NSE4 Authentication and VPN Practice Question
A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?
⚠ Common exam trap
Many exam-takers assume LDAP authentication failure is always due to connectivity or protocol issues (like TLS or HTTP), but FortiGate's group membership enforcement is a distinct step that can cause failure even with valid credentials and a reachable server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is not a member of the configured user group
The most likely cause is that the user is not a member of the configured user group. In FortiGate, when LDAP authentication is used for a captive portal, the FortiGate first verifies the user's credentials against the LDAP server. Even if the credentials are valid, the FortiGate then checks whether the authenticated user belongs to a specific user group that is permitted to access the captive portal. If the user is not a member of that group, the authentication fails, even though the LDAP server itself accepts the credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user is not a member of the configured user group
Why this is correct
FortiGate uses LDAP for credential validation, but the firewall policy specifies a particular user group that must contain the authenticated account. After the LDAP bind succeeds, FortiGate performs a group lookup against the configured group; if the user is not a member, the captive portal rejects the login even though the password was correct. This is an authorization failure rather than an authentication failure, and it is the classic cause of a captive portal rejecting valid LDAP creds.
- ✗
The captive portal is using HTTP instead of HTTPS
Why it's wrong here
Serving the captive portal over HTTP instead of HTTPS does not break the authentication flow; the FortiGate still processes the submitted form over port 80 and can authenticate the user against LDAP. It only exposes the credentials to eavesdropping on the network, which is a security risk, not a functional reason for a login to fail. Since the user is able to submit their credentials and see an authentication error, HTTP is not the culprit.
- ✗
The captive portal interface is not in the same VDOM as the LDAP server
Why it's wrong here
The captive portal interface and the LDAP server can reside in different VDOMs without affecting authentication, because FortiGate routes LDAP traffic based on its routing table rather than requiring same-VDOM placement. As long as a valid route exists to reach the LDAP server, the FortiGate will bind and query it for authentication. VDOM placement only matters for policy enforcement and administrative boundaries, not for LDAP connectivity.
- ✗
The LDAP server requires TLS and FortiGate is using plain LDAP
Why it's wrong here
If the LDAP server required TLS and FortiGate were using plain LDAP, the initial connection to port 389 would be rejected or reset by the server before any credentials are transmitted. That would surface as an LDAP server unreachable or connection error in the logs, and the user would not even see a captive portal login failure after submitting credentials. The scenario described indicates authentication was attempted and processed, so a TLS mismatch is not consistent with the symptom.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.