NSE4 Authentication and VPN Practice Question
You receive an alert that a user's FortiToken synchronization is off. You need to resynchronize the token. Which CLI command achieves this?
⚠ Common exam trap
Watch out — candidates often confuse the `execute` level command for resynchronization with the `diagnose` level command used for viewing token status, or they mistakenly think that editing the token configuration (Option B) can fix synchronization issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
execute fortitoken-resync <token-serial>
The correct command to resynchronize a FortiToken on a FortiGate is `execute fortitoken-resync <token-serial>`. This CLI command triggers the token to synchronize its time-based one-time password (TOTP) seed with the FortiGate, correcting drift caused by clock skew or battery depletion. Options A, B, and C either use incorrect syntax, perform a different function, or do not exist in the FortiOS CLI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
diagnose user fortitoken resync <token-serial>
Why it's wrong here
The "diagnose" CLI hierarchy is intended for low-level troubleshooting and does not include a "fortitoken resync" subcommand. Resynchronizing a token is an administrative operation, not a diagnostic query, so the command must be run from the "execute" level. Using "diagnose user fortitoken resync" would return an invalid command error because the correct syntax is "execute fortitoken-resync <token-serial>".
- ✗
config user fortitoken edit <token-serial> set status activate
Why it's wrong here
The "config user fortitoken" branch is used to edit token configuration objects, such as setting status, description, or linking to a user. While "set status activate" re-activates a token (moves it from inactive to active state), it does not align the token's OTP counter with the FortiGate's expected counter. Resynchronization requires matching the token's current OTP sequence to the server, which only the "execute fortitoken-resync" command can accomplish.
- ✗
execute fortitoken-update <token-serial>
Why it's wrong here
"execute fortitoken-update" is not a valid command in FortiOS; there is no such administrative function. The correct command for token resynchronization is "execute fortitoken-resync". This is a common point of confusion because FortiOS has several "update" commands (e.g., "execute update-ias"), but for tokens the specific verb is "resync", and using a non-existent command will result in a "Command not found" error.
- ✓
execute fortitoken-resync <token-serial>
Why this is correct
"execute fortitoken-resync <token-serial>" is the correct command to resynchronize a FortiToken's OTP sequence with the FortiGate. It re-aligns the token's counter value with the server's expected counter, which is necessary when the token has been pressed multiple times without authentication, causing drift. This command is executed from the "execute" CLI level and takes the token serial number as its only argument.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.