NSE4 Authentication and VPN Practice Test 8 — 15 Questions

Question 1

A FortiGate is configured with FSSO (Fortinet Single Sign-On) to authenticate users from Active Directory. Users are logging in to their domain-joined computers, but the FortiGate does not see the user sessions. The polling connector is configured correctly. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS resolution for the Domain Controller is failing. The polling connector relies on the FortiGate communicating with the Domain Controller (DC) to retrieve user logon events. If DNS resolution for the DC fails, the FortiGate cannot resolve the DC's hostname to an IP address, preventing the polling connector from establishing the necessary LDAP or NetAPI connections to collect user session data. This is the most likely cause because the polling connector is configured correctly, but network-level name resolution is a prerequisite for any communication.

Answer

The FSSO agent is not installed on the Domain Controller

Answer

The user group filter is too restrictive

Answer

The FortiGate is not in the same subnet as the users

Question 2

An administrator wants to configure SSL VPN web mode to allow remote users to access a specific internal web application without installing any client software. Which authentication method is required?

Accepted Answer

Any supported authentication method (local, LDAP, RADIUS, certificates). SSL VPN web mode on FortiGate allows remote users to access internal web applications through a browser without client software. FortiGate supports multiple authentication methods for web mode, including local users, LDAP, RADIUS, and certificate-based authentication, so any supported method can be used. There is no requirement for a specific authentication type, making option D correct.

Answer

Certificate-based authentication only

Answer

No authentication is required for web mode

Answer

Two-factor authentication with FortiToken is mandatory

Question 3

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 supports MOBIKE to handle IP address changes. IKEv2's primary advantage over IKEv1 is its support for MOBIKE (Mobility and Multihoming, RFC 4555), which allows an IPsec VPN tunnel to survive IP address changes without re-establishing the entire security association. This is critical for mobile users who switch between networks (e.g., from Wi-Fi to cellular) or for failover scenarios where the public IP changes. IKEv1 lacks this capability and would require a full rekey, causing session disruption.

Answer

IKEv2 requires less CPU resources

Answer

IKEv2 provides built-in NAT traversal

Answer

IKEv2 supports only certificate authentication

Question 4

An administrator needs to configure two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Enable FortiToken on the user account and configure the authentication scheme to require token. FortiGate requires two-factor authentication to be enabled on the user account itself (via the 'Two-factor Authentication' field set to 'FortiToken') and then an authentication scheme must be configured that includes a 'Token' requirement. This ensures that the user must provide both their password and a one-time token from the FortiToken device or app during SSL VPN login.

Answer

Enable two-factor authentication globally on the FortiGate

Answer

Install the FortiToken mobile app on the FortiGate

Answer

Create a separate firewall policy for token-based authentication

Question 5

A FortiGate is configured for SSL VPN tunnel mode with split tunneling enabled. The administrator wants to ensure that traffic to the corporate DNS server (10.0.1.10) goes through the tunnel while all other traffic goes directly to the internet. Which THREE configuration steps are required?

Accepted Answer

Add the DNS server subnet (10.0.1.0/24) to the split tunneling destinations. Adding the DNS server subnet (10.0.1.0/24) to the split tunneling destinations ensures that traffic destined for the corporate DNS server is routed through the SSL VPN tunnel, while all other traffic bypasses the tunnel. This is necessary when split tunneling is enabled and only specific subnets should traverse the VPN.

Answer

Disable NAT on the tunnel interface

Answer

Configure a static route on the client for 10.0.1.0/24 via the virtual adapter

Question 6

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN with three spokes. Each spoke has a dial-up connection to the hub. The hub uses a dynamic DNS name. Which THREE settings are necessary on each spoke to establish the VPN?

Accepted Answer

The pre-shared key or certificate for authentication. In a hub-and-spoke IPsec VPN with dial-up spokes, each spoke must authenticate with the hub. The pre-shared key or certificate (Option B) is required for IKE Phase 1 authentication, ensuring the spoke is trusted before the tunnel is established. Without this, the hub will reject the connection attempt.

Answer

A static route on the spoke for the hub's local networks

Answer

NAT enabled on the spoke tunnel interface

Question 7

An administrator is configuring a hub-and-spoke IPsec VPN with a FortiGate as the hub. The spokes must be able to communicate with each other through the hub. Which THREE settings must be enabled on the hub FortiGate?

Accepted Answer

Enable 'arp-response' on the phase1 interface. For a hub-and-spoke IPsec VPN where spokes communicate through the hub, three settings must be enabled on the hub FortiGate. First, 'arp-response' on the phase1 interface (A) allows the hub to respond to ARP requests for spoke subnets, enabling Layer 2 communication. Second, static routes for each spoke's local subnet (B) ensure the hub knows how to forward traffic between spokes. Third, 'add-route' on each phase1 interface (E) automatically installs routes for the subnets defined in the phase2 selectors, which is necessary for the hub to route traffic to and from spokes. Options C and D are incorrect: 'mode-cfg' is for client IP assignment in remote access, not site-to-site; 'auto-discovery-sender' is for ADVPN dynamic tunnels, not for static hub-and-spoke.

