The correct answer is that the phase2 configuration does not specify the local and remote subnets to protect. This is the most likely cause because IPsec VPN tunnels require explicit proxy IDs in phase2 to define which traffic should be encrypted; without these subnets, the security associations (SAs) for actual data traffic cannot be established, even though the tunnel status shows as up from a successful phase1 IKE negotiation. On the Fortinet NSE 4 exam, this scenario tests your understanding that a tunnel being "up" only confirms authentication and key exchange, not that traffic can flow—a common trap where candidates mistake phase1 completion for full connectivity. Remember that phase1 builds the management tunnel, but phase2 builds the data tunnel; if proxy IDs are missing, no traffic will traverse the VPN. A useful memory tip: "Phase1 is the handshake, phase2 is the roadmap—no roadmap, no traffic."
NSE4 Authentication and VPN Practice Question
This NSE4 practice question tests your understanding of authentication and vpn. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
config vpn ipsec phase1-interface
edit "to_Branch"
set interface "wan1"
set ike-version 2
set keylife 86400
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set dhgroup 14
set remote-gw 203.0.113.5
set psksecret ENC ...
next
end
config vpn ipsec phase2-interface
edit "to_Branch_p2"
set phase1name "to_Branch"
set proposal aes256-sha256
set pfs enable
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
end
Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Refer to the exhibit.
config vpn ipsec phase1-interface
edit "to_Branch"
set interface "wan1"
set ike-version 2
set keylife 86400
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set dhgroup 14
set remote-gw 203.0.113.5
set psksecret ENC ...
next
end
config vpn ipsec phase2-interface
edit "to_Branch_p2"
set phase1name "to_Branch"
set proposal aes256-sha256
set pfs enable
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
end
A
The phase1 keylife is longer than the phase2 keylife, causing rekey issues.
Why wrong: Different keylifes are acceptable; phase2 rekeys independently.
B
The 'set net-device disable' prevents the tunnel from being used for routing.
Why wrong: net-device disable is typical for route-based VPNs; the tunnel interface is still used.
C
The phase2 configuration does not specify the local and remote subnets to protect.
Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.
D
The phase2 proposal does not match the phase1 proposal.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The phase2 configuration does not specify the local and remote subnets to protect.
Option C is correct because the phase2 configuration in an IPsecVPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The phase1 keylife is longer than the phase2 keylife, causing rekey issues.
Why it's wrong here
Different keylifes are acceptable; phase2 rekeys independently.
✗
The 'set net-device disable' prevents the tunnel from being used for routing.
Why it's wrong here
net-device disable is typical for route-based VPNs; the tunnel interface is still used.
✓
The phase2 configuration does not specify the local and remote subnets to protect.
Why this is correct
Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The phase2 proposal does not match the phase1 proposal.
Why it's wrong here
Both use aes256-sha256; they match.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume a tunnel status of 'up' means the VPN is fully functional, but in reality, phase1 success alone does not guarantee that phase2 has been negotiated with the correct proxy IDs, and traffic will still fail without proper subnet definitions.
Detailed technical explanation
How to think about this question
In IPsec VPNs, phase1 (IKE) establishes a secure channel for control traffic, while phase2 (IPsec) negotiates the actual data encryption parameters and proxy IDs (local/remote subnets). If proxy IDs are omitted or misconfigured, the IPsec SA will not be created for the desired traffic, and packets will be dropped or sent in clear text. This is a common misconfiguration in FortiGate and other firewall platforms, where the tunnel interface may show as up but no traffic can pass because the security policy or route relies on the phase2 selectors.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Authentication and VPN — This question tests Authentication and VPN — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The phase2 configuration does not specify the local and remote subnets to protect. — Option C is correct because the phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.