NSE4 Authentication and VPN Practice Test 7 — 15 Questions

Question 1

You receive an alert that a user's FortiToken synchronization is off. You need to resynchronize the token. Which CLI command achieves this?

Accepted Answer

execute fortitoken-resync . The correct command to resynchronize a FortiToken on a FortiGate is `execute fortitoken-resync `. This CLI command triggers the token to synchronize its time-based one-time password (TOTP) seed with the FortiGate, correcting drift caused by clock skew or battery depletion. Options A, B, and C either use incorrect syntax, perform a different function, or do not exist in the FortiOS CLI.

Answer

diagnose user fortitoken resync <token-serial>

Answer

config user fortitoken edit <token-serial> set status activate

Answer

execute fortitoken-update <token-serial>

Question 2

In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?

Accepted Answer

Create a separate IPsec VPN between each spoke pair. In a hub-and-spoke IPsec VPN topology, spoke sites cannot communicate directly by default. To enable direct spoke-to-spoke communication, the most straightforward configuration change is to create separate IPsec VPN tunnels between each spoke pair. While ADVPN (Auto Discovery VPN) with dynamic routing is a more efficient method, it is not listed as an option. Option D directly establishes the required tunnels, allowing traffic to bypass the hub for spoke-to-spoke traffic. Other options are insufficient: Option A only adds routes for the hub, Option B only propagates routes without establishing direct tunnels, and Option C forces traffic through the hub.

Answer

Set the 'add-route' option to 'enable' on the spoke Phase 1 settings

Answer

Configure dynamic routing (BGP) on all sites and enable route exchange

Answer

Add static routes on the hub pointing to each spoke's subnet via the respective tunnels

Question 3

A FortiGate administrator is configuring ZTNA for a web application. Which TWO components are required for a ZTNA configuration to function?

Accepted Answer

ZTNA rules. ZTNA rules are the core policy mechanism that defines access control for ZTNA applications, specifying which users and devices can access which resources based on identity and device posture. Without ZTNA rules, the FortiGate cannot enforce the granular, identity-based access decisions that ZTNA requires.

Answer

SSL VPN

Answer

IPsec VPN

Answer

Firewall policy

Question 4

A FortiGate administrator is configuring RADIUS authentication for firewall users. Which THREE steps are required to complete the configuration? (Select THREE.)

Accepted Answer

Configure a firewall policy with the user group set in 'users/groups'. A firewall policy must reference the user group that uses the RADIUS server as its authentication source. Without this policy configuration, RADIUS-authenticated users cannot match the policy and will be denied access. The 'users/groups' field in the firewall policy is where the user group object is specified to enforce authentication-based access control.

Answer

Import the RADIUS server certificate into FortiGate

Answer

Enable 'set auth-type radius' on the interface

Question 5

A FortiGate is configured with an IPsec VPN to a remote site using IKEv1. The VPN tunnel goes down intermittently. The admin runs 'diagnose vpn ike gateway list' and sees 'state=UP' but no Phase2 selectors. What is the most likely cause?

Accepted Answer

Mismatched Phase2 parameters between the local and remote gateways. When 'diagnose vpn ike gateway list' shows the IKE gateway state as UP but no Phase2 selectors are present, it indicates that the IKE Phase1 (main mode or aggressive mode) has completed successfully, but the IPsec Phase2 (quick mode) negotiation has failed. The most common cause for this is a mismatch in Phase2 parameters such as encryption algorithm, authentication algorithm, or proxy IDs (local/remote subnets) between the local and remote gateways. Since the tunnel goes down intermittently, the Phase2 rekey may be failing due to these mismatches, causing the tunnel to drop until a successful renegotiation occurs.

Answer

The firewall policy allowing IPsec traffic is misconfigured

Answer

The remote gateway has a different PSK

Answer

Dead Peer Detection (DPD) is disabled

Question 6

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?

Accepted Answer

The hub is missing static routes to the spoke networks via the respective tunnel interfaces. In a hub-and-spoke route-based VPN, the hub uses tunnel interfaces for each spoke. After a reboot, the hub's routing table is cleared, and without static routes pointing to the spoke networks via the respective tunnel interfaces, the hub cannot forward traffic between spokes. Even though each spoke can reach the hub, inter-spoke traffic requires the hub to have explicit routes to the remote spoke networks, as dynamic routing protocols are not mentioned in this scenario.

Answer

The firewall policies on the hub do not allow traffic between the spoke networks

Answer

The spokes have mismatched IKE versions

Answer

The hub's IPsec Phase1 is not configured for DPD

Question 7

The output of 'diagnose debug application ike -1' shows 'no proposal chosen' for a Phase1 negotiation. Which action should the administrator take to resolve this?

Accepted Answer

Check and align the Phase1 encryption, authentication, and DH group settings. The 'no proposal chosen' error in Phase 1 IKE negotiation indicates that the two VPN peers cannot agree on a common set of security parameters (proposal). The administrator must check and align the Phase 1 settings, specifically the encryption algorithm, authentication method, and Diffie-Hellman group, because these are the mandatory parameters matched during the IKE SA negotiation. Option C directly addresses this by ensuring both sides use identical Phase 1 proposals.

Answer

Increase the Phase1 lifetime on both sides

Answer

Verify the pre-shared key is correct

Answer

Change the IKE version from v1 to v2

Question 8

A FortiGate administrator needs to authenticate VPN users against an LDAP server. What is the primary purpose of the 'CN=,OU=,DC=' distinguished name (DN) configured in the LDAP server settings?

