Fortinet FCP_FGT_AD-7.6 Questions & Answers

A backup identity server is ineffective when its address, route or retry behavior is misconfigured explains a different situation, radius timeout and failover, where valid users fail authentication during a primary RADIUS server outage despite a configured secondary server. It does not account for the specific observed central nat migration testing condition at Fairmont Regional Hospital. The decisive mechanism here is: Changing NAT control location can leave implicit per-policy translation behavior unrepresented.

Guest credentials without enforced expiry can outlast the intended access window explains a different situation, guest account expiration, where short-term contractors continue to authenticate through old FortiGate guest identities after their authorized engagement ends. It does not account for the specific observed central nat migration testing condition at Fairmont Regional Hospital. The decisive mechanism here is: Changing NAT control location can leave implicit per-policy translation behavior unrepresented.

A collector cannot infer logons that never reach any configured event or agent source explains a different situation, fsso domain-controller agent collection, where domain users intermittently lose identity mapping after their logons move to a domain controller that lacks the FSSO agent. It does not account for the specific observed central nat migration testing condition at Fairmont Regional Hospital. The decisive mechanism here is: Changing NAT control location can leave implicit per-policy translation behavior unrepresented.

An outage test authenticates through the secondary server without excessive delay would validate the separate control radius timeout and failover, not the fault reported for Fairmont Regional Hospital. To confirm this correction, the team instead needs: Traffic tests show the planned translated addresses before and after the change. That is the observable check related to central nat migration testing.

A supervised expired guest account is rejected while a current approved guest still connects would validate the separate control guest account expiration, not the fault reported for Fairmont Regional Hospital. To confirm this correction, the team instead needs: Traffic tests show the planned translated addresses before and after the change. That is the observable check related to central nat migration testing.

A test logon on each monitored domain controller appears in the FSSO user list would validate the separate control fsso domain-controller agent collection, not the fault reported for Fairmont Regional Hospital. To confirm this correction, the team instead needs: Traffic tests show the planned translated addresses before and after the change. That is the observable check related to central nat migration testing.

Exercise identity-server failover under controlled conditions reduces recurrence of radius timeout and failover, rather than the observed central nat migration testing issue. The relevant preventive control for Fairmont Regional Hospital is: Maintain NAT migration matrices and rollback configuration. This distinction matters because changing NAT control location can leave implicit per-policy translation behavior unrepresented.

Reconcile active guests to current sponsor approvals reduces recurrence of guest account expiration, rather than the observed central nat migration testing issue. The relevant preventive control for Fairmont Regional Hospital is: Maintain NAT migration matrices and rollback configuration. This distinction matters because changing NAT control location can leave implicit per-policy translation behavior unrepresented.

Audit domain-controller additions and agent health reduces recurrence of fsso domain-controller agent collection, rather than the observed central nat migration testing issue. The relevant preventive control for Fairmont Regional Hospital is: Maintain NAT migration matrices and rollback configuration. This distinction matters because changing NAT control location can leave implicit per-policy translation behavior unrepresented.

Evaluate supported RADIUS accounting and session-logging configuration for the required user context is a relevant remedy for a DIFFERENT problem—radius accounting visibility—when security operations cannot correlate user logoff events because the FortiGate implementation collects only RADIUS authentication results. In this Fairmont Retail Group case that is not the failing component. Here the correct intervention is to restore the correct inside route and interface connectivity toward the mapped server because dNAT changes an address but does not create a valid route to an unreachable internal destination.

Configure a supported MFA-capable remote identity integration and verify enforcement for the privileged group is a relevant remedy for a DIFFERENT problem—mfa through identity provider—when remote privileged firewall users authenticate through an external directory without the required multi-factor challenge. In this Fairmont Retail Group case that is not the failing component. Here the correct intervention is to restore the correct inside route and interface connectivity toward the mapped server because dNAT changes an address but does not create a valid route to an unreachable internal destination.

Add the required approved domain group to the FSSO collector and FortiGate group filters is a relevant remedy for a DIFFERENT problem—fsso group filter scope—when fortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. In this Fairmont Retail Group case that is not the failing component. Here the correct intervention is to restore the correct inside route and interface connectivity toward the mapped server because dNAT changes an address but does not create a valid route to an unreachable internal destination.

Authentication success alone does not necessarily provide session start, stop or accounting records explains a different situation, radius accounting visibility, where security operations cannot correlate user logoff events because the FortiGate implementation collects only RADIUS authentication results. It does not account for the specific observed vip mapped address subnet gateway condition at Fairmont Retail Group. The decisive mechanism here is: DNAT changes an address but does not create a valid route to an unreachable internal destination.

Remote directory password validation does not imply a second authentication factor is being enforced explains a different situation, mfa through identity provider, where remote privileged firewall users authenticate through an external directory without the required multi-factor challenge. It does not account for the specific observed vip mapped address subnet gateway condition at Fairmont Retail Group. The decisive mechanism here is: DNAT changes an address but does not create a valid route to an unreachable internal destination.

A populated FSSO user table does not guarantee every AD group is included in identity policy mapping explains a different situation, fsso group filter scope, where fortiGate learns user IPs via FSSO but authorized members of a particular AD group are never recognized. It does not account for the specific observed vip mapped address subnet gateway condition at Fairmont Retail Group. The decisive mechanism here is: DNAT changes an address but does not create a valid route to an unreachable internal destination.

A controlled user session produces appropriate accounting start and stop context would validate the separate control radius accounting visibility, not the fault reported for Fairmont Retail Group. To confirm this correction, the team instead needs: The mapped server receives the packet and the reverse session returns through the FortiGate. That is the observable check related to vip mapped address subnet gateway.

