NSE4 Authentication and VPN — Timed 40 Questions

Question 1

A remote user reports that they can connect to the FortiGate SSL VPN portal but cannot access internal resources. The administrator checks the SSL VPN settings and sees that the tunnel mode is enabled with split tunneling. What is the most likely cause?

Accepted Answer

The routing table on the client is missing the internal network routes.. With split tunneling enabled, the FortiGate SSL VPN portal connection succeeds, but the client's routing table does not automatically include routes for the internal network. Without those routes, traffic to internal resources is sent to the default gateway instead of through the VPN tunnel, causing access failure. This is the most likely cause because the user can authenticate and establish the tunnel but cannot reach internal subnets.

Answer

The IP pool is exhausted and no IP address was assigned.

Answer

The firewall policy allowing SSL VPN traffic to internal resources is missing.

Answer

The SSL VPN authentication timeout is too short.

Question 2

An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?

Accepted Answer

The Phase 2 selectors (local and remote subnets) are mismatched.. When Phase 1 parameters are identical and the VPN is down, the most common cause is a mismatch in Phase 2 selectors (local and remote subnets). Phase 2 uses these selectors to negotiate the IPsec security associations (SAs); if they do not match exactly on both sides, the IKEv1/v2 Quick Mode or Child SA exchange will fail, leaving the tunnel in a 'down' state even though Phase 1 (IKE SA) may be up.

Answer

The pre-shared keys do not match.

Answer

The firewall policies are not configured.

Answer

NAT traversal is disabled but both FortiGates are behind NAT.

Question 3

A company with multiple remote sites uses IPsec VPNs. One site reports intermittent connectivity. The administrator checks the logs and sees 'IPsec phase 2 negotiation failed' messages. Which configuration change is most likely to resolve the issue?

Accepted Answer

Enable Dead Peer Detection (DPD) on the Phase 1 interface.. Intermittent IPsec phase 2 negotiation failures often occur when one peer's Phase 2 security association (SA) expires while the other peer still considers it valid, causing a mismatch. Enabling Dead Peer Detection (DPD) on the Phase 1 interface allows the FortiGate to actively probe the peer's liveness and renegotiate Phase 1 and Phase 2 SAs before they expire, preventing the state mismatch that leads to intermittent failures.

Answer

Change the encryption algorithm from AES256 to 3DES.

Answer

Increase the Phase 2 lifetime.

Answer

Enable NAT traversal.

Question 4

An administrator is troubleshooting an SSL VPN connection issue. Users can authenticate but receive 'No available tunnel' error. What is the most likely cause?

Accepted Answer

The SSL VPN IP pool has run out of addresses.. The 'No available tunnel' error after successful authentication indicates that the SSL VPN daemon cannot assign an IP address to the client. The most likely cause is that the SSL VPN IP pool has exhausted its available addresses, preventing the creation of a virtual tunnel interface. This is a common issue when the pool size is smaller than the number of concurrent users.

Answer

Split tunneling is misconfigured.

Answer

The firewall policy does not allow traffic from the SSL VPN interface.

Answer

The SSL VPN port is blocked on the firewall.

Question 5

A site-to-site IPsec VPN is configured with IKEv2. The tunnel establishes but traffic does not pass. Which two troubleshooting steps should the administrator perform first?

Accepted Answer

Check the firewall policies allowing traffic through the tunnel.. Option C is correct because even if the IPsec tunnel is established, traffic will not pass unless firewall policies explicitly permit it. In FortiGate, a Phase 2 tunnel being up does not imply that traffic is allowed; you must have a policy that matches the source/destination and enables the action to forward traffic through the tunnel interface.

Answer

Check the Phase 2 selectors.

Answer

Verify that the Phase 1 proposal matches.

Question 6

A FortiGate administrator is designing an SSL VPN solution for 500 remote users. The users need full network access. Which two design considerations are most important?