Accepted Answer

It specifies the bind user credentials to connect to the LDAP server. The DN configured in the LDAP server settings on FortiGate specifies the bind user credentials (username and password) that the FortiGate uses to authenticate itself to the LDAP server before performing user searches. This bind DN is required because LDAP servers typically require a valid authenticated session to query the directory; the bind DN provides the necessary identity and privileges for the FortiGate to search for VPN users.

Answer

It is used to encrypt LDAP communication

Answer

It defines the IP address of the LDAP server

Answer

It specifies the base DN for searching users

Question 9

During an SSL VPN tunnel mode connection, the client reports that they cannot access any internal resources, but the VPN connection is established. The FortiGate debug shows 'no matching policy'. The administrator has configured a policy allowing the SSL VPN interface to internal. What else must be configured?

Accepted Answer

Ensure the incoming interface of the policy is set to 'ssl.root' (or the SSL VPN interface). The SSL VPN tunnel mode creates a virtual interface (typically named 'ssl.root' or 'ssl.VDOM') on the FortiGate. Even though the administrator configured a policy allowing the SSL VPN interface to internal, the incoming interface in the policy must explicitly be set to this SSL VPN interface. If it is set to a different interface (e.g., the physical WAN interface), the FortiGate will not match the traffic from the SSL VPN tunnel, resulting in the 'no matching policy' debug message.

Answer

Add the client's assigned IP to a local user group

Answer

Configure a static route on the FortiGate for the client's tunnel IP

Answer

Enable split tunneling on the SSL VPN portal

Question 10

An administrator is troubleshooting an IPsec VPN that uses aggressive mode. The VPN establishes successfully, but the administrator is concerned about security. Which statement is true regarding aggressive mode?

Accepted Answer

Aggressive mode transmits the identification in clear text. In aggressive mode, the IKE phase 1 exchange uses three messages instead of six, and the peer's identity (such as the IP address or FQDN) is transmitted in cleartext during the second message before the secure tunnel is established. This exposes the identity to eavesdropping, making it less secure than main mode, which encrypts the identity after the tunnel is set up. The administrator's concern is valid because aggressive mode sacrifices identity protection for faster negotiation.

Answer

Aggressive mode is more secure than main mode

Answer

Aggressive mode provides perfect forward secrecy (PFS) by default

Answer

Aggressive mode uses six messages instead of three

Question 11

An administrator runs 'diagnose vpn ssl stat' and sees 'tun-num: 5, clients: 0'. Users are unable to connect to the SSL VPN. The SSL VPN settings are correct and the certificate is valid. What could be the cause?

Accepted Answer

The SSL VPN is listening on a non-default port and users are connecting to the default port. The 'tun-num: 5, clients: 0' output indicates that the SSL VPN tunnel interface is up but no clients are connected. If the SSL VPN settings and certificate are correct, the most likely cause is a port mismatch: the FortiGate is configured to listen on a non-default port (e.g., 10443), but users are attempting to connect to the default SSL VPN port (443). This prevents the SSL handshake from completing, resulting in zero active clients.

Answer

The FortiGate has reached the maximum number of SSL VPN users allowed by the license

Answer

The SSL VPN certificate is not trusted by the client browsers

Answer

The SSL VPN portal is configured with 'limit-scan' scanning

Question 12

An administrator needs to deploy two-factor authentication for SSL VPN users. The company uses FortiTokens. Which two steps are required to enable FortiToken for SSL VPN users? (Choose two.)

Accepted Answer

Configure two-factor authentication on the SSL VPN portal to require token code. FortiToken requires the user account to be associated with a FortiToken serial number, and the authentication method must be set to require token code along with password.

Answer

Install the FortiToken mobile app on the administrator's phone

Answer

Change the SSL VPN authentication scheme to RADIUS

Question 13

An administrator is configuring an IPsec VPN between two FortiGates using IKEv1. The tunnel must use main mode and support multiple subnets behind each gate. Which Phase2 settings are required to allow multiple subnets? (Choose two.)

Accepted Answer

Create multiple Phase2 selectors, each with different local and remote subnets. IKEv1 main mode requires that each pair of local and remote subnets be defined in its own Phase2 selector. This allows the VPN to establish separate security associations (SAs) for each subnet pair, enabling multiple subnets behind each FortiGate. Option E is also correct because using address objects that contain multiple subnets (e.g., a subnet group or address range) in a single Phase2 definition is a supported method to negotiate a single SA covering all those subnets, reducing the number of Phase2 selectors needed.

Answer

Set the Phase2 keylife to a higher value

Answer

Set the Phase2 proposal to include multiple encryption algorithms

Answer

Enable NAT traversal on the Phase2

Question 14

An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)

Accepted Answer

ZTNA proxy (application gateway). The ZTNA proxy (application gateway) is the core component that terminates client connections and forwards them to internal applications after verifying device and user identity. It acts as a reverse proxy, enforcing access policies before allowing any traffic to reach the protected resource. Without this gateway, the FortiGate cannot mediate ZTNA connections.

Answer

IPsec VPN tunnel

Answer

Captive portal

Question 15

A FortiGate administrator wants to authenticate VPN users against an existing Active Directory server. The administrator creates a user group referencing a remote LDAP server and configures the firewall policy to authenticate using that group. However, users report authentication failures. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag test authserver ldap '. The `diag test authserver ldap` command directly tests LDAP authentication against the specified server, username, and password, isolating whether the FortiGate can successfully bind and authenticate the user. This is the fastest way to determine if the issue lies with the LDAP server connectivity, credentials, or configuration, rather than with the user group or policy. Since the administrator has already created the group and policy, the first logical step is to verify the fundamental authentication path before examining higher-level configurations.

Answer

Verify the user group configuration

Answer

Restart the FortiGate

Answer

Check the LDAP server's firewall rules