NSE4 Authentication and VPN Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting an SSL VPN issue where remote users cannot access internal resources after successful authentication. Which TWO steps should the admin take to resolve the issue? (Select two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that a firewall policy exists allowing traffic from the SSL VPN interface to the internal network. After successful SSL VPN authentication, traffic from the remote user must be permitted by a firewall policy that allows traffic from the SSL VPN interface (e.g., ssl.root) to the destination internal network interface. Without this policy, packets are dropped even if authentication succeeds. Option C is correct because the FortiGate must have a route back to the SSL VPN client IP pool (or the client's virtual IP) in its routing table; if the return route is missing, the FortiGate cannot forward reply traffic to the remote user, causing asymmetric routing and connectivity failure.

Answer

Increase the authentication timeout

Answer

Restart the FortiGate

Answer

Disable the SSL VPN portal

Question 2

A company sets up a hub-and-spoke IPsec VPN where all spokes must communicate through the hub. The hub uses policy-based IPsec. Which THREE configurations are required on the hub to allow spoke-to-spoke traffic? (Select three.)

Accepted Answer

Separate phase2 selectors defining traffic between each pair of spokes. In a hub-and-spoke policy-based IPsec VPN, the hub must have separate phase2 selectors for each spoke-to-spoke traffic flow because policy-based VPNs define encryption domains per pair of subnets. Without these selectors, the hub cannot match spoke-to-spoke traffic to a specific IPsec SA, and the traffic will be dropped or sent unencrypted.

Answer

Configure IKEv2 instead of IKEv1

Answer

Enable NAT on the hub for spoke-to-spoke traffic

Question 3

An organization wants to implement ZTNA (Zero Trust Network Access) on their FortiGate. Which TWO components are essential for ZTNA? (Select two.)

Accepted Answer

Client certificates for device posture verification. Client certificates are essential for ZTNA because they enable device posture verification, ensuring that only trusted and compliant devices can access protected resources. FortiGate uses client certificates to validate the device's identity and health status before granting access, which is a core principle of Zero Trust.

Answer

A dedicated VPN tunnel

Answer

A static IP address for the client

Answer

A RADIUS server for two-factor authentication

Question 4

An administrator runs 'diagnose debug application ike -1' and sees the following output:
ike 0:come to x.x.x.x:500, IKEv1, cookie 123456789abcdef0
ike 0:incoming IKE packet: src y.y.y.y:500, dst x.x.x.x:500, len 456
ike 0:send IKE packet: src x.x.x.x:500, dst y.y.y.y:500, len 456
ike 0:phase 1 negotiation failed due to time out.
What is the likely cause?

Accepted Answer

A firewall rule is blocking UDP 500/4500 between the peers. The output shows that the IKE packet is being sent and received (no proposal mismatch or interface down), but the negotiation fails due to a timeout. This indicates that the packet is leaving the local FortiGate but the response is not arriving back, which is classic behavior when a firewall (or ACL) between the peers is blocking UDP 500 or 4500. The timeout occurs because the remote peer never receives the initial packet or the local peer never receives the reply, preventing any IKE exchange from completing.

Answer

The remote FortiGate's Phase 1 proposal does not match

Answer

The pre-shared key is incorrect

Answer

The local FortiGate's external interface is down

Question 5

An administrator wants to allow remote users to access internal resources using a web browser without installing any client software. Which VPN type should be configured on the FortiGate?

Accepted Answer

SSL VPN web mode. SSL VPN web mode (option D) is correct because it provides clientless remote access to internal resources via a web browser, requiring no software installation. The FortiGate acts as a reverse proxy, translating HTTPS requests from the user's browser to internal HTTP/HTTPS servers, which matches the requirement for browser-only access without client software.

Answer

ZTNA access proxy

Answer

IPsec VPN with dial-up mode

Answer

SSL VPN tunnel mode

Question 6

A company uses Active Directory for user authentication. They want users to automatically authenticate to the FortiGate without entering credentials when accessing the internet. Which authentication method should the administrator configure?

Accepted Answer

FSSO with Active Directory polling. FSSO (Fortinet Single Sign-On) with Active Directory polling allows users to be automatically authenticated to the FortiGate based on their existing Windows domain login. The FortiGate polls the domain controllers for user logon events, mapping the user's IP address to their authenticated identity without requiring any additional credential entry. This meets the requirement of transparent internet access authentication.

Answer

LDAP authentication with captive portal

Answer

RADIUS authentication with PAP

Answer

Local user authentication

Question 7

An administrator is troubleshooting an IPsec VPN that fails to establish. The 'diagnose vpn ike log' shows 'initial contact received'. What does this message indicate?

Accepted Answer

The remote peer has restarted and cleared its security associations. In IPsec IKE (Internet Key Exchange), an 'initial contact' notification is sent by a peer to inform the other side that it has just restarted or cleared its security associations (SAs). This message tells the receiving peer to delete any existing SAs associated with that peer, allowing a fresh IKE negotiation to begin. Therefore, the message indicates the remote peer has restarted and cleared its SAs, not a configuration or NAT issue.

Answer

The pre-shared key is incorrect

Answer

The Phase 1 proposal is mismatched

Answer

A network address translation device is altering the IKE packets

Question 8

Which of the following FortiGate features allows users to authenticate using a one-time password generated by a mobile app?

