Authentication and VPN practice questions

A remote user reports that they can connect to the FortiGate SSL VPN portal but cannot access internal resources. The administrator checks the SSL VPN settings and sees that the tunnel mode is enabled with split tunneling. What is the most likely cause?

Trap 1: The IP pool is exhausted and no IP address was assigned.

Without IP, tunnel wouldn't establish.

Trap 2: The firewall policy allowing SSL VPN traffic to internal resources…

Policy is needed but routing is more likely given split tunneling.

Trap 3: The SSL VPN authentication timeout is too short.

Timeout would disconnect, not block resources.

A
The IP pool is exhausted and no IP address was assigned.
Why wrong: Without IP, tunnel wouldn't establish.
B
The firewall policy allowing SSL VPN traffic to internal resources is missing.
Why wrong: Policy is needed but routing is more likely given split tunneling.
C
The routing table on the client is missing the internal network routes.
Split tunneling requires proper routes to internal networks.
D
The SSL VPN authentication timeout is too short.
Why wrong: Timeout would disconnect, not block resources.

Question 2mediummultiple choice

An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?

Trap 1: The pre-shared keys do not match.

Phase 1 would fail, not Phase 2.

Trap 2: The firewall policies are not configured.

Policies are needed for traffic, not for bringing up the tunnel.

Trap 3: NAT traversal is disabled but both FortiGates are behind NAT.

NAT-T mismatch would cause Phase 1 issues.

A
The Phase 2 selectors (local and remote subnets) are mismatched.
Phase 2 requires matching proxy IDs.
B
The pre-shared keys do not match.
Why wrong: Phase 1 would fail, not Phase 2.
C
The firewall policies are not configured.
Why wrong: Policies are needed for traffic, not for bringing up the tunnel.
D
NAT traversal is disabled but both FortiGates are behind NAT.
Why wrong: NAT-T mismatch would cause Phase 1 issues.

Question 3hardmultiple choice

A company with multiple remote sites uses IPsec VPNs. One site reports intermittent connectivity. The administrator checks the logs and sees 'IPsec phase 2 negotiation failed' messages. Which configuration change is most likely to resolve the issue?

Trap 1: Change the encryption algorithm from AES256 to 3DES.

Algorithm mismatch would cause constant failure.

Trap 2: Increase the Phase 2 lifetime.

Longer lifetime may mask the problem but not fix intermittent negotiation.

Trap 3: Enable NAT traversal.

NAT-T is for NAT environments, not intermittent drops.

A
Enable Dead Peer Detection (DPD) on the Phase 1 interface.
DPD detects peer failure and triggers renegotiation.
B
Change the encryption algorithm from AES256 to 3DES.
Why wrong: Algorithm mismatch would cause constant failure.
C
Increase the Phase 2 lifetime.
Why wrong: Longer lifetime may mask the problem but not fix intermittent negotiation.
D
Enable NAT traversal.
Why wrong: NAT-T is for NAT environments, not intermittent drops.

Question 4easymultiple choice

An administrator is troubleshooting an SSL VPN connection issue. Users can authenticate but receive 'No available tunnel' error. What is the most likely cause?

Trap 1: Split tunneling is misconfigured.

Split tunneling affects routing, not tunnel availability.

Trap 2: The firewall policy does not allow traffic from the SSL VPN…

Policy would block traffic, not tunnel assignment.

Trap 3: The SSL VPN port is blocked on the firewall.

Blocked port would prevent connection entirely.

A
Split tunneling is misconfigured.
Why wrong: Split tunneling affects routing, not tunnel availability.
B
The firewall policy does not allow traffic from the SSL VPN interface.
Why wrong: Policy would block traffic, not tunnel assignment.
C
The SSL VPN port is blocked on the firewall.
Why wrong: Blocked port would prevent connection entirely.
D
The SSL VPN IP pool has run out of addresses.
Exhausted IP pool prevents tunnel assignment.

Question 5mediummulti select

A site-to-site IPsec VPN is configured with IKEv2. The tunnel establishes but traffic does not pass. Which two troubleshooting steps should the administrator perform first?

Trap 1: Check the Phase 2 selectors.

Phase 2 is up.

Trap 2: Verify that the Phase 1 proposal matches.

Phase 1 is already up.

A
Check the Phase 2 selectors.
Why wrong: Phase 2 is up.
B
Verify that the Phase 1 proposal matches.
Why wrong: Phase 1 is already up.
C
Check the firewall policies allowing traffic through the tunnel.
Policies must permit traffic between zones.
D
Check the routing table for routes pointing to the remote networks.
Proper routes are needed for traffic to use tunnel.

Question 6hardmulti select

A FortiGate administrator is designing an SSL VPN solution for 500 remote users. The users need full network access. Which two design considerations are most important?

