IPsec VPN Issues NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A branch office FortiGate has a site-to-site IPsec tunnel to the head office. The head office gateway occasionally becomes unreachable for a few minutes due to maintenance. The administrator wants the tunnel to detect the failure and re-establish automatically when the head office gateway returns. What should they configure?

   • AIncrease the phase 2 rekey margin to allow more time for renegotiation.
   • BSet a longer phase 1 key lifetime to keep the tunnel up longer.
   • CEnable Dead Peer Detection (DPD) on the phase 1 interface with a short detection interval and retry count.
   • DConfigure a static route with a higher administrative distance to the tunnel.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common symptom of an MTU issue on an IPsec tunnel?

   • AThe tunnel fails to establish at all.
   • BThe tunnel rekeys every few minutes.
   • CSmall packets (e.g., ping with 100 bytes) work, but large packets (e.g., ping with 1500 bytes) fail.
   • DThe tunnel shows 'down' in the status.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of Dead Peer Detection (DPD) in an IPsec VPN?

   • ATo encrypt traffic more efficiently by detecting idle periods.
   • BTo automatically update the pre-shared key when the peer changes.
   • CTo detect when the remote peer becomes unreachable and tear down the tunnel so it can be re-established.
   • DTo prevent NAT traversal by using a different UDP port.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When NAT-T is enabled, which UDP port is used for IPsec traffic?

   • AUDP 500
   • BTCP 443
   • CUDP 1701
   • DUDP 4500
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An IPsec tunnel is operational, but throughput is lower than expected. The FortiGate is a model that supports hardware acceleration for IPsec. What should the administrator check first?

   • AVerify that the IPsec traffic is being offloaded to the hardware acceleration engine and not processed by the CPU.
   • BIncrease the phase 2 key lifetime to reduce rekey overhead.
   • CEnable NAT traversal to improve encapsulation efficiency.
   • DChange the encryption algorithm to a weaker one to reduce CPU load.
   Reveal Solution Discussion Select an answer first