Fortinet NSE6_FAC-6.4 Exam Practice Test Instant Access

Question 1

You are an administrator for a large enterprise and you want to delegate the creation and management of guest users to a group of sponsors.

How would you associate the guest accounts with individual sponsors?

AAs an administrator, you can assign guest groups to individual sponsors.

BGuest accounts are associated with the sponsor that creates the guest account.

CYou can automatically add guest accounts to groups associated with specific sponsors.

DSelect the sponsor on the guest portal, during registration.

Answer : B

Guest accounts are associated with the sponsor that creates the guest account.A sponsor is a user who has permission to create and manage guest accounts on behalf of other users3.A sponsor can create guest accounts using the sponsor portal or the REST API3.The sponsor's username is recorded as a field in the guest account's profile3.

Question 2

A device or user identity cannot be established transparently, such as with non-domain BYOD devices, and allow users to create their own credentialis.

In this case, which user idendity discovery method can Fortiauthenticator use?

ASyslog messaging or SAML IDP

BKerberos-base authentication

CRadius accounting

DPortal authentication

Answer : D

Portal authentication is a user identity discovery method that can be used when a device or user identity cannot be established transparently, such as with non-domain BYOD devices, and allow users to create their own credentials. Portal authentication requires users to enter their credentials on a web page before accessing network resources. The other methods are used for transparent identification of domain devices or users. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372406/user-identity-discovery

Question 3

What are three key features of FortiAuthenticator? (Choose three)

AIdentity management device

BLog server

CCertificate authority

DPortal services

ERSSO Server

Answer : A, C, D

FortiAuthenticator is a user and identity management solution that provides strong authentication, wireless 802.1X authentication, certificate management, RADIUS AAA (authentication, authorization, and accounting), and Fortinet Single Sign-On (FSSO). It also offers portal services for guest management, self-service password reset, and device registration. It is not a log server or an RSSO server. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/release-notes

Question 4

When configuring syslog SSO, which three actions must you take, in addition to enabling the syslog SSO method? (Choose three.)

AEnable syslog on the FortiAuthenticator interface.

BDefine a syslog source.

CSelect a syslog rule for message parsing.

DSet the same password on both the FortiAuthenticator and the syslog server.

ESet the syslog UDP port on FortiAuthenticator.

Answer : B, C, E

To configure syslog SSO, three actions must be taken, in addition to enabling the syslog SSO method:

Define a syslog source, which is a device that sends syslog messages to FortiAuthenticator containing user logon or logoff information.

Select a syslog rule for message parsing, which is a predefined or custom rule that defines how to extract the user name, IP address, and logon or logoff action from the syslog message.

Set the syslog UDP port on FortiAuthenticator, which is the port number that FortiAuthenticator listens on for incoming syslog messages.

Question 5

What happens when a certificate is revoked? (Choose two)

ARevoked certificates cannot be reinstated for any reason

BAll certificates signed by a revoked CA certificate are automatically revoked

CRevoked certificates are automatically added to the CRL

DExternal CAs will priodically query Fortiauthenticator and automatically download revoked certificates

Answer : B, C

When a certificate is revoked, it means that it is no longer valid and should not be trusted by any entity. Revoked certificates are automatically added to the certificate revocation list (CRL) which is published by the issuing CA and can be checked by other parties. If a CA certificate is revoked, all certificates signed by that CA are also revoked and added to the CRL. Revoked certificates can be reinstated if the reason for revocation is resolved, such as a compromised private key being recovered or a misissued certificate being corrected. External CAs do not query FortiAuthenticator for revoked certificates, but they can use protocols such as SCEP or OCSP to exchange certificate information with FortiAuthenticator. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372408/certificate-management

Question 6

Which two features of FortiAuthenticator are used for EAP deployment? (Choose two)

ACertificate authority

BLDAP server

CMAC authentication bypass

DRADIUS server

Answer : A, D

Two features of FortiAuthenticator that are used for EAP deployment are certificate authority and RADIUS server. Certificate authority allows FortiAuthenticator to issue and manage digital certificates for EAP methods that require certificate-based authentication, such as EAP-TLS or PEAP-EAP-TLS. RADIUS server allows FortiAuthenticator to act as an authentication server for EAP methods that use RADIUS as a transport protocol, such as EAP-GTC or PEAP-MSCHAPV2.

Question 7

Which statement about the assignment of permissions for sponsor and administrator accounts is true?

AOnly administrator accounts permissions are assigned using admin profiles.

BSponsor permissions are assigned using group settings.

CAdministrator capabilities are assigned by applying permission sets to admin groups.

DBoth sponsor and administrator account permissions are assigned using admin profiles.

Answer : D

Both sponsor and administrator account permissions are assigned using admin profiles. An admin profile is a set of permissions that defines what actions an administrator or a sponsor can perform on FortiAuthenticator. An admin profile can be assigned to an admin group or an individual admin user. A sponsor is a special type of admin user who can create and manage guest accounts on behalf of other users.

Fortinet NSE 6 - FortiAuthenticator 6.4 NSE6_FAC-6.4 Exam Practice Test