36 of 186 questions · Page 3/3 · Nse4 Auth Vpn topic · Answers revealed
Web mode is clientless and limited to pre-configured bookmarks. Without bookmarks, no access is granted.
Why this answer
Web mode provides clientless access only to bookmarked web applications. To access other internal resources, tunnel mode (with a virtual adapter) is required.
A FortiGate is configured with FSSO and Active Directory polling. Users report that they are frequently prompted for authentication even though they are logged into the domain. Which THREE possible causes should the administrator investigate?
IP changes can cause loss of FSSO session.
Why this answer
Polling issues (A), logon event not sent (B), and stale IP mapping (C) are common causes. Option D is about FortiToken, which is not relevant to FSSO. Option E is for captive portal, not FSSO.
An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?
The remote network in Phase 2 should be 0.0.0.0/0 for dial-up, because the client's real IP is dynamic. Setting it to 10.0.0.0/8 means the FortiGate expects the client's IP to be in that range, which it is not.
Why this answer
In dial-up VPN, the Phase 2 selector on the FortiGate must be set to 0.0.0.0/0 to accept traffic from any remote IP, or the specific remote subnet must match the user's assigned IP pool. If the remote network is set to anything other than 0.0.0.0/0, it may mismatch the client's proposal.
An administrator wants to enable two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?
The token must be assigned to the user, and the group must require token authentication.
Why this answer
FortiToken two-factor authentication is enforced by enabling 'fortitoken' in the user group settings. The group must be added to the SSL VPN firewall policy.
This accepts any subnet, simplifying configuration.
Why this answer
Using a single Phase 2 with 0.0.0.0/0 as local/remote subnet allows the hub to accept all traffic without needing per-spoke Phase 2 selectors. But security-conscious admins often use specific selectors. The question asks for simplification; dynamic routing (BGP) is even better.
A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)
DH group is also part of the proposal.
Why this answer
The error 'no proposal chosen' indicates that the local and remote IKE peers have no common Phase1 proposal. This can be caused by mismatched encryption, authentication, or Diffie-Hellman group. Lifetime mismatch usually results in a different error.
A firewall policy is required to permit traffic from the SSL VPN interface to destination zones.
An administrator wants to use Fortinet Single Sign-On (FSSO) with Active Directory to transparently authenticate users. Which component is responsible for polling Active Directory for user logon events?
The Collector Agent polls AD security logs.
Why this answer
The FSSO Collector Agent (or the FortiGate itself with embedded agent) polls AD for logon events.
LDAP authentication allows FortiGate to query the LDAP server for user credentials and group membership.
Why this answer
To authenticate users against an LDAP server, the administrator must create an LDAP server object and then create a user group that references that LDAP server. The group membership is typically based on LDAP group membership.
Correct. Web mode only supports web-based applications via a browser. SMB requires tunnel mode.
A FortiGate admin has configured FSSO (Fortinet Single Sign-On) using Active Directory polling. Users authenticate to the domain but when accessing the internet through the FortiGate, they are still prompted for credentials. What is the MOST likely cause?
Without polling, FSSO cannot map user logins to IP addresses.
Why this answer
FSSO polling requires the FortiGate to monitor domain controller logs. If polling is not working, users won't be detected and will be prompted.
A FortiGate administrator wants to configure a dial-up IPsec VPN where remote users connect using VPN clients with pre-shared key authentication. The company has recently experienced a data breach where the PSK was compromised. What is the best method to improve security without changing all clients immediately?
Certificates provide per-peer authentication. Even if one certificate is compromised, others are not affected. This is the best improvement.
Why this answer
Using certificate-based authentication (IKE with certificates) replaces the static PSK with dynamic per-device certificates. This provides stronger authentication and allows revocation of compromised certificates without affecting other clients. PSK is shared, so if compromised, all clients are vulnerable.
Main mode and aggressive mode use different packet formats. A mismatch causes the peers to reject each other's proposals.
Why this answer
Option D is correct. IKE mode (main vs aggressive) must match between peers. If one side uses main mode and the other aggressive mode, Phase 1 will fail with 'no proposal chosen' because the IKE exchange format differs.
An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?
FortiClient provides endpoint compliance and is the agent for ZTNA.
Why this answer
FortiClient is required on the client device to collect endpoint posture information (e.g., antivirus status, OS patches) and enforce ZTNA rules. The FortiGate uses FortiClient telemetry to make access decisions.
For route-based VPN, a static route must point to the virtual IPsec interface for the remote subnet.
Why this answer
In route-based VPN, the VPN interface must have the correct remote IP address or the route must be via the VPN interface. A common issue is that the remote subnet is not correctly learned or the static route points to the correct interface.
A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?
FortiGate checks membership in the group referenced in the policy. If the user is not in that group, authentication fails.
Why this answer
Captive portal authentication requires the user to be a member of a user group that is referenced in the firewall policy. If the LDAP user is not in the configured group (or the group is not properly mapped to an LDAP query), authentication will fail.
The hub needs routes to forward traffic between spokes.
Why this answer
To allow spoke-to-spoke communication without hub, the hub must have routes to both spokes, Phase 2 selectors to allow traffic between spokes, and a firewall policy permitting inter-spoke traffic.
An administrator needs to configure two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?
The user must be assigned a token, and the authentication method must enforce two-factor.
Why this answer
FortiToken two-factor authentication requires the user account to have a FortiToken assigned. The user can then be required to enter a token code during authentication. The firewall policy itself must use an authentication scheme that enforces two-factor.
An administrator needs to implement two-factor authentication for SSL VPN access using FortiToken. Which configuration steps are required?
