NSE7 Advanced VPN and Zero Trust Practice Question
Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?
⚠ Common exam trap
Many exam-takers confuse firewall policy requirements with Phase 2 negotiation requirements, mistakenly thinking that firewall policies must allow traffic before Phase 2 can establish, when in fact Phase 2 only requires matching proxy IDs, proposals, and PFS settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Proxy IDs (local and remote subnets) match on both sides
IPsec Phase 2 uses Proxy IDs (local and remote subnets) to negotiate the security associations (SAs) that define which traffic is protected. If the proxy IDs do not match on both peers, the IKEv1 or IKEv2 Quick Mode exchange will fail, preventing the establishment of Phase 2 SAs. This is a fundamental requirement for matching traffic selectors in the IPsec SA negotiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Proxy IDs (local and remote subnets) match on both sides
Why this is correct
Phase2 uses proxy IDs to define interesting traffic; they must match.
- ✗
Firewall policies allow traffic between the subnets
Why it's wrong here
Firewall policies are not required for phase2 negotiation; they affect data traffic.
- ✓
Perfect Forward Secrecy (PFS) settings match if enabled
Why this is correct
If PFS is configured on one side, it must be enabled on the other with matching DH group.
- ✓
Phase2 proposals match between peers
Why this is correct
Matching encryption and authentication algorithms are required.
- ✗
NAT traversal is enabled on both sides
Why it's wrong here
NAT traversal is only needed if a NAT device is between peers; not a mandatory condition.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.