Fortinet FortiOS 7.6 NSE4_FGT_AD-7.6 LDAP RADIUS Active Passive Authentication Practice Test

 

This Fortinet NSE4_FGT_AD-7.6 practice test focuses on ldap radius active passive authentication and user monitoring through original applied scenarios aligned to the current Fortinet NSE 4 – FortiOS 7.6 Administrator scope for FortiOS 7.6.0. Use the full ExamSnap NSE4_FGT_AD-7.6 collection for broader practice across all current domains. For broader exam preparation, review the Fortinet NSE4_FGT_AD-7.6 Exam Dumps page.

Question 1

During a maintenance window at Trey Research, the team must authenticate users against an LDAP directory and resolve directory groups. Which action is the most appropriate? The change is being made during a controlled production window.

• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry

Correct answer: C

Explanation

1. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
2. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
3. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This directly satisfies the stated requirement.
4. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
5. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.

Learning point: For this FortiOS 7.6 scenario, configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior. LDAP authentication depends on a successful directory connection and correct search or bind parameters.

Question 2

A change review at Nod Publishers identifies one requirement: troubleshoot LDAP authentication after directory administrators moved users to a different branch. Which FortiGate action best satisfies it? The team will validate the result immediately after the change.

• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions

Correct answer: E

Explanation

1. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
2. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
3. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
4. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
5. Directory structure and search scope determine whether FortiGate can find the user and groups. This directly satisfies the stated requirement.

Learning point: For this FortiOS 7.6 scenario, verify the LDAP base DN, user search path, group membership lookup, and bind account permissions. Directory structure and search scope determine whether FortiGate can find the user and groups.

Question 3

While troubleshooting at Contoso Finance, the security engineer needs to authenticate network users through an existing centralized AAA platform. What is the best next step? No unrelated security controls should be changed.

• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate

Correct answer: E

Explanation

1. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
2. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
3. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
4. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
5. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This directly satisfies the stated requirement.

Learning point: For this FortiOS 7.6 scenario, configure the RADIUS server address, shared secret, and required authentication settings on FortiGate. RADIUS uses a shared secret and reachable AAA server to validate authentication requests.

Question 4

Litware Logistics is standardizing its FortiGate 7.6 operations. Which approach should it use to diagnose RADIUS timeouts after a server migration? The administrator wants a configuration that is easy to audit later.

• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry

Correct answer: A

Explanation

1. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This directly satisfies the stated requirement.
2. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
3. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
4. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
5. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.

Learning point: For this FortiOS 7.6 scenario, check routing, firewall reachability, server address and port, and the shared secret on both sides. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout.

Question 5

A production ticket for Wide World Importers states that administrators must force users to identify themselves interactively before a policy grants access. Which choice is correct? The administrator must choose the action that addresses the stated cause rather than a different FortiGate feature.

• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case

Correct answer: E

Explanation

1. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
2. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
3. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
4. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
5. Active authentication prompts the user instead of learning identity silently from another source. This directly satisfies the stated requirement.

Learning point: For this FortiOS 7.6 scenario, use an active firewall-authentication method such as a captive authentication workflow for the policy use case. Active authentication prompts the user instead of learning identity silently from another source.

Question 6

The security team at Graphic Design Institute wants to apply identity policy without repeatedly prompting domain users who have already signed in. Which FortiGate configuration or action most directly meets that goal? The team wants the smallest change that directly addresses the requirement.

• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Check routing, firewall reachability, server address and port, and the shared secret on both sides

Correct answer: A

Explanation

1. Passive authentication learns user identity from external login information rather than prompting each session. This directly satisfies the stated requirement.
2. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
3. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
4. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
5. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.

Learning point: For this FortiOS 7.6 scenario, use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings. Passive authentication learns user identity from external login information rather than prompting each session.

Question 7

An incident at Lamna Healthcare requires the security engineer to confirm which user FortiGate currently associates with a workstation IP. What should be done first? The choice should follow normal FortiOS administration practice.

• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Check routing, firewall reachability, server address and port, and the shared secret on both sides

Correct answer: A

Explanation

1. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This directly satisfies the stated requirement.
2. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
3. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
4. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
5. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.

Learning point: For this FortiOS 7.6 scenario, use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry. The user monitor shows current authenticated identities and their associated addresses or authentication sources.

Question 8

For a FortiGate 7.6 deployment at Tailspin Toys, which option correctly addresses the need to limit a policy to members of an approved remote directory group? The solution must preserve the existing production design where possible.

• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings

Correct answer: D

Explanation

1. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
2. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
3. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
4. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This directly satisfies the stated requirement.
5. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.

Learning point: For this FortiOS 7.6 scenario, map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership.

Question 9

Humongous Insurance has validated routing and basic reachability. The remaining requirement is to authenticate users against an LDAP directory and resolve directory groups. Which action should the team take? The change is being made during a controlled production window.

• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case

Correct answer: D

Explanation

1. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
2. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
3. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
4. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This directly satisfies the stated requirement.
5. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.

