Fortinet NSE6_FAC-6.4 Exam Practice Test Instant Access

Question 1

At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)

AConfiguring a portal policy

BConfiguring at least on post-login service

CConfiguring a RADIUS client

DConfiguring an external authentication portal

Answer : A, B

To enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and the authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully, such as sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional steps that depend on your network setup and requirements. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management

Question 2

What are three key features of FortiAuthenticator? (Choose three)

AIdentity management device

BLog server

CCertificate authority

DPortal services

ERSSO Server

Answer : A, C, D

FortiAuthenticator is a user and identity management solution that provides strong authentication, wireless 802.1X authentication, certificate management, RADIUS AAA (authentication, authorization, and accounting), and Fortinet Single Sign-On (FSSO). It also offers portal services for guest management, self-service password reset, and device registration. It is not a log server or an RSSO server. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/release-notes

Question 3

What capability does the inbound proxy setting provide?

AIt allows FortiAuthenticator to determine the origin source IP address after traffic passes through a proxy for system access,

BIt allows FortiAuthenticator to act as a proxy for remote authentication servers.

CIt allows FortiAuthenticator the ability to round robin load balance remote authentication servers.

DIt allows FortiAuthenticator system access to authenticating users, based on a geo IP address designation.

Answer : A

The inbound proxy setting provides the ability for FortiAuthenticator to determine the origin source IP address after traffic passes through a proxy for system access. The inbound proxy setting allows FortiAuthenticator to use the X-Forwarded-For header in the HTTP request to identify the original client IP address. This can help FortiAuthenticator apply the correct authentication policy or portal policy based on the source IP address.

Question 4

Which two SAML roles can Fortiauthenticator be configured as? (Choose two)

AIdendity provider

BPrincipal

CAssertion server

DService provider

Answer : A, D

FortiAuthenticator can be configured as a SAML identity provider (IdP) or a SAML service provider (SP). As an IdP, FortiAuthenticator authenticates users and issues SAML assertions to SPs. As an SP, FortiAuthenticator receives SAML assertions from IdPs and grants access to users based on the attributes in the assertions. Principal and assertion server are not valid SAML roles. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372407/saml

Question 5

Examine the screenshot shown in the exhibit.

Which two statements regarding the configuration are true? (Choose two.)

AAll guest accounts created using the account registration feature will be placed under the Guest_Portal_Users group

BAll accounts registered through the guest portal must be validated through email

CGuest users must fill in all the fields on the registration form

DGuest user account will expire after eight hours

Answer : A, B

The screenshot shows that the account registration feature is enabled for the guest portal and that the guest group is set to Guest_Portal_Users.This means that all guest accounts created using this feature will be placed under that group1. The screenshot also shows that email validation is enabled for the guest portal and that the email validation link expires after 24 hours.This means that all accounts registered through the guest portal must be validated through email within that time frame1.

Question 6

Which behaviors exist for certificate revocation lists (CRLs) on FortiAuthenticator? (Choose two)

ACRLs contain the serial number of the certificate that has been revoked

BRevoked certificates are automaticlly placed on the CRL

CCRLs can be exported only through the SCEP server

DAll local CAs share the same CRLs

Answer : A, B

CRLs are lists of certificates that have been revoked by the issuing CA and should not be trusted by any entity. CRLs contain the serial number of the certificate that has been revoked, the date and time of revocation, and the reason for revocation. Revoked certificates are automatically placed on the CRL by the CA and the CRL is updated periodically. CRLs can be exported through various methods, such as HTTP, LDAP, or SCEP. Each local CA has its own CRL that is specific to its issued certificates. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372408/certificate-management/372413/certificate-revocation-lists

Question 7

You are a Wi-Fi provider and host multiple domains.

How do you delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device?

ACreate realms.

BCreate user groups

CCreate multiple directory trees on FortiAuthenticator

DAutomatically import hosts from each domain as they authenticate.

Answer : A

Realms are a way to delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device. A realm is a logical grouping of users and groups based on a common attribute, such as a domain name or an IP address range. Realms allow administrators to apply different authentication policies and settings to different groups of users based on their realm membership.

Fortinet NSE 6 - FortiAuthenticator 6.4 NSE6_FAC-6.4 Exam Practice Test