NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator wants to use SAML SSO to authenticate VPN users. The FortiGate will act as the service provider (SP) and an external identity provider (IdP) will be used. Which of the following must be configured on the FortiGate to enable SAML authentication for SSL VPN?
⚠ Common exam trap
NSE7 often tests the specific FortiGate objects required for SAML SSO, and candidates frequently confuse SAML with RADIUS or LDAP, or assume a local user object is sufficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user group with SAML authentication method and an SSL VPN portal referencing that group.
To enable SAML SSO for SSL VPN on FortiGate, the administrator must configure a user group with the SAML authentication method that references the external IdP, and then reference that group in the SSL VPN portal settings. This establishes the trust relationship where FortiGate acts as the SP and redirects authentication to the IdP. Without the user group and portal binding, SAML authentication cannot be applied to VPN users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A RADIUS server pointing to the IdP and an authentication rule.
Why it's wrong here
SAML SSO requires the FortiGate to consume IdP metadata and assertions directly; a RADIUS server cannot broker SAML, so authentication fails. It is tempting because RADIUS is the familiar VPN authentication path, and would be correct when the IdP exposes RADIUS rather than SAML.
- ✗
An LDAP server with the IdP's certificate and a matching policy.
Why it's wrong here
LDAP binds directly against a directory server; it cannot consume SAML assertions from an external IdP, so authentication would fail. LDAP is the right choice when the FortiGate queries a directory such as Active Directory for user credentials rather than federating through SAML.
- ✓
A user group with SAML authentication method and an SSL VPN portal referencing that group.
Why this is correct
SAML SSO requires a user group configured with the SAML authentication method, plus an SSL VPN portal that references it. The group binds the IdP assertion to FortiGate policy, and the portal determines what authenticated users may access.
- ✗
A local user with SAML attributes and a firewall policy referencing that user.
Why it's wrong here
SAML SSO validates assertions from the external IdP, so the FortiGate needs a SAML SSO user group referencing the IdP metadata, not a local user with static attributes. A local user suits fallback or two-factor authentication where credentials reside on the FortiGate itself.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.