NSE4 Authentication and VPN Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To provide two-factor authentication for the VPN connection

  Why it's wrong here

  Two-factor authentication is a separate security control, typically implemented through FortiToken or other MFA solutions, that verifies the user's identity during the VPN authentication phase. Split tunneling, in contrast, is a routing configuration that determines which destination networks are sent through the encrypted tunnel and which are sent directly. Enabling split tunneling has no impact on the authentication method or the number of factors required to establish the VPN session.

• ✗

  To encrypt all traffic from the remote client, including Internet traffic

  Why it's wrong here

  This description actually defines full tunneling, not split tunneling. In a full tunnel configuration, 100% of the client's traffic, including Internet-bound packets, is encapsulated and encrypted inside the VPN tunnel and then forwarded by the FortiGate to its final destination. Split tunneling, on the other hand, selectively routes only corporate-network traffic (e.g., to private IP ranges) through the tunnel, while allowing all other Internet traffic to be sent directly from the client's local network unencrypted to the ISP, thereby reducing VPN gateway load and latency.

• ✗

  To enable the use of client certificates for authentication

  Why it's wrong here

  Client certificates are an authentication mechanism used during the IKE or SSL-VPN handshake to cryptographically verify the remote user's device identity, and they are configured via certificate authorities and peer IDs. Split tunneling is entirely a routing policy that controls traffic forwarding based on destination addresses, and it is unrelated to the authentication credentials or certificates used to establish the VPN. Even if client certificates are mandatory, split tunneling can be either enabled or disabled independently, as these two features operate on different layers of the VPN architecture.

• ✓

  To allow the remote client to access both the corporate network and the Internet simultaneously without routing all traffic through the VPN

  Why this is correct

  Split tunneling is a VPN configuration that routes only traffic destined for the corporate network (e.g., private subnets or specific IP ranges) through the encrypted tunnel, while all other Internet-bound traffic exits directly from the client's local interface. This allows the remote user to simultaneously access corporate resources and general Internet services without forcing every packet through the VPN gateway, which reduces bandwidth consumption, lowers latency for unrelated web browsing, and prevents the VPN concentrator from becoming a bottleneck. The FortiGate implements this by adding specific routes for corporate CIDRs to be sent over the tunnel interface, leaving the default route on the physical adapter for direct Internet access.

Go deeper

Related to this question