NSE4 Authentication and VPN Practice Question
A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?
⚠ Common exam trap
A common mix-up: candidates think enabling 'Captive Portal' on the interface is sufficient, but they forget that a firewall policy with the correct action and authentication setting is required to actually trigger the redirect for unauthenticated traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.
Captive portal authentication on a FortiGate requires a firewall policy that matches the unauthenticated traffic (source interface 'guest', destination 'any') with action 'ACCEPT' and the 'Authentication' setting set to 'Captive Portal'. This policy triggers the FortiGate to intercept HTTP/HTTPS traffic from unauthenticated users and redirect them to the captive portal login page, enforcing authentication before allowing further access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the 'Guest Management' feature in the FortiGate dashboard.
Why it's wrong here
The Guest Management feature provides a framework for creating and administering guest user accounts, often integrating with a captive portal for self-registration or sponsor approval. However, enabling Guest Management alone does not trigger a redirect for unauthored traffic; you must still define a firewall policy with Captive Portal authentication on the source interface (guest) to catch and redirect those users.
- ✓
Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.
Why this is correct
The correct method is to configure a firewall policy that selects the 'guest' interface as the source, 'any' as the destination, and sets the action to ACCEPT while enabling 'Captive Portal' as the authentication method. When unauthenticated traffic matches this policy, FortiGate intercepts it and redirects the user to the captive portal for credentials. Once authenticated, the same policy permits the traffic, and this is the standard approach to enforce captive portal on a specific interface.
- ✗
Configure a 'Landing Page' under SSL-VPN settings.
Why it's wrong here
A 'Landing Page' under SSL-VPN settings is purely a customization for the SSL VPN web portal that users see after authenticating via the SSL VPN, not for captive portal authentication on a network interface. This setting has no effect on captive portal traffic arriving from the 'guest' interface, and configuring it will not redirect those HTTP requests to the authentication page.
- ✗
Enable 'Captive Portal' on the interface under System > Network > Interface.
Why it's wrong here
FortiGate does not expose a direct 'Enable Captive Portal' toggle on an interface under System > Network > Interface. Captive portal is a policy-based authentication feature; you enable it by creating a security policy that references the interface and sets an authentication scheme to Captive Portal. Without a matching policy, the interface itself will not redirect any traffic to a portal, so this option is invalid.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.