How Many Questions Of NSE6_FAC-6.4 Free Practice Exam

NEW QUESTION 1
Which method is the most secure way of delivering FortiToken data once the token has been seeded?

• A. Online activation of the tokens through the FortiGuard network
• B. Shipment of the seed files on a CD using a tamper-evident envelope
• C. Using the in-house token provisioning tool
• D. Automatic token generation using FortiAuthenticator

Answer: A

Explanation:
Online activation of the tokens through the FortiGuard network is the most secure way of delivering FortiToken data once the token has been seeded because it eliminates the risk of seed files being compromised during transit or storage. The other methods involve physical or manual delivery of seed files which can be intercepted, lost, or stolen. References: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372403/fortitoken

NEW QUESTION 2
A system administrator wants to integrate FortiAuthenticator with an existing identity management system with the goal of authenticating and deauthenticating users into FSSO.
What feature does FortiAuthenticator offer for this type of integration?

• A. The ability to import and export users from CSV files
• B. RADIUS learning mode for migrating users
• C. REST API
• D. SNMP monitoring and traps

Answer: C

Explanation:
REST API is a feature that allows FortiAuthenticator to integrate with an existing identity management system with the goal of authenticating and deauthenticating users into FSSO. REST API stands for Representational State Transfer Application Programming Interface, which is a method of exchanging data between different systems using HTTP requests and responses. FortiAuthenticator provides a REST API that can be used by external systems to perform various actions, such as creating, updating, deleting, or querying users and groups, or sending FSSO logon or logoff events.
References: https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/rest-api

NEW QUESTION 3
Which two SAML roles can Fortiauthenticator be configured as? (Choose two)

• A. Idendity provider
• B. Principal
• C. Assertion server
• D. Service provider

Answer: AD

Explanation:
FortiAuthenticator can be configured as a SAML identity provider (IdP) or a SAML service provider (SP). As an IdP, FortiAuthenticator authenticates users and issues SAML assertions to SPs. As an SP, FortiAuthenticator receives SAML assertions from IdPs and grants access to users based on the attributes in the assertions. Principal and assertion server are not valid SAML roles. References: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372407/saml

NEW QUESTION 4
Which statement about the guest portal policies is true?

• A. Guest portal policies apply only to authentication requests coming from unknown RADIUS clients
• B. Guest portal policies can be used only for BYODs
• C. Conditions in the policy apply only to guest wireless users
• D. All conditions in the policy must match before a user is presented with the guest portal

Answer: D

Explanation:
Guest portal policies are rules that determine when and how to present the guest portal to users who want to access the network. Each policy has a set of conditions that can be based on various factors, such as the source IP address, MAC address, RADIUS client, user agent, or SSID. All conditions in the policy must match before a user is presented with the guest portal. Guest portal policies can apply to any authentication request coming from any RADIUS client, not just unknown ones. They can also be used for any type of device, not just BYODs. They can also apply to wired or VPN users, not just wireless users. References:
https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management/37240

NEW QUESTION 5
Which statement about the assignment of permissions for sponsor and administrator accounts is true?

• A. Only administrator accounts permissions are assigned using admin profiles.
• B. Sponsor permissions are assigned using group settings.
• C. Administrator capabilities are assigned by applying permission sets to admin groups.
• D. Both sponsor and administrator account permissions are assigned using admin profiles.

Answer: D

Explanation:
Both sponsor and administrator account permissions are assigned using admin profiles. An admin profile is a set of permissions that defines what actions an administrator or a sponsor can perform on FortiAuthenticator. An admin profile can be assigned to an admin group or an individual admin user. A sponsor is a special type of admin user who can create and manage guest accounts on behalf of other users.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/administrators#admin-p

NEW QUESTION 6
Which FSSO discovery method transparently detects logged off users without having to rely on external features such as WMI polling?

• A. Windows AD polling
• B. FortiClient SSO Mobility Agent
• C. Radius Accounting
• D. DC Polling

Answer: B

Explanation:
FortiClient SSO Mobility Agent is a FSSO discovery method that transparently detects logged off users without having to rely on external features such as WMI polling. FortiClient SSO Mobility Agent is a software agent that runs on Windows devices and communicates with FortiAuthenticator to provide FSSO information. The agent can detect user logon and logoff events without using WMI polling, which can reduce network traffic and improve performance.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/single-sign-on#forticlie

NEW QUESTION 7
An administrator is integrating FortiAuthenticator with an existing RADIUS server with the intent of eventually replacing the RADIUS server with FortiAuthenticator.
How can FortiAuthenticator help facilitate this process?

• A. By configuring the RADIUS accounting proxy
• B. By enabling automatic REST API calls from the RADIUS server
• C. By enabling learning mode in the RADIUS server configuration
• D. By importing the RADIUS user records

Answer: C

Explanation:
FortiAuthenticator can help facilitate the process of replacing an existing RADIUS server by enabling learning mode in the RADIUS server configuration. This allows FortiAuthenticator to learn user credentials from the existing RADIUS server and store them locally for future authentication requests2. This way, FortiAuthenticator can gradually take over the role of the RADIUS server without disrupting the user experience.
References: 2 https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/radiu

NEW QUESTION 8
Which option correctly describes an SP-initiated SSO SAML packet flow for a host without a SAML assertion?