Learning point: For this FortiOS 7.6 scenario, configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior. LDAP authentication depends on a successful directory connection and correct search or bind parameters.

Question 10

At Coho Winery, a infrastructure engineer is handling a FortiGate 7.6 change. The requirement is to troubleshoot LDAP authentication after directory administrators moved users to a different branch. What should the administrator do? The team will validate the result immediately after the change.

• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case

Correct answer: C

Explanation

1. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
2. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
3. Directory structure and search scope determine whether FortiGate can find the user and groups. This directly satisfies the stated requirement.
4. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
5. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.

Learning point: For this FortiOS 7.6 scenario, verify the LDAP base DN, user search path, group membership lookup, and bind account permissions. Directory structure and search scope determine whether FortiGate can find the user and groups.

Question 11

During a maintenance window at Relecloud, the team must authenticate network users through an existing centralized AAA platform. Which action is the most appropriate? No unrelated security controls should be changed.

• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Check routing, firewall reachability, server address and port, and the shared secret on both sides

Correct answer: D

Explanation

1. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
2. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
3. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
4. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This directly satisfies the stated requirement.
5. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.

Learning point: For this FortiOS 7.6 scenario, configure the RADIUS server address, shared secret, and required authentication settings on FortiGate. RADIUS uses a shared secret and reachable AAA server to validate authentication requests.

Question 12

A change review at Woodgrove Bank identifies one requirement: diagnose RADIUS timeouts after a server migration. Which FortiGate action best satisfies it? The administrator wants a configuration that is easy to audit later.

• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Check routing, firewall reachability, server address and port, and the shared secret on both sides

Correct answer: E

Explanation

1. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
2. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
3. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
4. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
5. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This directly satisfies the stated requirement.

Learning point: For this FortiOS 7.6 scenario, check routing, firewall reachability, server address and port, and the shared secret on both sides. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout.

Question 13

While troubleshooting at Alpine Ski House, the security engineer needs to force users to identify themselves interactively before a policy grants access. What is the best next step? The administrator must choose the action that addresses the stated cause rather than a different FortiGate feature.

• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry

Correct answer: A

Explanation

1. Active authentication prompts the user instead of learning identity silently from another source. This directly satisfies the stated requirement.
2. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
3. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
4. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
5. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.

Learning point: For this FortiOS 7.6 scenario, use an active firewall-authentication method such as a captive authentication workflow for the policy use case. Active authentication prompts the user instead of learning identity silently from another source.

Question 14

Datum Corporation is standardizing its FortiGate 7.6 operations. Which approach should it use to apply identity policy without repeatedly prompting domain users who have already signed in? The team wants the smallest change that directly addresses the requirement.

• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry

Correct answer: D

Explanation

1. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
2. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
3. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
4. Passive authentication learns user identity from external login information rather than prompting each session. This directly satisfies the stated requirement.
5. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.

Learning point: For this FortiOS 7.6 scenario, use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings. Passive authentication learns user identity from external login information rather than prompting each session.

Question 15

A production ticket for Southridge Video states that administrators must confirm which user FortiGate currently associates with a workstation IP. Which choice is correct? The choice should follow normal FortiOS administration practice.

• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings

Correct answer: A

Explanation

1. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This directly satisfies the stated requirement.
2. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
3. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
4. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
5. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.

Learning point: For this FortiOS 7.6 scenario, use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry. The user monitor shows current authenticated identities and their associated addresses or authentication sources.

Question 16

The security team at Fabrikam Manufacturing wants to limit a policy to members of an approved remote directory group. Which FortiGate configuration or action most directly meets that goal? The solution must preserve the existing production design where possible.

• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Check routing, firewall reachability, server address and port, and the shared secret on both sides

Correct answer: D

Explanation

1. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
2. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
3. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
4. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This directly satisfies the stated requirement.
5. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.

Learning point: For this FortiOS 7.6 scenario, map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership.

Question 17

An incident at Wingtip Energy requires the security engineer to authenticate users against an LDAP directory and resolve directory groups. What should be done first? The change is being made during a controlled production window.

• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior

Correct answer: E

Explanation

1. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
2. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
3. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
4. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
5. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This directly satisfies the stated requirement.

Learning point: For this FortiOS 7.6 scenario, configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior. LDAP authentication depends on a successful directory connection and correct search or bind parameters.

Question 18

For a FortiGate 7.6 deployment at Lucerne Publishing, which option correctly addresses the need to troubleshoot LDAP authentication after directory administrators moved users to a different branch? The team will validate the result immediately after the change.

• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior

Correct answer: C

Explanation

1. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
2. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
3. Directory structure and search scope determine whether FortiGate can find the user and groups. This directly satisfies the stated requirement.
4. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.
5. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to troubleshoot LDAP authentication after directory administrators moved users to a different branch.

Learning point: For this FortiOS 7.6 scenario, verify the LDAP base DN, user search path, group membership lookup, and bind account permissions. Directory structure and search scope determine whether FortiGate can find the user and groups.

