Pass Fortinet NSE6_FAC-6.4 Actual Free Exam Q&As Updated Dump Dec 24, 2023
Latest NSE6_FAC-6.4 Actual Free Exam Updated 49 Questions
NEW QUESTION # 16
Which interface services must be enabled for the SCEP client to connect to Authenticator?
- A. REST API
- B. SSH
- C. OCSP
- D. HTTP/HTTPS
Answer: D
Explanation:
HTTP/HTTPS are the interface services that must be enabled for the SCEP client to connect to FortiAuthenticator. SCEP stands for Simple Certificate Enrollment Protocol, which is a method of requesting and issuing digital certificates over HTTP or HTTPS. FortiAuthenticator supports SCEP as a certificate authority (CA) and can process SCEP requests from SCEP clients. To enable SCEP on FortiAuthenticator, the HTTP or HTTPS service must be enabled on the interface that receives the SCEP requests.
NEW QUESTION # 17
An administrator has an active directory (AD) server integrated with FortiAuthenticator. They want members of only specific AD groups to participate in FSSO with their corporate FortiGate firewalls.
How does the administrator accomplish this goal?
- A. Configure a FortiGate filter on FortiAuthenticatoc
- B. Configure SSO groups and assign them to FortiGate groups.
- C. Configure fine-grained controls on FortiAuthenticator to designate AD groups.
- D. Configure a domain groupings list to identify the desired AD groups.
Answer: B
Explanation:
To allow members of only specific AD groups to participate in FSSO with their corporate FortiGate firewalls, the administrator can configure SSO groups and assign them to FortiGate groups. SSO groups are groups of users or devices that are defined on FortiAuthenticator based on various criteria, such as user group membership, source IP address, MAC address, or device type. FortiGate groups are groups of users or devices that are defined on FortiGate based on various criteria, such as user group membership, firewall policy, or authentication method. By mapping SSO groups to FortiGate groups, the administrator can control which users or devices can access the network resources protected by FortiGate.
NEW QUESTION # 18
You are a Wi-Fi provider and host multiple domains.
How do you delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device?
- A. Automatically import hosts from each domain as they authenticate.
- B. Create user groups
- C. Create realms.
- D. Create multiple directory trees on FortiAuthenticator
Answer: C
Explanation:
Realms are a way to delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device. A realm is a logical grouping of users and groups based on a common attribute, such as a domain name or an IP address range. Realms allow administrators to apply different authentication policies and settings to different groups of users based on their realm membership.
NEW QUESTION # 19
At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)
- A. Configuring a portal policy
- B. Configuring an external authentication portal
- C. Configuring at least on post-login service
- D. Configuring a RADIUS client
Answer: A,C
Explanation:
enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and the authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully, such as sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional steps that depend on your network setup and requirements. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management
NEW QUESTION # 20
When configuring syslog SSO, which three actions must you take, in addition to enabling the syslog SSO method? (Choose three.)
- A. Select a syslog rule for message parsing.
- B. Set the syslog UDP port on FortiAuthenticator.
- C. Enable syslog on the FortiAuthenticator interface.
- D. Define a syslog source.
- E. Set the same password on both the FortiAuthenticator and the syslog server.
Answer: A,B,D
Explanation:
To configure syslog SSO, three actions must be taken, in addition to enabling the syslog SSO method:
Define a syslog source, which is a device that sends syslog messages to FortiAuthenticator containing user logon or logoff information.
Select a syslog rule for message parsing, which is a predefined or custom rule that defines how to extract the user name, IP address, and logon or logoff action from the syslog message.
Set the syslog UDP port on FortiAuthenticator, which is the port number that FortiAuthenticator listens on for incoming syslog messages.
NEW QUESTION # 21
A digital certificate, also known as an X.509 certificate, contains which two pieces of information? (Choose two.)
- A. Public key
- B. Private key
- C. Issuer
- D. Shared secret
Answer: A,C
Explanation:
A digital certificate, also known as an X.509 certificate, contains two pieces of information:
Issuer, which is the identity of the certificate authority (CA) that issued the certificate Public key, which is the public part of the asymmetric key pair that is associated with the certificate subject
NEW QUESTION # 22
You are an administrator for a large enterprise and you want to delegate the creation and management of guest users to a group of sponsors.
How would you associate the guest accounts with individual sponsors?
- A. Select the sponsor on the guest portal, during registration.
- B. You can automatically add guest accounts to groups associated with specific sponsors.
- C. Guest accounts are associated with the sponsor that creates the guest account.
- D. As an administrator, you can assign guest groups to individual sponsors.