A privileged test login demands the approved second factor and a single-factor attempt fails would validate the separate control mfa through identity provider, not the fault reported for Fairmont Retail Group. To confirm this correction, the team instead needs: The mapped server receives the packet and the reverse session returns through the FortiGate. That is the observable check related to vip mapped address subnet gateway.

An eligible group member matches the intended identity rule without other groups being granted would validate the separate control fsso group filter scope, not the fault reported for Fairmont Retail Group. To confirm this correction, the team instead needs: The mapped server receives the packet and the reverse session returns through the FortiGate. That is the observable check related to vip mapped address subnet gateway.

Monitor accounting collector availability and event retention reduces recurrence of radius accounting visibility, rather than the observed vip mapped address subnet gateway issue. The relevant preventive control for Fairmont Retail Group is: Validate internal reachability before adding external NAT rules. This distinction matters because dNAT changes an address but does not create a valid route to an unreachable internal destination.

Review MFA policies and exception accounts after directory changes reduces recurrence of mfa through identity provider, rather than the observed vip mapped address subnet gateway issue. The relevant preventive control for Fairmont Retail Group is: Validate internal reachability before adding external NAT rules. This distinction matters because dNAT changes an address but does not create a valid route to an unreachable internal destination.

Review FSSO filters when application groups change reduces recurrence of fsso group filter scope, rather than the observed vip mapped address subnet gateway issue. The relevant preventive control for Fairmont Retail Group is: Validate internal reachability before adding external NAT rules. This distinction matters because dNAT changes an address but does not create a valid route to an unreachable internal destination.

Configure the supported identity-based firewall or captive portal authentication policy on the guest traffic path is a relevant remedy for a DIFFERENT problem—captive portal active authentication—when guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. In this Fairmont Transport Authority case that is not the failing component. Here the correct intervention is to restrict the VIP port forwarding and inbound firewall service to the approved listener because broad all-port destination translation exposes unnecessary services behind a public address.

Expand the authorized LDAP search base or filter to include the intended directory subtree is a relevant remedy for a DIFFERENT problem—ldap search-base scope—when directory authentication fails only for employees moved into a different organizational unit. In this Fairmont Transport Authority case that is not the failing component. Here the correct intervention is to restrict the VIP port forwarding and inbound firewall service to the approved listener because broad all-port destination translation exposes unnecessary services behind a public address.

Update the supported FSSO collector connection credentials consistently on FortiGate and collector is a relevant remedy for a DIFFERENT problem—fsso collector shared secret—when the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. In this Fairmont Transport Authority case that is not the failing component. Here the correct intervention is to restrict the VIP port forwarding and inbound firewall service to the approved listener because broad all-port destination translation exposes unnecessary services behind a public address.

An ordinary source-address permit rule does not force the end user to complete interactive authentication explains a different situation, captive portal active authentication, where guest wireless clients pass the firewall to a restricted website without ever being prompted for required login. It does not account for the specific observed vip security exposure minimization condition at Fairmont Transport Authority. The decisive mechanism here is: Broad all-port destination translation exposes unnecessary services behind a public address.

LDAP searches do not find identities outside the configured base and filtering scope explains a different situation, ldap search-base scope, where directory authentication fails only for employees moved into a different organizational unit. It does not account for the specific observed vip security exposure minimization condition at Fairmont Transport Authority. The decisive mechanism here is: Broad all-port destination translation exposes unnecessary services behind a public address.

An authenticated agent connection rejects clients with a mismatched shared password explains a different situation, fsso collector shared secret, where the FortiGate cannot retrieve login mappings after the FSSO collector password rotates. It does not account for the specific observed vip security exposure minimization condition at Fairmont Transport Authority. The decisive mechanism here is: Broad all-port destination translation exposes unnecessary services behind a public address.

A test guest sees the required portal and accesses the service only after an approved login would validate the separate control captive portal active authentication, not the fault reported for Fairmont Transport Authority. To confirm this correction, the team instead needs: HTTPS is reachable from authorized sources and a test management port remains denied. That is the observable check related to vip security exposure minimization.

Both affected and previously valid user accounts are resolved without including prohibited groups would validate the separate control ldap search-base scope, not the fault reported for Fairmont Transport Authority. To confirm this correction, the team instead needs: HTTPS is reachable from authorized sources and a test management port remains denied. That is the observable check related to vip security exposure minimization.

The FortiGate reconnects to the collector and receives test user sessions would validate the separate control fsso collector shared secret, not the fault reported for Fairmont Transport Authority. To confirm this correction, the team instead needs: HTTPS is reachable from authorized sources and a test management port remains denied. That is the observable check related to vip security exposure minimization.

Test authentication prompts after guest policy changes reduces recurrence of captive portal active authentication, rather than the observed vip security exposure minimization issue. The relevant preventive control for Fairmont Transport Authority is: Audit service exposure when reusing or cloning VIP objects. This distinction matters because broad all-port destination translation exposes unnecessary services behind a public address.

Validate LDAP scope when HR directory structures change reduces recurrence of ldap search-base scope, rather than the observed vip security exposure minimization issue. The relevant preventive control for Fairmont Transport Authority is: Audit service exposure when reusing or cloning VIP objects. This distinction matters because broad all-port destination translation exposes unnecessary services behind a public address.

Coordinate collector credential rotation with firewall configuration reduces recurrence of fsso collector shared secret, rather than the observed vip security exposure minimization issue. The relevant preventive control for Fairmont Transport Authority is: Audit service exposure when reusing or cloning VIP objects. This distinction matters because broad all-port destination translation exposes unnecessary services behind a public address.