NSE4 Authentication and VPN Practice Test 5 — 15 Questions

Question 1

An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Phase 2 proposals do not match between the FortiGate and the client.. In IKEv2 VPNs, Phase 1 establishes the secure control channel (ISAKMP SA) and shows 'up' even if Phase 2 fails. Phase 2 creates the IPsec SA for actual data traffic; if it remains 'down', the most common cause is a mismatch in Phase 2 proposals (encryption, authentication, or PFS settings) between the FortiGate and the remote client. Since the client can connect but traffic is not routed, the tunnel is not fully established for data, pointing directly to a Phase 2 proposal mismatch.

Answer

The firewall policy for the VPN traffic is missing.

Answer

The pre-shared key for Phase 2 is incorrect.

Answer

The remote user's client does not support IKEv2.

Question 2

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Accepted Answer

Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.. Captive portal authentication on a FortiGate requires a firewall policy that matches the unauthenticated traffic (source interface 'guest', destination 'any') with action 'ACCEPT' and the 'Authentication' setting set to 'Captive Portal'. This policy triggers the FortiGate to intercept HTTP/HTTPS traffic from unauthenticated users and redirect them to the captive portal login page, enforcing authentication before allowing further access.

Answer

Set the 'Guest Management' feature in the FortiGate dashboard.

Answer

Configure a 'Landing Page' under SSL-VPN settings.

Answer

Enable 'Captive Portal' on the interface under System > Network > Interface.

Question 3

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Accepted Answer

Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.. The primary difference is that route-based IPsec VPNs use a tunnel interface (e.g., 'phase1-interface' and 'phase2-interface') which participates in routing, while policy-based IPsec VPNs rely on firewall policies with explicit traffic selectors (source/destination addresses and services) to trigger encryption. In route-based VPNs, the tunnel interface is assigned an IP address and routes are used to direct traffic into the tunnel, decoupling encryption from policy matching. In policy-based VPNs, the firewall policy itself defines what traffic is encrypted, making the traffic selector part of the policy configuration.

Answer

Route-based requires a static route, policy-based uses dynamic routing.

Answer

Route-based encrypts all traffic, policy-based encrypts only specified services.

Answer

Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.

Question 4

During an IPsec VPN troubleshooting, you run 'diagnose vpn ike config' and see the output includes 'peer-id: any'. What does this mean?

Accepted Answer

The FortiGate will accept any peer identity during IKE authentication.. The 'peer-id: any' output in 'diagnose vpn ike config' indicates that the FortiGate is configured to accept any peer identity during IKE authentication. This means the FortiGate will not validate the identity presented by the remote peer (e.g., IP address, FQDN, or user ID) against a specific value in the Phase 1 configuration. This is common when using pre-shared keys and not requiring strict peer identity validation.

Answer

The FortiGate will accept connections from any remote IP address.

Answer

The FortiGate will use aggressive mode for IKE negotiation.

Answer

The Phase 2 selectors are configured for any protocol.

Question 5

A FortiGate is configured in an HA active-passive cluster. When the active unit fails, the passive unit takes over, but IPsec VPN tunnels fail to re-establish. The configuration is synchronized. What is the most likely cause?

Accepted Answer

The IPsec VPN is using the physical interface IP instead of a virtual IP (VIP) or floating IP.. In an HA active-passive cluster, IPsec VPN tunnels typically bind to the physical interface IP address. When failover occurs, the passive unit assumes the cluster's virtual MAC and IP addresses, but the IPsec tunnel endpoints remain tied to the original physical IP. Since the new active unit has a different physical interface IP, the remote peer sees a mismatched source address and drops the connection. Using a virtual IP (VIP) or floating IP ensures the tunnel endpoint stays consistent across failover.

Answer

The pre-shared key is different on the two units.

Answer

The firewall policies for VPN traffic are not synchronized.

Answer

The HA heartbeat interface is down.

Question 6

What is the purpose of a 'realm' in FortiGate SSL VPN configuration?

