NSE4 Authentication and VPN Practice Test 5 — 15 Questions

Question 1

What is the purpose of a ZTNA (Zero Trust Network Access) tag on a FortiGate?

Accepted Answer

To mark devices or users with attributes used in security policies. ZTNA tags are user- or device-specific attributes (e.g., 'OS=Windows', 'Compliant=true') that FortiGate applies to endpoints after posture assessment. These tags can then be referenced in firewall policies to enforce granular, identity-aware access control, which is the core of Zero Trust Network Access.

Answer

To enable SNMP monitoring on the device

Answer

To assign static IP addresses to clients

Answer

To tag firewall policies for logging purposes

Question 2

A FortiGate is configured as a hub in a hub-and-spoke IPsec VPN. The spokes are remote branches. The hub has a Phase 2 selector set to 0.0.0.0/0 for both local and remote subnets. What is the advantage of this configuration?

Accepted Answer

It simplifies configuration by not needing specific subnet definitions per spoke. Setting Phase 2 selectors to 0.0.0.0/0 allows the hub to accept any subnet from the spokes, simplifying configuration when spokes have different subnets. However, traffic between spokes must route through the hub.

Answer

It reduces the number of IPsec SAs needed

Answer

It allows direct spoke-to-spoke communication without passing through the hub

Answer

It enables dynamic routing protocols over the VPN

Question 3

An administrator needs to implement two-factor authentication for SSL VPN access using FortiToken. Which configuration steps are required?

Accepted Answer

Assign a FortiToken to the user and set the user's authentication method to two-factor. To implement two-factor authentication for SSL VPN using FortiToken, you must assign a FortiToken to the user and set the user's authentication method to two-factor. This is done in the user configuration (e.g., under User & Authentication > User Definition) by selecting 'FortiToken' as the second factor and linking the token serial number. This ensures that during SSL VPN login, the user must provide both their password and a one-time password from the FortiToken, which is validated locally by the FortiGate without requiring an external RADIUS server.

Answer

Configure the RADIUS server to send FortiToken challenges

Answer

Enable FortiToken on the firewall policy

Answer

Enable two-factor authentication on the SSL VPN portal settings

Question 4

Which of the following is a characteristic of route-based IPsec VPN compared to policy-based IPsec VPN?

Accepted Answer

Route-based VPN can use dynamic routing protocols like OSPF. Route-based IPsec VPNs create a virtual tunnel interface (e.g., ipsec0 or tunnel) that acts as a logical routing point, allowing dynamic routing protocols such as OSPF to exchange routes over the encrypted tunnel. This is a key advantage over policy-based VPNs, which rely on static security policies and cannot support dynamic routing.

Answer

Route-based VPN is only supported in IKEv1

Answer

Route-based VPN requires Phase 2 selectors to match both local and remote subnets

Answer

Route-based VPN uses firewall policies with IPsec action

Question 5

A company wants to implement SSL VPN split tunneling to allow remote users to access both internal resources and the internet directly. Which three configurations are required on the FortiGate?

Accepted Answer

Configure a firewall policy allowing the SSL VPN interface to the internet interface with NAT enabled. To allow SSL VPN users to access the internet directly while using split tunneling, a firewall policy must permit traffic from the SSL VPN interface to the internet interface with NAT enabled. This policy ensures that traffic destined for the internet is source-NATed, allowing the remote user's traffic to exit the FortiGate and reach external resources without being routed back through the tunnel.

Answer

Assign a public IP address to the SSL VPN interface

Answer

Configure a static route on the FortiGate to send all traffic through the SSL VPN tunnel

Question 6

An administrator is configuring Active Directory polling for FSSO. Which two components must be set up correctly for FSSO to work?

Accepted Answer

A firewall policy that allows LDAP traffic from FortiGate to the domain controller. For FSSO to function, two components are essential: a firewall policy allowing LDAP traffic from FortiGate to the domain controller (used for user/group queries) and an FSSO collector agent installed on a Windows server in the domain (to capture user logon events). The collector agent sends logon events to the FortiGate, which then queries LDAP for group information. Without both, FSSO cannot properly map users to groups.

Answer

A RADIUS server configured for user authentication

Answer

An IPsec tunnel between FortiGate and the domain controller

Answer

FortiToken license for each user

Question 7

A network administrator configured an IPsec VPN between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The diagnose output shows 'no matching proposal'. What is the MOST likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match between peers. The 'no matching proposal' error in Phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two FortiGate peers. Phase 2 uses these proposals to negotiate the IPsec SA for protecting data traffic, and a mismatch prevents the tunnel from establishing. Since Phase 1 completed successfully, the pre-shared keys and gateway IP are already verified, isolating the issue to Phase 2 configuration.

Answer

The firewall policy allowing the VPN traffic is missing

Answer

The pre-shared keys do not match

Answer

The remote gateway IP address is incorrect

Question 8

A FortiGate admin wants to authenticate VPN users against an existing Microsoft Active Directory. Which authentication method should be configured on the FortiGate?

