nerdexam
Fortinet

NSE4_FGT-7.0 · Question #106

An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

The correct answer is C. Dialup clients must provide a username and password for authentication. When a dialup IPsec VPN is configured with XAuth, the client is required to provide a username and password for authentication in addition to the Phase 1 authentication method.

VPN

Question

An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

Options

  • APhase 1 negotiations will skip preshared key exchange.
  • BOnly digital certificates will be accepted as an authentication method in phase 1.C
  • CDialup clients must provide a username and password for authentication.
  • DDialup clients must provide their local ID during phase 2 negotiations.

How the community answered

(33 responses)
  • A
    3% (1)
  • C
    94% (31)
  • D
    3% (1)

Why each option

When a dialup IPsec VPN is configured with XAuth, the client is required to provide a username and password for authentication in addition to the Phase 1 authentication method.

APhase 1 negotiations will skip preshared key exchange.

XAuth is an additional authentication step; it does not skip the initial Phase 1 authentication methods like preshared keys or digital certificates.

BOnly digital certificates will be accepted as an authentication method in phase 1.C

XAuth can be used with either preshared keys or digital certificates as the Phase 1 authentication method; it does not restrict Phase 1 to only digital certificates.

CDialup clients must provide a username and password for authentication.Correct

XAuth (Extended Authentication) adds an extra layer of user authentication to IPsec VPNs, typically requiring dialup clients to provide a username and password after Phase 1 completes and before Phase 2 begins, providing granular user access control.

DDialup clients must provide their local ID during phase 2 negotiations.

The local ID is part of Phase 1 identification, not an additional authentication step during Phase 2; XAuth handles username/password after Phase 1.

Concept tested: IPsec VPN XAuth functionality

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/37829/xauth

Topics

#IPsec VPN#XAuth#Dialup VPN#User authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4_FGT-7.0 Practice