NSE4 Authentication and VPN Practice Question
A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?
⚠ Common exam trap
It's easy for candidates to assume LDAP server configuration is the root cause for any authentication failure, but FSSO polling relies on the collector agent, not LDAP binds, making Option D a common distractor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FSSO collector agent settings for VDOM2
In a multi-VDOM FSSO setup with Active Directory polling, each VDOM requires its own FSSO collector agent configuration to map domain users to the correct VDOM. Since VDOM1 works but VDOM2 does not, the most likely cause is that the FSSO collector agent settings for VDOM2 are missing or misconfigured, such as the collector agent IP, port, or shared secret. This is the first item to verify because FSSO polling relies on per-VDOM agent communication to deliver user-to-IP mappings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS resolution for the domain controller in VDOM2
Why it's wrong here
DNS resolution is a common prerequisite for FSSO, but in a multi-VDOM FortiGate, the FortiGate itself typically resolves the domain controller's hostname globally, not per VDOM. If the same DNS server is used for all VDOMs, a failure would be system-wide, not isolated to VDOM2. Moreover, the FSSO collector agent often sends the DC's IP address directly to the FortiGate, bypassing DNS entirely. Thus, a per-VDOM DNS misconfiguration would not independently break FSSO for VDOM2.
- ✗
The firewall policy ordering in VDOM2
Why it's wrong here
Firewall policy ordering controls how traffic is matched and which authentication requirements are enforced, but it does not affect the background process of FSSO. FSSO operates at the authentication layer, collecting user-to-IP mappings from AD even if policies are misordered. A misordered policy might prevent successful firewall authentication or cause traffic to drop, but it would not stop the FSSO collector agent from polling Active Directory. Since VDOM2's FSSO relies on collector agent settings, not policy sequence, this option is incorrect.
- ✓
The FSSO collector agent settings for VDOM2
Why this is correct
In a multi-VDOM architecture, each VDOM is a separate security context, so FSSO collector agent settings must be defined individually for every VDOM that requires single sign-on. If VDOM2 lacks its own collector agent configuration, or if the configured agent's IP, port, shared secret, or AD polling credentials are incorrect, the FortiGate will not receive login events for users in that VDOM. Without these events, FSSO cannot map users to IP addresses, breaking user-aware policies. This is the root cause and the correct answer.
- ✗
The LDAP server configuration in VDOM2
Why it's wrong here
LDAP server configuration in a VDOM is used for direct user authentication or for querying AD group membership during policy checks, but FSSO operates independently. The FSSO collector agent monitors domain controller security event logs and sends user-IP mappings to the FortiGate via port 8000 (or FSSO polling), without requiring the FortiGate's LDAP settings. Even if LDAP is misconfigured or absent in VDOM2, the collector agent can still push authentication data to the FortiGate. Therefore, an LDAP problem would not prevent FSSO from working, making this option incorrect.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.