NSE4 Authentication and VPN Practice Question
A FortiGate administrator is configuring FSSO with Active Directory polling. Users in the 'Sales' group are not being authenticated correctly, while users in the 'IT' group are working fine. The administrator verifies that the FSSO agent is connected and polling the domain controllers. Which action should the administrator take to troubleshoot the issue?
⚠ Common exam trap
The trap here is assuming that FSSO automatically authenticates all groups, but it only does so for groups explicitly included in the FSSO configuration or matching a filter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the FSSO group filter and ensure that the 'Sales' group is included in the FSSO configuration.
In FSSO with AD polling, the FortiGate only monitors and authenticates users from groups that are included in the FSSO configuration. If the 'Sales' group is not selected or does not match a group filter, users in that group will not be recognized as authenticated. The administrator should check the FSSO connector settings to ensure the 'Sales' group is included. Other actions like restarting the agent or changing polling interval are unlikely to help because the 'IT' group works, indicating the agent is operational.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the 'Sales' group exists in Active Directory and has the correct permissions.
Why it's wrong here
While it is good to verify the group exists, the issue is more likely on the FortiGate's FSSO configuration. If the group exists but is not included in the FSSO filter, users will not be authenticated. Checking AD permissions is less relevant because FSSO polling uses the FSSO agent's credentials, not the user's. The administrator should focus on the FSSO group filter.
- ✓
Check the FSSO group filter and ensure that the 'Sales' group is included in the FSSO configuration.
Why this is correct
If the 'Sales' group is not included in the FSSO group filter, the FortiGate will not recognize users from that group as authenticated. The administrator should verify that the FSSO configuration on the FortiGate includes the 'Sales' group, either by selecting it in the FSSO connector or by using a group filter that matches it. This is a common oversight when some groups work and others do not.
- ✗
Increase the 'polling interval' in the FSSO configuration to reduce latency.
Why it's wrong here
Increasing the polling interval would actually delay updates, potentially making the problem worse. Polling interval controls how often the FortiGate checks for new logon events. If the 'IT' group works, the interval is not the issue. The problem is likely that the 'Sales' group is not being monitored or filtered correctly.
- ✗
Restart the FSSO agent service on the domain controller.
Why it's wrong here
Restarting the FSSO agent might disrupt all users, and since the 'IT' group is working, the agent is likely functioning. The issue is specific to the 'Sales' group, so restarting the service is unlikely to resolve the problem and could cause unnecessary downtime. The administrator should first check group filters and event log polling.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.