NSE4 Authentication and VPN Practice Question
A FortiGate admin wants to authenticate VPN users against an existing Microsoft Active Directory. Which authentication method should be configured on the FortiGate?
⚠ Common exam trap
Many candidates confuse FSSO (which is for transparent network access) with direct authentication, or assume RADIUS is always required for AD integration, when LDAP is the simpler and correct method for direct user authentication in VPN scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP
(LDAP) is correct because Microsoft Active Directory natively supports LDAP (Lightweight Directory Access Protocol) for authentication and directory lookups. FortiGate can directly bind to AD using LDAP to verify VPN user credentials against the AD database without requiring an additional RADIUS server or agent. This method is efficient for direct user authentication in a Windows domain environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
LDAP
Why this is correct
LDAP is the standard directory access protocol used by Active Directory for querying and binding user credentials. When a FortiGate authenticates VPN users against an LDAP server, it performs an LDAP bind with the user's username and password to verify the credentials directly against the directory. Optionally, it can also retrieve group memberships to enforce access policies, making LDAP the most native and efficient method for integrating with AD.
- ✗
RADIUS
Why it's wrong here
RADIUS is an AAA protocol that centralizes authentication for network access but typically acts as an intermediary, proxying or forwarding authentication requests to a backend identity source such as LDAP or AD. In a FortiGate VPN setup, using RADIUS would require configuring and maintaining a separate RADIUS server to mediate between the firewall and the directory, adding unnecessary complexity and latency. This indirect approach is not the direct method implied by the question, which specifically asks about authenticating against an LDAP-compatible directory.
- ✗
FSSO
Why it's wrong here
FSSO (Fortinet Single Sign-On) is designed to capture Windows user logon events and map them to IP addresses for identity-based firewall policies, not to authenticate VPN users themselves. It relies on users already being authenticated to the domain and then reuses that context for traffic control, but it does not perform a credential validation for VPN tunnel establishment. Therefore, FSSO cannot serve as the authentication backend for validating VPN user passwords against AD.
- ✗
TACACS+
Why it's wrong here
TACACS+ is a Cisco-developed protocol primarily used for administrative authentication, authorization, and accounting of network devices, such as routers and switches. It separates the three A's to provide granular control over admin commands, but it is not intended for end-user VPN authentication. Moreover, TACACS+ is not commonly integrated with Active Directory for remote access scenarios, making it an unusual and incorrect choice for authenticating VPN users against an LDAP-based directory.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.