Answer: C
Explanation:
Guest accounts are associated with the sponsor that creates the guest account. A sponsor is a user who has permission to create and manage guest accounts on behalf of other users3. A sponsor can create guest accounts using the sponsor portal or the REST API3. The sponsor's username is recorded as a field in the guest account's profile3.
NEW QUESTION # 23
You are the administrator of a global enterprise with three FortiAuthenticator devices. You would like to deploy them to provide active-passive HA at headquarters, with geographically distributed load balancing.
What would the role settings be?
- A. One standalone primary, one cluster member, and one load balancer
- B. One standalone and two load balancers
- C. Two cluster members and one load balancer
- D. Two cluster members and one backup
Answer: A
Explanation:
To deploy three FortiAuthenticator devices to provide active-passive HA at headquarters, with geographically distributed load balancing, the role settings would be:
One standalone primary, which acts as the master device for HA and load balancing One cluster member, which acts as the backup device for HA and load balancing One load balancer, which acts as a remote device that forwards authentication requests to the primary or cluster member device
NEW QUESTION # 24
A device or user identity cannot be established transparently, such as with non-domain BYOD devices, and allow users to create their own credentialis.
In this case, which user idendity discovery method can Fortiauthenticator use?
- A. Syslog messaging or SAML IDP
- B. Kerberos-base authentication
- C. Radius accounting
- D. Portal authentication
Answer: D
Explanation:
Portal authentication is a user identity discovery method that can be used when a device or user identity cannot be established transparently, such as with non-domain BYOD devices, and allow users to create their own credentials. Portal authentication requires users to enter their credentials on a web page before accessing network resources. The other methods are used for transparent identification of domain devices or users. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372406/user-identity-discovery
NEW QUESTION # 25
Examine the screenshot shown in the exhibit.
Which two statements regarding the configuration are true? (Choose two.)
- A. Guest users must fill in all the fields on the registration form
- B. Guest user account will expire after eight hours
- C. All accounts registered through the guest portal must be validated through email
- D. All guest accounts created using the account registration feature will be placed under the Guest_Portal_Users group
Answer: C,D
Explanation:
The screenshot shows that the account registration feature is enabled for the guest portal and that the guest group is set to Guest_Portal_Users. This means that all guest accounts created using this feature will be placed under that group1. The screenshot also shows that email validation is enabled for the guest portal and that the email validation link expires after 24 hours. This means that all accounts registered through the guest portal must be validated through email within that time frame1.
NEW QUESTION # 26
Which option correctly describes an SP-initiated SSO SAML packet flow for a host without a SAML assertion?
- A. Principal contacts idendity provider and is redirected to service provider, principal establishes connection with service provider, service provider validates authentication with identify provider
- B. Service provider contacts idendity provider, idendity provider validates principal for service provider, service provider establishes communication with principal
- C. Principal contacts service provider, service provider redirects principal to idendity provider, after succesfull authentication identify provider redirects principal to service provider
- D. Principal contacts idendity provider and authenticates, identity provider relays principal to service provider after valid authentication
Answer: C
Explanation:
SP-initiated SSO SAML packet flow for a host without a SAML assertion is as follows:
Principal contacts service provider, requesting access to a protected resource.
Service provider redirects principal to identity provider, sending a SAML authentication request.
Principal authenticates with identity provider using their credentials.
After successful authentication, identity provider redirects principal back to service provider, sending a SAML response with a SAML assertion containing the principal's attributes.
Service provider validates the SAML response and assertion, and grants access to the principal.
NEW QUESTION # 27
How can a SAML metada file be used?
- A. To correlate the IDP address to its hostname
- B. To defined a list of trusted user names
- C. To resolve the IDP realm for authentication
- D. To import the required IDP configuration
Answer: D
Explanation:
A SAML metadata file can be used to import the required IDP configuration for SAML service provider mode. A SAML metadata file is an XML file that contains information about the identity provider (IDP) and the service provider (SP), such as their entity IDs, endpoints, certificates, and attributes. By importing a SAML metadata file from the IDP, FortiAuthenticator can automatically configure the necessary settings for SAML service provider mode.
NEW QUESTION # 28
Which EAP method is known as the outer authentication method?
- A. EAP-GTC
- B. PEAP
- C. EAP-TLS
- D. MSCHAPV2
Answer: B
Explanation:
PEAP is known as the outer authentication method because it establishes a secure tunnel between the client and the server using TLS. The inner authentication method, such as EAP-GTC, EAP-TLS, or MSCHAPV2, is then used to authenticate the client within the tunnel.
