NSE4 Authentication and VPN Practice Question
An admin needs to authenticate remote users connecting via SSL VPN. The users are in an Active Directory domain. Which authentication method should be configured on the FortiGate to allow users to log in with their domain credentials?
⚠ Common exam trap
Watch out — candidates often confuse FSSO with direct authentication, assuming it can handle SSL VPN logins, when in fact FSSO only provides passive identity collection and cannot validate passwords for VPN access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP server
LDAP (Lightweight Directory Access Protocol) allows FortiGate to directly query the Active Directory domain controller to authenticate users with their domain credentials. This method validates the username and password against the AD database without requiring an additional RADIUS server or local user accounts, making it the most straightforward choice for SSL VPN authentication with domain users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
LDAP server
Why this is correct
LDAP is the standard protocol for direct authentication against an Active Directory domain. When a remote user submits credentials via the SSL VPN portal, the FortiGate performs an LDAP bind to the domain controller using that username and password, verifying them against the AD directory. This is the most straightforward and native method for AD-based authentication, requiring no intermediate RADIUS infrastructure. LDAP also allows fetching group memberships for granular authorization policies.
- ✗
Local user database
Why it's wrong here
The local user database stores usernames, password hashes, and group assignments directly on the FortiGate itself, completely independent of any external directory service. This would require manually creating and synchronizing each remote user account, which does not leverage the existing AD identities or enforce domain password policies. Since the administrator needs to authenticate users who are already in AD, the local database is a poor fit and lacks the central management and scalability that LDAP/AD integration provides.
- ✗
RADIUS server
Why it's wrong here
A RADIUS server can authenticate users by forwarding their credentials to Active Directory, but it introduces an additional network component and configuration layer. The FortiGate would need to be configured as a RADIUS client, and a RADIUS server (such as NPS on Windows) must be set up with the appropriate connection between RADIUS and AD. While RADIUS is useful for centralized AAA across heterogeneous devices, it is less direct and more complex than using LDAP to bind directly against AD for SSL VPN authentication.
- ✗
FSSO
Why it's wrong here
FSSO (Fortinet Single Sign-On) is designed for transparent network identity mapping based on a user's already-established Windows login session. It monitors Windows security events from domain controllers to associate IP addresses with AD usernames, enabling identity-based firewall policies without prompting the user again. FSSO does not validate credentials at VPN login time; it operates after the user has authenticated to Windows, so it cannot serve as the actual authentication mechanism for the SSL VPN portal itself.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.