NSE4 Authentication and VPN Practice Question
A FortiGate is configured with FSSO using a DC agent. Users authenticate to the domain, but the firewall policy using FSSO groups is not matching traffic. The admin runs 'diagnose debug authd fsso list' and sees user entries. However, the traffic is being denied by the default deny policy. What is the most likely issue?
⚠ Common exam trap
The trap here is that candidates see the user in the FSSO debug output and assume authentication is fully working, overlooking the fact that session identity is static and not updated for pre-existing sessions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session was established before the user logged in and is not updated with the user identity
When a user logs in after a session is already established, the FortiGate does not automatically update that session with the user's identity. The 'diagnose debug authd fsso list' shows the user is authenticated, but the existing session still lacks the FSSO group information, causing it to match the default deny policy instead of the FSSO-based policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FSSO session timeout is too short
Why it's wrong here
A short FSSO session timeout would cause the FortiGate to expire the user's authentication entry after the configured idle period, removing the user from the 'debug fsso list' output. This would manifest as the user dropping out of the FSSO user list entirely or requiring re-authentication on new traffic, not as an existing session that simply lacks a user identity. The symptom described (a session with no FSSO identity) occurs at session creation time, not due to a later timeout event.
- ✓
The session was established before the user logged in and is not updated with the user identity
Why this is correct
When a client establishes a session (e.g., a TCP connection or UDP flow) before the FSSO DC agent processes the user's login event, the FortiGate's session table entry is initially created with no user identity or with a default guest/anonymous mapping. The FortiGate does not retroactively apply the learned FSSO user to pre-existing sessions; it only assigns the user identity to new sessions created after the login event is synchronized. To resolve this, the existing session must be cleared (via 'execute session clear' or waiting for idle timeout) so that the next packet re-triggers session setup and gets the correct FSSO user attribute.
- ✗
The firewall policy has the wrong schedule applied
Why it's wrong here
A wrong schedule on a firewall policy affects when the policy is active, not how user identity is assigned. If the schedule is not current, the policy would be inactive entirely, causing traffic to be dropped or matched by a different (often deny) policy, resulting in complete connectivity loss during off-schedule periods. In contrast, the described symptom—an active session without user identity—would still allow the session to pass if another policy permits it, but it would not be subject to FSSO group-based restrictions. The schedule error would therefore produce time-dependent access failures, not a static identity mismatch in the session table.
- ✗
The user is not a member of the correct FSSO group in Active Directory
Why it's wrong here
If the user were not a member of the correct FSSO group in Active Directory, the FortiGate would still learn the user's identity via the DC agent but would not match the policy that references that group. This would cause the user's traffic to be denied or matched by a fallback policy, but the user would still appear in 'debug fsso list' with their actual group memberships. The symptom of a session lacking any user identity is distinct from having a wrong identity—FSSO group membership affects policy matching after identity is resolved, not the resolution process itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.