NSE4 Authentication and VPN Practice Test 9 — 15 Questions

Question 1

You run the following command on a FortiGate: diagnose vpn ike gateway list. The output shows a gateway with state=DOWN. What is the most likely cause?

Accepted Answer

The remote peer is not reachable or is blocking IKE traffic. The `state=DOWN` in the `diagnose vpn ike gateway list` output indicates that the IKE Phase 1 (main mode or aggressive mode) negotiation has failed or never completed. The most common cause is that the remote peer is unreachable (e.g., due to network issues, firewall rules blocking UDP ports 500/4500, or incorrect peer IP configuration) or that the remote peer is actively blocking IKE traffic, preventing the initial exchange of IKE SA proposals.

Answer

The pre-shared key is correct but expired

Answer

The IPsec Phase 2 parameters are mismatched

Answer

The local certificate is not trusted by the remote peer

Question 2

A FortiGate is configured with IPsec VPN using IKEv2 and a policy-based tunnel. The remote subnet is 10.0.2.0/24, and the local subnet is 192.168.1.0/24. The tunnel is up, but traffic from 192.168.1.0/24 to 10.0.2.0/24 fails. The administrator checks the firewall policy and sees a policy allowing traffic from the local interface (port1) to the remote interface (virtual ipsec interface) with the action set to IPSEC. What is the most likely missing configuration?

Accepted Answer

The firewall policy's source or destination addresses are not correctly set to the local and remote subnets. In a policy-based IPsec VPN on FortiGate, the firewall policy must explicitly specify the local and remote subnets as the source and destination addresses. Even if the tunnel is up, traffic will fail if the policy's source/destination address objects do not match the actual subnets (192.168.1.0/24 and 10.0.2.0/24). The action set to IPSEC only enables VPN encapsulation; it does not override incorrect address matching.

Answer

IKEv2 does not support policy-based VPNs

Answer

The tunnel interface is not assigned to the correct VDOM

Answer

The Phase 2 proposal does not match the remote subnet

Question 3

What is the primary function of Fortinet Single Sign-On (FSSO) in a FortiGate deployment?

Accepted Answer

To collect user login events from Active Directory for user-based policies. Fortinet Single Sign-On (FSSO) is designed to collect user login events from Active Directory (AD) domain controllers. It monitors authentication traffic (e.g., via NetAPI or polling the AD security event log) to map IP addresses to usernames, enabling FortiGate to enforce user-based firewall policies without requiring users to manually authenticate to the firewall.

Answer

To provide two-factor authentication using FortiToken

Answer

To sync FortiGate configuration with Active Directory

Answer

To authenticate users against a RADIUS server

Question 4

An administrator configures a dial-up IPsec VPN with IKEv1 main mode. Remote clients can connect successfully, but the administrator notices that the Phase 1 negotiation takes a long time. Which change would most improve the negotiation speed without compromising security?

Accepted Answer

Enable IKEv2 instead of IKEv1. IKEv2 reduces Phase 1 negotiation time by using a single exchange of two messages (request/response) instead of IKEv1 main mode's six messages. This eliminates the extra round trips required for identity protection and SA negotiation, speeding up the process without reducing security. The question specifies IKEv1 main mode, so switching to IKEv2 directly addresses the slow negotiation while maintaining strong cryptographic protections.

Answer

Switch from main mode to aggressive mode

Answer

Reduce the IKE SA lifetime

Answer

Increase the number of Phase 1 proposals

Question 5

You run 'diagnose debug application sslvpn -1' and see the following output:
sslvpn: SSL VPN tunnel mode connection from 10.0.0.5:12345 to 192.168.1.100:443
sslvpn: User 'john' authenticated successfully
sslvpn: Error: no matching policy for the request. What does this indicate?

Accepted Answer

There is no SSL VPN policy that allows the user to access the destination IP/port. The error 'no matching policy for the request' indicates that the SSL VPN tunnel mode connection from user 'john' (source IP 10.0.0.5) to destination 192.168.1.100:443 did not match any SSL VPN policy configured on the FortiGate. SSL VPN policies define which users or user groups can access specific destination IP addresses and ports. Since authentication succeeded but no policy matched, the connection is denied at the policy layer, not due to authentication or interface issues.

Answer

The user's password has expired

Answer

The SSL VPN interface is administratively down

Answer

The FortiGate is not licensed for SSL VPN

Question 6

What is the purpose of a ZTNA (Zero Trust Network Access) tag on a FortiGate?

Accepted Answer

To mark devices or users with attributes used in security policies. ZTNA tags are user- or device-specific attributes (e.g., 'OS=Windows', 'Compliant=true') that FortiGate applies to endpoints after posture assessment. These tags can then be referenced in firewall policies to enforce granular, identity-aware access control, which is the core of Zero Trust Network Access.

Answer

To enable SNMP monitoring on the device

Answer

To assign static IP addresses to clients

Answer

To tag firewall policies for logging purposes

Question 7

A FortiGate is configured as a hub in a hub-and-spoke IPsec VPN. The spokes are remote branches. The hub has a Phase 2 selector set to 0.0.0.0/0 for both local and remote subnets. What is the advantage of this configuration?

Accepted Answer

It simplifies configuration by not needing specific subnet definitions per spoke. Using 0.0.0.0/0 as the Phase 2 selector on the hub allows the hub to accept any remote subnet from any spoke without defining each spoke's specific subnet in the Phase 2 configuration. This dramatically simplifies hub configuration in a hub-and-spoke topology because new spokes can be added without modifying the hub's Phase 2 selectors.

