NSE4 Authentication and VPN Practice Question
A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume SSL VPN always provides full network access or that a missing security profile is the cause, but the NSE4 exam specifically tests the distinction between web mode (bookmark-based) and tunnel mode (full access).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web mode only allows access to specific bookmarks configured in the portal
In SSL VPN web mode, the FortiGate acts as a proxy, granting access only to pre-configured bookmarks (URLs or applications) defined in the SSL VPN portal. Default portal settings do not include any bookmarks, so even after successful authentication, the user sees an empty portal and cannot reach internal resources. This is by design, as web mode does not provide full network-layer access like tunnel mode does.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user must be authenticated via LDAP
Why it's wrong here
The SSL VPN web-mode experience is entirely independent of the authentication source. FortiGate supports local, LDAP, RADIUS, and PKI authentication for SSL VPN users, and any of these can successfully authenticate a web-mode session. Therefore, requiring LDAP specifically is incorrect; the problem would persist even after switching to LDAP, because authentication is not the limiting factor for portal access.
- ✗
The user has not installed the FortiClient VPN plugin
Why it's wrong here
Web mode is a clientless SSL VPN technology, meaning the remote user accesses the FortiGate portal through a standard HTTPS-capable browser without any additional software. The FortiClient VPN plugin or separate FortiClient application is only needed for tunnel-mode SSL VPN or IPSec, not for web mode. Consequently, the absence of FortiClient cannot explain why a web-mode user cannot access resources; the portal itself is delivered entirely in the browser.
- ✓
Web mode only allows access to specific bookmarks configured in the portal
Why this is correct
In SSL VPN web mode, the user's entire accessible domain is restricted to the bookmarks that the administrator has explicitly defined in the user's assigned portal. Without pre-configured bookmarks to internal URLs, the portal displays no resources, and the user cannot navigate to any internal application. This is exactly the symptom described: a remote user can connect and authenticate, but there are no portal bookmarks, so no access is granted.
- ✗
The SSL VPN policy is missing a security profile
Why it's wrong here
Security profiles attached to an SSL VPN policy are used for deep inspection of the traffic that transits the tunnel, such as antivirus, web filtering, or application control. If a security profile is absent, traffic is simply passed without inspection; it does not cause the connection or portal access to fail. Therefore, a missing security profile would not block a web-mode user from reaching resources—it would only reduce security oversight, not stop connectivity.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.