IPsec VPN Issues NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An IPsec tunnel fails to establish with an authentication error. What is the most likely cause?

   • AThe pre-shared key on the two peers does not match.
   • BThe phase 2 encryption algorithm is different.
   • CThe remote gateway IP is incorrect.
   • DThe tunnel interface MTU is too small.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When using certificate-based authentication for IPsec, what must be valid on both peers for authentication to succeed?

   • AThe certificate must be signed by the same CA that issued the local certificate.
   • BThe certificate must be imported into the FortiGate's local certificate store.
   • CThe certificate must have the same serial number on both peers.
   • DThe certificate chain must be trusted by the peer, and the certificate must not be expired or revoked.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A site-to-site IPsec tunnel between two FortiGates is configured with DPD enabled. The tunnel goes down, but the FortiGate does not detect the peer as dead for several minutes, causing traffic to be black-holed. The administrator wants faster detection. What should they do?

   • AReduce the DPD retry interval and retry count on the phase 1 configuration.
   • BIncrease the phase 1 key lifetime to keep the tunnel up longer.
   • CAdd a static route with a lower administrative distance to the tunnel.
   • DDisable DPD and rely on the phase 2 rekey to detect the peer.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following factors can degrade IPsec tunnel throughput?

   • AUsing a longer encryption key (e.g., AES-256 vs AES-128)
   • BUsing DPD in on-demand mode
   • CEnabling NAT traversal
   • DSetting a shorter phase 2 lifetime
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A remote user's IPsec VPN client cannot establish a tunnel to the FortiGate. The user is on a network that uses NAT. The FortiGate logs show phase 1 negotiation failures. What should the administrator check?

   • ACheck that the phase 2 proposal matches the client's settings.
   • BConfirm that the user's client is using the correct pre-shared key.
   • CEnsure that NAT traversal is enabled on the FortiGate's phase 1 configuration for the VPN.
   • DVerify that the user's client has a valid certificate.
   Reveal Solution Discussion Select an answer first