Question 1

At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)

Accepted Answer

enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and the
authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully, such as
sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional steps
that depend on your network setup and requirements. References:
https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management

Question 2

Which two protocols are the default management access protocols for administrative access for FortiAuthenticator? (Choose two)

Accepted Answer

HTTPS and SSH are the default management access protocols for administrative access for FortiAuthenticator. HTTPS allows administrators to access the webbased GUI of FortiAuthenticator using a web browser and a secure connection. SSH allows administrators to access the CLI of FortiAuthenticator using an SSH
client and an encrypted connection. Both protocols require the administrator to enter a valid username and password to log in.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/system-settings#manag

Question 3

Which three of the following can be used as SSO sources? (Choose three)

Accepted Answer

FortiAuthenticator supports various SSO sources that can provide user identity information to other devices in the network, such as FortiGate firewalls or
FortiAnalyzer log servers. Some of the supported SSO sources are:
 FortiClient SSO Mobility Agent: A software agent that runs on Windows devices and sends user login information to FortiAuthenticator.
 FortiGate: A firewall device that can send user login information from various sources, such as FSSO agents, captive portals, VPNs, or LDAP servers, to
FortiAuthenticator.
 RADIUS accounting: A protocol that can send user login information from RADIUS servers or clients, such as wireless access points or VPN concentrators, to
FortiAuthenticator.
SSH sessions and FortiAuthenticator in SAML SP role are not valid SSO sources because they do not provide user identity information to other devices in the
network. References: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372410/single-sign-on

Question 4

You are an administrator for a large enterprise and you want to delegate the creation and management of guest users to a group of sponsors.
How would you associate the guest accounts with individual sponsors?

Accepted Answer

Guest accounts are associated with the sponsor that creates the guest account. A sponsor is a user who has permission to create and manage guest accounts on
behalf of other users3. A sponsor can create guest accounts using the sponsor portal or the REST API3. The sponsor’s username is recorded as a field in the
guest account’s profile3.
References: 3 https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/guest

Question 5

Which two capabilities does FortiAuthenticator offer when acting as a self-signed or local CA? (Choose two)

/NSE6_FAC-6.4-exam/ (47 Q&As)

Accepted Answer

FortiAuthenticator can act as a self-signed or local CA that can issue certificates to users, devices, or other CAs. It can also import other CA certificates and CRLs
to trust them and validate their certificates. It can also create, sign, and revoke X.509 certificates for various purposes, such as VPN authentication, web server
encryption, or wireless security. It cannot validate other CA CRLs using OCSP or merge local and remote CRLs using SCEP because these are protocols that
require communication with external CAs. References: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372408/certificatemanagement

Question 6

At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)

Accepted Answer

To enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and
the authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully,
such as sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional
steps that depend on your network setup and requirements. References:
https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management

Question 7

You are the administrator of a large network that includes a large local user datadabase on the current Fortiauthenticatior. You want to import all the local users
into a new Fortiauthenticator device.
Which method should you use to migrate the local users?

Accepted Answer

The best method to migrate local users from one FortiAuthenticator device to another is to export the users from the current device as a CSV file and then import
the CSV file into the new device. This method preserves all the user attributes and settings and allows you to modify them if needed before importing. The other
methods are not suitable for migrating local users because they either require an external RADIUS server or do not transfer all the user information. References:
https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372409/user-management

Question 8

Which of the following is an OATH-based standard to generate event-based, one-time password tokens?

Accepted Answer

Correct answer: A

Question 9

Which two statements about the EAP-TTLS authentication method are true? (Choose two)

Accepted Answer

EAP-TTLS is an authentication method that uses digital certificates only on the server side to establish a secure tunnel between the server and the client. The
client does not need a certificate but can use any inner authentication method supported by the server, such as PAP, CHAP, MS-CHAP, or EAP-MD5. EAP-TTLS
requires an EAP server certificate that is issued by a trusted CA and installed on the FortiAuthenticator device acting as the EAP server. EAP-TTLS supports both
wireless and wired solutions for port access control. References: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372412/eap-ttls

Question 10

Which two features of FortiAuthenticator are used for EAP deployment? (Choose two)

/NSE6_FAC-6.4-exam/ (47 Q&As)

Accepted Answer

Two features of FortiAuthenticator that are used for EAP deployment are certificate authority and RADIUS server. Certificate authority allows FortiAuthenticator to
issue and manage digital certificates for EAP methods that require certificate-based authentication, such as EAP-TLS or PEAP-EAP-TLS. RADIUS server allows
FortiAuthenticator to act as an authentication server for EAP methods that use RADIUS as a transport protocol, such as EAP-GTC or PEAP-MSCHAPV2.
References:
https://docs.fortinet.com/document/fortiauthenticator/6.4.0/administration-guide/906179/wireless-802-1x-authen