I85PREP
⌘ K
FCP FortiAuthenticator 6.5 study materials
FCP FortiAuthenticator 6.5 study resources

FCP FortiAuthenticator 6.5 practice questions

One question at a time. Build your FCP FortiAuthenticator 6.5 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity and Access Management Fundamentals

In FortiAuthenticator, which built-in local database is used as the primary store for users created directly on the appliance rather than imported from an external source?

  1. The FortiToken license pool
  2. The Remote LDAP directory
  3. The Local Users database Correct answer.
  4. The RADIUS client list

Explanation

FortiAuthenticator stores users created on the appliance itself in the Local Users database, which is independent of any external directory. Imported directory accounts are referenced through remote LDAP or RADIUS configurations instead. This local store is what local user groups and local realms authenticate against.

Question 2Identity and Access Management Fundamentals

Which statement best describes the role of a realm in FortiAuthenticator?

  1. It maps FortiToken serial numbers to licensed appliance models.
  2. It defines the encryption algorithm used for RADIUS shared secrets.
  3. It groups users under a namespace tied to a specific authentication source. Correct answer.
  4. It schedules automatic synchronization of FortiGate configuration backups.

Explanation

A realm provides a namespace that scopes users to a particular authentication source, such as a local database or an LDAP directory. Because the same username can exist in multiple sources, the realm disambiguates which identity is being referenced. Realms are therefore a core organizing concept in FortiAuthenticator identity management.

Question 3Identity and Access Management Fundamentals

A user authenticates to a FortiGate that forwards the request to FortiAuthenticator. In this exchange, what role does the FortiGate play?

  1. It acts as the certificate authority issuing user certificates.
  2. It acts as a RADIUS client sending requests to the authentication server. Correct answer.
  3. It acts as the identity provider generating SAML assertions.
  4. It acts as the LDAP server storing user credentials.

Explanation

When a FortiGate forwards credentials to FortiAuthenticator over RADIUS, the FortiGate is the RADIUS client (network access server) and FortiAuthenticator is the authentication server. The client originates access-request messages and enforces the accept or reject decision returned by the server. This client-server split is fundamental to how FortiAuthenticator integrates with network devices.

Question 4Identity and Access Management Fundamentals

Which protocol does FortiAuthenticator use to validate one-time passwords generated by hardware and software tokens during user authentication?

  1. TOTP or HOTP validation against the token seed Correct answer.
  2. NTP stratum comparison
  3. SNMP community string matching
  4. Kerberos ticket granting via the KDC

Explanation

FortiAuthenticator validates one-time passwords by applying the time-based or counter-based algorithm to the stored token seed and comparing the result with the submitted code. This is the mechanism behind FortiToken and compatible OTP authenticators. Successful validation then contributes a second factor to the authentication decision.

Question 5Identity and Access Management Fundamentals

What is the primary purpose of a user group in FortiAuthenticator?

  1. To store the private keys used for portal HTTPS certificates
  2. To assign a static IP address to each member device
  3. To bundle users so that policies and authorization decisions can reference them collectively Correct answer.
  4. To encrypt traffic between FortiAuthenticator and managed FortiGates

Explanation

User groups aggregate identities so that authentication and authorization policies can target the group rather than individual accounts. Membership can come from local users or be synchronized from external directories. This simplifies administration and keeps policy references stable as users change.

Question 6Identity and Access Management Fundamentals

Which authentication method relies on a shared secret and a challenge-response exchange between a client and FortiAuthenticator without transmitting the user password in cleartext?

  1. HTTP basic authentication
  2. CHAP Correct answer.
  3. Plain LDAP simple bind
  4. PAP

Explanation

CHAP uses a challenge-response exchange in which the client proves knowledge of the password without sending it directly. PAP, by contrast, transmits the password in cleartext inside the request. Choosing a challenge-response method reduces exposure of credentials on the network path.

Question 7Identity and Access Management Fundamentals

Which FortiAuthenticator feature lets an administrator require a second factor only for users who match specific conditions such as group membership or access method?

