NSE4 Authentication and VPN Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable DPD on the phase1 interface to reduce overhead.

  Why it's wrong here

  Disabling DPD on the phase1 interface to reduce overhead is wrong because DPD probes are only sent when the tunnel has no recent traffic, so the extra control message overhead is negligible. Without DPD, the firewall cannot detect when a remote peer is dead, causing traffic to be black-holed until the IKE SA lifetime expires or manual intervention occurs. Best practice is to enable DPD with a reasonable retry interval so the tunnel fails over as soon as peer loss occurs.

• ✓

  Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.

  Why this is correct

  Enabling PFS for phase2 is a best practice because it forces a new Diffie-Hellman exchange for each Quick Mode, generating fresh session keys independent of the IKE SA's shared secret. If the firewall's private key or pre-shared secret is later stolen, an attacker cannot use it to derive previous or subsequent phase2 keys, limiting data exposure to the current session. PFS adds a small computational cost but is strongly recommended for environments handling sensitive data.

• ✗

  Use aggressive mode for faster IKE negotiation.

  Why it's wrong here

  Using aggressive mode in IKEv1 for faster negotiation is not a recommended practice because it sends the identity payload and hash in the second exchange without encryption, allowing an attacker to perform offline dictionary attacks on weak pre-shared keys. Main mode protects the identity by encrypting it after an authenticated Diffie-Hellman exchange, making it the secure default. If performance is a concern, prefer IKEv2, which provides improved reliability and security without aggressive-mode weaknesses.

• ✓

  Configure a dead peer detection (DPD) interval to detect tunnel failures.

  Why this is correct

  Configuring a dead peer detection (DPD) interval is a best practice because it allows the firewall to quickly identify when a remote VPN peer becomes unreachable, avoiding prolonged outages and routing over dead tunnels. FortiGate's DPD implementation (RFC 3706) sends a small phase1 notify payload and waits for a corresponding R-U-THERE-II response; if no reply is received after the configured retry count, the tunnel is declared down and traffic can be redirected. Set the interval conservatively (e.g., 5-30 seconds) to balance detection speed against bandwidth usage.

• ✗

  Disable PFS to reduce CPU load on the firewall.

  Why it's wrong here

  Disabling PFS to reduce CPU load on the firewall is not a best practice because it increases security risk: without PFS, phase2 session keys are derived directly from the IKE SA's Diffie-Hellman result, so compromising the long-term private key compromises all current and future session keys. The CPU overhead of performing an additional DH exchange per phase2 rekey is negligible on modern FortiGate hardware, and the security benefit far outweighs any minor performance impact. Hence PFS should remain enabled for all phase2 negotiations.

Go deeper

Related to this question