NSE4 Authentication and VPN Practice Question
An administrator wants to restrict SSL VPN access to only users who have a valid client certificate issued by the company's internal CA. Which setting should be configured?
⚠ Common exam trap
Many exam-takers confuse 'certificate-based authentication' with a user group setting, when in fact the enforcement point is the SSL VPN portal or interface configuration, not the user group definition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'require client certificate' in the SSL VPN settings
The 'require client certificate' setting in the SSL VPN portal or interface configuration enforces mutual TLS (mTLS), where the FortiGate requests and validates a client certificate against the configured CA. This ensures that only users presenting a valid certificate issued by the company's internal CA can establish the SSL VPN tunnel, regardless of their authentication credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a firewall policy with identity-based authentication
Why it's wrong here
Identity-based firewall policies authenticate users by username and password credentials, not by examining the client certificate presented during the SSL handshake. Enabling this only causes the FortiGate to prompt for user credentials after the tunnel is established, so it cannot enforce that only US users with valid certificates connect. The certificate requirement must be set at the SSL VPN gateway level, not in the firewall policy.
- ✗
Enable 'certificate-based authentication' in the user group
Why it's wrong here
Enabling certificate-based authentication in the user group defines that group members may authenticate using certificates, but it does not force the SSL VPN portal to actually request a client certificate during the initial TLS negotiation. Unless the global SSL VPN setting 'require client certificate' is enabled, the FortiGate will allow sessions without a certificate, making the group setting ineffective for restricting access. The group setting merely controls how a user is identified after a certificate is presented voluntarily.
- ✓
Enable 'require client certificate' in the SSL VPN settings
Why this is correct
Setting 'Require Client Certificate' in the SSL VPN settings makes the FortiGate demand a client certificate during the SSL/TLS handshake, and only a certificate signed by a configured trusted CA will be accepted. This ensures that every SSL VPN session is cryptographically tied to a credential that is bound to a specific US user, so users without a valid certificate cannot even initiate the handshake. This is the direct control that physically enforces certificate-based access.
- ✗
Import the users' public keys into the FortiGate
Why it's wrong here
Importing users' public keys into the FortiGate is not the appropriate mechanism, because FortiGate certificate authentication validates the complete certificate chain using a configured CA certificate, not individual public keys. Even if a public key is imported, the SSL VPN gateway will not automatically request a client certificate unless the 'require client certificate' option is enabled, and public keys alone do not provide the identity context needed for access control. Certificate trust is established via the CA, not via key import.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.