  1. Static routing entries
  2. DHCP reservations
  3. Two-factor authentication policy rules Correct answer.
  4. Interface MTU settings

Explanation

Two-factor authentication policies in FortiAuthenticator define conditions under which a second factor is demanded. Conditions can reference user groups, authentication method, or source, allowing selective enforcement. This lets organizations apply stronger assurance where risk is higher without forcing OTP on every login.

Question 8Identity and Access Management Fundamentals

What does single sign-on provide to users in an identity and access management deployment?

  1. One authentication event grants access to multiple trusted resources without re-entering credentials. Correct answer.
  2. Users must register a separate token for every protected application.
  3. Each application stores an independent copy of the user password for verification.
  4. Administrators manually approve each application login in real time.

Explanation

Single sign-on means the user authenticates once and the resulting session or assertion is trusted by multiple service providers. This reduces password fatigue and the number of credential exposures. Trust between the identity provider and the relying applications is what makes the reuse of one authentication event possible.

Question 9Identity and Access Management Fundamentals

A company wants FortiAuthenticator to authenticate users against its existing Microsoft Active Directory without copying passwords into the appliance. Which configuration approach fits this requirement?

  1. Enable the built-in SMTP relay for credential verification.
  2. Configure a remote LDAP directory pointing to the domain controllers and reference it from a realm. Correct answer.
  3. Create duplicate local user accounts and synchronize passwords manually each week.
  4. Configure a RADIUS client entry for each domain controller.

Explanation

FortiAuthenticator can query an external LDAP directory such as Active Directory and bind to validate credentials, so passwords stay in the directory. The directory is attached to a realm so that users are resolved within a defined namespace. This avoids duplicating accounts and keeps a single source of truth.

Question 10Identity and Access Management Fundamentals

An administrator needs users to enroll their own FortiTokens through a web portal. Which FortiAuthenticator capability should be enabled to support this self-service flow?

  1. OSPF area configuration
  2. User self-registration and token provisioning on the user portal Correct answer.
  3. SNMP trap forwarding
  4. RADIUS accounting interim updates

Explanation

The FortiAuthenticator user portal supports self-service functions including token provisioning and account registration. Enabling these features lets users obtain and activate a token without administrator intervention. This scales multifactor rollout while keeping enrollment auditable.

Question 11Identity and Access Management Fundamentals

Which statement accurately describes the difference between authentication and authorization in FortiAuthenticator deployments?

  1. Authentication verifies identity, while authorization determines which resources that identity may use. Correct answer.
  2. Authorization occurs only during token enrollment, while authentication occurs at every login.
  3. Authentication determines resource access, while authorization verifies the password.
  4. Both terms describe the same check performed at the RADIUS client.

Explanation

Authentication establishes who the user is, typically by validating credentials or a token. Authorization then decides what that verified identity is permitted to reach, often through group-based policy. Keeping the two concepts distinct clarifies where identity proofing ends and access control begins.

Question 12Identity and Access Management Fundamentals

A FortiAuthenticator administrator wants guest accounts to expire automatically after a fixed period. Which mechanism accomplishes this?

  1. Reduce the FortiToken license count to zero.
  2. Disable the guest portal and rely on the default admin account.
  3. Define a guest user account with a configured expiration date and time. Correct answer.
  4. Set the RADIUS shared secret to expire on a schedule.

Explanation

Guest accounts in FortiAuthenticator can be created with an explicit expiration so that access is revoked automatically when the period ends. This is a common requirement for temporary contractors and visitors. Expiration is enforced by the appliance without manual cleanup.

Question 13Identity and Access Management Fundamentals

Which FortiAuthenticator object is used to define the certificate authority that issues certificates for users or devices?

  1. A RADIUS client entry
  2. A CA certificate configuration referencing an internal or external certificate authority Correct answer.
  3. An LDAP attribute mapping
  4. A user group with static membership

Explanation

Certificate-based identity requires a configured certificate authority that FortiAuthenticator can use to issue or validate certificates. The CA configuration identifies the trust anchor and signing authority. This underpins certificate authentication and portal TLS trust.