Accepted Answer

Ensure the SSL VPN IP pool has enough addresses for concurrent users.. Option A is correct because the SSL VPN IP pool must have enough addresses to assign to all concurrent users. Without a sufficient pool, users will fail to obtain an IP address and cannot access the network. Option B is correct because firewall policies are required to permit traffic from the SSL VPN interface (e.g., ssl.root) to internal networks; without them, traffic is dropped even if the tunnel is established.

Answer

Configure split tunneling to reduce load on the FortiGate.

Answer

Use certificate-based authentication for all users.

Answer

Enable port forwarding for RDP and SSH.

Question 7

An administrator is configuring a dialup IPsec VPN for remote users. Which two settings must be configured on the FortiGate to allow clients to connect?

Accepted Answer

Enable mode-cfg on the Phase 1 interface.. Option C is correct because mode-config (mode-cfg) on the Phase 1 interface is required to push network configuration parameters (such as DNS, WINS, and the virtual IP address) to remote IPsec VPN clients. This setting enables the FortiGate to act as a server in a dialup VPN scenario, dynamically assigning IP addresses and other settings to clients without requiring static configuration on each client.

Answer

Enable XAuth for user authentication.

Answer

Enable Dead Peer Detection.

Answer

Enable NAT traversal.

Question 8

A company has a FortiGate at headquarters running FortiOS 7.2 and a remote office with a FortiGate 60F running FortiOS 7.0. They have an IPsec VPN tunnel between them for site-to-site connectivity. Recently, the remote office upgraded their FortiGate from 6.4 to 7.0. After the upgrade, the VPN tunnel is down. The Phase 1 status shows 'negotiating' but never completes. The administrator has verified that the pre-shared key, IKE version (IKEv2), and authentication method are the same on both sides. The Phase 1 proposal on the headquarters is: encryption: AES256, SHA256, DH group 14, lifetime 86400. The remote office uses: encryption: AES256, SHA1, DH group 14, lifetime 86400. What is the most likely cause of the failure?

Accepted Answer

The Phase 1 hash algorithm differs; headquarters uses SHA256, remote uses SHA1.. The Phase 1 proposal mismatch on the hash algorithm (SHA256 vs. SHA1) prevents the IKEv2 peers from agreeing on a common transform set. Even though all other parameters match, the hash algorithm must be identical on both sides for the IKE SA to be established. The 'negotiating' state that never completes is a classic symptom of a proposal mismatch.

Answer

The DH group is different; headquarters uses group 14, remote uses group 5.

Answer

The IKE version is mismatched; headquarters uses IKEv2 and remote uses IKEv1.

Answer

The pre-shared key is incorrect after the upgrade.

Question 9

A company wants to provide remote access to internal resources for employees using laptops that may connect from untrusted networks. The security team requires that all traffic between the remote users and the corporate network be encrypted, and that users must authenticate using a username/password plus a one-time passcode from a hardware token. Which FortiGate VPN solution best meets these requirements?

Accepted Answer

SSL VPN with FortiToken two-factor authentication. Option C is correct because SSL VPN with FortiToken two-factor authentication meets the requirement for encrypted remote access with username/password plus a one-time passcode from a hardware token. SSL VPN provides encrypted tunnels over HTTPS, and FortiToken adds the required second factor, ensuring strong authentication even from untrusted networks.

Answer

IPsec VPN with certificate-based authentication

Answer

SSL VPN with local password authentication

Answer

L2TP/IPsec VPN with a pre-shared key and user password

Question 10

Which TWO are best practices for configuring IPsec VPN on FortiGate to ensure high availability and security?

Accepted Answer

Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.. Perfect Forward Secrecy (PFS) ensures that if an attacker compromises the private key used during IKE phase1, they cannot derive the session keys used in phase2. By requiring a new Diffie-Hellman exchange for each phase2 rekey, PFS isolates the compromise to only the current session, protecting past and future encrypted traffic. This is a critical security best practice for IPsec VPNs on FortiGate.

Answer

Disable DPD on the phase1 interface to reduce overhead.