• A. Service provider contacts idendity provider, idendity provider validates principal for service provider, service provider establishes communication with principal
• B. Principal contacts idendity provider and is redirected to service provider, principal establishes connection with service provider, service provider validates authentication with identify provider
• C. Principal contacts service provider, service provider redirects principal to idendity provider, after succesfull authentication identify provider redirects principal to service provider
• D. Principal contacts idendity provider and authenticates, identity provider relays principal to service provider after valid authentication

Answer: C

Explanation:
SP-initiated SSO SAML packet flow for a host without a SAML assertion is as follows:
Principal contacts service provider, requesting access to a protected resource.
Service provider redirects principal to identity provider, sending a SAML authentication request.
Principal authenticates with identity provider using their credentials.
After successful authentication, identity provider redirects principal back to service provider, sending a SAML response with a SAML assertion containing the principal’s attributes.
Service provider validates the SAML response and assertion, and grants access to the principal.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/saml-service-provider#

NEW QUESTION 9
Which two statement about the RADIUS service on FortiAuthenticator are true? (Choose two)

• A. Two-factor authentication cannot be enforced when using RADIUS authentication
• B. RADIUS users can migrated to LDAP users
• C. Only local users can be authenticated through RADIUS
• D. FortiAuthenticator answers only to RADIUS client that are registered with FortiAuthenticator

Answer: BD

Explanation:
Two statements about the RADIUS service on FortiAuthenticator are true:
RADIUS users can be migrated to LDAP users using the RADIUS learning mode feature. This feature allows FortiAuthenticator to learn user credentials from an existing RADIUS server and store them locally as LDAP users for future authentication requests.
FortiAuthenticator answers only to RADIUS clients that are registered with FortiAuthenticator. A RADIUS client is a device that sends RADIUS authentication or accounting requests to FortiAuthenticator. A RADIUS client must be added and configured on FortiAuthenticator before it can communicate with it.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/radius-service

NEW QUESTION 10
A digital certificate, also known as an X.509 certificate, contains which two pieces of information? (Choose two.)

• A. Issuer
• B. Shared secret
• C. Public key
• D. Private key

Answer: AC

Explanation:
A digital certificate, also known as an X.509 certificate, contains two pieces of information:
Issuer, which is the identity of the certificate authority (CA) that issued the certificate
Public key, which is the public part of the asymmetric key pair that is associated with the certificate subject
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/certificate-management

NEW QUESTION 11
Which two statements about the EAP-TTLS authentication method are true? (Choose two)

• A. Uses mutual authentication
• B. Uses digital certificates only on the server side
• C. Requires an EAP server certificate
• D. Support a port access control (wired) solution only

Answer: BC

Explanation:
EAP-TTLS is an authentication method that uses digital certificates only on the server side to establish a secure tunnel between the server and the client. The client does not need a certificate but can use any inner authentication method supported by the server, such as PAP, CHAP, MS-CHAP, or EAP-MD5. EAP-TTLS requires an EAP server certificate that is issued by a trusted CA and installed on the FortiAuthenticator device acting as the EAP server. EAP-TTLS supports both wireless and wired solutions for port access control. References: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372412/eap-ttls

NEW QUESTION 12
You are the administrator of a global enterprise with three FortiAuthenticator devices. You would like to deploy them to provide active-passive HA at headquarters, with geographically distributed load balancing.
What would the role settings be?

• A. One standalone and two load balancersB One standalone primary, one cluster member, and one load balancer
• B. Two cluster members and one backup
• C. Two cluster members and one load balancer

Answer: B

Explanation:
To deploy three FortiAuthenticator devices to provide active-passive HA at headquarters, with geographically distributed load balancing, the role settings would be:
One standalone primary, which acts as the master device for HA and load balancing
One cluster member, which acts as the backup device for HA and load balancing
One load balancer, which acts as a remote device that forwards authentication requests to the primary or cluster member device
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/high-availability#ha-an

NEW QUESTION 13
At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)

• A. Configuring a portal policy
• B. Configuring at least on post-login service
• C. Configuring a RADIUS client
• D. Configuring an external authentication portal

Answer: AB

Explanation:
enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and the authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully, such as sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional steps that depend on your network setup and requirements. References:
https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management

NEW QUESTION 14
You have implemented two-factor authentication to enhance security to sensitive enterprise systems. How could you bypass the need for two-factor authentication for users accessing form specific secured
networks?

• A. Create an admin realm in the authentication policy
• B. Specify the appropriate RADIUS clients in the authentication policy
• C. Enable Adaptive Authentication in the portal policy
• D. Enable the Resolve user geolocation from their IP address option in the authentication policy.

Answer: C

Explanation:
Adaptive Authentication is a feature that allows administrators to bypass the need for two-factor authentication for users accessing from specific secured networks. Adaptive Authentication uses geolocation information from IP addresses to determine whether a user is accessing from a trusted network or not. If the user is accessing from a trusted network, FortiAuthenticator can skip the second factor of authentication and grant access based on the first factor only.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/authentication-policies

NEW QUESTION 15
......