What is the purpose of perfect forward secrecy (PFS) in IKE Phase 2?

To speed up the renegotiation of IPsec security associations

To compress the data before encryption

To ensure that a compromised key cannot be used to derive past or future keys

To authenticate the remote peer using certificates

A site-to-site IPsec VPN is failing to establish. The administrator runs `diagnose vpn ike log` and sees the error 'received invalid proposal'. The Phase 1 settings on both FortiGates appear identical. What is the most likely cause?

The remote gateway IP address is wrong

The Phase 2 traffic selectors do not match

The pre-shared key is incorrect

The Phase 1 encryption or authentication algorithms are not actually identical due to a typo or different order

In FortiOS IPsec VPNs, what are the two phases of IKE (Internet Key Exchange) responsible for?

Phase 1 encrypts user data; Phase 2 authenticates user data

Phase 1 sets up the tunnel interface; Phase 2 configures routing

Phase 1 establishes a secure channel for negotiation; Phase 2 negotiates the IPsec security associations for data traffic

Phase 1 authenticates users; Phase 2 assigns IP addresses

What happens when an IPsec security association reaches the end of its lifetime?

The encryption keys are changed to a pre-defined static key

It is renegotiated, typically through a new IKE Phase 2 exchange

The FortiGate reboots to reset the VPN

The VPN tunnel is permanently deleted

An administrator is configuring a site-to-site IPsec VPN on a FortiGate. They have completed the Phase 1 and Phase 2 configurations. What additional configuration is required to allow traffic to flow through the tunnel?

Enable NAT on the tunnel interface

Configure the tunnel interface with an IP address

Create a firewall policy that permits traffic from the local network to the remote network via the tunnel interface

Configure a static route to the remote network via the tunnel interface

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 5Objective 1

IPsec VPN Concepts NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Part of the VPNs domain, which accounts for 10-15% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–9 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

10-15%of the exam

Questions 11–15

11foundation · easy
What is the purpose of perfect forward secrecy (PFS) in IKE Phase 2?
Select an answer first
12expert · hard
A site-to-site IPsec VPN is failing to establish. The administrator runs `diagnose vpn ike log` and sees the error 'received invalid proposal'. The Phase 1 settings on both FortiGates appear identical. What is the most likely cause?
Select an answer first
13foundation · easy
In FortiOS IPsec VPNs, what are the two phases of IKE (Internet Key Exchange) responsible for?
Select an answer first
14foundation · easy
What happens when an IPsec security association reaches the end of its lifetime?
Select an answer first
15application · medium
An administrator is configuring a site-to-site IPsec VPN on a FortiGate. They have completed the Phase 1 and Phase 2 configurations. What additional configuration is required to allow traffic to flow through the tunnel?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.