Free Access to Fortinet.FCSS_LED_AR-7.6.v2026-08-19.q93 with Valid Practice Test (Page 12)

Question 51

Refer to the exhibits.

Examine the FortiGate RSSO configuration shown in the exhibit.
FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User-Name attribute and group membership in the Class attribute.
You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups.
Which three critical configurations must you implement on the FortiGate device? (Choose three.)

A.The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
B.Device detection and Security Fabric Connection should be enabled on port3.
C.RSSO user groups should be assigned to all firewall policies.
D.The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User- Name.
E.The RADIUS Attribute Value setting configured for an RSSO user group should match the Class RADIUS attribute value in the RADIUS accounting message.

Question 52

How does the Syslog-based single sign-on (SSO) feature in FortiAuthenticator function to correlate user activity with authentication events across multiple network devices?

A.It uses syslog messages to monitor authentication events and correlate them with user activities.
B.It modifies user credentials based on the outcome of authentication events.
C.It relies on external servers to analyze syslog messages for user authentication.
D.It authenticates users through a captive portal by monitoring login attempts.

Question 53

A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and receive their configurations upon first boot. However, after powering on the devices, they fail to register with FortiManager. What could be a possible cause of this issue?

A.The FortiGate device requires manual intervention to accept the FortiManager connection.
B.In this scenario, the ZTP process works only when devices are connected using a console cable.
C.The FortiGate device must be preloaded with a configuration file before ZTP can function.
D.The FortiManager IP address is not reachable over TCP port 541.

Question 54

Refer to the exhibit.

On FortiGate, a RADIUS server is configured to forward authentication requests to FortiAuthenticator, which acts as a RADIUS proxy. FortiAuthenticator then relays these authentication requests to a remote Windows AD server using LDAP.
While testing authentication using the CLI command diagnose test authserver. the administrator observed that authentication succeeded with PAP but failed when using MS-CHAFV2.
Which two solutions can the administrator implement to enable MS-CHAPv2 authentication? (Choose two.)

A.Enable Windows Active Directory domain authentication on FortiAuthenticator.
B.Configure FortiAuthenticator to use RADIUS instead of LDAP as the back-end authentication server.
C.Enable RADIUS attribute filtering on FortiAuthenticator.
D.Change the FortiGate authentication method to CHAP instead of MS-CHAPv2.

Correct Answer: A,B

The correct answers are A and B.
The LAN Edge 7.6 Architect study guide explains that when LDAP is the back-end server, CHAP, MS- CHAP, and MS-CHAPv2 do not work because the client sends a one-way password hash, while LDAP expects the actual password:
"If FortiGate is configured to authenticate clients using a remote LDAP server, VPN and wireless clients using CHAP schemes are not able to authenticate... The reason is that during CHAP, MS-CHAP, and MS- CHAPv2 authentication, a client sends a one-way hash of the password. However, the LDAP server, which is on the back end, is expecting the password itself." The same study guide then gives the two valid solutions:
"Two possible methods that you can use to solve the CHAP and LDAP problem are:"
"Use RADIUS: Change your back-end server from LDAP to RADIUS."
and
"If you are using Windows AD as your LDAP server, an alternative is to use FortiAuthenticator as an authentication proxy... You must also configure FortiAuthenticator to log in to the Windows domain using the credentials of a Windows administrator. This adds FortiAuthenticator as a trusted device on the Windows AD domain, allowing FortiAuthenticator to proxy the password hash from the client to the Windows server, using NTLM." That directly matches:
A). Enable Windows Active Directory domain authentication on FortiAuthenticator.
B). Configure FortiAuthenticator to use RADIUS instead of LDAP as the back-end authentication server.
The study guide also states this explicitly in the FortiAuthenticator LDAP configuration section:
"If you want FortiAuthenticator to relay CHAP, MS-CHAP, and MS-CHAPv2 authentication to a Windows AD server, you must enable Windows Active Directory Domain Authentication and enter the credentials for a Windows administrator." And it separately confirms RADIUS as another supported back-end proxy model:
"You can configure FortiAuthenticator to connect to existing RADIUS servers... If the local user database is not used, FortiAuthenticator proxies RADIUS authentication requests." Why the other options are incorrect:
C). Incorrect. RADIUS attribute filtering does not solve the CHAP/MS-CHAPv2 versus LDAP hash problem.
The issue is the back-end authentication method, not attribute filtering.
D). Incorrect. Changing from MS-CHAPv2 to CHAP does not fix it, because the study guide says the same limitation applies to CHAP, MS-CHAP, and MS-CHAPv2 when LDAP is the back end Final verified conclusion:
To enable MS-CHAPv2 authentication in this scenario, the two valid solutions are:
A). Enable Windows Active Directory domain authentication on FortiAuthenticator.
B). Configure FortiAuthenticator to use RADIUS instead of LDAP as the back-end authentication server.

Question 55

You are setting up a captive portal to provide Wi-Fi access for visitors. To simplify the process, your team wants visitors to authenticate using their existing social media accounts instead of creating new accounts or entering credentials manually.
Which two actions are required to enable this functionality? (Choose two.)

A.Set up a remote open authorization (OAuth) server for each selected social media platform.
B.Configure only the email login option because a social media login cannot be used with captive portals.
C.Enable Account Login as the authentication type and configure a remote LDAP server.
D.Set up the FortiAuthenticator internal database as the primary source for user credentials.
E.Configure the social login profiles for the supported platforms.

Correct Answer: A,E

The correct answers are A and E.
The LAN Edge 7.6 Architect study guide explicitly states that guest portals on FortiAuthenticator support social login:
"The guest portal ... provides user account and pre-login services ... Social login option" More importantly, in the portal policy configuration, the guide states:
"The social user login option allows users to authenticate using third-party single sign-on (SSO) services such as Facebook, LinkedIn, and so on. You must configure social login profiles to use this method." That directly proves E is required.
The same exact extract also says:
"If you have enabled social users as an authentication type, you will select the social platforms that will be available for user authentication. The options are Facebook, Google, Twitter, Linkedin, Phone number, and Email. For each option, other than phone number and email, you will need to configured a remote open authorization (OAuth) server." That directly proves A is required.
Why the other options are incorrect:
B). Incorrect. The study guide explicitly says social login is supported in the guest portal, so it is false to say social media login cannot be used with captive portals C). Incorrect. Account Login is a different authentication method. The guide says: "Account login means that user credentials are provided by the FortiAuthenticator internal database or remote authentication server." That is for standard account-based login, not required for social login D). Incorrect. FortiAuthenticator internal database can be used for account login, but the question asks specifically for visitors authenticating with existing social media accounts. That uses social login profiles and OAuth servers, not the internal database as the primary source Final verified conclusion:
To enable captive portal authentication using social media accounts, you must:
* configure social login profiles
* configure a remote OAuth server for each selected social platform
So the correct answers are A and E.

Question 51

Question 52

Question 53

Question 54

Question 55

Download PDF File