NSE4 Authentication and VPN Practice Question
A FortiGate administrator is configuring an SSL VPN web mode portal. The administrator wants users to access only a specific internal web application (https://internal-app.company.local) and nothing else. Which SSL VPN setting should be configured to achieve this?
⚠ Common exam trap
Candidates often confuse network-layer controls (firewall policies or split tunneling) with application-layer controls (URL Access), assuming that blocking traffic at the IP/port level is sufficient to restrict web-based access within an SSL VPN portal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Under the SSL VPN portal, configure 'URL Access' to allow only https://internal-app.company.local
The 'URL Access' setting in the SSL VPN web mode portal allows the administrator to explicitly define which URLs users can access through the portal. By configuring an allow list with only https://internal-app.company.local, users are restricted to that specific internal web application, and all other URLs are blocked. This provides granular control over web-based resources in the SSL VPN portal without relying on network-layer restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In the SSL VPN portal, set the default bookmark to the application URL
Why it's wrong here
Setting a default bookmark in the SSL VPN portal only creates a convenience link that pre-populates the address bar for the user. It does not enforce any egress restrictions; a user can still click in the address bar and manually type or navigate to any other URL reachable through the FortiGate proxy. In web mode, the portal functions as a reverse proxy, so any URL that resolves and is reachable from the FortiGate is potentially accessible unless explicitly blocked. Thus a bookmark merely aids navigation and offers no security control.
- ✗
Configure a firewall policy that allows traffic only to the application's IP address
Why it's wrong here
In SSL VPN web mode, the FortiGate acts as a reverse proxy: the user's browser establishes an HTTPS session to the FortiGate, and the FortiGate fetches the web application content on behalf of the user. Therefore, the source address of requests to the internal application is the FortiGate's own IP address, not the client's IP. A firewall policy that explicitly permits traffic from the FortiGate to the application's IP address is required for the proxy to function, but it is a network-layer permission that does not restrict which URLs the user can request through the portal. The user could still request a different web resource whose IP is also permitted by some other implicit or explicit rule, or the FortiGate could access it before any deny policy is evaluated.
- ✗
Enable split tunneling under the SSL VPN settings
Why it's wrong here
Split tunneling is a tunnel-mode routing setting that determines whether a remote user's non-encrypted traffic goes directly to the Internet or is sent through the tunnel and then routed by the FortiGate. It operates at the IP routing table level and has no awareness of HTTP URLs or web application content. In web mode, there is no tunnel established; the user's browser simply connects to the FortiGate's portal and sends HTTP requests that are proxied. Even if split tunneling were enabled or disabled, it would have no effect on which uniform resource locators a user could type into the portal address bar, so it cannot restrict access to web applications.
- ✓
Under the SSL VPN portal, configure 'URL Access' to allow only https://internal-app.company.local
Why this is correct
The URL Access feature under the SSL VPN portal provides a per-portal whitelist of web addresses that users are allowed to access through the reverse proxy. When you specify only https://internal-app.company.local, the FortiGate enforces that rule during proxy processing: any request to a URL that does not match the whitelist is denied with an error. This precisely meets the requirement because it is a proxy-level, application-aware access control, rather than a network-layer rule or a UI shortcut. It effectively prevents users from browsing to any other internal or external web host through the portal while allowing the specific internal application.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.