NSE4 Authentication and VPN Practice Test 4 — 15 Questions

Question 1

A FortiGate administrator configured an SSL VPN web portal for remote users. The users authenticate via LDAP and connect successfully, but when they click the bookmark for an internal web server, they receive a '403 Forbidden' error from the FortiGate. The administrator confirms the LDAP user is a member of the 'VPN-Users' group, and the SSL VPN policy allows the 'VPN-Users' group full access. Which configuration step is most likely missing to allow access to the internal web server through the SSL VPN web portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a firewall policy that allows traffic from the SSL VPN interface to the internal server and apply the correct user group.. When using SSL VPN web mode, the FortiGate acts as a proxy. Access to internal resources requires a firewall policy that allows traffic from the SSL VPN interface to the internal network, and this policy must reference the user group for authentication. The SSL VPN policy only controls who can connect to the portal, not what they can access after connecting. Without the appropriate firewall policy, the FortiGate returns a 403 Forbidden error.

Answer

Enable 'web-mode' in the SSL VPN settings and add the internal server to the 'Portal' bookmarks.

Answer

Enable 'HTTP redirect' on the SSL VPN portal to forward requests to the internal server.

Answer

Add the internal web server's IP address to the 'Split Tunneling' routing table.

Question 2

A remote user reports that they can connect to the FortiGate SSL VPN portal but cannot access internal resources. The administrator checks the SSL VPN settings and sees that the tunnel mode is enabled with split tunneling. What is the most likely cause?

Accepted Answer

The routing table on the client is missing the internal network routes.. With split tunneling enabled, the FortiGate SSL VPN portal connection succeeds, but the client's routing table does not automatically include routes for the internal network. Without those routes, traffic to internal resources is sent to the default gateway instead of through the VPN tunnel, causing access failure. This is the most likely cause because the user can authenticate and establish the tunnel but cannot reach internal subnets.

Answer

The IP pool is exhausted and no IP address was assigned.

Answer

The firewall policy allowing SSL VPN traffic to internal resources is missing.

Answer

The SSL VPN authentication timeout is too short.

Question 3

An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?

Accepted Answer

The Phase 2 selectors (local and remote subnets) are mismatched.. When Phase 1 parameters are identical and the VPN is down, the most common cause is a mismatch in Phase 2 selectors (local and remote subnets). Phase 2 uses these selectors to negotiate the IPsec security associations (SAs); if they do not match exactly on both sides, the IKEv1/v2 Quick Mode or Child SA exchange will fail, leaving the tunnel in a 'down' state even though Phase 1 (IKE SA) may be up.

Answer

The pre-shared keys do not match.

Answer

The firewall policies are not configured.

Answer

NAT traversal is disabled but both FortiGates are behind NAT.

Question 4

A company with multiple remote sites uses IPsec VPNs. One site reports intermittent connectivity. The administrator checks the logs and sees 'IPsec phase 2 negotiation failed' messages. Which configuration change is most likely to resolve the issue?

Accepted Answer

Enable Dead Peer Detection (DPD) on the Phase 1 interface.. Intermittent IPsec phase 2 negotiation failures often occur when one peer's Phase 2 security association (SA) expires while the other peer still considers it valid, causing a mismatch. Enabling Dead Peer Detection (DPD) on the Phase 1 interface allows the FortiGate to actively probe the peer's liveness and renegotiate Phase 1 and Phase 2 SAs before they expire, preventing the state mismatch that leads to intermittent failures.

Answer

Change the encryption algorithm from AES256 to 3DES.

Answer

Increase the Phase 2 lifetime.

Answer

Enable NAT traversal.

Question 5

An administrator is troubleshooting an SSL VPN connection issue. Users can authenticate but receive 'No available tunnel' error. What is the most likely cause?

Accepted Answer

The SSL VPN IP pool has run out of addresses.. The 'No available tunnel' error after successful authentication indicates that the SSL VPN daemon cannot assign an IP address to the client. The most likely cause is that the SSL VPN IP pool has exhausted its available addresses, preventing the creation of a virtual tunnel interface. This is a common issue when the pool size is smaller than the number of concurrent users.

Answer

Split tunneling is misconfigured.

Answer

The firewall policy does not allow traffic from the SSL VPN interface.

Answer

The SSL VPN port is blocked on the firewall.

Question 6

A site-to-site IPsec VPN is configured with IKEv2. The tunnel establishes but traffic does not pass. Which two troubleshooting steps should the administrator perform first?

Accepted Answer

Check the firewall policies allowing traffic through the tunnel.. Even if the IPsec tunnel is established, traffic will not pass unless firewall policies explicitly permit it. In FortiGate, a Phase 2 tunnel being up does not imply that traffic is allowed; you must have a policy that matches the source/destination and enables the action to forward traffic through the tunnel interface.

Answer

Check the Phase 2 selectors.

Answer

Verify that the Phase 1 proposal matches.

Question 7

A FortiGate administrator is designing an SSL VPN solution for 500 remote users. The users need full network access. Which two design considerations are most important?

Accepted Answer

Ensure the SSL VPN IP pool has enough addresses for concurrent users.. The SSL VPN IP pool must have enough addresses to assign to all concurrent users. Without a sufficient pool, users will fail to obtain an IP address and cannot access the network. Option B is correct because firewall policies are required to permit traffic from the SSL VPN interface (e.g., ssl.root) to internal networks; without them, traffic is dropped even if the tunnel is established.

Answer

Configure split tunneling to reduce load on the FortiGate.

Answer

Use certificate-based authentication for all users.

Answer

Enable port forwarding for RDP and SSH.

Question 8

An administrator is configuring a dialup IPsec VPN for remote users. Which two settings must be configured on the FortiGate to allow clients to connect?

