Which FortiOS feature can offload IPsec encryption to hardware to improve throughput?

IPsec hardware acceleration (CP8/CP9/SoC)

What is the purpose of NAT Traversal (NAT-T) in IPsec?

To allow IPsec packets to pass through NAT devices by encapsulating them in UDP.

To authenticate IPsec peers using digital certificates.

To encrypt IPsec packets with an additional layer of encryption.

To compress IPsec packets to reduce bandwidth usage.

A site-to-site IPsec tunnel fails to establish. The FortiGate logs show 'no proposal chosen' in phase 1. Both sides are configured with the same encryption and authentication algorithms. What is the most likely cause?

The Diffie-Hellman group is different on the two sides.

The phase 2 selector is misconfigured.

The pre-shared key is incorrect.

The tunnel interface IP is incorrect.

A FortiGate IPsec tunnel fails to establish. The phase 1 status shows 'negotiation failed'. Which configuration mismatch is a common cause of this failure?

The firewall policy allows traffic but the routing table has no route to the remote subnet.

The phase 2 selectors (local and remote subnets) are reversed.

The remote gateway IP address is set to the peer's internal interface instead of its public IP.

The tunnel name is different on the two peers.

A site-to-site IPsec tunnel between two FortiGates works when both are on the same LAN, but fails when one side is behind a NAT device. What should the administrator enable on the FortiGate behind the NAT?

Change the phase 2 encapsulation mode to transport mode.

Set the phase 1 proposal to use AES-GCM instead of AES-CBC.

Enable NAT traversal (NAT-T) on the phase 1 configuration.

Enable Dead Peer Detection (DPD) on the phase 1 configuration.

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 5Objective 5

IPsec VPN Issues NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Part of the VPNs domain, which accounts for 10-15% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–9 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

9concepts

10-15%of the exam

Questions 11–15

11foundation · easy
Which FortiOS feature can offload IPsec encryption to hardware to improve throughput?
Select an answer first
12foundation · easy
What is the purpose of NAT Traversal (NAT-T) in IPsec?
Select an answer first
13expert · medium
A site-to-site IPsec tunnel fails to establish. The FortiGate logs show 'no proposal chosen' in phase 1. Both sides are configured with the same encryption and authentication algorithms. What is the most likely cause?
Select an answer first
14foundation · easy
A FortiGate IPsec tunnel fails to establish. The phase 1 status shows 'negotiation failed'. Which configuration mismatch is a common cause of this failure?
Select an answer first
15application · medium
A site-to-site IPsec tunnel between two FortiGates works when both are on the same LAN, but fails when one side is behind a NAT device. What should the administrator enable on the FortiGate behind the NAT?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.