Answer

It reduces the number of IPsec SAs needed

Answer

It allows direct spoke-to-spoke communication without passing through the hub

Answer

It enables dynamic routing protocols over the VPN

Question 8

An administrator needs to implement two-factor authentication for SSL VPN access using FortiToken. Which configuration steps are required?

Accepted Answer

Assign a FortiToken to the user and set the user's authentication method to two-factor. To implement two-factor authentication for SSL VPN using FortiToken, you must assign a FortiToken to the user and set the user's authentication method to two-factor. This is done in the user configuration (e.g., under User & Authentication > User Definition) by selecting 'FortiToken' as the second factor and linking the token serial number. This ensures that during SSL VPN login, the user must provide both their password and a one-time password from the FortiToken, which is validated locally by the FortiGate without requiring an external RADIUS server.

Answer

Configure the RADIUS server to send FortiToken challenges

Answer

Enable FortiToken on the firewall policy

Answer

Enable two-factor authentication on the SSL VPN portal settings

Question 9

Which of the following is a characteristic of route-based IPsec VPN compared to policy-based IPsec VPN?

Accepted Answer

Route-based VPN can use dynamic routing protocols like OSPF. Route-based IPsec VPNs create a virtual tunnel interface (e.g., ipsec0 or tunnel) that acts as a logical routing point, allowing dynamic routing protocols such as OSPF to exchange routes over the encrypted tunnel. This is a key advantage over policy-based VPNs, which rely on static security policies and cannot support dynamic routing.

Answer

Route-based VPN is only supported in IKEv1

Answer

Route-based VPN requires Phase 2 selectors to match both local and remote subnets

Answer

Route-based VPN uses firewall policies with IPsec action

Question 10

A network administrator configured an IPsec VPN between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The diagnose output shows 'no matching proposal'. What is the MOST likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match between peers. The 'no matching proposal' error in Phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two FortiGate peers. Phase 2 uses these proposals to negotiate the IPsec SA for protecting data traffic, and a mismatch prevents the tunnel from establishing. Since Phase 1 completed successfully, the pre-shared keys and gateway IP are already verified, isolating the issue to Phase 2 configuration.

Answer

The firewall policy allowing the VPN traffic is missing

Answer

The pre-shared keys do not match

Answer

The remote gateway IP address is incorrect

Question 11

A FortiGate admin wants to authenticate VPN users against an existing Microsoft Active Directory. Which authentication method should be configured on the FortiGate?

Accepted Answer

LDAP. (LDAP) is correct because Microsoft Active Directory natively supports LDAP (Lightweight Directory Access Protocol) for authentication and directory lookups. FortiGate can directly bind to AD using LDAP to verify VPN user credentials against the AD database without requiring an additional RADIUS server or agent. This method is efficient for direct user authentication in a Windows domain environment.

Answer

RADIUS

Answer

FSSO

Answer

TACACS+

Question 12

Which IPsec VPN mode is typically used for site-to-site VPNs and is more secure because it negotiates Phase 1 in six messages?

Accepted Answer

Main mode. Main mode is the correct answer because it is the IPsec VPN mode typically used for site-to-site VPNs and is considered more secure due to its use of six messages during Phase 1 (IKE) negotiation. This mode protects the identities of both peers by encrypting the identity payloads after the Diffie-Hellman exchange, making it resistant to man-in-the-middle attacks and identity disclosure.

Answer

Quick mode

Answer

Aggressive mode

Answer

IKEv2

Question 13

A FortiGate admin configures a captive portal for guest users on a wireless network. Users can connect to the SSID but cannot access the internet. The admin verifies the firewall policy permits traffic from the captive portal interface to the internet. What is missing?

Accepted Answer

The firewall policy must have 'Enable Captive Portal' selected. For a captive portal to redirect unauthenticated users to the authentication page, the firewall policy that permits traffic from the captive portal interface to the internet must have the 'Enable Captive Portal' option selected. Without this setting, the FortiGate will not intercept HTTP/HTTPS requests and redirect them to the captive portal login page, so users remain unauthenticated and cannot access the internet even though the policy allows traffic.

Answer

A DNS server must be configured on the FortiGate

Answer

The users must be added to the local user database

Answer

The wireless controller must be configured with a RADIUS server

Question 14

An administrator runs 'diagnose vpn ike config' and sees the output includes 'P2 proposals: aes128-sha256, aes256-sha1'. What does this indicate?

Accepted Answer

The Phase 2 encryption and authentication algorithms. The output 'P2 proposals: aes128-sha256, aes256-sha1' from the 'diagnose vpn ike config' command specifically lists the Phase 2 (IPsec) proposals, which define the encryption and authentication algorithms used for protecting data traffic. Option C is correct because these are the Phase 2 encryption (aes128, aes256) and authentication (sha256, sha1) algorithms, not Phase 1 settings or other parameters.

Answer

The Diffie-Hellman groups for Phase 2

Answer

The Phase 1 encryption settings

Answer

The lifetime settings for the VPN tunnel

Question 15

A FortiGate in a hub-and-spoke VPN topology has multiple spoke sites connecting via IPsec. The hub administrator wants to enable direct spoke-to-spoke communication without routing traffic through the hub. What technology should be used?

Accepted Answer

ADVPN (Auto-Discovery VPN). ADVPN (Auto-Discovery VPN) is the correct technology because it dynamically establishes direct IPsec tunnels between spoke sites in a hub-and-spoke topology, eliminating the need to route inter-spoke traffic through the hub. It uses IKEv2 with short-cut messages (via the hub as a signaling broker) to allow spokes to learn each other's public IP addresses and negotiate a direct tunnel, reducing latency and hub load.

Answer

Site-to-site VPN between each spoke pair manually

Answer

Policy-based VPN with multiple Phase 2 selectors

Answer

SSL VPN tunnel mode