NSE4 Authentication and VPN Practice Question
A FortiGate administrator configures an SSL VPN web mode portal. Users can access internal web applications but cannot access internal file shares via SMB. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to assume SSL VPN policies or firewall rules are misconfigured, overlooking the fundamental architectural limitation that web mode only supports web-based applications, not arbitrary TCP/UDP protocols like SMB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web mode does not support the SMB protocol; users must use tunnel mode to access fileshares
SSL VPN web mode operates as a reverse proxy, translating HTTP/HTTPS traffic only. SMB (Server Message Block) is a non-web protocol that requires direct network-layer connectivity, which web mode cannot provide. Tunnel mode creates a virtual network interface that allows any IP-based protocol, including SMB, to traverse the VPN. Therefore, the correct solution is to use tunnel mode for file share access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSL VPN policy does not allow SMB traffic
Why it's wrong here
The SSL VPN policy in web mode is an access control list for web-based resources, not a general traffic policy. It matches only HTTP/HTTPS connections to published applications, so SMB traffic is not even considered for policy matching. Even if the policy were modified to include SMB, the web-mode portal cannot proxy native CIFS or SMB protocol.
- ✗
The fileserver requires client certificates for authentication
Why it's wrong here
Client certificate authentication is unrelated to the protocol-matching problem in this scenario. While a fileserver may require certificates, the browser would handle that during the TLS handshake, and a misconfigured certificate requirement would produce authentication failures, not a blank SMB access attempt. Moreover, even with valid certificates, the web portal has no SMB client engine to establish a file share session.
- ✗
The firewall policy for SSL VPN is configured with the wrong interface
Why it's wrong here
The firewall policy for SSL VPN determines which traffic is permitted through the tunnel interface, such as ssl.root. In web mode, however, no tunnel is created and the user's browser connects directly to the FortiGate's HTTPS portal, so interface selection would affect the portal access itself. A misconfigured policy would block all web-mode access, not selectively prevent SMB file share access.
- ✓
Web mode does not support the SMB protocol; users must use tunnel mode to access fileshares
Why this is correct
Web mode is a clientless browser-based reverse proxy that only supports HTTP, HTTPS, and certain web applications. The SMB protocol, which runs on TCP port 445 and requires native network layer connectivity, cannot be proxied by web mode. To access SMB fileshares, users must connect using SSL VPN tunnel mode, which creates a virtual interface on the client and routes SMB traffic through the FortiGate.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.