NSE4 Authentication and VPN Practice Question
Which authentication server type can be used with FortiGate to authenticate remote VPN users with two-factor authentication using FortiTokens?
⚠ Common exam trap
Watch out — candidates often confuse LDAP with RADIUS, assuming LDAP can handle two-factor authentication because it is commonly used for user directory lookups, but LDAP lacks the protocol mechanisms (like Access-Challenge) to support token-based OTP validation required for FortiTokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RADIUS
RADIUS is the correct authentication server type because it supports two-factor authentication with FortiTokens, including the ability to forward token challenges (e.g., one-time passwords) between FortiGate and the RADIUS server. FortiGate acts as a RADIUS client, sending authentication requests to a RADIUS server that validates both the user's primary credentials and the FortiToken OTP, enabling secure remote VPN access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
POP3
Why it's wrong here
POP3 (Post Office Protocol version 3) is a protocol for retrieving email from a remote mailbox, not an authentication protocol. It has no mechanism for validating user credentials in the context of network access, VPN, or firewall policies. FortiGate therefore does not list POP3 as a supported authentication server type and it cannot be used for user authentication.
- ✗
LDAP
Why it's wrong here
LDAP is a directory access protocol used by FortiGate to query and validate credentials against directories like Active Directory or OpenLDAP. However, LDAP alone does not support native two-factor authentication such as FortiToken, which requires a RADIUS server to validate the one-time password. Since the question requires an authentication server type that supports FortiToken, LDAP is not the correct choice.
- ✓
RADIUS
Why this is correct
RADIUS (Remote Authentication Dial-In User Service) is the standard centralized authentication protocol for network access, and FortiGate supports it for VPN and firewall authentication. It can be integrated with a RADIUS server, such as FortiAuthenticator, to validate both the user password and FortiToken two-factor codes. This makes RADIUS the correct and widely used authentication server type for FortiGate with two-factor authentication.
- ✗
TACACS+
Why it's wrong here
TACACS+ is a Cisco-proprietary protocol designed primarily for administrative access control on network devices, not for VPN or security gateways. FortiGate does not support TACACS+ as an authentication server for user VPN access; it is unsuitable because it lacks FortiToken integration and is not a standard remote access protocol. Therefore, TACACS+ is not a viable option here.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.