Refer to the exhibits. An LDAP server has been successfully configured on FortiGate. which forwards LDAP authentication requests to a Windows Active Directory (AD) server. Wireless users report that they are unable to authenticate. Upon troubleshooting, you find that authentication fails when using MSCHAPv2. What is the most likely reason for this issue?
Correct Answer: D
From the exhibit, LDAP on FortiGate is correctly configured and tested: diagnose test authserver ldap FAC-LDAP wifi101 password authenticate 'wifi101' against 'FAC-LDAP' succeeded! Group membership(s) - CN=Domain Users,... So: * LDAP connectivity works * Bind DN, DN, CNID, and credentials are correct(so optionCis eliminated). * Firewall policies do not affect the802.1X / Wi-Fi authentication stepitself, soAis not the root cause. * Nothing in the scenario indicates that AD is enforcing LDAPS-only; the LDAP test already succeeds using the configured parameters, soBis also excluded. The Wi-Fi supplicant is configured forPEAP with inner authentication = MSCHAPv2. MSCHAPv2 is achallenge-response mechanism designed for RADIUS, not for LDAP simple bind. FortiGate's LDAP implementation uses asimple bind (username/password) over LDAP or LDAPS, and it doesnotimplement MSCHAPv2 against LDAP backends. In Fortinet's design, if you needPEAP-MSCHAPv2 with Active Directory, you must use: * ARADIUS server(such as Windows NPS or FortiAuthenticator), and * Have FortiGate use RADIUS,notLDAP, as the authentication backend for 802.1X / Wi-Fi users. Because FortiGate cannot process MSCHAPv2 exchanges directly against an LDAP server, authentication fails when the inner method is MSCHAPv2, even though LDAP works when tested with a simple bind from the CLI.
Question 17
A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and receive their configurations upon first boot. However, after powering on the devices, they fail to register with FortiManager. What could be a possible cause of this issue?
Correct Answer: D
Zero-Touch Provisioning (ZTP) for FortiGate devices is handled throughFortiDeploy, which automatically connects a FortiGate toFortiManagerso the device can download configuration templates and be centrally managed. For ZTP to work, the newly booted FortiGate must successfully reach FortiManager. One of thecritical requirementsis connectivity over theFGFM (FortiGate-FortiManager) management protocol, which uses: TCP Port 541 This is clearly stated in multiple Fortinet documents: * FortiGate Cloud Admin Guidelists port541as the management channel used for FortiGate # FortiManager / FortiGate Cloud communications:"Management... Protocol: TCP, Port:541" * FortiOS Administration Guidealso confirms this:"FortiManager provides remote management of FortiGate devices overTCP port 541." Since ZTP uses FortiDeploy to push the FortiManager IP to the device and relies on FGFM (port 541) for registration and configuration delivery,any failure on this port breaks the entire ZTP workflow. Why option D is correct If the FortiGate cannot reach FortiManager onTCP/541, itcannot register, cannot be authorized, and cannot receive its configuration - leading to a ZTP failure. This is themost common causein real deployments: * Firewall blocking TCP/541 * Upstream NAT device not forwarding 541 * ISP restrictions * Incorrect FortiManager IP or routing issue * ZTP device behind a network that does not allow outbound 541 Why the other options are incorrect A). The FortiGate device requires manual intervention to accept the FortiManager connection. Incorrect. ZTP is built specifically to avoid manual intervention. Once the FortiDeploy key is used, the device auto- connects to FortiManager without needing local acceptance. B). ZTP works only when devices are connected using a console cable. Incorrect. ZTP requiresno console cable- that's the whole point. It relies on DHCP, WAN connectivity, and FortiDeploy auto-join. C). The FortiGate device must be preloaded with a configuration file before ZTP can function. Incorrect. Preloading configuration defeats the purpose of ZTP. ZTP delivers the initial configuration automatically from FortiManager using FortiDeploy. LAN Edge 7.6 Architect Context LAN Edge deployments often use FortiManager as the central orchestrator for: * FortiSwitch management via FortiLink * FortiAP wireless provisioning * SD-Branch configuration templates * Security Fabric automation For all of this, ZTP enables remote sites to deploy FortiGate, FortiSwitch, and FortiAP withno on-site expertise. If TCP/541 to FortiManager is blocked, the entire LAN Edge deployment pipeline fails, making optionDthe only valid and document-supported answer.
Question 18
What must be done on the FortiGate to fully enable RSSO with FortiAuthenticator? Response:
Correct Answer: A
Question 19
In addition to requiring a FortiAnalyzer device to configure the Security Fabric, which license must be added to FortiAnalyzer to use Indicators of Compromise (IOC) rules?
Correct Answer: D
FortiAnalyzer requires a specific license to evaluateIndicators of Compromise (IOC). From theFortiAnalyzer 7.4.1 Administration Guide: IOC identification requires theThreat Detection Servicelicense on FortiAnalyzer. This license enables: * IOC database updates * Compromised host detection * Event correlation based on FortiGuard threat intelligence * Fabric-wide IOC automation triggers Why the other answers are incorrect: * A: IoT Security add-on is unrelated to IOC rules. * B: There isnoIOC subscription license type for FortiAnalyzer. * C: FAZ-Basic license doesNOTinclude IOC detection.
Question 20
What capability does FortiLink NAC add to standard FortiLink behavior? Response:
