NSE4 Authentication and VPN Practice Test 5 — 15 Questions

Question 1

You run the command 'diagnose vpn ike log filter name vpn1' and then 'diagnose vpn ike log filter type phase1'. The log shows: 'IKEv1 exchange:f4470f07:00000000: responder: main mode: received IKE_SA_INIT (aggressive mode not allowed)'. What is the problem?

Accepted Answer

The responder is configured for main mode only, but the initiator is sending aggressive mode. The log indicates that the initiator sent an IKE_SA_INIT message, which is part of aggressive mode (IKEv1). Since the responder expects main mode, it rejects the aggressive mode proposal.

Answer

The initiator is using IKEv2 while the responder uses IKEv1

Answer

The pre-shared key is wrong

Answer

The phase1 proposal is incompatible

Question 2

A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?

Accepted Answer

The FSSO collector agent settings for VDOM2. FSSO collector agents must be configured per VDOM. If VDOM2 does not have a collector agent or the poll interval is not set, user authentication will fail.

Answer

The DNS resolution for the domain controller in VDOM2

Answer

The firewall policy ordering in VDOM2

Answer

The LDAP server configuration in VDOM2

Question 3

An administrator wants to enable two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Add the FortiToken to the user's account and enable 'fortitoken' in the user group. FortiToken two-factor authentication is enforced by enabling 'fortitoken' in the user group settings. The group must be added to the SSL VPN firewall policy.

Answer

Create a RADIUS server pointing to FortiAuthenticator

Answer

Set the authentication timeout to 60 seconds

Answer

Configure SSL VPN to use certificate authentication

Question 4

Which IPsec VPN mode uses IP addresses and ports to define interesting traffic, and requires a separate security policy for each tunnel?

Accepted Answer

Policy-based VPN. Policy-based VPNs use firewall policies to define traffic that will be encrypted. They require a security policy per tunnel and do not use route-based selectors.

Answer

Hub-and-spoke VPN

Answer

Dial-up VPN

Answer

Route-based VPN

Question 5

You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?

Accepted Answer

There is no firewall policy allowing traffic from ssl.root to the internal network. Even if authentication succeeds, SSL VPN tunnel mode requires a firewall policy to allow traffic from the SSL VPN interface to internal networks. Without it, traffic is dropped.

Answer

Client certificate authentication is required but not provided

Answer

Split tunneling is disabled

Answer

The SSL VPN realm is not configured correctly

Question 6

What is the primary purpose of the captive portal feature on a FortiGate?

Accepted Answer

To provide a web-based authentication interface for users connecting through a firewall policy. Captive portal is used to authenticate users before allowing network access. It presents a login page to users who are not yet authenticated.

Answer

To monitor bandwidth usage per user

Answer

To block all traffic from unknown IP addresses

Answer

To enable SSL VPN connections

Question 7

A FortiGate administrator is setting up a dial-up IPsec VPN for remote employees. Each employee uses a FortiClient. Which authentication method should be used to allow individual user identities?

Accepted Answer

Certificate-based authentication using local or CA-issued certificates. Dial-up VPNs typically use x.509 certificates for device authentication, but for individual user identity, user-based authentication (like LDAP or RADIUS) is common. However, the question asks for a method that provides individual identities; using a pre-shared key per user is impractical. Certificate authentication is scalable and provides strong identity.

Answer

Pre-shared key (PSK) for each user

Answer

IKEv2 with EAP

Answer

Aggressive mode with PSK

Question 8

You have a hub-and-spoke IPsec VPN with 10 spokes. The central FortiGate (hub) has 10 phase2 selectors, one for each spoke. You need to add a new spoke. What is the MOST efficient way to configure the hub?

Accepted Answer

Configure a route-based VPN and use dynamic routing protocols to advertise routes. Using a route-based VPN with dynamic routing (e.g., BGP or OSPF) eliminates the need for multiple phase2 selectors. The hub only needs one phase2 selector for each spoke or can use a wildcard. Route-based VPN is more scalable.

Answer

Add another phase2 selector for the new spoke

Answer

Replace all phase2 selectors with a single policy-based VPN

Answer

Use a single phase2 selector with 0.0.0.0/0.0.0.0 for all spokes

Question 9

After upgrading FortiOS, an IPsec VPN tunnel fails to come up. The diagnose output shows 'negotiation failed: no acceptable proposal'. The remote peer is a third-party device. Which step should you take first?

