NSE7 Troubleshooting and Diagnostics Practice Question
An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?
⚠ Common exam trap
Many exam-takers assume matching encryption and authentication proposals guarantee phase 2 success, overlooking PFS and proxy ID mismatches which are frequently tested in NSE7 troubleshooting scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PFS (Perfect Forward Secrecy) settings
PFS ensures that if one session key is compromised, previous and future session keys remain secure by using a Diffie-Hellman exchange in phase 2. If PFS is enabled on one side but not the other, or if the DH groups do not match, phase 2 will fail even when the encryption and authentication proposals are identical. Since the phase 2 proposal 'aes128-sha256' matches on both sides, the mismatch likely lies in PFS settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PFS (Perfect Forward Secrecy) settings
Why this is correct
If one side has PFS enabled and the other does not, or they use different DH groups, phase 2 will fail.
- ✗
The local authentication method (certificate vs pre-shared key)
Why it's wrong here
This is a phase 1 parameter.
- ✗
The encryption algorithm for phase 2
Why it's wrong here
The question states the proposals match; encryption mismatch would already be covered.
- ✓
The local and remote subnets defined in phase 2 (proxy IDs)
Why this is correct
Mismatched proxy IDs are a common cause of phase 2 failure.
- ✗
The pre-shared key
Why it's wrong here
PSK is used in phase 1; phase 2 failure occurs after phase 1 is up.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.