NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator wants to use PKI certificates for IPsec VPN authentication instead of pre-shared keys. Which phase1 parameter must be set to 'signature' to enable certificate-based authentication?
⚠ Common exam trap
NSE7 often tests the confusion between authmethod (which selects PSK vs signature) and other certificate-related parameters like cert-validation or peer-id — candidates pick cert-validation thinking it enables certificate auth, but it only validates the chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
set authmethod signature
In FortiGate IPsec phase1 configuration, certificate-based authentication is enabled by setting authmethod to signature, which tells the FortiGate to use digital signatures (certificates) instead of pre-shared keys. This is the specific phase1 parameter that switches authentication from PSK to certificate-based.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
set authmethod signature
Why this is correct
Setting authmethod to signature makes phase1 use X.509 certificates for peer authentication rather than a pre-shared key, satisfying the requirement to replace PSKs with PKI. FortiGate then validates the peer certificate against the configured local or CA certificate.
- ✗
set cert-validation enable
Why it's wrong here
Certificate-based IPsec authentication requires setting authentication-method to signature in phase1; cert-validation enable only turns on revocation checking. The tempting confusion is that both parameters mention certificates, but validation is a supplementary check, not the authentication method selector.
- ✗
set ike-version 2
Why it's wrong here
ike-version 2 selects IKEv2 rather than IKEv1, but certificate authentication is enabled by the authentication method parameter, not the IKE version. IKEv2 is chosen when the peer requires it or when features such as EAP or multiple proposals are needed.
- ✗
set peer-id certificate
Why it's wrong here
peer-id is the identity type used for certificate matching, not the authentication method selector. The stem requires the authentication method itself set to signature; peer-id certificate merely tells the FortiGate to match the peer's certificate subject, which presupposes signature authentication is already configured.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.