NSE7 Advanced VPN and Zero Trust Practice Question
A company has two FortiGate devices at different sites connected via an IPsec VPN tunnel using IKEv2. The tunnel is established but intermittent packet loss is observed. Which two configuration changes should be applied to improve stability? (Choose two.)
⚠ Common exam trap
Many candidates think reducing DPD intervals or increasing lifetimes always improves stability, but in reality, aggressive DPD can cause flapping on lossy links, and IKEv2 is inherently more stable than IKEv1 for VPN tunnels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the phase2 rekey time to 8 hours.
Intermittent packet loss during stable VPN tunnels is often caused by frequent rekey events or DPD misconfiguration. Option D (increase phase2 rekey time to 8 hours) reduces the frequency of rekeying, minimizing packet loss during key regeneration. Option E (enable Dead Peer Detection on the tunnel interface) allows the FortiGate to detect peer failures more reliably without aggressive settings. Option A (reduce DPD retry interval to 3 seconds) is too aggressive and can cause flapping on lossy links. Option B (increase phase1 lifetime) does not address the packet loss issue, as phase1 rekeying is less frequent. Option C (change to IKEv1) would reduce stability since IKEv2 is more robust and supports faster rekeying.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce the DPD retry interval to 3 seconds.
Why it's wrong here
Too aggressive; may cause false timeouts and unnecessary rekeying.
- ✗
Increase the phase1 lifetime to 86400 seconds.
Why it's wrong here
Phase1 rekey is less frequent; changing it does not address the intermittent packet loss typically caused by phase2 rekey.
- ✗
Change the IKE version to IKEv1.
Why it's wrong here
IKEv2 is generally more stable than IKEv1 for IPsec VPNs.
- ✓
Increase the phase2 rekey time to 8 hours.
Why this is correct
Longer rekey intervals reduce the frequency of rekeying, which can disrupt traffic.
- ✓
Enable Dead Peer Detection (DPD) on the tunnel interface.
Why this is correct
DPD detects peer unreachability and triggers re-establishment, improving stability.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.