Accepted Answer

LDAP. (LDAP) is correct because Microsoft Active Directory natively supports LDAP (Lightweight Directory Access Protocol) for authentication and directory lookups. FortiGate can directly bind to AD using LDAP to verify VPN user credentials against the AD database without requiring an additional RADIUS server or agent. This method is efficient for direct user authentication in a Windows domain environment.

Answer

RADIUS

Answer

FSSO

Answer

TACACS+

Question 9

An SSL VPN user connects via web mode but cannot access internal resources. The admin checks the SSL VPN settings: tunnel mode is disabled, split tunneling is enabled, and the user's realm is configured correctly. What is the MOST likely cause?

Accepted Answer

No port forwarding rules are configured in the SSL VPN portal. In web mode, access to internal resources requires proper port forwarding rules within the SSL VPN portal. Without them, the user can only access resources explicitly listed.

Answer

Split tunneling is blocking internal routes

Answer

The user's browser does not support WebSocket

Answer

The user's client certificate is expired

Question 10

A FortiGate is configured with FSSO to poll Active Directory for user logon events. Users report that their logins are not being detected. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag debug fsso poll' to verify the collector agent status. The 'diag debug fsso poll' command directly checks the communication status between the FortiGate and the FSSO collector agent. This is the first logical step to verify whether the collector agent is successfully polling Active Directory for logon events, which is the root cause of undetected logins.

Answer

Recreate all firewall policies

Answer

Disable and re-enable FSSO

Answer

Restart the FortiGate firewall

Question 11

Which IPsec VPN mode is typically used for site-to-site VPNs and is more secure because it negotiates Phase 1 in six messages?

Accepted Answer

Main mode. Main mode is the correct answer because it is the IPsec VPN mode typically used for site-to-site VPNs and is considered more secure due to its use of six messages during Phase 1 (IKE) negotiation. This mode protects the identities of both peers by encrypting the identity payloads after the Diffie-Hellman exchange, making it resistant to man-in-the-middle attacks and identity disclosure.

Answer

Quick mode

Answer

Aggressive mode

Answer

IKEv2

Question 12

A FortiGate admin configures a captive portal for guest users on a wireless network. Users can connect to the SSID but cannot access the internet. The admin verifies the firewall policy permits traffic from the captive portal interface to the internet. What is missing?

Accepted Answer

The firewall policy must have 'Enable Captive Portal' selected. For a captive portal to redirect unauthenticated users to the authentication page, the firewall policy that permits traffic from the captive portal interface to the internet must have the 'Enable Captive Portal' option selected. Without this setting, the FortiGate will not intercept HTTP/HTTPS requests and redirect them to the captive portal login page, so users remain unauthenticated and cannot access the internet even though the policy allows traffic.

Answer

A DNS server must be configured on the FortiGate

Answer

The users must be added to the local user database

Answer

The wireless controller must be configured with a RADIUS server

Question 13

An administrator runs 'diagnose vpn ike config' and sees the output includes 'P2 proposals: aes128-sha256, aes256-sha1'. What does this indicate?

Accepted Answer

The Phase 2 encryption and authentication algorithms. The output 'P2 proposals: aes128-sha256, aes256-sha1' from the 'diagnose vpn ike config' command specifically lists the Phase 2 (IPsec) proposals, which define the encryption and authentication algorithms used for protecting data traffic. Option C is correct because these are the Phase 2 encryption (aes128, aes256) and authentication (sha256, sha1) algorithms, not Phase 1 settings or other parameters.

Answer

The Diffie-Hellman groups for Phase 2

Answer

The Phase 1 encryption settings

Answer

The lifetime settings for the VPN tunnel

Question 14

A FortiGate in a hub-and-spoke VPN topology has multiple spoke sites connecting via IPsec. The hub administrator wants to enable direct spoke-to-spoke communication without routing traffic through the hub. What technology should be used?

Accepted Answer

ADVPN (Auto-Discovery VPN). ADVPN (Auto-Discovery VPN) is the correct technology because it dynamically establishes direct IPsec tunnels between spoke sites in a hub-and-spoke topology, eliminating the need to route inter-spoke traffic through the hub. It uses IKEv2 with short-cut messages (via the hub as a signaling broker) to allow spokes to learn each other's public IP addresses and negotiate a direct tunnel, reducing latency and hub load.

Answer

Site-to-site VPN between each spoke pair manually

Answer

Policy-based VPN with multiple Phase 2 selectors

Answer

SSL VPN tunnel mode

Question 15

Which of the following is a benefit of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 is more robust to network changes and supports MOBIKE. IKEv2 is more robust to network changes because it supports the Mobility and Multihoming (MOBIKE) protocol, which allows an IPsec VPN tunnel to survive IP address changes without re-establishing the entire security association. This is a key advantage over IKEv1, which lacks native support for MOBIKE and requires a full rekey when the endpoint's IP address changes.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires fewer firewall rules

Answer

IKEv2 uses a single UDP port 500