Question 14Identity and Access Management Fundamentals

What is the effect of assigning a user to a group that is referenced by a FortiGate LDAP or RADIUS policy?

  1. The user is excluded from all token-based authentication.
  2. The user is automatically granted super-admin rights on FortiAuthenticator.
  3. The user's password is reset at each login.
  4. The user inherits the access rights the policy grants to that group. Correct answer.

Explanation

Policies on consuming devices reference groups, so membership determines which rights apply to a user. When FortiAuthenticator returns group information, the FortiGate matches it against its policy. This is how group-based authorization is enforced end to end.

Question 15Identity and Access Management Fundamentals

An organization wants FortiAuthenticator to act as a SAML identity provider for a cloud application. Which element must be exchanged with the application to establish trust?

  1. A DHCP scope definition
  2. A RADIUS shared secret
  3. Identity provider metadata containing the signing certificate and endpoints Correct answer.
  4. An OSPF neighbor statement

Explanation

SAML federation relies on metadata that describes the identity provider's endpoints and signing certificate so the service provider can validate assertions. The service provider's metadata is likewise imported into FortiAuthenticator. Exchanging metadata establishes the trust relationship needed for federated login.

Question 16Identity and Access Management Fundamentals

Which statement about RADIUS shared secrets between a FortiGate and FortiAuthenticator is correct?

  1. The secret is transmitted in every access-request for verification.
  2. Both sides must be configured with the identical secret for requests to be accepted. Correct answer.
  3. The secret must be different on each side to provide forward secrecy.
  4. The secret is optional when CHAP is used.

Explanation

The RADIUS shared secret is a pre-shared value that both the client and server use to authenticate and integrity-protect messages, so it must match exactly. A mismatch causes requests to be silently discarded. The secret itself is not sent over the network.

Question 17Identity and Access Management Fundamentals

A user reports that OTP codes are rejected even though the token is assigned. Which FortiAuthenticator-related cause is most plausible?

  1. The guest portal theme was changed recently.
  2. The user group contains too many members.
  3. The appliance clock has drifted out of synchronization with the token's time source. Correct answer.
  4. The RADIUS client list is alphabetically sorted.

Explanation

Time-based one-time passwords depend on close clock agreement between the token and the validator, so significant drift causes valid codes to be rejected. FortiAuthenticator should synchronize with a reliable time source. Checking time synchronization is a standard first troubleshooting step for OTP failures.

Question 18Identity and Access Management Fundamentals

Which FortiAuthenticator concept allows an administrator to map directory attributes to local user fields during synchronization?

  1. RADIUS accounting
  2. Interface VLAN tagging
  3. Certificate revocation list distribution
  4. LDAP attribute mapping Correct answer.

Explanation

Attribute mapping defines how fields from the external directory correspond to user attributes in FortiAuthenticator. Correct mapping ensures that group membership, email, and other values populate as expected. This is essential for policy matching after directory synchronization.

Question 19Identity and Access Management Fundamentals

What distinguishes two-factor authentication from single-factor authentication in an identity deployment?

  1. Two-factor authentication requires the user to log in twice to the same portal.
  2. Two-factor authentication requires evidence from two different factor categories. Correct answer.
  3. Two-factor authentication requires two passwords from the same category.
  4. Two-factor authentication requires two administrators to approve a login.

Explanation

Two-factor authentication combines evidence from distinct categories, such as something you know plus something you have. Repeating the same category, like two passwords, does not provide the same assurance. FortiAuthenticator enforces this by combining password validation with a token or certificate factor.

Question 20Identity and Access Management Fundamentals

An administrator wants FortiAuthenticator to accept logins from a FortiGate using a certificate rather than a shared secret. Which capability supports this?