This is the correct method: user object has two-factor enabled and a token assigned.
Why this answer
FortiToken two-factor requires enabling two-factor authentication on the user object, associating one or more FortiToken tokens with the user, and ensuring the SSL VPN authentication method uses that user group.
Peer-id 'any' means identity validation is not enforced.
Why this answer
The peer-id field in the IKE config shows the expected identity of the remote peer. If it's 'any', the FortiGate will accept any peer ID during Phase 1 authentication, which is typically used when the remote peer's IP is dynamic or when using certificates with subject matching disabled.
An administrator needs to deploy two-factor authentication for SSL VPN users. The company uses FortiTokens. Which two steps are required to enable FortiToken for SSL VPN users? (Choose two.)
The portal must be set to require token authentication.
Why this answer
FortiToken requires the user account to be associated with a FortiToken serial number, and the authentication method must be set to require token code along with password.
Authentication credential is required to establish Phase 1.
An administrator wants to use FortiToken two-factor authentication for SSL VPN users. In addition to configuring the user's FortiToken, which setting must be enabled on the firewall policy to force two-factor authentication?
The user group must have two-factor authentication enabled.
Why this answer
Two-factor authentication is enabled by setting the authentication method to require both password and FortiToken. The 'Two-factor authentication' option must be enabled on the user group or user, not the policy itself.
A FortiGate administrator is troubleshooting a dial-up IPsec VPN where remote users can connect but traffic does not pass. The Phase 1 and Phase 2 status show 'up'. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. However, 'diagnose sys session list' shows no sessions for the remote user's IP. What is the MOST likely cause?
A common issue after VPN establishment is missing firewall policies. Even with the tunnel up, traffic is dropped unless a policy allows it.
Correct. The proposal includes encryption, authentication, and DH group. Mismatch causes 'no proposal chosen'.
Why this answer
The proposal (encryption and authentication algorithms) and the Diffie-Hellman group must match between peers for Phase 1 to succeed. These are the key parameters negotiated during Phase 1.
A company wants to provide remote access to internal resources for employees using laptops that may connect from untrusted networks. The security team requires that all traffic between the remote users and the corporate network be encrypted, and that users must authenticate using a username/password plus a one-time passcode from a hardware token. Which FortiGate VPN solution best meets these requirements?
Why this answer
Option C is correct because SSL VPN with FortiToken two-factor authentication meets the requirement for encrypted remote access with username/password plus a one-time passcode from a hardware token. SSL VPN provides encrypted tunnels over HTTPS, and FortiToken adds the required second factor, ensuring strong authentication even from untrusted networks.
Exam trap
The trap here is that candidates may assume any VPN with encryption (like IPsec or L2TP/IPsec) automatically supports two-factor authentication, but FortiGate requires explicit configuration of a second factor like FortiToken, and SSL VPN is the typical solution for this requirement in the NSE4 exam context.
How to eliminate wrong answers
Option A is wrong because IPsec VPN with certificate-based authentication provides encryption but does not inherently support a one-time passcode from a hardware token; it relies on certificates, not two-factor authentication. Option B is wrong because SSL VPN with local password authentication provides encryption but only uses a single factor (password), failing the requirement for a one-time passcode. Option D is wrong because L2TP/IPsec VPN with a pre-shared key and user password provides encryption but uses only a pre-shared key and password, lacking the required two-factor authentication with a hardware token.
Dynamic routing (BGP/OSPF) can advertise spoke subnets to each other, allowing direct tunnels to be established if using ADVPN or additional Phase 2 selectors.
Why this answer
By default, hub-and-spoke only allows communication between spokes via the hub. To enable direct spoke-to-spoke, you need to add Phase 2 selectors with each other's subnets on the hub or configure dynamic routing (BGP/OSPF) to advertise routes between spokes. Another method is to use ADVPN (Auto Discovery VPN).
'Initial contact' notifies the local peer to delete old SAs and re-establish the tunnel.
Why this answer
'Initial contact' is a notification sent when a peer clears its Phase 1 and Phase 2 SAs. It typically indicates that the remote peer has restarted or its configuration has been reloaded. It is not an error but an informational message.
Correct. The firewall policy must explicitly permit traffic from the SSL VPN zone to the internal zone.
Why this answer
An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)
The proxy acts as a reverse proxy for the application.
Why this answer
ZTNA requires a ZTNA proxy to protect the application, a ZTNA rule (policy) to define access criteria, and an access proxy (or application) that listens for incoming connections. Option A, C, and D are correct.
Even with SSL VPN configured, traffic must be allowed by a firewall policy from the SSL VPN interface to the destination.
Why this answer
For SSL VPN tunnel mode, split-tunneling settings determine which traffic goes through the tunnel. If split-tunneling is not configured, the remote user's traffic may not be routed to the FortiGate properly. However, more commonly, the firewall policy between the SSL VPN interface and the internal network is missing or incorrect.
Phase 2 requires identical proposals on both sides.
Why this answer
Phase 2 parameters must match exactly. If there is a mismatch in encryption, authentication, or PFS settings, Phase 2 will fail. Option A is the most common cause.
An admin wants users to authenticate once via AD and have their network access controlled without repeated logins. Which feature should be used?
FSSO provides single sign-on by polling AD for logon events.
Why this answer
FSSO (Fortinet Single Sign-On) captures AD logon events and maps user IP addresses to user identities, allowing transparent authentication without repeated logins.
Phase2 requires matching proposals; a mismatch prevents establishment.
0.0.0.0 means any remote gateway is accepted.
Ready to test yourself?
Try a timed practice session using only Nse4 Auth Vpn questions.