StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 400 of 440 · medium

Why does a design enable PFS for the relevant Phase 2 rekeying?

Choose the single best answer.

  1. A.To create a reverse LAN policy automatically.
  2. B.To add a fresh DH exchange rather than rely solely on existing IKE keying material.
  3. C.To make the complete shared secret travel in each user packet.
  4. D.To eliminate the need for compatible peer parameters.
Show the answer and explanation

✓ Correct answer

  • To add a fresh DH exchange rather than rely solely on existing IKE keying material.

PFS adds fresh DH key agreement for the relevant rekeying. It neither transmits the private/shared secret, removes compatibility requirements nor creates authorization policy.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.