Answer

Use aggressive mode for faster IKE negotiation.

Answer

Disable PFS to reduce CPU load on the firewall.

Question 11

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

Accepted Answer

The phase2 configuration does not specify the local and remote subnets to protect.. Option C is correct because the phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.

Answer

The phase1 keylife is longer than the phase2 keylife, causing rekey issues.

Answer

The 'set net-device disable' prevents the tunnel from being used for routing.

Answer

The phase2 proposal does not match the phase1 proposal.

Question 12

Drag and drop the steps to upgrade FortiGate firmware via the web interface into the correct order.

Question 13

Match each FortiGate VPN type to its characteristic.

Question 14

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

Accepted Answer

Phase 2 encryption or authentication algorithms do not match on both sides.. This error indicates that the Phase 2 proposals (encryption, authentication, etc.) do not match between the two peers. Phase 1 succeeded, so the IKE parameters are compatible; the issue lies in the Phase 2 settings.

Answer

The firewall policy allowing IPsec traffic is missing.

Answer

The remote gateway IP address is unreachable.

Answer

The pre-shared key is incorrect.

Question 15

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is in SYN_SENT state and might be stuck due to no response from the server.. The session state '01' indicates TCP SYN_SENT, meaning the session is still in the handshake phase. The duration is 3600 seconds, which is unusually long for a TCP handshake, suggesting the session is stuck or the server is not responding.

Answer

The session is fully established and has been active for 3600 seconds.

Answer

The session has been idle for 3599 seconds and will expire soon.

Answer

The session is in FIN_WAIT state and is being closed.

Question 16

An organization wants to use FortiToken for two-factor authentication on SSL VPN logins. Which authentication method must be enabled on the FortiGate to support this?

Accepted Answer

Two-factor authentication with FortiToken. FortiToken requires two-factor authentication. On FortiGate, this is configured by enabling 'Two-factor Authentication' under the user group or authentication settings, typically set to 'FortiToken' for token-based OTP.

Answer

RADIUS authentication

Answer

PKI authentication

Answer

LDAP authentication

Question 17

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Accepted Answer

The FSSO collector agent service is not running.. FSSO relies on polling the domain controllers or using a collector agent to capture user logon events. If the DC polling fails or the collector agent is not working, FortiGate cannot correlate the user, so it prompts for authentication.

Answer

The users are not members of the FSSO group.

Answer

The firewall policy uses 'All Users' instead of a specific group.

Answer

The FortiGate's LDAP server is unreachable.

Question 18

An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?

Accepted Answer

The Phase 2 proposals do not match between the FortiGate and the client.. IKEv2 requires a valid proposal match for Phase 2. If the Phase 2 parameters (encryption, authentication, etc.) do not match between the peer and the FortiGate, Phase 2 fails. Also, with IKEv2, the tunnel mode and proxy IDs must be correctly configured.

Answer

The firewall policy for the VPN traffic is missing.

Answer

The pre-shared key for Phase 2 is incorrect.

Answer

The remote user's client does not support IKEv2.

Question 19

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Accepted Answer

Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.. Captive portal works by configuring a firewall policy that matches the user's traffic with 'Authentication' set to 'Captive Portal' or by enabling it directly on the interface. Typically, a policy with 'Security Mode' 'Captive Portal' forces redirect.

Answer

Set the 'Guest Management' feature in the FortiGate dashboard.

Answer

Configure a 'Landing Page' under SSL-VPN settings.

Answer

Enable 'Captive Portal' on the interface under System > Network > Interface.

Question 20

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Accepted Answer

Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.. Route-based VPNs create a virtual interface (e.g., 'tunnel') that is used in routing and firewall policies, while policy-based VPNs define the traffic selectors within the Phase 2 configuration itself, without a separate interface.

Answer

Route-based requires a static route, policy-based uses dynamic routing.

Answer

Route-based encrypts all traffic, policy-based encrypts only specified services.

Answer

Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.