Trap 1: Configure split tunneling to reduce load on the FortiGate.

Split tunneling may not be desired for full network access.

Trap 2: Use certificate-based authentication for all users.

Certificate authentication is not mandatory.

Trap 3: Enable port forwarding for RDP and SSH.

Port forwarding is not required for full access.

A
Ensure the SSL VPN IP pool has enough addresses for concurrent users.
Sufficient IP pool is critical for scalability.
B
Create firewall policies that allow traffic from the SSL VPN interface to internal networks.
Policies are essential to permit traffic.
C
Configure split tunneling to reduce load on the FortiGate.
Why wrong: Split tunneling may not be desired for full network access.
D
Use certificate-based authentication for all users.
Why wrong: Certificate authentication is not mandatory.
E
Enable port forwarding for RDP and SSH.
Why wrong: Port forwarding is not required for full access.

Question 7easymulti select

An administrator is configuring a dialup IPsec VPN for remote users. Which two settings must be configured on the FortiGate to allow clients to connect?

Trap 1: Enable XAuth for user authentication.

XAuth is not required for basic connectivity.

Trap 2: Enable Dead Peer Detection.

DPD is optional.

Trap 3: Enable NAT traversal.

NAT-T is only needed if clients are behind NAT.

A
Enable XAuth for user authentication.
Why wrong: XAuth is not required for basic connectivity.
B
Enable Dead Peer Detection.
Why wrong: DPD is optional.
C
Enable mode-cfg on the Phase 1 interface.
Mode-cfg provides client configuration.
D
Enable NAT traversal.
Why wrong: NAT-T is only needed if clients are behind NAT.
E
Create an IP pool for the remote clients.
IP pool assigns IP addresses to clients.

Question 8hardmultiple choice

A company has a FortiGate at headquarters running FortiOS 7.2 and a remote office with a FortiGate 60F running FortiOS 7.0. They have an IPsec VPN tunnel between them for site-to-site connectivity. Recently, the remote office upgraded their FortiGate from 6.4 to 7.0. After the upgrade, the VPN tunnel is down. The Phase 1 status shows 'negotiating' but never completes. The administrator has verified that the pre-shared key, IKE version (IKEv2), and authentication method are the same on both sides. The Phase 1 proposal on the headquarters is: encryption: AES256, SHA256, DH group 14, lifetime 86400. The remote office uses: encryption: AES256, SHA1, DH group 14, lifetime 86400. What is the most likely cause of the failure?

Trap 1: The DH group is different; headquarters uses group 14, remote uses…

Both use group 14.

Trap 2: The IKE version is mismatched; headquarters uses IKEv2 and remote…

Both are IKEv2.

Trap 3: The pre-shared key is incorrect after the upgrade.

The administrator verified it.

A
The DH group is different; headquarters uses group 14, remote uses group 5.
Why wrong: Both use group 14.
B
The Phase 1 hash algorithm differs; headquarters uses SHA256, remote uses SHA1.
Hash algorithm must match.
C
The IKE version is mismatched; headquarters uses IKEv2 and remote uses IKEv1.
Why wrong: Both are IKEv2.
D
The pre-shared key is incorrect after the upgrade.
Why wrong: The administrator verified it.

Question 9mediummultiple choice

A company wants to provide remote access to internal resources for employees using laptops that may connect from untrusted networks. The security team requires that all traffic between the remote users and the corporate network be encrypted, and that users must authenticate using a username/password plus a one-time passcode from a hardware token. Which FortiGate VPN solution best meets these requirements?

Trap 1: IPsec VPN with certificate-based authentication

Certificates provide strong authentication but no second factor.

Trap 2: SSL VPN with local password authentication

Uses password only, no hardware token.

Trap 3: L2TP/IPsec VPN with a pre-shared key and user password

Uses pre-shared key and password only, no hardware token.

A
IPsec VPN with certificate-based authentication
Why wrong: Certificates provide strong authentication but no second factor.
B
SSL VPN with local password authentication
Why wrong: Uses password only, no hardware token.
C
SSL VPN with FortiToken two-factor authentication
SSL VPN encrypts traffic, FortiToken provides required two-factor.
D
L2TP/IPsec VPN with a pre-shared key and user password
Why wrong: Uses pre-shared key and password only, no hardware token.

Question 10hardmulti select

Which TWO are best practices for configuring IPsec VPN on FortiGate to ensure high availability and security?

Trap 1: Disable DPD on the phase1 interface to reduce overhead.

Disabling DPD leaves the tunnel blind to peer failures.

Trap 2: Use aggressive mode for faster IKE negotiation.

Aggressive mode sends identity in cleartext, less secure.

Trap 3: Disable PFS to reduce CPU load on the firewall.

