Go to NSE6_FAC-6.4 Questions - Try NSE6_FAC-6.4 dumps pdf
Dumps Practice Exam Questions Study Guide for the NSE6_FAC-6.4 Exam
Fortinet NSE6_FAC-6.4 exam is a 60-minute exam that consists of 30 multiple-choice questions. NSE6_FAC-6.4 exam is available in English and can be taken at any Pearson VUE testing center. To pass the exam, candidates must achieve a minimum score of 60%. NSE6_FAC-6.4 exam is designed to test the candidate's knowledge of FortiAuthenticator 6.4 and their ability to apply this knowledge in real-world scenarios.
NEW QUESTION # 13
Which two statements about the EAP-TTLS authentication method are true? (Choose two)
- A. Support a port access control (wired) solution only
- B. Requires an EAP server certificate
- C. Uses mutual authentication
- D. Uses digital certificates only on the server side
Answer: B,D
Explanation:
EAP-TTLS is an authentication method that uses digital certificates only on the server side to establish a secure tunnel between the server and the client. The client does not need a certificate but can use any inner authentication method supported by the server, such as PAP, CHAP, MS-CHAP, or EAP-MD5. EAP-TTLS requires an EAP server certificate that is issued by a trusted CA and installed on the FortiAuthenticator device acting as the EAP server. EAP-TTLS supports both wireless and wired solutions for port access control. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372412/eap-ttls
NEW QUESTION # 14
Which statement about the guest portal policies is true?
- A. Guest portal policies can be used only for BYODs
- B. All conditions in the policy must match before a user is presented with the guest portal
- C. Conditions in the policy apply only to guest wireless users
- D. Guest portal policies apply only to authentication requests coming from unknown RADIUS clients
Answer: B
Explanation:
Guest portal policies are rules that determine when and how to present the guest portal to users who want to access the network. Each policy has a set of conditions that can be based on various factors, such as the source IP address, MAC address, RADIUS client, user agent, or SSID. All conditions in the policy must match before a user is presented with the guest portal. Guest portal policies can apply to any authentication request coming from any RADIUS client, not just unknown ones. They can also be used for any type of device, not just BYODs. They can also apply to wired or VPN users, not just wireless users. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management/372406/portal-policies
NEW QUESTION # 15
What capability does the inbound proxy setting provide?
- A. It allows FortiAuthenticator system access to authenticating users, based on a geo IP address designation.
- B. It allows FortiAuthenticator to determine the origin source IP address after traffic passes through a proxy for system access,
- C. It allows FortiAuthenticator to act as a proxy for remote authentication servers.
- D. It allows FortiAuthenticator the ability to round robin load balance remote authentication servers.
Answer: B
Explanation:
The inbound proxy setting provides the ability for FortiAuthenticator to determine the origin source IP address after traffic passes through a proxy for system access. The inbound proxy setting allows FortiAuthenticator to use the X-Forwarded-For header in the HTTP request to identify the original client IP address. This can help FortiAuthenticator apply the correct authentication policy or portal policy based on the source IP address.
NEW QUESTION # 16
Why would you configure an OCSP responder URL in an end-entity certificate?
- A. To identify the end point that a certificate has been assigned to
- B. To designate the SCEP server to use for CRL updates for that certificate
- C. To provide the CRL location for the certificate
- D. To designate a server for certificate status checking
Answer: D
Explanation:
An OCSP responder URL in an end-entity certificate is used to designate a server for certificate status checking. OCSP stands for Online Certificate Status Protocol, which is a method of verifying whether a certificate is valid or revoked in real time. An OCSP responder is a server that responds to OCSP requests from clients with the status of the certificate in question. The OCSP responder URL in an end-entity certificate points to the location of the OCSP responder that can provide the status of that certificate.
NEW QUESTION # 17
Examine the screenshot shown in the exhibit.
Which two statements regarding the configuration are true? (Choose two.)
- A. All guest accounts created using the account registration feature will be placed under the Guest_Portal_Users group
- B. Guest user account will expire after eight hours
- C. Guest users must fill in all the fields on the registration form
- D. All accounts registered through the guest portal must be validated through email
Answer: A,D
Explanation:
The screenshot shows that the account registration feature is enabled for the guest portal and that the guest group is set to Guest_Portal_Users. This means that all guest accounts created using this feature will be placed under that group1. The screenshot also shows that email validation is enabled for the guest portal and that the email validation link expires after 24 hours. This means that all accounts registered through the guest portal must be validated through email within that time frame1.
NEW QUESTION # 18
Which two capabilities does FortiAuthenticator offer when acting as a self-signed or local CA? (Choose two)
- A. Merging local and remote CRLs using SCEP
- B. Importing other CA certificates and CRLs
- C. Validating other CA CRLs using OSCP
- D. Creating, signing, and revoking of X.509 certificates
Answer: B,D
Explanation:
FortiAuthenticator can act as a self-signed or local CA that can issue certificates to users, devices, or other CAs. It can also import other CA certificates and CRLs to trust them and validate their certificates. It can also create, sign, and revoke X.509 certificates for various purposes, such as VPN authentication, web server encryption, or wireless security. It cannot validate other CA CRLs using OCSP or merge local and remote CRLs using SCEP because these are protocols that require communication with external CAs. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372408/certificate-management
NEW QUESTION # 19
At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)
- A. Configuring a RADIUS client
- B. Configuring an external authentication portal
- C. Configuring at least on post-login service
- D. Configuring a portal policy
Answer: C,D
Explanation:
enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and the authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully, such as sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional steps that depend on your network setup and requirements. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management
NEW QUESTION # 20
Which two protocols are the default management access protocols for administrative access for FortiAuthenticator? (Choose two)
- A. HTTPS
- B. SNMP
- C. Telnet
- D. SSH
Answer: A,D
Explanation:
HTTPS and SSH are the default management access protocols for administrative access for FortiAuthenticator. HTTPS allows administrators to access the web-based GUI of FortiAuthenticator using a web browser and a secure connection. SSH allows administrators to access the CLI of FortiAuthenticator using an SSH client and an encrypted connection. Both protocols require the administrator to enter a valid username and password to log in.