Accepted Answer

FortiToken. FortiToken is Fortinet's two-factor authentication solution that generates one-time passwords (OTPs) via a mobile app (FortiToken Mobile) or hardware token. When a user authenticates, they must provide both their regular password and the current OTP from the FortiToken app, which is validated by the FortiGate against the token's seed record. This directly matches the question's requirement for OTP generation by a mobile app.

Answer

FSSO

Answer

LDAP

Answer

Captive portal

Question 9

An administrator wants to restrict SSL VPN access to only users who have a valid client certificate issued by the company's internal CA. Which setting should be configured?

Accepted Answer

Enable 'require client certificate' in the SSL VPN settings. The 'require client certificate' setting in the SSL VPN portal or interface configuration enforces mutual TLS (mTLS), where the FortiGate requests and validates a client certificate against the configured CA. This ensures that only users presenting a valid certificate issued by the company's internal CA can establish the SSL VPN tunnel, regardless of their authentication credentials.

Answer

Configure a firewall policy with identity-based authentication

Answer

Enable 'certificate-based authentication' in the user group

Answer

Import the users' public keys into the FortiGate

Question 10

A FortiGate administrator has configured a route-based IPsec VPN. After Phase 2 is up, traffic is not passing. The administrator verifies that the firewall policy allows traffic and the routes are correct. What should the administrator check next?

Accepted Answer

The static route uses the VPN interface as the outgoing interface. In a route-based IPsec VPN, traffic is routed to the VPN tunnel interface (e.g., 'to_remote'). Even if firewall policies and static routes exist, the static route must explicitly use the VPN interface as the outgoing interface. If the static route points to a different interface or a next-hop IP instead of the tunnel interface, the kernel will not forward traffic into the IPsec tunnel, causing Phase 2 to be up but no traffic to pass. This is a common misconfiguration that breaks the route-based VPN model.

Answer

The remote gateway's IP address is reachable

Answer

The pre-shared key is correct

Answer

The Phase 2 proposal includes the correct local and remote subnets

Question 11

An administrator is configuring ZTNA on a FortiGate. The goal is to allow access to an internal web server only if the client device has a specific security posture (e.g., antivirus running). Which ZTNA component is responsible for verifying the client's security posture?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) is the ZTNA component that verifies the client's security posture by collecting endpoint telemetry (e.g., antivirus status, OS patch level) and enforcing compliance policies. The FortiGate queries FortiClient EMS via the FortiTelemetry protocol to determine if the client meets the required security posture before granting access. Without EMS, the FortiGate has no mechanism to assess endpoint health in a ZTNA flow.

Answer

ZTNA access proxy

Answer

IPsec VPN interface

Answer

SSL VPN portal

Question 12

An administrator has configured LDAP authentication on a FortiGate. When testing the LDAP connectivity, the test succeeds. However, users cannot authenticate through the captive portal. What is a possible cause?

Accepted Answer

The user group is not configured to use the LDAP server. The LDAP connectivity test succeeds, confirming the FortiGate can reach and bind to the LDAP server. However, for captive portal authentication to work, the user group must be explicitly configured to reference the LDAP server as its remote authentication source. Without this mapping, the FortiGate does not know to send authentication requests to the LDAP server, even though the LDAP server connection itself is functional.

Answer

The captive portal is disabled

Answer

The LDAP server is not reachable from the captive portal interface

Answer

The LDAP server's SSL certificate is expired

Question 13

An administrator is troubleshooting an IPsec VPN that is not passing traffic. The Phase 1 and Phase 2 are both up. Which TWO CLI commands can be used to verify the VPN tunnel status and traffic flow? (Choose two.)

Accepted Answer

diagnose vpn tunnel list. 'diagnose vpn tunnel list' displays the status of all IPsec VPN tunnels, including Phase 1 and Phase 2 security associations (SAs), their uptime, and the number of packets transmitted and received. This allows the administrator to verify that the tunnel is established and to check for any packet drops or errors that might indicate a traffic flow issue.

Answer

execute ping-options source

Answer

diagnose vpn ike config

Answer

diagnose netlink interface list

Question 14

Which authentication method allows FortiGate to authenticate users against an Active Directory domain without storing domain credentials locally?

Accepted Answer

LDAP authentication. LDAP authentication allows FortiGate to verify user credentials directly against an Active Directory domain controller without storing the domain passwords locally. The FortiGate sends a BIND request with the user's DN and password to the LDAP server, which validates the credentials and returns a success or failure response. This avoids local storage of domain credentials while still enabling centralized authentication.

Answer

FSSO polling

Answer

RADIUS authentication

Answer

Local user database

Question 15

A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?

Accepted Answer

Web mode only allows access to specific bookmarks configured in the portal. In SSL VPN web mode, the FortiGate acts as a proxy, granting access only to pre-configured bookmarks (URLs or applications) defined in the SSL VPN portal. Default portal settings do not include any bookmarks, so even after successful authentication, the user sees an empty portal and cannot reach internal resources. This is by design, as web mode does not provide full network-layer access like tunnel mode does.

Answer

The user must be authenticated via LDAP

Answer

The user has not installed the FortiClient VPN plugin

Answer

The SSL VPN policy is missing a security profile