NSE4 Authentication and VPN Practice Test 4 — 15 Questions

Question 1

A FortiGate administrator runs 'diagnose vpn tunnel list' and sees the following output for an IPsec tunnel: 'status: up', 'incoming: 0 packets', 'outgoing: 100 packets'. Phase 1 and Phase 2 both show state 'up'. What is the MOST likely cause of zero incoming packets?

Accepted Answer

The Phase 2 proposal includes a mismatched proxy ID. If outgoing packets are being sent but no incoming packets, the remote side may have a misconfiguration such as a wrong remote subnet in Phase 2 or a firewall policy blocking return traffic.

Answer

The remote gateway is using aggressive mode

Answer

The FortiGate has a static route pointing to the VPN interface

Answer

The VPN is configured in policy-based mode

Question 2

A FortiGate admin has configured FSSO (Fortinet Single Sign-On) using Active Directory polling. Users authenticate to the domain but when accessing the internet through the FortiGate, they are still prompted for credentials. What is the MOST likely cause?

Accepted Answer

The FortiGate is not polling the AD domain controllers. FSSO polling requires the FortiGate to monitor domain controller logs. If polling is not working, users won't be detected and will be prompted.

Answer

The users are using non-Windows machines

Answer

The firewall policy does not have FSSO authentication enabled

Answer

The FortiGate is not joined to the domain

Question 3

Which authentication server type can be used with FortiGate to authenticate remote VPN users with two-factor authentication using FortiTokens?

Accepted Answer

RADIUS. FortiToken two-factor authentication can be used with local users or with remote authentication servers like RADIUS. However, FortiToken is natively supported by FortiGate local users and can also be used with RADIUS if the FortiGate acts as the RADIUS client forwarding tokens.

Answer

POP3

Answer

LDAP

Answer

TACACS+

Question 4

An admin is configuring a dial-up IPsec VPN for remote users. The users will connect from various public IP addresses. Which Phase 1 configuration is required for the FortiGate to accept connections from unknown remote gateways?

Accepted Answer

Set the remote gateway to 0.0.0.0. The remote gateway IP must be set to 0.0.0.0 to accept connections from any IP address, which is typical for dial-up VPN.

Answer

Enable aggressive mode

Answer

Configure a static route to the remote users' subnet

Answer

Set the remote gateway to a specific IP address

Question 5

You run 'diagnose debug application ike -1' and see the following output: 'Initiator: no acceptable proposal'. What is the MOST likely cause of this error?

Accepted Answer

The Phase 1 encryption or hash algorithm is mismatched. The 'no acceptable proposal' error indicates that the IKE proposal sent by the initiator does not match any proposal configured on the responder. This is a Phase 1 mismatch.

Answer

The pre-shared key is incorrect

Answer

The remote gateway is not reachable

Answer

The firewall policy is blocking UDP port 500

Question 6

In Fortinet ZTNA, what is the primary purpose of the ZTNA access proxy component?

Accepted Answer

To proxy connections to internal applications after authentication and device verification. The ZTNA access proxy resides on the FortiGate and proxies connections to internal applications after verifying the user's identity and device posture.

Answer

To act as a forward proxy for web traffic

Answer

To provide load balancing for multiple FortiGates

Answer

To terminate IPsec VPN tunnels

Question 7

An admin needs to configure an SSL VPN for remote users that only provides access to specific internal applications, not full network access. What feature should be configured?

Accepted Answer

Split tunneling. Split tunneling with specific routes ensures only traffic destined for internal applications goes through the VPN, and all other traffic goes directly to the internet.

Answer

Full tunneling

Answer

Client certificate authentication

Answer

Web mode portal

Question 8

A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?

Accepted Answer

Enable 'add-route' on the hub Phase 2. In hub-and-spoke, the hub needs Phase 2 selectors that cover the spoke subnets, and the spokes need static routes pointing to the hub for other spoke subnets. Additionally, enabling 'add-route' on the hub can help, but the key is proper Phase 2 configuration.