  1. Guest account expiration
  2. SMTP alerting
  3. Certificate-based authentication of the RADIUS or administrative peer Correct answer.
  4. Static DNS entries

Explanation

FortiAuthenticator can authenticate peers using certificates, providing stronger assurance than a pre-shared secret. The peer presents a certificate that the appliance validates against a trusted CA. This option is often used where shared secrets are considered insufficient.

Question 21Identity and Access Management Fundamentals

Which statement best explains why FortiAuthenticator supports realms when multiple directories contain overlapping usernames?

  1. The realm converts RADIUS requests into LDAP queries automatically.
  2. The realm qualifies the username so the correct source is queried for that identity. Correct answer.
  3. The realm assigns a unique IP address to each authenticated user.
  4. The realm encrypts the password before it reaches the directory.

Explanation

Realms scope identities to a particular source, so a username that exists in two directories resolves unambiguously. The realm acts as a namespace qualifier during authentication. Without realms, overlapping usernames would be ambiguous to the appliance.

Question 22Identity and Access Management Fundamentals

A FortiAuthenticator deployment must enforce OTP for VPN users but allow password-only access for a kiosk group. Which design achieves this with the least administrative overhead?

  1. Remove all user groups and rely on the default admin profile.
  2. Create separate realms for every individual user and disable tokens globally.
  3. Issue a unique FortiToken to every kiosk user and leave the VPN group password-only.
  4. Create a two-factor policy that applies to the VPN user group and excludes the kiosk group. Correct answer.

Explanation

A two-factor policy scoped to the relevant group enforces OTP where required while leaving other groups unaffected. This is more maintainable than per-user configuration or globally toggling tokens. It also keeps the policy intent explicit and auditable.

Question 23Identity and Access Management Fundamentals

An administrator observes that users authenticating through a remote LDAP realm succeed, but their group-based FortiGate policies do not match. Which explanation is most likely?

  1. The guest portal certificate is self-signed.
  2. The RADIUS shared secret is too short.
  3. The FortiToken license has expired.
  4. Group membership attributes are not being synchronized or mapped into FortiAuthenticator groups. Correct answer.

Explanation

Policy matching depends on FortiAuthenticator knowing each user's group membership and returning it to the consuming device. If directory group attributes are not synchronized or mapped, the user authenticates but no group matches. Reviewing synchronization and attribute mapping resolves this class of issue.

Question 24Identity and Access Management Fundamentals

Which consideration most strongly favors certificate-based user authentication over password-based authentication in a FortiAuthenticator design?

  1. Certificates allow passwords to be stored in cleartext safely.
  2. Certificates remove the need to define user groups for authorization.
  3. Certificates eliminate the need for any certificate authority infrastructure.
  4. Possession of the private key bound to the certificate provides stronger assurance than a reusable secret. Correct answer.

Explanation

Certificate authentication ties identity to possession of a private key, which is harder to share or guess than a password. Passwords can be reused, phished, or weak, whereas key material is bound to the holder. Authorization still requires group or policy definitions regardless of the authentication method.

Question 25Identity and Access Management Fundamentals

A security team wants to confirm that FortiAuthenticator is the authoritative source for token validation while an external directory remains authoritative for passwords. Which architecture matches this split?

  1. A single local user database holding both passwords and token seeds with no directory link.
  2. Local token validation combined with remote LDAP password verification in a single realm flow. Correct answer.
  3. Password validation performed by the RADIUS client with tokens disabled.
  4. Token validation delegated entirely to the external directory server.

Explanation

FortiAuthenticator can combine a remote directory check for the password with local token validation for the second factor. This keeps each authority responsible for what it owns while the appliance orchestrates the combined decision. The result is a two-factor flow without duplicating password stores.

Question 26Identity and Access Management Fundamentals

In an identity and access management architecture, what is the primary role of an identity provider such as FortiAuthenticator?

  1. It assigns IP addresses to endpoints before they are allowed onto the network.
  2. It stores the network flow logs that relying parties use for forensic investigations.
  3. It issues and validates the assertions that relying parties use to establish a user's identity. Correct answer.
  4. It enforces application-level firewall rules on behalf of the relying party.

