NSE4 Authentication and VPN Practice Question
Which authentication method allows FortiGate to authenticate users against an Active Directory domain without storing domain credentials locally?
⚠ Common exam trap
Candidates often confuse FSSO with LDAP authentication, thinking FSSO also authenticates users, when in fact FSSO only collects authentication events from the domain controller and does not perform password verification itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LDAP authentication
LDAP authentication allows FortiGate to verify user credentials directly against an Active Directory domain controller without storing the domain passwords locally. The FortiGate sends a BIND request with the user's DN and password to the LDAP server, which validates the credentials and returns a success or failure response. This avoids local storage of domain credentials while still enabling centralized authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FSSO polling
Why it's wrong here
FSSO polling uses FortiGate's integration with Active Directory to collect security event logs from domain controllers, learning which users have logged into the domain. This polling discovers successful authentication events after they occur, so the FortiGate never verifies a password or performs a bind against AD. It is an identity-awareness mechanism, not an authentication method, because the FortiGate trusts results already produced by AD.
- ✗
RADIUS authentication
Why it's wrong here
RADIUS authentication sends the user's credentials from the FortiGate to an external RADIUS server, such as Microsoft NPS, which then checks them against Active Directory. The FortiGate itself does not directly speak LDAP to AD; it only processes the Access-Accept or Access-Reject reply from the RADIUS server. This is a viable way to authenticate users against AD, but it is an indirect proxy method rather than a direct directory bind.
- ✓
LDAP authentication
Why this is correct
LDAP authentication enables the FortiGate to connect directly to an Active Directory server using the LDAP protocol and perform a bind with the user's DN and provided password. This real-time directory bind verifies credentials against AD without storing any user secret on the FortiGate. This direct query and bind is why LDAP is the authentic direct authentication method for AD in FortiGate configurations.
- ✗
Local user database
Why it's wrong here
Local user database stores usernames and password hashes entirely on the FortiGate's local disk or memory, independent of any remote directory. Authentication is performed locally by comparing supplied credentials to stored entries, so Active Directory is not involved in any way. While convenient for small deployments or break-glass access, this method does not leverage AD authentication and requires separate user management.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.