NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator is configuring a multi-peer IPsec VPN where two remote sites connect to a central hub. The administrator wants to ensure that if one remote site loses connectivity, the other site can still reach the hub. Which configuration is essential?
⚠ Common exam trap
Many exam-takers confuse 'multiple remote IPs on a single phase1' (which is for dynamic or dialup VPNs) with the need for independent tunnels, leading them to choose option D, but that design shares a single IKE SA and is not fault-tolerant for multi-peer scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure separate phase1 interfaces for each remote site
In a multi-peer IPsec VPN hub-and-spoke topology, each remote site must have its own phase1 interface to maintain independent security associations (SAs). If a single phase1 interface is shared, the loss of one remote peer can disrupt the SA state for all peers, potentially breaking connectivity for the other remote site. Configuring separate phase1 interfaces ensures that each remote site's VPN tunnel operates independently, so a failure at one site does not affect the other.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the same preshared key for both remote sites
Why it's wrong here
While possible, it is not essential; separate keys can be used.
- ✓
Configure separate phase1 interfaces for each remote site
Why this is correct
Each remote site requires its own phase1 configuration so that they operate independently. If one fails, the other remains up.
- ✗
Enable auto-negotiation on all phase1 interfaces
Why it's wrong here
Auto-negotiation is for link speed/duplex, not VPN peer independence.
- ✗
Configure a single phase1 interface with multiple remote IPs
Why it's wrong here
In FortiGate, a single phase1 cannot have multiple remote IPs; each peer needs its own phase1.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.