Explanation

An identity provider authenticates the subject and then issues a signed assertion, such as a SAML assertion, that a relying party can trust without re-checking the user's credentials. FortiAuthenticator acts in this role when it is configured as a SAML IdP for external applications. The other functions listed belong to logging, DHCP, or firewall devices rather than to the identity provider role.

Question 27Identity and Access Management Fundamentals

Which FortiAuthenticator building block represents a distinct identity namespace that lets the same username exist in more than one directory without ambiguity?

  1. A RADIUS client entry keyed on the FortiGate IP address
  2. A token seed file exported for a hardware FortiToken
  3. A realm that is bound to a specific authentication source Correct answer.
  4. A local user group scoped to a single FortiGate policy

Explanation

A realm in FortiAuthenticator defines a separate namespace and is associated with a particular authentication source, so identical usernames in different directories remain distinguishable. Administrators select the realm when configuring the FortiGate LDAP or RADIUS connection. Groups, RADIUS clients, and token seeds do not by themselves separate overlapping username spaces.

Question 28Identity and Access Management Fundamentals

Which statement correctly describes how FortiAuthenticator treats a user who is a member of a remote LDAP group when the group is referenced in a FortiGate policy?

  1. The group membership is evaluated only if the user also has a local FortiAuthenticator account.
  2. The group membership is cached for one hour and then discarded without being sent to the FortiGate.
  3. The group membership is resolved from the directory and returned as a group attribute in the authentication response. Correct answer.
  4. The group membership is ignored unless a RADIUS attribute is manually mapped for every user.

Explanation

FortiAuthenticator reads group membership from the configured LDAP directory and includes the group information in the authentication response, typically as a RADIUS attribute, so the FortiGate can match its policy. A local account is not required for directory group evaluation, and the group is not discarded after a fixed cache period. Manual per-user attribute mapping is not a prerequisite for group-based policy matching.

Question 29Identity and Access Management Fundamentals

An administrator wants FortiAuthenticator to permit password-only logins from a legacy device that cannot generate OTPs while still requiring OTP for all other RADIUS clients. Which configuration approach fits this requirement?

  1. Create a separate RADIUS client entry for the legacy device and apply an authentication policy that does not require OTP. Correct answer.
  2. Lower the OTP drift window so the legacy device can reuse a recent code.
  3. Assign every user a hardware token and remove the legacy device from the network.
  4. Disable OTP globally and rely on password strength for every client.

Explanation

FortiAuthenticator authentication policies can be scoped by RADIUS client, so a dedicated client entry for the legacy device can be matched to a policy that permits password-only authentication. Other clients continue to match a policy that requires OTP. Global OTP disablement would weaken every client, and widening the drift window does not let a device without a token generate valid codes.

Question 30Identity and Access Management Fundamentals

Which FortiAuthenticator capability allows an administrator to define the conditions under which a second authentication factor is demanded for a given user or client?

  1. The syslog server definition that forwards authentication events
  2. The authentication policy that is evaluated during the login attempt Correct answer.
  3. The certificate revocation list that is published by the local CA
  4. The FortiToken license file that is uploaded to the appliance

Explanation

Authentication policies in FortiAuthenticator combine match conditions, such as user group or RADIUS client, with the authentication methods that must be satisfied, which is how conditional second-factor enforcement is implemented. Revocation lists, syslog definitions, and token licenses support other functions and do not decide when a second factor is required.

Question 31Identity and Access Management Fundamentals

What is the main security benefit of using certificate-based authentication instead of password-based authentication for VPN users in a FortiAuthenticator deployment?

  1. Certificates remove the requirement to validate the certificate chain during the TLS handshake.
  2. Certificates guarantee that the user's group membership is always current without directory synchronization.
  3. Certificates allow the private key to remain on the client and resist replay and password-guessing attacks. Correct answer.
  4. Certificates eliminate the need to configure any authentication policy on FortiAuthenticator.

