NSE4 Authentication and VPN Practice Question
An administrator receives a report that some users cannot authenticate via captive portal on a FortiGate. The captive portal is configured for firewall authentication. The administrator checks the authentication logs and sees 'Authentication failed: invalid credentials'. However, the users confirm they are entering the correct username and password. What is the MOST likely cause?
⚠ Common exam trap
NSE4 often tests the difference between authentication failures caused by wrong username format versus connectivity or certificate issues, and candidates may overlook the domain-qualification requirement for LDAP binds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The users are not including the domain name in the username field
When FortiGate performs firewall authentication (captive portal) against an LDAP server, the username format must match what the LDAP server expects. If the LDAP server requires a domain-qualified username (e.g., DOMAIN\user or user@domain.com) and users enter only their short username, the bind attempt fails with 'invalid credentials' even though the password is correct. This is the most likely cause given that users confirm their credentials are correct and the logs show authentication failure rather than a connectivity error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The captive portal interface is not configured with a valid certificate
Why it's wrong here
A captive portal certificate issue would prevent the HTTPS login page from loading or trigger browser security warnings, but it would not produce an invalid credentials error because the FortiGate cannot even initiate the LDAP bind without first serving the portal. The reported failure with an invalid credentials message indicates the user was able to submit credentials, so the certificate is not the cause. This is a transport/security-layer problem, not an authentication-format or directory-rejection problem.
- ✓
The users are not including the domain name in the username field
Why this is correct
When authenticating against an AD or LDAP server, FortiGate often requires the username in a fully qualified format such as DOMAIN\\username or as a User Principal Name (user@domain.com). If users type only their sAMAccountName, the FortiGate constructs a bind DN that does not match any directory entry, so the LDAP server returns error code 49 (invalidCredentials). The passwords may be correct, but the omitted domain prefix makes the bind fail exactly as if the password were wrong.
- ✗
The FortiGate's clock is out of sync with the LDAP server
Why it's wrong here
Time skew between the FortiGate and the LDAP server primarily affects Kerberos authentication because time-sensitive ticket requests are rejected if the clock offset exceeds the maximum tolerated skew (typically 5 minutes). Kerberos failures surface as errors like 'time skew' or 'KDC_ERR_CLIENT_REVOKED', not as a plain 'invalid credentials' message. For standard LDAP bind operations using LDAP/TLS, the authentication exchange does not depend on time synchronization, so clock drift would not cause a password rejection.
- ✗
The LDAP server is not reachable from the FortiGate
Why it's wrong here
If the LDAP server were unreachable, the FortiGate would fail during the initial TCP connection or LDAP bind attempt, generating an error such as 'connection timeout', 'server unreachable', or an LDAP-specific network failure message. The user would not see 'invalid credentials' because the authentication dialogue never completes. An invalid credentials error means the FortiGate successfully reached the LDAP server and performed a bind, but the bind was rejected due to a username or password problem, not a connectivity issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.