FortiToken Mobile OTP Authentication for FortiGate
Which of the following FortiGate features allows users to authenticate using a one-time password generated by a mobile app?
Quick Answer
The answer is FortiToken. FortiToken Mobile is the correct feature because it provides two-factor authentication by generating a one-time password (OTP) directly on a smartphone app, which users enter alongside their primary credentials to access the FortiGate VPN or administrative interface. This OTP changes every 60 seconds and is cryptographically tied to the FortiGate’s token seed, ensuring that even if a password is stolen, the session remains secure. On the Fortinet NSE 4 Network Security Professional exam, this question tests your understanding of FortiGate’s multi-factor authentication options, often appearing alongside a distractor like “FortiAuthenticator” or “LDAP”—remember that FortiAuthenticator is a separate server, while FortiToken is the actual token (hardware or mobile) that generates the OTP. A common trap is confusing the token with the authentication server; the key memory tip is “Token = the thing that generates the code, not the thing that checks it.”
⚠ Common exam trap
A common mix-up: candidates confuse FortiToken with FSSO or LDAP because all three involve authentication, but only FortiToken specifically generates and validates one-time passwords via a mobile app.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiToken
FortiToken is Fortinet's two-factor authentication solution that generates one-time passwords (OTPs) via a mobile app (FortiToken Mobile) or hardware token. When a user authenticates, they must provide both their regular password and the current OTP from the FortiToken app, which is validated by the FortiGate against the token's seed record. This directly matches the question's requirement for OTP generation by a mobile app.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FSSO
Why it's wrong here
FSSO uses Active Directory logon events.
- ✗
LDAP
Why it's wrong here
LDAP is a directory service protocol.
- ✓
FortiToken
Why this is correct
FortiToken generates OTPs for two-factor authentication.
- ✗
Captive portal
Why it's wrong here
Captive portal presents a login page but does not generate OTPs.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to use FortiToken for two-factor authentication on SSL VPN logins. Which authentication method must be enabled on the FortiGate to support this?
easy- ✓ A.Two-factor authentication with FortiToken
- B.RADIUS authentication
- C.PKI authentication
- D.LDAP authentication
Why A: FortiToken is a hardware or software token that generates one-time passwords (OTPs) for two-factor authentication (2FA). To use FortiToken with SSL VPN logins, the FortiGate must have 'Two-factor authentication with FortiToken' enabled in the user or user group configuration. This setting tells the FortiGate to prompt for both the user's regular password and the current FortiToken OTP during the SSL VPN authentication process.
Variation 2. Which authentication server type can be used with FortiGate to authenticate remote VPN users with two-factor authentication using FortiTokens?
easy- A.POP3
- B.LDAP
- ✓ C.RADIUS
- D.TACACS+
Why C: RADIUS is the correct authentication server type because it supports two-factor authentication with FortiTokens, including the ability to forward token challenges (e.g., one-time passwords) between FortiGate and the RADIUS server. FortiGate acts as a RADIUS client, sending authentication requests to a RADIUS server that validates both the user's primary credentials and the FortiToken OTP, enabling secure remote VPN access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.