Explanation

Certificate authentication relies on possession of a private key that never leaves the client, so an attacker cannot replay a captured credential or guess it as with a password. FortiAuthenticator still validates the certificate chain and revocation status, and authentication policies still apply. Group membership continues to depend on the configured directory source.

Question 32Identity and Access Management Fundamentals

Which FortiAuthenticator feature lets an administrator synchronize users and groups from a remote directory on a recurring schedule?

  1. An LDAP synchronization rule configured for the remote server Correct answer.
  2. A RADIUS accounting update sent by the FortiGate
  3. A SAML metadata refresh initiated by the service provider
  4. A local user import performed once through the GUI

Explanation

LDAP synchronization rules in FortiAuthenticator define which remote users and groups are imported and how often the synchronization runs, keeping local representations current. A one-time import does not recur, RADIUS accounting carries session usage data, and SAML metadata refresh concerns federation trust rather than directory users.

Question 33Identity and Access Management Fundamentals

An administrator configures FortiAuthenticator as a SAML identity provider for an external application. Which element must the service provider receive so it can validate the signed assertions?

  1. The FortiAuthenticator signing certificate that corresponds to the IdP signing key Correct answer.
  2. The local CA private key that issues user certificates
  3. The LDAP bind password used for directory synchronization
  4. The RADIUS shared secret used between FortiAuthenticator and the FortiGate

Explanation

A SAML service provider validates assertions by checking the signature with the identity provider's public signing certificate. FortiAuthenticator's IdP signing certificate is therefore shared with the service provider through metadata or manual configuration. RADIUS secrets, LDAP bind passwords, and CA private keys are unrelated to SAML assertion validation and must not be disclosed.

Question 34Identity and Access Management Fundamentals

Which statement best explains the difference between authentication and authorization in a FortiAuthenticator deployment?

  1. Authentication verifies the user's identity, while authorization determines which resources the user is permitted to access. Correct answer.
  2. Authentication applies only to administrators, while authorization applies only to VPN users.
  3. Authentication determines what resources a user may reach, while authorization verifies the user's identity.
  4. Authentication and authorization are performed exclusively by the FortiGate, never by FortiAuthenticator.

Explanation

Authentication establishes who the user is, and authorization decides what that authenticated identity is allowed to do. FortiAuthenticator participates in both by authenticating users and returning group or attribute information that the FortiGate uses for policy decisions. The two concepts are distinct and apply to all user categories.

Question 35Identity and Access Management Fundamentals

A FortiAuthenticator administrator wants guest accounts to be created with a fixed lifetime and removed automatically when that lifetime ends. Which mechanism accomplishes this?

  1. A RADIUS client entry with a short timeout value
  2. A local user group with a static membership list
  3. A guest user account configured with an expiration date and time Correct answer.
  4. A certificate template with a short key length

Explanation

Guest accounts in FortiAuthenticator can be given an explicit expiration, after which the account is no longer valid for authentication. Group membership, RADIUS timeouts, and certificate key length do not control the lifetime of a guest account. The expiration setting is the mechanism that enforces automatic expiry.

Question 36Identity and Access Management Fundamentals

Which FortiAuthenticator object is used to define the certificate authority that issues certificates for users and devices?

  1. An LDAP server definition configured under remote authentication
  2. A FortiToken seed file configured under token management
  3. A local CA object configured under certificate management Correct answer.
  4. A RADIUS client entry configured under authentication

Explanation

The local CA object in FortiAuthenticator represents the certificate authority whose key material signs user and device certificates. RADIUS client entries identify requesting devices, LDAP definitions describe directory servers, and token seed files hold OTP secrets. Only the CA object defines the issuing authority.

Question 37Identity and Access Management Fundamentals

Which consideration most strongly favors certificate-based user authentication over password-based authentication when users connect from unmanaged devices over the internet?

