Fortinet NSE 6 - FortiAuthenticator 6.4 Free Sample Questions

The most probable cause is that the SAML assertion is not sending the required group membership information to the Service Provider (SaaS application). FortiAuthenticator, acting as the IdP, must be configured to query the user's groups from the remote LDAP/AD server and then map that information into a specific SAML attribute (like 'memberOf' or 'role') that the SP expects to receive to assign the correct privileges.

This is the most appropriate solution. EAP-TLS provides the highest security for corporate-issued devices using client certificates. PEAP (MSCHAPv2) is ideal for BYOD scenarios as it uses username/password credentials, which students have, without requiring certificate management on personal devices. MAC Authentication Bypass (MAB) is the standard method for authenticating devices like printers and legacy equipment that do not have an 802.1X supplicant.

This statement is true. In a standard FortiAuthenticator HA cluster, system and object configurations are synchronized from the primary to the secondary unit. However, most runtime data, including active user sessions and RADIUS accounting data, is not synchronized in real-time. This means that upon a failover, active sessions may need to re-authenticate.

FortiAuthenticator's FSSO function relies on polling Windows Security Event Logs from domain controllers, typically using Windows Management Instrumentation (WMI) or Remote Procedure Calls (RPC). If the FortiAuthenticator is on a different subnet, network firewalls and, most commonly, the Windows Firewall on the domain controllers themselves, may block this traffic. Ensuring the necessary ports for WMI/RPC are open from the FortiAuthenticator's IP is a critical first step.

FortiAuthenticator's RADIUS policies support adaptive authentication. By enabling 'Authentication factors' and specifying the corporate office subnet in the 'Trusted source addresses' list, you can create a rule that exempts users from 2FA when their connection originates from that trusted network. All other connections will be prompted for the second factor as per the policy.

Simply revoking a certificate marks it for inclusion in the next Certificate Revocation List (CRL). The CRL must then be generated and published. Furthermore, the EAP-TLS authentication policy on the RADIUS server (FortiAuthenticator) must be explicitly configured to perform a CRL check during the authentication process. If either of these steps is missed, the server will not know the certificate has been revoked and will continue to accept it.

The guest portal feature with sponsor-based approval is designed specifically for this scenario. Guests can self-register on the portal, and the system will then notify a designated sponsor (or a group of sponsors, like the receptionists) to approve or deny the request. The guest account is only activated after the sponsor grants approval.

RSSO relies on RADIUS Accounting messages to track user sessions. The third-party RADIUS client (wireless controller) must be configured to send Accounting-Request messages with a status type of 'Start' when a user connects and 'Stop' when they disconnect. FortiAuthenticator listens for these accounting packets to create and terminate the corresponding FSSO sessions.

Realms are used to direct authentication requests to the correct user source based on the source of the request (like the SSID). The correct approach is to create two distinct realms. The employee realm would be associated with the corporate SSID and configured to use the remote AD server for authentication. The guest realm would be associated with the guest SSID and configured to use a captive portal with social media authenticators enabled.