Accepted Answer

Enable mode-cfg on the Phase 1 interface.. Mode-config (mode-cfg) on the Phase 1 interface is required to push network configuration parameters (such as DNS, WINS, and the virtual IP address) to remote IPsec VPN clients. This setting enables the FortiGate to act as a server in a dialup VPN scenario, dynamically assigning IP addresses and other settings to clients without requiring static configuration on each client.

Answer

Enable XAuth for user authentication.

Answer

Enable Dead Peer Detection.

Answer

Enable NAT traversal.

Question 9

A company has a FortiGate at headquarters running FortiOS 7.2 and a remote office with a FortiGate 60F running FortiOS 7.0. They have an IPsec VPN tunnel between them for site-to-site connectivity. Recently, the remote office upgraded their FortiGate from 6.4 to 7.0. After the upgrade, the VPN tunnel is down. The Phase 1 status shows 'negotiating' but never completes. The administrator has verified that the pre-shared key, IKE version (IKEv2), and authentication method are the same on both sides. The Phase 1 proposal on the headquarters is: encryption: AES256, SHA256, DH group 14, lifetime 86400. The remote office uses: encryption: AES256, SHA1, DH group 14, lifetime 86400. What is the most likely cause of the failure?

Accepted Answer

The Phase 1 hash algorithm differs; headquarters uses SHA256, remote uses SHA1.. The Phase 1 proposal mismatch on the hash algorithm (SHA256 vs. SHA1) prevents the IKEv2 peers from agreeing on a common transform set. Even though all other parameters match, the hash algorithm must be identical on both sides for the IKE SA to be established. The 'negotiating' state that never completes is a classic symptom of a proposal mismatch.

Answer

The DH group is different; headquarters uses group 14, remote uses group 5.

Answer

The IKE version is mismatched; headquarters uses IKEv2 and remote uses IKEv1.

Answer

The pre-shared key is incorrect after the upgrade.

Question 10

A company wants to provide remote access to internal resources for employees using laptops that may connect from untrusted networks. The security team requires that all traffic between the remote users and the corporate network be encrypted, and that users must authenticate using a username/password plus a one-time passcode from a hardware token. Which FortiGate VPN solution best meets these requirements?

Accepted Answer

SSL VPN with FortiToken two-factor authentication. SSL VPN with FortiToken two-factor authentication meets the requirement for encrypted remote access with username/password plus a one-time passcode from a hardware token. SSL VPN provides encrypted tunnels over HTTPS, and FortiToken adds the required second factor, ensuring strong authentication even from untrusted networks.

Answer

IPsec VPN with certificate-based authentication

Answer

SSL VPN with local password authentication

Answer

L2TP/IPsec VPN with a pre-shared key and user password

Question 11

Which TWO are best practices for configuring IPsec VPN on FortiGate to ensure high availability and security?

Accepted Answer

Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.. Perfect Forward Secrecy (PFS) ensures that if an attacker compromises the private key used during IKE phase1, they cannot derive the session keys used in phase2. By requiring a new Diffie-Hellman exchange for each phase2 rekey, PFS isolates the compromise to only the current session, protecting past and future encrypted traffic. This is a critical security best practice for IPsec VPNs on FortiGate.

Answer

Disable DPD on the phase1 interface to reduce overhead.

Answer

Use aggressive mode for faster IKE negotiation.

Answer

Disable PFS to reduce CPU load on the firewall.

Question 12

Drag and drop the steps to upgrade FortiGate firmware via the web interface into the correct order.

Accepted Answer

Upload the firmware image first, then confirm the upgrade, then reboot.. Firmware upgrade requires uploading the image and confirming; the device reboots automatically.

Answer

Confirm the upgrade first, then upload the firmware image, then reboot.

Answer

Upload the firmware image first, then reboot, then confirm the upgrade.

Answer

Reboot first, then upload the firmware image, then confirm the upgrade.

Question 13

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

Accepted Answer

Phase 2 encryption or authentication algorithms do not match on both sides.. The 'no suitable proposal found' error in Phase 2 of an IPsec VPN tunnel indicates that the Phase 2 parameters (encryption algorithm, authentication algorithm, or PFS settings) do not match between the two FortiGate peers. Since Phase 1 is up, the IKE SA is established, meaning pre-shared keys, remote gateway reachability, and basic firewall policies for IKE traffic are correct. The mismatch specifically occurs in the Phase 2 proposal negotiation, where each side sends its supported transforms and the responder cannot find a common set.

Answer

The firewall policy allowing IPsec traffic is missing.

Answer

The remote gateway IP address is unreachable.

Answer

The pre-shared key is incorrect.

Question 14

An organization wants to use FortiToken for two-factor authentication on SSL VPN logins. Which authentication method must be enabled on the FortiGate to support this?

Accepted Answer

Two-factor authentication with FortiToken. FortiToken is a hardware or software token that generates one-time passwords (OTPs) for two-factor authentication (2FA). To use FortiToken with SSL VPN logins, the FortiGate must have 'Two-factor authentication with FortiToken' enabled in the user or user group configuration. This setting tells the FortiGate to prompt for both the user's regular password and the current FortiToken OTP during the SSL VPN authentication process.

Answer

RADIUS authentication

Answer

PKI authentication

Answer

LDAP authentication

Question 15

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Accepted Answer

The FSSO collector agent service is not running.. If the FSSO collector agent service is not running, the FortiGate cannot receive the logon events from the domain controllers. Without these events, the FortiGate has no way to know which users are authenticated, so it falls back to prompting for credentials on every new session, even though users are already logged into the domain.

Answer

The users are not members of the FSSO group.

Answer

The firewall policy uses 'All Users' instead of a specific group.

Answer

The FortiGate's LDAP server is unreachable.