Accepted Answer

To create distinct portals with separate authentication and access policies.. In FortiGate SSL VPN, a 'realm' allows the administrator to create distinct login portals, each with its own authentication requirements and access policies. This enables different user groups (e.g., employees vs. contractors) to have separate VPN experiences without requiring multiple FortiGate interfaces or IP pools. The realm is appended to the VPN URL (e.g., https://fortigate:10443/remote/portal) to direct users to the correct portal.

Answer

To enable two-factor authentication.

Answer

To specify the authentication server for the VPN.

Answer

To define the encryption algorithm for SSL VPN.

Question 7

An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?

Accepted Answer

FortiClient. FortiClient is the required endpoint component for ZTNA because it acts as the ZTNA agent on the client device, establishing a secure tunnel (via IPSec or SSL VPN) to the FortiGate and enforcing posture checks (e.g., OS version, antivirus status) before granting access. Without FortiClient, the FortiGate cannot verify the device's trust level or enforce ZTNA access policies at the endpoint.

Answer

FortiManager

Answer

FortiToken

Answer

FortiAnalyzer

Question 8

An organization uses LDAP authentication for firewall policies. Users complain that they are frequently prompted for credentials. Which TWO settings can reduce the frequency of authentication prompts?

Accepted Answer

Increase the authentication timeout on the firewall policy.. Increasing the authentication timeout on the firewall policy (Option A) allows the firewall to cache the user's authentication state for a longer period, so users are not re-prompted for credentials as frequently when traffic matches that policy. Enabling single sign-on (SSO) authentication (Option C) leverages Kerberos or NTLM to automatically authenticate users based on their domain logon, eliminating repeated manual credential prompts.

Answer

Increase the idle timeout on the LDAP server.

Answer

Disable captive portal on the interface.

Answer

Use a longer password for LDAP accounts.

Question 9

A network administrator configures an IPsec VPN between two FortiGate devices. Phase 1 completes successfully, but Phase 2 fails to establish. The administrator runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the MOST likely cause?

Accepted Answer

The Phase 2 local and remote subnets do not match on both ends. The error 'proposal mismatch' in the Phase 2 IKE log indicates that the IPsec security associations (SAs) proposed by one FortiGate do not match the configured Phase 2 parameters on the other. Since Phase 1 completed successfully, the IKE version and pre-shared key are already validated. The mismatch specifically refers to the local and remote subnet definitions, encryption algorithms, or authentication methods in the Phase 2 selectors. Therefore, the most likely cause is that the Phase 2 local and remote subnets are not correctly mirrored on both ends.

Answer

The IKE version is mismatched (IKEv1 vs IKEv2)

Answer

The pre-shared key is incorrect

Answer

The firewall policies are blocking IKE traffic on UDP port 500

Question 10

A FortiGate administrator is troubleshooting a dial-up IPsec VPN where remote users can connect but traffic does not pass. The Phase 1 and Phase 2 status show 'up'. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. However, 'diagnose sys session list' shows no sessions for the remote user's IP. What is the MOST likely cause?

Accepted Answer

There is no firewall policy permitting traffic from the dial-up interface to the destination network. Even when Phase 1 and Phase 2 are up and the tunnel is established, traffic will not pass through a dial-up IPsec VPN unless a firewall policy explicitly permits traffic from the dial-up interface (often the virtual IPsec interface) to the destination network. The 'diagnose sys session list' showing no sessions for the remote user's IP confirms that the FortiGate is not processing any traffic for that user, which points to a missing or misconfigured firewall policy rather than an encryption or routing issue.

Answer

The Phase 2 proposal uses AES256 but the remote client only supports AES128

Answer

The FortiGate's routing table does not have a route to the remote user's subnet

Answer

The remote user's FortiClient is blocking split tunneling

Question 11

A FortiGate administrator wants to authenticate VPN users against an existing LDAP server. The administrator creates an LDAP user group on the FortiGate. What additional configuration is REQUIRED to use this group for IPsec VPN authentication?

