NSE4 Authentication and VPN Practice Question
A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?
⚠ Common exam trap
Candidates often confuse FSSO with LDAP authentication, assuming an LDAP connectivity issue is the cause, when in fact FSSO relies on a separate collector agent and domain controller event polling, not direct LDAP queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FSSO collector agent service is not running.
If the FSSO collector agent service is not running, the FortiGate cannot receive the logon events from the domain controllers. Without these events, the FortiGate has no way to know which users are authenticated, so it falls back to prompting for credentials on every new session, even though users are already logged into the domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The users are not members of the FSSO group.
Why it's wrong here
FSSO identifies users by their active Windows domain logon session, regardless of which security groups they belong to. Even if the user is not a member of the FSSO group, a properly working collector agent would still report the user's identity to FortiGate, and any firewall authentication prompt would then be policy-driven (e.g., to gain additional access), not a failure of single sign-on. Therefore, group membership is not a prerequisite for avoiding the initial logon prompt; the prompt directly indicates that FortiGate never received the user's domain logon information.
- ✗
The firewall policy uses 'All Users' instead of a specific group.
Why it's wrong here
Configuring a firewall rule with 'All Users' instead of a specific FSSO group changes only whether the user's session is authorized to match that rule; it does not affect whether FortiGate has the user's identity. Since FSSO authenticates users at the domain level, FortiGate uses the collected logon event to map the user to a group, and a policy set to 'All Users' would simply broaden access, not suppress a login prompt. The prompt appears because FortiGate is being forced to authenticate an unknown user, not because of how the destination policy's user/group field is set.
- ✓
The FSSO collector agent service is not running.
Why this is correct
The FSSO collector agent is the critical component that gathers logon events from Active Directory (either through NetAPI polling or by reading Windows security event logs) and forwards them to the FortiGate. If the collector agent service is stopped or not running, the FortiGate has no source of domain user logon information, so it treats all traffic as unauthenticated and triggers local firewall authentication prompts. This is the most direct cause of the symptom described, because the entire FSSO identity pipeline is broken.
- ✗
The FortiGate's LDAP server is unreachable.
Why it's wrong here
Unreachability to an LDAP server would affect directory lookups, such as resolving group memberships for remote users or LDAP-based authentication rules, but it is not relevant to FSSO's core operation. FSSO relies on the collector agent's communication with Active Directory Domain Controllers and the FortiGate, not on the FortiGate's direct LDAP binding to authenticate Windows users. Therefore, an LDAP connectivity failure would not prevent FSSO from passing the user's identity; at most it might impact group authorization after the identity is already known, and it would not be the reason for a firewall authentication prompt.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.