Answer

Set 'mode-cfg' to enable on the hub phase1

Answer

Enable 'auto-discovery-sender' on the hub

Question 8

An administrator is troubleshooting an SSL VPN connection. Users can connect and authenticate, but they cannot access any internal resources. The firewall policy allows the SSL VPN interface to the internal network. Which THREE commands or configuration checks should the administrator use to diagnose the issue?

Accepted Answer

'get router info routing-table all' to verify routes. The correct commands are B, D, and E. B ('get router info routing-table all') verifies that a route exists to the internal network, which is essential even if the policy allows traffic. D ('diagnose firewall policy list') confirms whether the policy is actually matching traffic from the SSL VPN interface. E ('diagnose vpn ssl list') shows active SSL VPN sessions, allowing verification that the user has a valid assigned IP and tunnel status. A is incorrect because FortiGate cannot source pings from virtual interfaces like ssl.root, and C is incorrect because 'diagnose debug application sslvpn -1' focuses on SSL VPN handshake/debug logs, not routing or policy matching for post-authentication connectivity.

Answer

'execute ping from ssl.root to internal IP'

Answer

'diagnose debug application sslvpn -1' to enable debug logging

Question 9

An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?

Accepted Answer

The Phase 2 selectors (local and remote subnets) are mismatched.. When Phase 1 parameters are identical and the VPN is down, the most common cause is a mismatch in Phase 2 selectors (local and remote subnets). Phase 2 uses these selectors to negotiate the IPsec security associations (SAs); if they do not match exactly on both sides, the IKEv1/v2 Quick Mode or Child SA exchange will fail, leaving the tunnel in a 'down' state even though Phase 1 (IKE SA) may be up.

Answer

The pre-shared keys do not match.

Answer

The firewall policies are not configured.

Answer

NAT traversal is disabled but both FortiGates are behind NAT.

Question 10

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

Accepted Answer

The phase2 configuration does not specify the local and remote subnets to protect.. The phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.

Answer

The phase1 keylife is longer than the phase2 keylife, causing rekey issues.

Answer

The 'set net-device disable' prevents the tunnel from being used for routing.

Answer

The phase2 proposal does not match the phase1 proposal.

Question 11

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

Accepted Answer

Phase 2 encryption or authentication algorithms do not match on both sides.. The 'no suitable proposal found' error in Phase 2 of an IPsec VPN tunnel indicates that the Phase 2 parameters (encryption algorithm, authentication algorithm, or PFS settings) do not match between the two FortiGate peers. Since Phase 1 is up, the IKE SA is established, meaning pre-shared keys, remote gateway reachability, and basic firewall policies for IKE traffic are correct. The mismatch specifically occurs in the Phase 2 proposal negotiation, where each side sends its supported transforms and the responder cannot find a common set.

Answer

The firewall policy allowing IPsec traffic is missing.

Answer

The remote gateway IP address is unreachable.

Answer

The pre-shared key is incorrect.

Question 12

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is in SYN_SENT state and might be stuck due to no response from the server.. The output shows `proto_state=01`, which in Fortinet's session table corresponds to the TCP SYN_SENT state (the session is waiting for a SYN-ACK from the server). The `duration=3600` indicates the session has existed for 3600 seconds, but the `expire=3599` shows it has not yet been confirmed as established. This combination indicates the session is stuck in the SYN_SENT state, likely because the server is not responding, making option B correct.

Answer

The session is fully established and has been active for 3600 seconds.

Answer

The session has been idle for 3599 seconds and will expire soon.

Answer

The session is in FIN_WAIT state and is being closed.

Question 13

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Accepted Answer

The FSSO collector agent service is not running.. If the FSSO collector agent service is not running, the FortiGate cannot receive the logon events from the domain controllers. Without these events, the FortiGate has no way to know which users are authenticated, so it falls back to prompting for credentials on every new session, even though users are already logged into the domain.

Answer

The users are not members of the FSSO group.

Answer

The firewall policy uses 'All Users' instead of a specific group.

Answer

The FortiGate's LDAP server is unreachable.

Question 14

An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?

Accepted Answer

The Phase 2 proposals do not match between the FortiGate and the client.. In IKEv2 VPNs, Phase 1 establishes the secure control channel (ISAKMP SA) and shows 'up' even if Phase 2 fails. Phase 2 creates the IPsec SA for actual data traffic; if it remains 'down', the most common cause is a mismatch in Phase 2 proposals (encryption, authentication, or PFS settings) between the FortiGate and the remote client. Since the client can connect but traffic is not routed, the tunnel is not fully established for data, pointing directly to a Phase 2 proposal mismatch.

Answer

The firewall policy for the VPN traffic is missing.

Answer

The pre-shared key for Phase 2 is incorrect.

Answer

The remote user's client does not support IKEv2.

Question 15

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Accepted Answer

Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.. Captive portal authentication on a FortiGate requires a firewall policy that matches the unauthenticated traffic (source interface 'guest', destination 'any') with action 'ACCEPT' and the 'Authentication' setting set to 'Captive Portal'. This policy triggers the FortiGate to intercept HTTP/HTTPS traffic from unauthenticated users and redirect them to the captive portal login page, enforcing authentication before allowing further access.

Answer

Set the 'Guest Management' feature in the FortiGate dashboard.

Answer

Configure a 'Landing Page' under SSL-VPN settings.

Answer

Enable 'Captive Portal' on the interface under System > Network > Interface.