Accepted Answer

In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication. For IPsec VPN authentication, the FortiGate must know which users are allowed to connect. Setting the peer type to 'dialup' in Phase 1 enables the FortiGate to accept connections from remote users rather than another gateway. Specifying the LDAP user group under authentication tells the FortiGate to validate the VPN user's credentials against that group's members, which are resolved via the LDAP server. Without this configuration, the FortiGate has no way to associate the LDAP group with the VPN tunnel.

Answer

Enable LDAP over TLS (LDAPS) on the FortiGate

Answer

Assign the LDAP user group to a firewall policy

Answer

Configure a RADIUS server as an intermediate proxy between FortiGate and LDAP

Question 12

An administrator receives a report that some users cannot authenticate via captive portal on a FortiGate. The captive portal is configured for firewall authentication. The administrator checks the authentication logs and sees 'Authentication failed: invalid credentials'. However, the users confirm they are entering the correct username and password. What is the MOST likely cause?

Accepted Answer

The users are not including the domain name in the username field. When FortiGate performs firewall authentication (captive portal) against an LDAP server, the username format must match what the LDAP server expects. If the LDAP server requires a domain-qualified username (e.g., DOMAIN\user or user@domain.com) and users enter only their short username, the bind attempt fails with 'invalid credentials' even though the password is correct. This is the most likely cause given that users confirm their credentials are correct and the logs show authentication failure rather than a connectivity error.

Answer

The captive portal interface is not configured with a valid certificate

Answer

The FortiGate's clock is out of sync with the LDAP server

Answer

The LDAP server is not reachable from the FortiGate

Question 13

A FortiGate administrator is configuring an SSL VPN web mode portal. The administrator wants users to access only a specific internal web application (https://internal-app.company.local) and nothing else. Which SSL VPN setting should be configured to achieve this?

Accepted Answer

Under the SSL VPN portal, configure 'URL Access' to allow only https://internal-app.company.local. The 'URL Access' setting in the SSL VPN web mode portal allows the administrator to explicitly define which URLs users can access through the portal. By configuring an allow list with only https://internal-app.company.local, users are restricted to that specific internal web application, and all other URLs are blocked. This provides granular control over web-based resources in the SSL VPN portal without relying on network-layer restrictions.

Answer

In the SSL VPN portal, set the default bookmark to the application URL

Answer

Configure a firewall policy that allows traffic only to the application's IP address

Answer

Enable split tunneling under the SSL VPN settings

Question 14

A FortiGate administrator is configuring a route-based IPsec VPN between two FortiGate devices. After setting up the tunnel and firewall policies, traffic does not flow. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. 'get router info routing-table all' shows routes on both sides. However, pings from the local network to the remote network fail. What is the MOST likely cause?

Accepted Answer

The firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. The tunnel is up and routes are present, indicating Phase 1 and Phase 2 negotiations succeeded. The most likely cause is that the firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. In a route-based VPN, the policy must have the incoming interface as the source (e.g., internal) and the outgoing interface as the destination (e.g., the VPN tunnel interface). Reversing these prevents traffic from being matched, even though the tunnel is established.

Answer

The pre-shared key is incorrect

Answer

The remote FortiGate's static route points to the wrong local subnet

Answer

The Phase 2 proposal uses different encryption algorithms on each side

Question 15

Which authentication method allows a FortiGate to transparently authenticate users based on their Active Directory login events without prompting for credentials?

Accepted Answer

FSSO (Fortinet Single Sign-On). Fortinet Single Sign-On (FSSO) allows FortiGate to transparently authenticate users by collecting login events from Active Directory domain controllers. It uses the NetAPI or a polling mechanism to capture user logon events without requiring any user interaction or credential prompts, enabling seamless identity-based policy enforcement.

Answer

RADIUS authentication

Answer

Local database authentication

Answer

LDAP authentication