most common cause is that the remote peer is unreachable (e.g., due to network issues, firewall rules blocking UDP ports 500/4500, or incorrect peer IP configuration) or that the remote peer is actively blocking IKE traffic, preventing the initial exchange of IKE SA proposals.

Answer

The pre-shared key is correct but expired

Answer

The IPsec Phase 2 parameters are mismatched

Answer

The local certificate is not trusted by the remote peer

Question 11

A FortiGate is configured with IPsec VPN using IKEv2 and a policy-based tunnel. The remote subnet is 10.0.2.0/24, and the local subnet is 192.168.1.0/24. The tunnel is up, but traffic from 192.168.1.0/24 to 10.0.2.0/24 fails. The administrator checks the firewall policy and sees a policy allowing traffic from the local interface (port1) to the remote interface (virtual ipsec interface) with the action set to IPSEC. What is the most likely missing configuration?

Accepted Answer

The firewall policy's source or destination addresses are not correctly set to the local and remote subnets. In a policy-based IPsec VPN on FortiGate, the firewall policy must explicitly specify the local and remote subnets as the source and destination addresses. Even if the tunnel is up, traffic will fail if the policy's source/destination address objects do not match the actual subnets (192.168.1.0/24 and 10.0.2.0/24). The action set to IPSEC only enables VPN encapsulation; it does not override incorrect address matching.

Answer

IKEv2 does not support policy-based VPNs

Answer

The tunnel interface is not assigned to the correct VDOM

Answer

The Phase 2 proposal does not match the remote subnet

Question 12

What is the primary function of Fortinet Single Sign-On (FSSO) in a FortiGate deployment?

Accepted Answer

To collect user login events from Active Directory for user-based policies. Fortinet Single Sign-On (FSSO) is designed to collect user login events from Active Directory (AD) domain controllers. It monitors authentication traffic (e.g., via NetAPI or polling the AD security event log) to map IP addresses to usernames, enabling FortiGate to enforce user-based firewall policies without requiring users to manually authenticate to the firewall.

Answer

To provide two-factor authentication using FortiToken

Answer

To sync FortiGate configuration with Active Directory

Answer

To authenticate users against a RADIUS server

Question 13

An administrator configures a dial-up IPsec VPN with IKEv1 main mode. Remote clients can connect successfully, but the administrator notices that the Phase 1 negotiation takes a long time. Which change would most improve the negotiation speed without compromising security?

Accepted Answer

Enable IKEv2 instead of IKEv1. IKEv2 reduces Phase 1 negotiation time by using a single exchange of two messages (request/response) instead of IKEv1 main mode's six messages. This eliminates the extra round trips required for identity protection and SA negotiation, speeding up the process without reducing security. The question specifies IKEv1 main mode, so switching to IKEv2 directly addresses the slow negotiation while maintaining strong cryptographic protections.

Answer

Switch from main mode to aggressive mode

Answer

Reduce the IKE SA lifetime

Answer

Increase the number of Phase 1 proposals

Question 14

A captive portal is configured on a FortiGate to authenticate users before allowing internet access. Users report that after entering credentials, they are redirected to the original website, but then they cannot access other sites. What is the most likely issue?

Accepted Answer

The user is not a member of the required user group specified in the firewall policy. After authentication, the FortiGate must allow the user's traffic based on the firewall policy. If the policy uses the authenticated user group but the user is not in any group, traffic is blocked. Additionally, the captive portal policy must be separate from the internet access policy.

Answer

The captive portal is using a self-signed certificate causing browser warnings

Answer

The DNS server is not configured on the FortiGate

Answer

The session timeout is set too low

Question 15

You run 'diagnose debug application sslvpn -1' and see the following output:
sslvpn: SSL VPN tunnel mode connection from 10.0.0.5:12345 to 192.168.1.100:443
sslvpn: User 'john' authenticated successfully
sslvpn: Error: no matching policy for the request. What does this indicate?

Accepted Answer

There is no SSL VPN policy that allows the user to access the destination IP/port. The error 'no matching policy for the request' indicates that the SSL VPN tunnel mode connection from user 'john' (source IP 10.0.0.5) to destination 192.168.1.100:443 did not match any SSL VPN policy configured on the FortiGate. SSL VPN policies define which users or user groups can access specific destination IP addresses and ports. Since authentication succeeded but no policy matched, the connection is denied at the policy layer, not due to authentication or interface issues.

Answer

The user's password has expired

Answer

The SSL VPN interface is administratively down

Answer

The FortiGate is not licensed for SSL VPN