Answer

Set the hub as the default gateway on each spoke

Answer

Use policy-based VPN instead of route-based

Answer

Configure NAT on the hub

Question 9

An administrator configures an LDAP user group for firewall authentication. Users are able to authenticate, but the FortiGate does not retrieve group membership information. What is likely misconfigured?

Accepted Answer

The LDAP bind account does not have permission to read group attributes. The LDAP server must be configured with the correct bind credentials and search filter to retrieve group memberships. The 'cn' or 'member' attribute mapping is also critical.

Answer

The LDAP server's IP address is incorrect

Answer

SSL is not enabled for LDAP

Answer

The FortiGate is not joined to the domain

Question 10

You are configuring a route-based IPsec VPN with BGP over the tunnel. After Phase 2 is up, the BGP session does not establish. You run 'diagnose debug ipsec' and see no errors. What should you check next?

Accepted Answer

Ensure the tunnel interface is added to the BGP neighbor configuration. In route-based VPN, the tunnel interface must be included in the BGP configuration as a neighbor update source or the BGP update must be allowed in the firewall policy.

Answer

Disable anti-replay on the tunnel

Answer

Enable NAT traversal

Answer

Check the Phase 1 proposal

Question 11

An administrator is troubleshooting an SSL VPN connection. Users can connect but cannot access internal resources. Which TWO commands would help diagnose the issue?

Accepted Answer

get router info routing-table. Option A checks the SSL VPN session, and option D checks routing for the tunnel interface. Option B is for IPsec, option C is for DNS, and option E is for general routing but not specific to SSL VPN.

Answer

diagnose vpn ike status

Answer

execute ping 8.8.8.8

Answer

diagnose debug application dnsproxy

Question 12

A FortiGate is configured with FSSO and Active Directory polling. Users report that they are frequently prompted for authentication even though they are logged into the domain. Which THREE possible causes should the administrator investigate?

Accepted Answer

The user's IP address has changed and the FortiGate still has a stale mapping. Polling issues (A), logon event not sent (B), and stale IP mapping (C) are common causes. Option D is about FortiToken, which is not relevant to FSSO. Option E is for captive portal, not FSSO.

Answer

The FortiToken server is overloaded

Answer

The captive portal is enabled on the policy

Question 13

A network admin is configuring a hub-and-spoke VPN with three spokes. Which TWO statements are correct about route-based VPN in this topology?

Accepted Answer

Each spoke must have a route-based VPN interface configured to the hub. Option A is correct: each spoke needs a route-based tunnel to the hub. Option D is correct: BGP can be used for dynamic routing. Option B is wrong because aggressive mode is not required. Option C is wrong because each spoke needs a separate tunnel. Option E is wrong because route-based uses tunnel interfaces, not policy per tunnel.

Answer

A single firewall policy can control traffic to all spokes

Answer

Aggressive mode must be enabled for the hub to accept multiple spokes

Answer

All spokes can share the same Phase 1 configuration

Question 14

A network admin configures a site-to-site IPsec VPN between two FortiGates using IKEv1 main mode. The tunnel establishes successfully, but no traffic passes. What is the MOST likely cause?

Accepted Answer

There is no firewall policy allowing traffic through the VPN tunnel. Main mode IKEv1 uses IP protocol 50 (ESP) and UDP 500/4500. If there is no firewall policy allowing traffic between the source and destination zones, traffic will be dropped even if the tunnel is up.

Answer

Aggressive mode should be used instead of main mode

Answer

The pre-shared key is incorrect

Answer

The phase2 proposal does not match between peers

Question 15

An admin needs to authenticate remote users connecting via SSL VPN. The users are in an Active Directory domain. Which authentication method should be configured on the FortiGate to allow users to log in with their domain credentials?

Accepted Answer

LDAP server. LDAP is the protocol used to authenticate against Active Directory. FortiGate can query AD via LDAP to validate user credentials.

Answer

Local user database

Answer

RADIUS server

Answer

FSSO