NSE4 Authentication and VPN Practice Test 8 — 15 Questions

Question 1

An SSL VPN user connects via web mode but cannot access internal resources. The admin checks the SSL VPN settings: tunnel mode is disabled, split tunneling is enabled, and the user's realm is configured correctly. What is the MOST likely cause?

Accepted Answer

No port forwarding rules are configured in the SSL VPN portal. In web mode, access to internal resources requires proper port forwarding rules within the SSL VPN portal. Without them, the user can only access resources explicitly listed.

Answer

Split tunneling is blocking internal routes

Answer

The user's browser does not support WebSocket

Answer

The user's client certificate is expired

Question 2

A FortiGate is configured with FSSO to poll Active Directory for user logon events. Users report that their logins are not being detected. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag debug fsso poll' to verify the collector agent status. The 'diag debug fsso poll' command shows the status of the FSSO collector agent and polling process, helping to identify issues.

Answer

Recreate all firewall policies

Answer

Disable and re-enable FSSO

Answer

Restart the FortiGate firewall

Question 3

Which IPsec VPN mode is typically used for site-to-site VPNs and is more secure because it negotiates Phase 1 in six messages?

Accepted Answer

Main mode. Main mode uses six messages to negotiate IKE Phase 1, providing identity protection and higher security.

Answer

Quick mode

Answer

Aggressive mode

Answer

IKEv2

Question 4

A FortiGate admin is configuring a dial-up IPsec VPN for remote users. The users have dynamic IP addresses. Which Phase 1 configuration is appropriate?

Accepted Answer

Set the remote gateway to 'Dialup User' and enable an IP pool. For dial-up VPN with dynamic remote IPs, set the remote gateway to 'Dialup User' and configure an IP pool to assign addresses to clients.

Answer

Disable XAuth authentication

Answer

Set the remote gateway to the user's IP address

Answer

Use aggressive mode with a group pre-shared key

Question 5

A FortiGate administrator notices that the IPsec VPN tunnel is established but traffic is not passing. The firewall policy allowing traffic from the remote subnet to the local subnet is in place. What is the MOST likely cause?

Accepted Answer

There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface. If the tunnel is up but no traffic passes, it could be due to routing misconfiguration, such as missing static routes for the remote subnet pointing to the VPN tunnel interface.

Answer

The VPN tunnel is a policy-based VPN and the policy is incorrectly configured

Answer

The Phase 2 proposal includes PFS, but the remote side does not

Answer

The local firewall is blocking ICMP

Question 6

A FortiGate admin configures a captive portal for guest users on a wireless network. Users can connect to the SSID but cannot access the internet. The admin verifies the firewall policy permits traffic from the captive portal interface to the internet. What is missing?

Accepted Answer

The firewall policy must have 'Enable Captive Portal' selected. Captive portal requires that the firewall policy has authentication enabled or the captive portal feature enabled under the policy's security features. A common issue is that the policy does not have 'Enable Captive Portal' checked.

Answer

A DNS server must be configured on the FortiGate

Answer

The users must be added to the local user database

Answer

The wireless controller must be configured with a RADIUS server

Question 7

An administrator runs 'diagnose vpn ike config' and sees the output includes 'P2 proposals: aes128-sha256, aes256-sha1'. What does this indicate?

Accepted Answer

The Phase 2 encryption and authentication algorithms. This output shows the Phase 2 proposals configured on the VPN tunnel. It lists the encryption and authentication algorithms that will be offered to the peer.

Answer

The Diffie-Hellman groups for Phase 2

Answer

The Phase 1 encryption settings

Answer

The lifetime settings for the VPN tunnel

Question 8

A FortiGate in a hub-and-spoke VPN topology has multiple spoke sites connecting via IPsec. The hub administrator wants to enable direct spoke-to-spoke communication without routing traffic through the hub. What technology should be used?

Accepted Answer

ADVPN (Auto-Discovery VPN). ADVPN (Auto-Discovery VPN) allows spokes to dynamically establish direct tunnels between each other, reducing hub load and latency.

Answer

Site-to-site VPN between each spoke pair manually

Answer

Policy-based VPN with multiple Phase 2 selectors

Answer

SSL VPN tunnel mode

Question 9

Which of the following is a benefit of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 is more robust to network changes and supports MOBIKE. IKEv2 is more resilient to network changes and supports MOBIKE, which allows the VPN to survive IP address changes.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires fewer firewall rules

Answer

IKEv2 uses a single UDP port 500

Question 10

A FortiGate admin configures a remote user for SSL VPN tunnel mode. The user can connect but cannot access resources on the internal network. The admin checks the SSL VPN settings: tunnel mode enabled, split tunneling disabled. What is the issue?

Accepted Answer

The firewall policy from the SSL VPN interface to the internal network is missing or incorrectly configured. When split tunneling is disabled, all traffic goes through the tunnel. The internal resources may not be reachable if the VPN interface's IP pool addresses are not routed correctly or if firewall policies on the FortiGate do not allow traffic from the tunnel interface.

Answer

The user's FortiClient is outdated

Answer

The SSL certificate is expired

Answer

The user's client software is not configured to route all traffic through the tunnel

Question 11

A FortiGate admin is troubleshooting an IPsec VPN where Phase 1 is up but Phase 2 fails to establish. Which TWO diagnostic commands would provide the most relevant information?

Accepted Answer

diagnose vpn tunnel list. 'diagnose vpn ike log' shows IKE negotiation details including Phase 2, and 'diagnose vpn tunnel list' shows tunnel status and configuration.

Answer

diagnose debug application ike -1

Answer

diagnose netlink interface list

Answer

diagnose sys session list

Question 12

An organization is implementing two-factor authentication for SSL VPN access using FortiToken. Which THREE components are necessary for this setup?

Accepted Answer

A firewall policy that requires authentication and references the user group. FortiToken two-factor requires the FortiToken itself, a user group with two-factor authentication enabled, and a firewall policy that references that user group and requires authentication.

Answer

An LDAP server for user synchronization

Answer

A RADIUS server for token validation

Question 13

A FortiGate admin wants to implement ZTNA to secure access to an internal application. Which TWO components are required for a basic ZTNA configuration?

Accepted Answer

A ZTNA rule (policy) that specifies access conditions. ZTNA requires a ZTNA rule (policy) that defines access criteria and a proxy policy that intercepts and forwards traffic to the internal application.

Answer

A FortiClient EMS server

Answer

An IPsec VPN tunnel to the client

Answer

A static route to the application server

Question 14

A network administrator wants to authenticate VPN users against an existing LDAP server. Which authentication method should be configured on the FortiGate?

Accepted Answer

LDAP. LDAP is the correct protocol for authenticating against an LDAP server. Local is for local users, RADIUS for RADIUS servers, and FSSO for SSO with Active Directory.

Answer

FSSO

Answer

RADIUS

Answer

Local

Question 15

An administrator configures an IPsec VPN with IKEv1 main mode. The remote peer reports that Phase 1 fails with a 'no proposal chosen' error. The local Phase 1 settings include: encryption AES128, authentication SHA1, DH group 2, lifetime 86400. Which remote peer setting is MOST likely causing the mismatch?

Accepted Answer

Remote peer uses AES256 instead of AES128. Main mode requires both sides to have matching parameters. A mismatch in any parameter causes 'no proposal chosen' error. The remote peer likely has AES256 instead of AES128.

Answer

Remote peer uses aggressive mode

Answer

Remote peer uses DH group 5 instead of group 2

Answer

Remote peer uses SHA256 instead of SHA1