Question 19

School of Fine Art has validated routing and basic reachability. The remaining requirement is to authenticate network users through an existing centralized AAA platform. Which action should the team take? No unrelated security controls should be changed.

• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions

Correct answer: C

Explanation

1. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
2. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
3. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This directly satisfies the stated requirement.
4. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.
5. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate network users through an existing centralized AAA platform.

Learning point: For this FortiOS 7.6 scenario, configure the RADIUS server address, shared secret, and required authentication settings on FortiGate. RADIUS uses a shared secret and reachable AAA server to validate authentication requests.

Question 20

At Apex Retail, a infrastructure engineer is handling a FortiGate 7.6 change. The requirement is to diagnose RADIUS timeouts after a server migration. What should the administrator do? The administrator wants a configuration that is easy to audit later.

• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions

Correct answer: B

Explanation

1. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
2. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This directly satisfies the stated requirement.
3. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
4. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.
5. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to diagnose RADIUS timeouts after a server migration.

Learning point: For this FortiOS 7.6 scenario, check routing, firewall reachability, server address and port, and the shared secret on both sides. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout.

Question 21

During a maintenance window at Proseware Media, the team must force users to identify themselves interactively before a policy grants access. Which action is the most appropriate? The administrator must choose the action that addresses the stated cause rather than a different FortiGate feature.

• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior

Correct answer: C

Explanation

1. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
2. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
3. Active authentication prompts the user instead of learning identity silently from another source. This directly satisfies the stated requirement.
4. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.
5. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to force users to identify themselves interactively before a policy grants access.

Learning point: For this FortiOS 7.6 scenario, use an active firewall-authentication method such as a captive authentication workflow for the policy use case. Active authentication prompts the user instead of learning identity silently from another source.

Question 22

A change review at City Power & Light identifies one requirement: apply identity policy without repeatedly prompting domain users who have already signed in. Which FortiGate action best satisfies it? The team wants the smallest change that directly addresses the requirement.

• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate

Correct answer: A

Explanation

1. Passive authentication learns user identity from external login information rather than prompting each session. This directly satisfies the stated requirement.
2. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
3. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
4. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.
5. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to apply identity policy without repeatedly prompting domain users who have already signed in.

Learning point: For this FortiOS 7.6 scenario, use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings. Passive authentication learns user identity from external login information rather than prompting each session.

Question 23

While troubleshooting at Margie Travel, the security engineer needs to confirm which user FortiGate currently associates with a workstation IP. What is the best next step? The choice should follow normal FortiOS administration practice.

• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions

Correct answer: A

Explanation

1. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This directly satisfies the stated requirement.
2. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
3. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
4. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.
5. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to confirm which user FortiGate currently associates with a workstation IP.

Learning point: For this FortiOS 7.6 scenario, use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry. The user monitor shows current authenticated identities and their associated addresses or authentication sources.

Question 24

Bellows College is standardizing its FortiGate 7.6 operations. Which approach should it use to limit a policy to members of an approved remote directory group? The solution must preserve the existing production design where possible.

• Map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy
• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Configure the RADIUS server address, shared secret, and required authentication settings on FortiGate
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Use an active firewall-authentication method such as a captive authentication workflow for the policy use case

Correct answer: A

Explanation

1. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership. This directly satisfies the stated requirement.
2. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
3. RADIUS uses a shared secret and reachable AAA server to validate authentication requests. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
4. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.
5. Active authentication prompts the user instead of learning identity silently from another source. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to limit a policy to members of an approved remote directory group.

Learning point: For this FortiOS 7.6 scenario, map or reference the correct remote group in a FortiGate user group and use that user group in the firewall policy. Firewall policies can enforce identity by matching FortiGate groups backed by remote directory membership.

Question 25

A production ticket for Adventure Works states that administrators must authenticate users against an LDAP directory and resolve directory groups. Which choice is correct? The change is being made during a controlled production window.

• Check routing, firewall reachability, server address and port, and the shared secret on both sides
• Use the FortiGate firewall-user or authenticated-user monitoring view and inspect the active entry
• Use a supported passive authentication source such as FSSO when the environment can supply trustworthy user-to-IP mappings
• Configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior
• Verify the LDAP base DN, user search path, group membership lookup, and bind account permissions

Correct answer: D

Explanation

1. A wrong secret or unreachable RADIUS service commonly causes authentication failure or timeout. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
2. The user monitor shows current authenticated identities and their associated addresses or authentication sources. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
3. Passive authentication learns user identity from external login information rather than prompting each session. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.
4. LDAP authentication depends on a successful directory connection and correct search or bind parameters. This directly satisfies the stated requirement.
5. Directory structure and search scope determine whether FortiGate can find the user and groups. This can be appropriate in a different FortiGate situation, but it does not directly satisfy the stated requirement to authenticate users against an LDAP directory and resolve directory groups.

Learning point: For this FortiOS 7.6 scenario, configure the LDAP server with correct reachability, bind or authentication settings, base DN, and group lookup behavior. LDAP authentication depends on a successful directory connection and correct search or bind parameters.