A site-to-site IPsec VPN is established, but the administrator notices that the Phase 2 SA is renegotiated every 10 minutes. The Phase 2 lifetime is set to 3600 seconds. What is the most likely cause?

The remote peer has a shorter Phase 2 lifetime configured

The Phase 1 lifetime is set to 600 seconds

The pre-shared key is being changed automatically

The tunnel is experiencing high traffic volume

What is an IPsec security association (SA)?

A user account used for VPN authentication

A firewall policy that allows VPN traffic

A set of parameters that define how IPsec traffic is encrypted and authenticated

A routing table entry for the VPN tunnel

What is the first step in configuring a site-to-site IPsec VPN on a FortiGate?

Define the IKE Phase 1 parameters

Configure routing for the remote subnet

Set up the IPsec tunnel interface

Create a firewall policy for the VPN traffic

A site-to-site IPsec VPN is established, but only traffic from a specific source subnet is being encrypted. Other subnets are not passing through the tunnel. The Phase 2 selector is configured with a single local subnet. What is the most likely cause?

The pre-shared key is incorrect

The Phase 1 encryption algorithm is too weak

The Phase 2 selector does not include the other subnets

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 5Objective 1

IPsec VPN Concepts NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 5)

Part of the VPNs domain, which accounts for 10-15% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–9 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

10-15%of the exam

Questions 21–25

21foundation · easy
Which FortiOS command is used to view real-time IPsec VPN negotiation messages?
Select an answer first
22expert · hard
A site-to-site IPsec VPN is established, but the administrator notices that the Phase 2 SA is renegotiated every 10 minutes. The Phase 2 lifetime is set to 3600 seconds. What is the most likely cause?
Select an answer first
23foundation · easy
What is an IPsec security association (SA)?
Select an answer first
24foundation · easy
What is the first step in configuring a site-to-site IPsec VPN on a FortiGate?
Select an answer first
25expert · hard
A site-to-site IPsec VPN is established, but only traffic from a specific source subnet is being encrypted. Other subnets are not passing through the tunnel. The Phase 2 selector is configured with a single local subnet. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.