NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate has an IPsec VPN with a remote peer that uses IKEv2. The administrator wants to ensure that child SA rekeying uses PFS (Perfect Forward Secrecy) with Diffie-Hellman group 14. Which CLI command should the administrator configure on the FortiGate's phase 2 proposal?
⚠ Common exam trap
NSE7 often tests the exact FortiGate CLI keyword 'dhgrp' versus the generic 'dh-group' used by other vendors — candidates who memorize generic IPsec terminology instead of FortiOS-specific syntax pick the wrong option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
set pfs enable; set dhgrp 14
On a FortiGate IPsec phase 2 proposal, PFS is enabled with 'set pfs enable' and the Diffie-Hellman group is specified with 'set dhgrp 14' (note the abbreviated keyword 'dhgrp', not 'dh-group'). This ensures that child SA rekeying performs a fresh DH exchange using group 14 (2048-bit MODP), providing Perfect Forward Secrecy. The 'auto-negotiate' and 'proposal' keywords belong to different configuration contexts and do not control PFS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
set auto-negotiate enable; set dh-group 14
Why it's wrong here
auto-negotiate controls whether the phase 2 proposal is negotiated rather than fixed; it does not enable PFS, so no DH group 14 exchange occurs during child SA rekeying. It is tempting because negotiation settings appear related to rekeying behaviour. PFS requires the pfs enable setting on the phase 2 proposal to trigger the DH exchange.
- ✓
set pfs enable; set dhgrp 14
Why this is correct
Phase 2 handles child SA rekeying, so PFS is negotiated there. Enabling pfs plus dhgrp 14 forces a fresh Diffie-Hellman exchange using group 14 on each rekey, delivering the forward secrecy the administrator requires for the IPsec tunnel.
- ✗
set proposal aes256-sha256 dh-group 14
Why it's wrong here
The phase 2 proposal string lists encryption and hashing algorithms; dh-group inside it is not parsed as a PFS trigger, so child SA rekeying proceeds without a DH exchange. It is tempting because proposal syntax looks like the natural place for cryptographic settings. PFS needs the separate dh-group parameter on the phase 2 entry.
- ✗
set pfs enable; set dh-group 14
Why it's wrong here
The correct CLI parameter is 'dhgrp', not 'dh-group'.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.