NSE4 Authentication and VPN Practice Test 7 — 15 Questions

Question 1

A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'add-route' on the hub Phase 2. In a hub-and-spoke IPsec VPN, the hub FortiGate must have 'add-route' enabled on its Phase 2 selectors to automatically install routes for the spoke subnets into its routing table. Without this, the hub knows how to reach each spoke but does not have routes to forward traffic between spokes, so spoke-to-spoke traffic is dropped. Enabling 'add-route' on the hub's Phase 2 configurations ensures the hub learns the remote subnets and can route traffic between spokes.

Answer

Set the hub as the default gateway on each spoke

Answer

Use policy-based VPN instead of route-based

Answer

Configure NAT on the hub

Question 2

An administrator configures an LDAP user group for firewall authentication. Users are able to authenticate, but the FortiGate does not retrieve group membership information. What is likely misconfigured?

Accepted Answer

The LDAP bind account does not have permission to read group attributes. The LDAP bind account must have sufficient permissions to read the memberOf or group membership attributes from the directory. If the bind account can authenticate users but cannot query group membership, the FortiGate will not be able to enforce policies based on LDAP groups. This is the most common cause when authentication succeeds but group information is missing.

Answer

The LDAP server's IP address is incorrect

Answer

SSL is not enabled for LDAP

Answer

The FortiGate is not joined to the domain

Question 3

You are configuring a route-based IPsec VPN with BGP over the tunnel. After Phase 2 is up, the BGP session does not establish. You run 'diagnose debug ipsec' and see no errors. What should you check next?

Accepted Answer

Ensure the tunnel interface is added to the BGP neighbor configuration. When Phase 2 is up and 'diagnose debug ipsec' shows no errors, the IPsec tunnel is functioning correctly at the encryption layer. The BGP session failing to establish typically indicates a routing or interface configuration issue. Option C is correct because the tunnel interface must be explicitly added to the BGP neighbor configuration (e.g., 'config router bgp -> config neighbor -> set interface <tunnel>') so that BGP knows to send its TCP packets (port 179) over that specific tunnel interface; without this, BGP may try to use the physical interface instead, causing the session to fail.

Answer

Disable anti-replay on the tunnel

Answer

Enable NAT traversal

Answer

Check the Phase 1 proposal

Question 4

An administrator is troubleshooting an SSL VPN connection. Users can connect but cannot access internal resources. Which TWO commands would help diagnose the issue?

Accepted Answer

get router info routing-table. The 'get router info routing-table' command displays the FortiGate's routing table, which is essential for verifying that the FortiGate has a route to the internal resources the SSL VPN users are trying to access. If the route is missing or incorrect, traffic from the SSL VPN tunnel will not be forwarded to the internal network. Option B is correct because 'diagnose vpn ssl list' shows active SSL VPN sessions, including the assigned virtual IP (VIP) and tunnel interface, which helps confirm that the user is properly connected and has received an IP address from the correct address pool.

Answer

diagnose vpn ike status

Answer

execute ping 8.8.8.8

Answer

diagnose debug application dnsproxy

Question 5

A FortiGate is configured with FSSO and Active Directory polling. Users report that they are frequently prompted for authentication even though they are logged into the domain. Which THREE possible causes should the administrator investigate?

Accepted Answer

The user's IP address has changed and the FortiGate still has a stale mapping. FSSO with Active Directory polling relies on the FortiGate maintaining a mapping between a user's domain logon and their IP address. If the user's IP address changes (e.g., due to DHCP lease renewal or moving to a different subnet) and the FortiGate still holds the old mapping, the firewall will not recognize the user as authenticated, prompting re-authentication. This is a common issue in dynamic IP environments where the FortiGate's polling interval may not immediately detect the change.

Answer

The FortiToken server is overloaded

Answer

The captive portal is enabled on the policy

Question 6

A network admin configures a site-to-site IPsec VPN between two FortiGates using IKEv1 main mode. The tunnel establishes successfully, but no traffic passes. What is the MOST likely cause?

Accepted Answer

There is no firewall policy allowing traffic through the VPN tunnel. The tunnel establishes successfully, meaning IKE phase 1 and phase 2 negotiations completed correctly, which rules out mismatched proposals or incorrect pre-shared keys. However, even with a functional IPsec tunnel, traffic cannot flow unless a firewall policy explicitly permits it between the source and destination zones using the VPN interface. In FortiGate, the VPN tunnel is treated as an interface, and without a policy allowing traffic from the internal network to the VPN interface (or vice versa), packets are dropped by the firewall engine.

Answer

Aggressive mode should be used instead of main mode

Answer

The pre-shared key is incorrect

Answer

The phase2 proposal does not match between peers

Question 7

An admin needs to authenticate remote users connecting via SSL VPN. The users are in an Active Directory domain. Which authentication method should be configured on the FortiGate to allow users to log in with their domain credentials?

Accepted Answer

LDAP server. LDAP (Lightweight Directory Access Protocol) allows FortiGate to directly query the Active Directory domain controller to authenticate users with their domain credentials. This method validates the username and password against the AD database without requiring an additional RADIUS server or local user accounts, making it the most straightforward choice for SSL VPN authentication with domain users.

Answer

Local user database

Answer

RADIUS server

Answer

FSSO

Question 8

You run the command 'diagnose vpn ike log filter name vpn1' and then 'diagnose vpn ike log filter type phase1'. The log shows: 'IKEv1 exchange:f4470f07:00000000: responder: main mode: received IKE_SA_INIT (aggressive mode not allowed)'. What is the problem?