NEW QUESTION # 29
Which three of the following can be used as SSO sources? (Choose three)
- A. SSH Sessions
- B. RADIUS accounting
- C. FortiClient SSO Mobility Agent
- D. FortiAuthenticator in SAML SP role
- E. Fortigate
Answer: B,C,E
Explanation:
FortiAuthenticator supports various SSO sources that can provide user identity information to other devices in the network, such as FortiGate firewalls or FortiAnalyzer log servers. Some of the supported SSO sources are:
FortiClient SSO Mobility Agent: A software agent that runs on Windows devices and sends user login information to FortiAuthenticator.
FortiGate: A firewall device that can send user login information from various sources, such as FSSO agents, captive portals, VPNs, or LDAP servers, to FortiAuthenticator.
RADIUS accounting: A protocol that can send user login information from RADIUS servers or clients, such as wireless access points or VPN concentrators, to FortiAuthenticator.
SSH sessions and FortiAuthenticator in SAML SP role are not valid SSO sources because they do not provide user identity information to other devices in the network. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372410/single-sign-on
NEW QUESTION # 30
An administrator wants to keep local CA cryptographic keys stored in a central location.
Which FortiAuthenticator feature would provide this functionality?
- A. REST API
- B. SCEP support
- C. SFTP server
- D. Network HSM
Answer: D
Explanation:
Network HSM is a feature that allows FortiAuthenticator to keep local CA cryptographic keys stored in a central location. HSM stands for Hardware Security Module, which is a physical device that provides secure storage and generation of cryptographic keys. Network HSM allows FortiAuthenticator to use an external HSM device to store and manage the private keys of its local CAs, instead of storing them locally on the FortiAuthenticator device.
NEW QUESTION # 31
Which two types of digital certificates can you create in Fortiauthenticator? (Choose two)
- A. Organization validation certificate
- B. User certificate
- C. Local service certificate
- D. Third-party root certificate
Answer: B,C
Explanation:
FortiAuthenticator can create two types of digital certificates: user certificates and local service certificates. User certificates are issued to users or devices for authentication purposes, such as VPN, wireless, or web access. Local service certificates are issued to FortiAuthenticator itself for securing its own services, such as HTTPS, RADIUS, or LDAP.
NEW QUESTION # 32
Which two SAML roles can Fortiauthenticator be configured as? (Choose two)
- A. Assertion server
- B. Idendity provider
- C. Service provider
- D. Principal
Answer: B,C
Explanation:
FortiAuthenticator can be configured as a SAML identity provider (IdP) or a SAML service provider (SP). As an IdP, FortiAuthenticator authenticates users and issues SAML assertions to SPs. As an SP, FortiAuthenticator receives SAML assertions from IdPs and grants access to users based on the attributes in the assertions. Principal and assertion server are not valid SAML roles. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372407/saml
NEW QUESTION # 33
Which two protocols are the default management access protocols for administrative access for FortiAuthenticator? (Choose two)
- A. HTTPS
- B. Telnet
- C. SSH
- D. SNMP
Answer: A,C
Explanation:
HTTPS and SSH are the default management access protocols for administrative access for FortiAuthenticator. HTTPS allows administrators to access the web-based GUI of FortiAuthenticator using a web browser and a secure connection. SSH allows administrators to access the CLI of FortiAuthenticator using an SSH client and an encrypted connection. Both protocols require the administrator to enter a valid username and password to log in.
NEW QUESTION # 34
You want to monitor FortiAuthenticator system information and receive FortiAuthenticator traps through SNMP.
Which two configurations must be performed after enabling SNMP access on the FortiAuthenticator interface? (Choose two)
- A. Upload management information base (MIB) files to SNMP server
- B. Associate an ASN, 1 mapping rule to the receiving host
- C. Set the tresholds to trigger SNMP traps
- D. Enable logging services
Answer: A,C
Explanation:
To monitor FortiAuthenticator system information and receive FortiAuthenticator traps through SNMP, two configurations must be performed after enabling SNMP access on the FortiAuthenticator interface:
Set the thresholds to trigger SNMP traps for various system events, such as CPU usage, disk usage, memory usage, or temperature.
Upload management information base (MIB) files to SNMP server to enable the server to interpret the SNMP traps sent by FortiAuthenticator.
NEW QUESTION # 35
......
Online Questions - Valid Practice NSE6_FAC-6.4 Exam Dumps Test Questions: https://www.testkingfree.com/Fortinet/NSE6_FAC-6.4-practice-exam-dumps.html
100% Real NSE6_FAC-6.4 dumps - Brilliant NSE6_FAC-6.4 Exam Questions PDF: https://drive.google.com/open?id=13GQ5wcEAHqtOted6i-AGoDT-NtxyQYKA