NSE4 Authentication and VPN Practice Question
Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?
⚠ Common exam trap
A common mix-up: candidates confuse 'split tunneling' as a separate VPN mode when it is actually a routing configuration option within tunnel mode, leading them to incorrectly select Option C instead of recognizing that tunnel mode is the only mode providing full network-layer access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tunnel mode
Tunnel mode is correct because it creates a virtual network interface on the client that obtains an IP address from the FortiGate's SSL VPN address pool, encapsulating all IP traffic within SSL/TLS packets. This provides full network-layer (Layer 3) access, allowing any application—including those using non-HTTP protocols like SSH, RDP, or custom TCP/UDP services—to function as if the client were directly connected to the remote network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tunnel mode
Why this is correct
Tunnel mode is the SSL VPN operating mode that creates a virtual network adapter on the client and assigns it an IP address from the internal network. This allows the client to participate at Layer 3, with routing entries directing traffic through the TLS-encrypted tunnel, thereby providing full network-layer access to any IP-based service, not just web applications.
- ✗
Web mode
Why it's wrong here
Web mode, sometimes called portal mode, only redirects a browser to specific preconfigured URLs that the FortiGate proxy can publish without extending the user's network identity. Because it operates at Layer 7 by proxying HTTP/HTTPS, there is no virtual adapter, no IP-level routing, and no path for non-web protocols, so it cannot deliver the full network-layer connectivity of tunnel mode.
- ✗
Split tunneling mode
Why it's wrong here
Split tunneling is a policy option that can be applied to tunnel mode to decide which destination subnets traverse the VPN versus which go out the client's local interface. It is not a distinct SSL VPN mode; it merely modifies the routing table within tunnel mode, and even when enabled, selected traffic still uses a tunnel interface to reach those networks.
- ✗
Clientless mode
Why it's wrong here
Clientless mode is an alternative name for web mode, emphasizing that no VPN client software is installed; all access is through a browser-based portal that proxies only web content. Since the destination server sees the FortiGate's IP rather than a client-assigned internal IP, there is no network-layer presence or routing capability, making it incapable of providing full network access.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.