  1. Certificates eliminate the need for TLS on the VPN gateway.
  2. Certificates can be revoked centrally when a device is lost or compromised. Correct answer.
  3. Certificates are easier to share among coworkers than passwords.
  4. Certificates remove the need for any directory integration.

Explanation

Certificate revocation lets the organization invalidate a credential promptly when a device is lost, which is a strong control for unmanaged endpoints. Certificates should not be shared, they do not remove directory integration for group policy, and they do not replace TLS. Revocation is the advantage that most directly addresses the risk described.

Question 38Identity and Access Management Fundamentals

Which FortiAuthenticator component is responsible for generating and validating one-time passwords for FortiToken mobile and hardware tokens?

  1. The LDAP synchronization schedule
  2. The syslog forwarding configuration
  3. The token management module Correct answer.
  4. The RADIUS client table

Explanation

Token management in FortiAuthenticator holds token seeds and performs the OTP generation and validation used during two-factor authentication. RADIUS client entries identify devices, syslog forwarding moves event records, and LDAP synchronization imports directory objects. None of those components validates OTPs.

Question 39Identity and Access Management Fundamentals

An administrator observes that users authenticating through a remote LDAP realm succeed, but their group-based FortiGate policies do not match. Which FortiAuthenticator configuration is the most likely cause?

  1. The FortiToken drift window is set too wide for the affected users.
  2. The LDAP group membership attribute is not mapped or the group is not synchronized into FortiAuthenticator. Correct answer.
  3. The RADIUS accounting interval is shorter than the session timeout.
  4. The local CA certificate has expired for the affected users.

Explanation

Group-based policy matching depends on FortiAuthenticator knowing each user's directory groups and returning that information in the authentication response. If the group membership attribute is unmapped or the group has not been synchronized, authentication can still succeed while group matching fails. Token drift, CA expiry, and accounting intervals do not explain missing group attributes.

Question 40Identity and Access Management Fundamentals

A FortiAuthenticator deployment must enforce OTP for VPN users while allowing password-only access for a kiosk group. Which design achieves this with the least administrative overhead?

  1. Create authentication policies that match each user group and apply the required methods per policy. Correct answer.
  2. Create a separate FortiAuthenticator appliance for the kiosk group.
  3. Issue hardware tokens to the kiosk group and require OTP for everyone.
  4. Disable OTP on the FortiGate and rely on password complexity for all users.

Explanation

Authentication policies can match on user group, so one policy can require OTP for the VPN group while another permits password-only authentication for the kiosk group. This avoids extra appliances and does not weaken other users. Disabling OTP globally or issuing tokens to the kiosk group contradicts the stated requirement.

Question 41Authentication and Authorization

A FortiAuthenticator administrator wants users to authenticate with a one-time password delivered by SMS the moment they log in. Which token type must be assigned to the user account to achieve this?

  1. FortiToken hardware token
  2. Push notification token
  3. SMS token Correct answer.
  4. Email token

Explanation

An SMS token sends the one-time password to the user's registered mobile number at authentication time, so the code arrives on demand. Email tokens deliver the code by email instead, and hardware or push tokens use the FortiToken Mobile or physical device flow rather than an SMS message.

Question 42Authentication and Authorization

Which FortiAuthenticator feature lets an administrator enforce that members of an LDAP group must pass a FortiToken challenge in addition to their directory password?

  1. RADIUS client profile
  2. Two-factor authentication policy Correct answer.
  3. Captive portal disclaimer
  4. Guest portal registration

Explanation

Two-factor authentication policies bind a user group to a token method so that directory credentials alone are insufficient. The policy is evaluated after the initial password check, forcing the second factor for the matched group.

Question 43Authentication and Authorization

A user is configured with a FortiToken Mobile token but reports that push notifications never arrive. Which FortiAuthenticator setting should be verified first to confirm push delivery is enabled?