Accepted Answer

The responder is configured for main mode only, but the initiator is sending aggressive mode. The log message 'aggressive mode not allowed' indicates the responder (FortiGate) is configured to accept only main mode IKE phase1 negotiations, but the initiator sent an aggressive mode request. This mismatch causes the responder to reject the IKE_SA_INIT message, as aggressive mode is disabled by default or explicitly set to main mode only in the phase1 configuration.

Answer

The initiator is using IKEv2 while the responder uses IKEv1

Answer

The pre-shared key is wrong

Answer

The phase1 proposal is incompatible

Question 9

A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?

Accepted Answer

The FSSO collector agent settings for VDOM2. In a multi-VDOM FSSO setup with Active Directory polling, each VDOM requires its own FSSO collector agent configuration to map domain users to the correct VDOM. Since VDOM1 works but VDOM2 does not, the most likely cause is that the FSSO collector agent settings for VDOM2 are missing or misconfigured, such as the collector agent IP, port, or shared secret. This is the first item to verify because FSSO polling relies on per-VDOM agent communication to deliver user-to-IP mappings.

Answer

The DNS resolution for the domain controller in VDOM2

Answer

The firewall policy ordering in VDOM2

Answer

The LDAP server configuration in VDOM2

Question 10

Which IPsec VPN mode uses IP addresses and ports to define interesting traffic, and requires a separate security policy for each tunnel?

Accepted Answer

Policy-based VPN. Policy-based VPN (B) is correct because it defines interesting traffic using source/destination IP addresses and ports, and each tunnel requires a separate security policy to specify which traffic should be encrypted. This contrasts with route-based VPNs, which use virtual interfaces and routing tables to determine traffic, allowing a single policy to handle multiple tunnels.

Answer

Hub-and-spoke VPN

Answer

Dial-up VPN

Answer

Route-based VPN

Question 11

You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?

Accepted Answer

There is no firewall policy allowing traffic from ssl.root to the internal network. The user can authenticate and reach the SSL VPN portal, which indicates that the SSL VPN tunnel itself is established and authentication is successful. However, the inability to ping or access internal resources despite being authenticated points to a missing firewall policy that explicitly permits traffic from the SSL VPN interface (ssl.root) to the internal network. Without this policy, the FortiGate will drop all traffic from the SSL VPN tunnel, even though the user is logged in.

Answer

Client certificate authentication is required but not provided

Answer

Split tunneling is disabled

Answer

The SSL VPN realm is not configured correctly

Question 12

What is the primary purpose of the captive portal feature on a FortiGate?

Accepted Answer

To provide a web-based authentication interface for users connecting through a firewall policy. The captive portal feature on a FortiGate provides a web-based authentication interface that intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a login page. Once the user successfully authenticates (e.g., via local database, LDAP, or RADIUS), the FortiGate dynamically creates a firewall authentication entry, allowing the user's traffic to pass according to the configured firewall policy. This is the primary purpose: to enforce user-based access control through a browser-based authentication mechanism.

Answer

To monitor bandwidth usage per user

Answer

To block all traffic from unknown IP addresses

Answer

To enable SSL VPN connections

Question 13

You have a hub-and-spoke IPsec VPN with 10 spokes. The central FortiGate (hub) has 10 phase2 selectors, one for each spoke. You need to add a new spoke. What is the MOST efficient way to configure the hub?

Accepted Answer

Configure a route-based VPN and use dynamic routing protocols to advertise routes. A route-based VPN with dynamic routing (e.g., BGP or OSPF) is the most efficient approach because it eliminates the need to manually add a new phase2 selector for each new spoke. The hub can automatically learn the spoke's routes via the dynamic routing protocol, and the single phase2 selector (0.0.0.0/0) covers all traffic, simplifying configuration and scaling. This design also supports redundancy and load balancing across multiple spokes without reconfiguring the hub.

Answer

Add another phase2 selector for the new spoke

Answer

Replace all phase2 selectors with a single policy-based VPN

Answer

Use a single phase2 selector with 0.0.0.0/0.0.0.0 for all spokes

Question 14

After upgrading FortiOS, an IPsec VPN tunnel fails to come up. The diagnose output shows 'negotiation failed: no acceptable proposal'. The remote peer is a third-party device. Which step should you take first?

Accepted Answer

Check the phase1 and phase2 proposal settings on both ends to ensure they match. The 'no acceptable proposal' error indicates a mismatch in the Internet Key Exchange (IKE) parameters between the FortiGate and the remote peer. Since the remote peer is a third-party device, the most common cause is a misalignment in phase1 (IKE) or phase2 (IPsec) settings such as encryption algorithm, authentication method, Diffie-Hellman group, or lifetime. Option D is correct because verifying and aligning these proposals on both ends is the standard first step to resolve proposal mismatches.

Answer

Change the IKE version to IKEv2

Answer

Disable dead peer detection on the FortiGate

Answer

Reboot the remote peer

Question 15

An admin wants users to authenticate once via AD and have their network access controlled without repeated logins. Which feature should be used?

Accepted Answer

FSSO with Active Directory polling. FSSO with Active Directory polling allows users to authenticate once at Windows logon, and FortiGate polls the AD domain controllers to capture authentication events. This enables transparent network access control without repeated logins, as the user's identity and group memberships are mapped to firewall policies automatically.

Answer

Local user authentication

Answer

Captive portal with LDAP

Answer

SSL VPN with certificate authentication