NSE7 Advanced VPN and Zero Trust Practice Question
Which TWO configurations are required to enable SSL VPN authentication using a RADIUS server on a FortiGate?
⚠ Common exam trap
A common mix-up: candidates think configuring the RADIUS server alone is sufficient, but FortiGate requires the user group to link the RADIUS server to the SSL VPN authentication process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user group that includes the RADIUS server as an authentication method
A user group must be created to reference the RADIUS server as an authentication method. This group is then applied to the SSL VPN portal or firewall policy, allowing FortiGate to forward authentication requests to the RADIUS server. Without the user group, the RADIUS server cannot be associated with SSL VPN authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a user group that includes the RADIUS server as an authentication method
Why this is correct
A user group ties the RADIUS server to SSL VPN authentication.
- ✗
Configure an LDAP server to synchronize user accounts
Why it's wrong here
LDAP is not required for RADIUS authentication.
- ✗
Configure an SSL VPN portal with 'Require Authentication' enabled
Why it's wrong here
Portal settings don't specify the authentication method.
- ✓
Define the RADIUS server under User & Authentication > RADIUS Servers
Why this is correct
The RADIUS server must be defined before it can be used.
- ✗
Set a local password policy for SSL VPN users
Why it's wrong here
Password policy is not required; RADIUS handles passwords.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.