  1. The SMTP relay hostname
  2. The FortiToken Mobile push service configuration under the token settings Correct answer.
  3. The RADIUS shared secret on the client
  4. The LDAP bind DN password

Explanation

Push notifications depend on the FortiToken Mobile push service being configured and reachable from FortiAuthenticator. Without that service configuration, the token can still generate OTPs but push approval will not be delivered.

Question 44Authentication and Authorization

Which protocol does FortiAuthenticator use when it acts as an authentication server for a FortiGate that forwards user credentials for verification?

  1. NetFlow
  2. SNMP
  3. Syslog
  4. RADIUS Correct answer.

Explanation

FortiAuthenticator commonly receives authentication requests from FortiGate over RADIUS, returning Accept or Reject along with attributes. SNMP, syslog, and NetFlow are monitoring or logging protocols and cannot carry authentication decisions.

Question 45Authentication and Authorization

An administrator needs FortiAuthenticator to accept logins using Windows domain credentials without storing a separate password. Which authentication source should be configured?

  1. TACACS+ server
  2. RADIUS server
  3. Active Directory LDAP Correct answer.
  4. Local user database

Explanation

Configuring an Active Directory LDAP source lets FortiAuthenticator validate credentials against the domain rather than a local password store. Local users would require separate passwords, and RADIUS or TACACS+ are protocols FortiAuthenticator serves rather than directory sources.

Question 46Authentication and Authorization

Which statement correctly describes the role of a realm on FortiAuthenticator?

  1. It defines the encryption cipher used for RADIUS packets.
  2. It groups users and authentication sources under a namespace that can be selected during login. Correct answer.
  3. It specifies the syslog server that receives authentication logs.
  4. It sets the maximum number of concurrent sessions per FortiGate.

Explanation

A realm provides a namespace that scopes users and authentication sources, and the realm can be chosen at login so the correct source is queried. It is not related to packet encryption, logging destinations, or session limits.

Question 47Authentication and Authorization

A FortiAuthenticator administrator wants to restrict which FortiGate devices may send RADIUS authentication requests. What should be configured?

  1. A local user group with token enforcement
  2. A RADIUS client entry with the device IP and shared secret Correct answer.
  3. An LDAP group mapping filter
  4. A guest user self-registration policy

Explanation

FortiAuthenticator accepts RADIUS requests only from configured RADIUS clients, which are identified by device address and shared secret. Requests from unknown clients are rejected regardless of the user credentials supplied.

Question 48Authentication and Authorization

Which FortiAuthenticator object is used to define the conditions under which a user is granted access to a protected resource after authentication succeeds?

  1. Syslog filter
  2. OCSP responder
  3. Authentication policy Correct answer.
  4. Certificate template

Explanation

Authentication policies evaluate attributes and group membership to decide whether an authenticated user is granted access. Certificate templates, OCSP responders, and syslog filters serve certificate and logging functions rather than authorization decisions.

Question 49Authentication and Authorization

A company wants FortiAuthenticator to authenticate VPN users against Active Directory and also require a FortiToken OTP. Which combination of configuration elements is required?

  1. An LDAP source for the directory plus a two-factor authentication policy referencing a token Correct answer.
  2. A local user database plus a guest portal
  3. A certificate template plus an OCSP responder
  4. A RADIUS client entry plus a syslog server

Explanation

Directory authentication requires an LDAP source, and requiring an OTP on top of it requires a two-factor policy that references the token method for the relevant group. Neither element alone delivers both directory validation and a token challenge.

Question 50Authentication and Authorization

An administrator configures an LDAP source and maps an Active Directory group to a FortiAuthenticator user group. A user who is a member of that AD group is rejected at login. Which troubleshooting step is most appropriate?

  1. Verify the group membership attribute and filter used in the LDAP group mapping Correct answer.
  2. Change the syslog severity level
  3. Increase the RADIUS timeout on the FortiGate
  4. Reissue the FortiAuthenticator server certificate

Explanation

Group mapping depends on the correct membership attribute and filter so FortiAuthenticator can resolve the user's groups in the directory. If the filter does not match, the user is not placed in the mapped group and the policy rejects the login.