NSE4 Authentication and VPN Practice Question
Exhibit
Refer to the exhibit.
config vpn ipsec phase1-interface
edit "to_Branch"
set interface "wan1"
set ike-version 2
set keylife 86400
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha256
set dhgroup 14
set remote-gw 203.0.113.5
set psksecret ENC ...
next
end
config vpn ipsec phase2-interface
edit "to_Branch_p2"
set phase1name "to_Branch"
set proposal aes256-sha256
set pfs enable
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
endRefer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?
⚠ Common exam trap
Test-takers frequently assume a tunnel status of 'up' means the VPN is fully functional, but in reality, phase1 success alone does not guarantee that phase2 has been negotiated with the correct proxy IDs, and traffic will still fail without proper subnet definitions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The phase2 configuration does not specify the local and remote subnets to protect.
The phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The phase1 keylife is longer than the phase2 keylife, causing rekey issues.
Why it's wrong here
Different keylifes are acceptable; phase2 rekeys independently.
- ✗
The 'set net-device disable' prevents the tunnel from being used for routing.
Why it's wrong here
net-device disable is typical for route-based VPNs; the tunnel interface is still used.
- ✓
The phase2 configuration does not specify the local and remote subnets to protect.
Why this is correct
Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.
- ✗
The phase2 proposal does not match the phase1 proposal.
Why it's wrong here
Both use aes256-sha256; they match.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.