FORTINET-NSE123 Practice Question: Nse 2 Technical Introduction TO Fortinet Security
Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.
SSL VPN can operate in web mode (browser-based) or tunnel mode, whereas IPsec VPN requires dedicated client software or OS-level configurations. SSL VPN typically uses standard ports like TCP 443, whereas IPsec VPN uses UDP 500/4500.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.
Why it's wrong here
IPsec VPN operates at Layer 3 (Network layer), encapsulating IP packets directly.
- ✗
SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.
Why it's wrong here
IKE phase parameters are specific to IPsec VPN, not SSL VPN.
- ✗
IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.
Why it's wrong here
IPsec VPN is a standards-based protocol supported natively on FortiGate without requiring FortiClient EMS.
- ✓
SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.
Why this is correct
Using standard HTTPS ports allows SSL VPN to bypass strict outbound filtering rules that often block UDP ports used by IPsec.
- ✓
SSL VPN can provide clientless web-portal access without requiring a pre-installed VPN client application.
Why this is correct
SSL VPN supports web mode, allowing users to access corporate resources directly via a web browser.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva writes every FORTINET-NSE123 question from scratch — 296 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Fortinet exam blueprint
This FORTINET-NSE123 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the FORTINET-NSE123 exam.