Disabling PFS weakens security; CPU impact is usually acceptable.

A
Disable DPD on the phase1 interface to reduce overhead.
Why wrong: Disabling DPD leaves the tunnel blind to peer failures.
B
Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.
PFS ensures that compromise of one key does not affect others.
C
Use aggressive mode for faster IKE negotiation.
Why wrong: Aggressive mode sends identity in cleartext, less secure.
D
Configure a dead peer detection (DPD) interval to detect tunnel failures.
DPD is essential for detecting peer failures in IPsec VPNs.
E
Disable PFS to reduce CPU load on the firewall.
Why wrong: Disabling PFS weakens security; CPU impact is usually acceptable.

Question 11easymultiple choice

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

Exhibit

Refer to the exhibit.
config vpn ipsec phase1-interface
    edit "to_Branch"
        set interface "wan1"
        set ike-version 2
        set keylife 86400
        set peertype any
        set net-device disable
        set mode-cfg enable
        set proposal aes256-sha256
        set dhgroup 14
        set remote-gw 203.0.113.5
        set psksecret ENC ...
    next
end
config vpn ipsec phase2-interface
    edit "to_Branch_p2"
        set phase1name "to_Branch"
        set proposal aes256-sha256
        set pfs enable
        set dhgrp 14
        set auto-negotiate enable
        set keylifeseconds 3600
    next
end

Trap 1: The phase1 keylife is longer than the phase2 keylife, causing rekey…

Different keylifes are acceptable; phase2 rekeys independently.

Trap 2: The 'set net-device disable' prevents the tunnel from being used…

net-device disable is typical for route-based VPNs; the tunnel interface is still used.

Trap 3: The phase2 proposal does not match the phase1 proposal.

Both use aes256-sha256; they match.

A
The phase1 keylife is longer than the phase2 keylife, causing rekey issues.
Why wrong: Different keylifes are acceptable; phase2 rekeys independently.
B
The 'set net-device disable' prevents the tunnel from being used for routing.
Why wrong: net-device disable is typical for route-based VPNs; the tunnel interface is still used.
C
The phase2 configuration does not specify the local and remote subnets to protect.
Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.
D
The phase2 proposal does not match the phase1 proposal.
Why wrong: Both use aes256-sha256; they match.

Question 12mediumdrag order

Drag and drop the steps to upgrade FortiGate firmware via the web interface into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediummatching

Match each FortiGate VPN type to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Connects two networks over the internet securely

Provides remote access via web browser or client software

Legacy VPN protocol with weaker security

Combines Layer 2 tunneling with IPsec encryption

Auto-discovery VPN that dynamically establishes shortcuts

Question 14mediummultiple choice

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

Trap 1: The firewall policy allowing IPsec traffic is missing.

A missing policy would prevent all traffic; Phase 2 would still attempt to negotiate but fail due to policy, not proposal mismatch.

Trap 2: The remote gateway IP address is unreachable.

If the remote gateway were unreachable, Phase 1 would not come up.

Trap 3: The pre-shared key is incorrect.

An incorrect pre-shared key would cause Phase 1 to fail, not Phase 2.

A
Phase 2 encryption or authentication algorithms do not match on both sides.
Phase 2 proposals must match; otherwise, the tunnel cannot establish.
B
The firewall policy allowing IPsec traffic is missing.
Why wrong: A missing policy would prevent all traffic; Phase 2 would still attempt to negotiate but fail due to policy, not proposal mismatch.
C
The remote gateway IP address is unreachable.
Why wrong: If the remote gateway were unreachable, Phase 1 would not come up.
D
The pre-shared key is incorrect.
Why wrong: An incorrect pre-shared key would cause Phase 1 to fail, not Phase 2.

Question 15hardmultiple choice

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

Trap 1: The session is fully established and has been active for 3600…

State '01' is not established; established state is typically '09' or '0a'.

Trap 2: The session has been idle for 3599 seconds and will expire soon.

The expiry counter decreases, but state 01 indicates the session is still in initiation, not idle.

Trap 3: The session is in FIN_WAIT state and is being closed.

FIN_WAIT states have different values (e.g., 03).

A
The session is fully established and has been active for 3600 seconds.
Why wrong: State '01' is not established; established state is typically '09' or '0a'.
B
The session is in SYN_SENT state and might be stuck due to no response from the server.
State 01 means SYN_SENT; a long duration indicates the three-way handshake is not completing.
C
The session has been idle for 3599 seconds and will expire soon.
Why wrong: The expiry counter decreases, but state 01 indicates the session is still in initiation, not idle.
D
The session is in FIN_WAIT state and is being closed.
Why wrong: FIN_WAIT states have different values (e.g., 03).

