Refer to the exhibits.
FortiGate RSSO configuration

FortiGate RSSO Group

FortiGate interface configuration

RSSO authentication has been configured on FortiGate. Port3 has been enabled to receive RADIUS accounting messages. Internet access is available through port1. FortiGate is successfully handling incoming RADIUS accounting messages, ensuring that RSSO users are correctly mapped to the RSSO Group user group. The administrator realized that internet access is open to all users and aims to enforce access restrictions, ensuring that only RSSO users are permitted to have internet access. Which configuration change should the administrator apply to address this issue? Response:

• A.Modify the firewall policy and add RSSO Group as a Source.
• B.Change the RADIUS attribute value setting to match the name of the RADIUS attribute containing the group membership information of the RSSO users.
• C.Create a second firewall policy from port3 to port1, and select the target destination subnets.
• D.Configure a local user group and manually add users to enforce authentication-based restrictions.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits.


An LDAP server has been successfully configured on FortiGate, which forward LDAP authentication requests to a Windows Active Directory (AD) server. Wireless users report that they are unable to authenticate. Upon troubleshooting, you find that authentication fails when using MSCHAPv2.
What is the most likely reason for this issue?

• A.FortiGate does not support MSCHAPv2 for LDAP authentication.
• B.The FortiGate LDAP configuration is missing the correct Bind DN.
• C.A firewall policy is missing an LDAP authentication rule.
• D.The Windows AD server requires LDAPS (LDAP over SSL) for authentication.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits.




You are adding a new FortiSwitch to FortiGate for management. All necessary settings have been configured on FortiGate, but FortiSwitch remains offline. The cabling has been verified and is correctly connected.
Which misconfiguration might be preventing FortiGate from detecting FortiSwitch?

• A.The Fortilink interface setting ip-managed-by-fortiipam must be enabled.
• B.The Fortilink interface has the wrong interface member.
• C.The Fortilink interface setting cype must be physical.
• D.The DHCP server setting vci-string is misconfigured.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits.

Examine the FortiGate RSSO configuration shown in the exhibit.
FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User-Name attribute and group membership in the Class attribute. You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups.
Which three critical configurations must you implement on the FortiGate device? (Choose three.)

• A.The RADIUS Attribute Value setting configured for an RSSO user group should match the class RADIUS attribute value in the RADIUS accounting message.
• B.RSSO user groups should be assigned to all firewall policies.
• C.Device detection and Security Fabric Connection should be enabled on port3
• D.The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
• E.The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User- Name.

Comment: *

Name: *

Email: *

Verification: *

You are deploying a FortiSwitch device managed by FortiGate in a secure network environment. To ensure accurate communication, you must identify which protocols are required for communication and control between FortiGate and FortiSwitch.
Which three protocols are used by FortiGate to manage and control FortiSwitch devices? (Choose three.)

• A.SNMP can be used by FortiGate to manage FortiSwitch devices by monitoring their status.
• B.UHTTPS is usea;by FortiGate to securely manage and configure FortiSwitch devices.
• C.FortiGate uses the Fortilink protocol to establish communication with FortiSwitch.
• D.CAPWAP is used to establish the control channel between FortiSwitch and FortiGate.
• E.IGMP is required for managing communication between FortiGate and FortiSwitch devices in multicast environments.

Comment: *

Name: *

Email: *

Verification: *