Accepted Answer

Check the phase1 and phase2 proposal settings on both ends to ensure they match. The log indicates proposal mismatch. Since the remote peer is third-party, the FortiGate should be configured to match the remote peer's proposals. Checking the phase1 and phase2 settings against the remote peer's requirements is the logical first step.

Answer

Change the IKE version to IKEv2

Answer

Disable dead peer detection on the FortiGate

Answer

Reboot the remote peer

Question 10

An admin wants users to authenticate once via AD and have their network access controlled without repeated logins. Which feature should be used?

Accepted Answer

FSSO with Active Directory polling. FSSO (Fortinet Single Sign-On) captures AD logon events and maps user IP addresses to user identities, allowing transparent authentication without repeated logins.

Answer

Local user authentication

Answer

Captive portal with LDAP

Answer

SSL VPN with certificate authentication

Question 11

A FortiGate administrator is troubleshooting an SSL VPN issue where remote users cannot access internal resources after successful authentication. Which TWO steps should the admin take to resolve the issue? (Select two.)

Accepted Answer

Verify that a firewall policy exists allowing traffic from the SSL VPN interface to the internal network. If authentication succeeds but traffic fails, likely causes are missing firewall policy or incorrect routing. Check firewall policies for SSL VPN interface and ensure appropriate routes (e.g., enable split tunneling or add static routes).

Answer

Increase the authentication timeout

Answer

Restart the FortiGate

Answer

Disable the SSL VPN portal

Question 12

A company sets up a hub-and-spoke IPsec VPN where all spokes must communicate through the hub. The hub uses policy-based IPsec. Which THREE configurations are required on the hub to allow spoke-to-spoke traffic? (Select three.)

Accepted Answer

Separate phase2 selectors defining traffic between each pair of spokes. For spoke-to-spoke traffic via hub, the hub needs firewall policies to forward traffic between spokes, static routes for spoke networks, and phase2 selectors covering source/destination pairs (or use a broad selector).

Answer

Configure IKEv2 instead of IKEv1

Answer

Enable NAT on the hub for spoke-to-spoke traffic

Question 13

An organization wants to implement ZTNA (Zero Trust Network Access) on their FortiGate. Which TWO components are essential for ZTNA? (Select two.)

Accepted Answer

Client certificates for device posture verification. ZTNA requires an identity provider (IdP) for user authentication and client certificates for device verification. Access proxy is also needed, but the question asks for two essential components; IdP and client certificates are core.

Answer

A dedicated VPN tunnel

Answer

A static IP address for the client

Answer

A RADIUS server for two-factor authentication

Question 14

A network administrator has configured an IPsec VPN between two FortiGate devices. The Phase 1 proposal includes AES256-SHA256-DH14. The Phase 2 proposal includes AES128-SHA1. The VPN tunnel fails to establish. Which of the following is the MOST likely cause?

Accepted Answer

The Phase 2 proposal does not match between the two devices. With IKEv1, both Phase 2 proposals must match exactly on both sides. AES128-SHA1 is mismatched if the other side uses a different encryption or authentication algorithm. AES128 is used, not AES256.

Answer

The Phase 1 proposal is too strong and the remote FortiGate does not support DH14

Answer

The VPN policy has not been configured on the remote FortiGate

Answer

The pre-shared key is incorrect

Question 15

An administrator runs 'diagnose debug application ike -1' and sees the following output:
ike 0:come to x.x.x.x:500, IKEv1, cookie 123456789abcdef0
ike 0:incoming IKE packet: src y.y.y.y:500, dst x.x.x.x:500, len 456
ike 0:send IKE packet: src x.x.x.x:500, dst y.y.y.y:500, len 456
ike 0:phase 1 negotiation failed due to time out.
What is the likely cause?

Accepted Answer

A firewall rule is blocking UDP 500/4500 between the peers. The debug shows Phase 1 negotiation failing due to timeout. This typically indicates that the remote peer is not responding. The most common reason is that the remote firewall is not reachable due to a firewall rule blocking UDP 500 or 4500, or the remote peer is not configured.

Answer

The remote FortiGate's Phase 1 proposal does not match

Answer

The pre-shared key is incorrect

Answer

The local FortiGate's external interface is down