Question 16easymultiple choice

An organization wants to use FortiToken for two-factor authentication on SSL VPN logins. Which authentication method must be enabled on the FortiGate to support this?

Trap 1: RADIUS authentication

RADIUS can be used but not specifically for FortiToken; FortiToken is native.

Trap 2: PKI authentication

PKI uses certificates, not OTP tokens.

Trap 3: LDAP authentication

LDAP is a backend server, not the two-factor method itself.

A
Two-factor authentication with FortiToken
This is the setting that enables token-based OTP.
B
RADIUS authentication
Why wrong: RADIUS can be used but not specifically for FortiToken; FortiToken is native.
C
PKI authentication
Why wrong: PKI uses certificates, not OTP tokens.
D
LDAP authentication
Why wrong: LDAP is a backend server, not the two-factor method itself.

Question 17mediummultiple choice

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Trap 1: The users are not members of the FSSO group.

Even if not in the group, FSSO should still pass the user's identity if polling works; prompts would then be policy-based.

Trap 2: The firewall policy uses 'All Users' instead of a specific group.

This would affect authorization, not authentication prompting.

Trap 3: The FortiGate's LDAP server is unreachable.

FSSO uses AD polling, not LDAP for authentication in this scenario.

A
The users are not members of the FSSO group.
Why wrong: Even if not in the group, FSSO should still pass the user's identity if polling works; prompts would then be policy-based.
B
The firewall policy uses 'All Users' instead of a specific group.
Why wrong: This would affect authorization, not authentication prompting.
C
The FSSO collector agent service is not running.
Without the collector agent, FortiGate cannot get logon events from AD.
D
The FortiGate's LDAP server is unreachable.
Why wrong: FSSO uses AD polling, not LDAP for authentication in this scenario.

Question 18hardmultiple choice

An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?

Trap 1: The firewall policy for the VPN traffic is missing.

A missing policy would prevent traffic even if Phase 2 is up; but Phase 2 must be up first.

Trap 2: The pre-shared key for Phase 2 is incorrect.

IKEv2 uses certificates or PSK in Phase 1; Phase 2 does not have a separate PSK.

Trap 3: The remote user's client does not support IKEv2.

If Phase 1 is up, IKEv2 is supported.

A
The firewall policy for the VPN traffic is missing.
Why wrong: A missing policy would prevent traffic even if Phase 2 is up; but Phase 2 must be up first.
B
The Phase 2 proposals do not match between the FortiGate and the client.
IKEv2 Phase 2 requires matching proposals; otherwise, it fails.
C
The pre-shared key for Phase 2 is incorrect.
Why wrong: IKEv2 uses certificates or PSK in Phase 1; Phase 2 does not have a separate PSK.
D
The remote user's client does not support IKEv2.
Why wrong: If Phase 1 is up, IKEv2 is supported.

Read the full wireless explanation →

Question 19mediummultiple choice

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Trap 1: Set the 'Guest Management' feature in the FortiGate dashboard.

Guest management is separate; it uses captive portal but requires a policy to trigger it.

Trap 2: Configure a 'Landing Page' under SSL-VPN settings.

Landing page is for SSL VPN, not captive portal.

Trap 3: Enable 'Captive Portal' on the interface under System > Network >…

Captive portal is not enabled on the interface directly; it's done via policies or security profiles.

A
Set the 'Guest Management' feature in the FortiGate dashboard.
Why wrong: Guest management is separate; it uses captive portal but requires a policy to trigger it.
B
Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.
This policy catches unauthenticated traffic and redirects to the captive portal.
C
Configure a 'Landing Page' under SSL-VPN settings.
Why wrong: Landing page is for SSL VPN, not captive portal.
D
Enable 'Captive Portal' on the interface under System > Network > Interface.
Why wrong: Captive portal is not enabled on the interface directly; it's done via policies or security profiles.

Question 20easymultiple choice

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Trap 1: Route-based requires a static route, policy-based uses dynamic…

Both can use static or dynamic routing; route-based uses routes via the tunnel interface.

Trap 2: Route-based encrypts all traffic, policy-based encrypts only…

Both encrypt based on policies; route-based uses firewall policies for encryption.

Trap 3: Route-based supports only IKEv2, policy-based supports both IKEv1…

Both types support IKEv1 and IKEv2.

A
Route-based requires a static route, policy-based uses dynamic routing.
Why wrong: Both can use static or dynamic routing; route-based uses routes via the tunnel interface.
B
Route-based encrypts all traffic, policy-based encrypts only specified services.
Why wrong: Both encrypt based on policies; route-based uses firewall policies for encryption.
C
Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.
Why wrong: Both types support IKEv1 and IKEv2.
D
Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.
Correct: route-based has a tunnel interface; policy-based defines selectors in Phase 2.