NSE4 Authentication and VPN Practice Question
An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?
⚠ Common exam trap
It's easy for candidates to confuse 'LDAP' as a protocol with 'RADIUS' as a protocol, assuming both are interchangeable for external authentication, but FortiGate requires the LDAP method specifically when the authentication source is an LDAP directory server, not a RADIUS server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP
To authenticate VPN users against an external LDAP server, the user group for the SSL VPN portal must be configured with the LDAP authentication method. This directs FortiGate to bind directly to the LDAP server (e.g., Active Directory or OpenLDAP) using the configured LDAP server object, performing a simple bind or SASL bind to verify user credentials. Other methods like RADIUS, FSSO, or Local would not leverage the LDAP server directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RADIUS
Why it's wrong here
RADIUS is a network authentication protocol that works by passing authentication requests to a RADIUS server; the FortiGate does not query LDAP directly. While RADIUS can authenticate VPN users, it requires either a RADIUS server with its own database or an intermediary proxy to an LDAP backend. When the administrator specifically wants to authenticate against an existing LDAP server, configuring the FortiGate to use LDAP directly is simpler and more efficient, so RADIUS is not the correct choice here.
- ✗
FSSO
Why it's wrong here
FSSO (Fortinet Single Sign-On) is designed for transparent domain authentication by collecting login events from Windows domain controllers, not for performing direct credential validation against LDAP. It maps users to IP addresses for network access policies, but it does not authenticate VPN users at the point of tunnel establishment. Since the requirement is to authenticate VPN users against an LDAP server, FSSO fails because it never verifies the user's password against LDAP.
- ✗
Local
Why it's wrong here
Local authentication uses user accounts that are stored directly on the FortiGate device, not in an LDAP directory. Creating local accounts would require duplicating every LDAP user and manually synchronizing passwords, which is impractical and prone to errors. The administrator already has an LDAP server as the source of truth, so relying on local accounts would bypass that central identity store and is not the correct approach.
- ✓
LDAP
Why this is correct
LDAP authentication enables the FortiGate to validate VPN users by performing a direct bind to the LDAP server (such as Active Directory or OpenLDAP) using the user's distinguished name and password. The FortiGate can also retrieve group memberships during the authentication process, allowing LDAP-based groups to be used in firewall policies. This is the most straightforward and correct method when the authentication source is an LDAP server, as it avoids an extra RADIUS or other proxy layer.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.