NSE4 Authentication and VPN Practice Question
A network administrator wants to authenticate VPN users against an existing LDAP server. Which authentication method should be configured on the FortiGate?
⚠ Common exam trap
Many candidates confuse 'authentication source' with 'authentication method' and select RADIUS (option C) because they assume LDAP must be proxied through RADIUS, but FortiGate can authenticate directly against LDAP for VPN users without any intermediary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP
To authenticate VPN users against an existing LDAP server, the FortiGate must be configured to query the LDAP directory directly for user credentials. The LDAP authentication method (option B) allows the FortiGate to bind to the LDAP server using the user's DN and password, verifying identity against the directory. This is the correct choice because the question explicitly specifies an LDAP server, and FortiGate supports native LDAP authentication for SSL/IPsec VPNs without requiring an intermediate RADIUS or FSSO server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FSSO
Why it's wrong here
FSSO (Fortinet Single Sign-On) is not an authentication method for validating VPN credentials. It works by monitoring security event logs from Active Directory domain controllers to associate user logons with IP addresses, enabling identity-based firewall policies. When a remote VPN user submits a username and password, FSSO cannot verify those credentials because it never receives or checks them—it only passively observes successful AD logons. Therefore, FSSO would not satisfy a requirement to authenticate against LDAP.
- ✓
LDAP
Why this is correct
LDAP authentication is the correct choice because the FortiGate directly binds to the LDAP directory server using the user's distinguished name (DN) and supplied password. A successful bind indicates that the entered credentials are valid, and the FortiGate can also retrieve group memberships to apply access policies. This method validates the remote user against the central enterprise directory without storing passwords locally, making it ideal for a network that already relies on LDAP.
- ✗
RADIUS
Why it's wrong here
RADIUS authentication works differently because the FortiGate acts as a RADIUS client forwarding the user's credentials to an external RADIUS server, which then decides whether to accept or reject the request. While that RADIUS server could proxy to an LDAP backend, the FortiGate itself never directly queries LDAP; it communicates via RADIUS protocol using a shared secret. If the existing infrastructure only has LDAP and no RADIUS server, this would not meet the administrator's stated goal of LDAP-based authentication.
- ✗
Local
Why it's wrong here
Local authentication uses only user accounts created and stored directly on the FortiGate, with password hashes kept in the device's local configuration. This approach has no dependency on LDAP and requires the administrator to manually provision every VPN user, which becomes tedious and error-prone in larger organizations. Since the requirement explicitly calls for authenticating against LDAP, local authentication would not provide directory-based verification and is therefore the wrong option.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.