NEW QUESTION # 21
You are a Wi-Fi provider and host multiple domains.
How do you delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device?
- A. Create user groups
- B. Create multiple directory trees on FortiAuthenticator
- C. Create realms.
- D. Automatically import hosts from each domain as they authenticate.
Answer: C
Explanation:
Realms are a way to delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device. A realm is a logical grouping of users and groups based on a common attribute, such as a domain name or an IP address range. Realms allow administrators to apply different authentication policies and settings to different groups of users based on their realm membership.
NEW QUESTION # 22
Which option correctly describes an SP-initiated SSO SAML packet flow for a host without a SAML assertion?
- A. Principal contacts idendity provider and is redirected to service provider, principal establishes connection with service provider, service provider validates authentication with identify provider
- B. Principal contacts service provider, service provider redirects principal to idendity provider, after succesfull authentication identify provider redirects principal to service provider
- C. Principal contacts idendity provider and authenticates, identity provider relays principal to service provider after valid authentication
- D. Service provider contacts idendity provider, idendity provider validates principal for service provider, service provider establishes communication with principal
Answer: B
Explanation:
SP-initiated SSO SAML packet flow for a host without a SAML assertion is as follows:
Principal contacts service provider, requesting access to a protected resource.
Service provider redirects principal to identity provider, sending a SAML authentication request.
Principal authenticates with identity provider using their credentials.
After successful authentication, identity provider redirects principal back to service provider, sending a SAML response with a SAML assertion containing the principal's attributes.
Service provider validates the SAML response and assertion, and grants access to the principal.
NEW QUESTION # 23
Which two statements about the self-service portal are true? (Choose two)
- A. Authenticating users must specify domain name along with username
- B. Administrator approval is required for all self-registration
- C. Self-registration information can be sent to the user through email or SMS
- D. Realms can be used to configure which seld-registered users or groups can authenticate on the network
Answer: C,D
Explanation:
Two statements about the self-service portal are true:
Self-registration information can be sent to the user through email or SMS using the notification templates feature. This feature allows administrators to customize the messages that are sent to users when they register or perform other actions on the self-service portal.
Realms can be used to configure which self-registered users or groups can authenticate on the network using the realm-based authentication feature. This feature allows administrators to apply different authentication policies and settings to different groups of users based on their realm membership.
NEW QUESTION # 24
Which two SAML roles can Fortiauthenticator be configured as? (Choose two)
- A. Service provider
- B. Principal
- C. Idendity provider
- D. Assertion server
Answer: A,C
Explanation:
FortiAuthenticator can be configured as a SAML identity provider (IdP) or a SAML service provider (SP). As an IdP, FortiAuthenticator authenticates users and issues SAML assertions to SPs. As an SP, FortiAuthenticator receives SAML assertions from IdPs and grants access to users based on the attributes in the assertions. Principal and assertion server are not valid SAML roles. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372407/saml
NEW QUESTION # 25
Which two statement about the RADIUS service on FortiAuthenticator are true? (Choose two)
- A. RADIUS users can migrated to LDAP users
- B. FortiAuthenticator answers only to RADIUS client that are registered with FortiAuthenticator
- C. Only local users can be authenticated through RADIUS
- D. Two-factor authentication cannot be enforced when using RADIUS authentication
Answer: A,B
Explanation:
Two statements about the RADIUS service on FortiAuthenticator are true:
RADIUS users can be migrated to LDAP users using the RADIUS learning mode feature. This feature allows FortiAuthenticator to learn user credentials from an existing RADIUS server and store them locally as LDAP users for future authentication requests.
FortiAuthenticator answers only to RADIUS clients that are registered with FortiAuthenticator. A RADIUS client is a device that sends RADIUS authentication or accounting requests to FortiAuthenticator. A RADIUS client must be added and configured on FortiAuthenticator before it can communicate with it.
NEW QUESTION # 26
You are an administrator for a large enterprise and you want to delegate the creation and management of guest users to a group of sponsors.
How would you associate the guest accounts with individual sponsors?
- A. Select the sponsor on the guest portal, during registration.
- B. You can automatically add guest accounts to groups associated with specific sponsors.
- C. Guest accounts are associated with the sponsor that creates the guest account.
- D. As an administrator, you can assign guest groups to individual sponsors.
Answer: C
Explanation:
Guest accounts are associated with the sponsor that creates the guest account. A sponsor is a user who has permission to create and manage guest accounts on behalf of other users3. A sponsor can create guest accounts using the sponsor portal or the REST API3. The sponsor's username is recorded as a field in the guest account's profile3.
NEW QUESTION # 27
You want to monitor FortiAuthenticator system information and receive FortiAuthenticator traps through SNMP.
Which two configurations must be performed after enabling SNMP access on the FortiAuthenticator interface? (Choose two)
- A. Set the tresholds to trigger SNMP traps
- B. Enable logging services
- C. Associate an ASN, 1 mapping rule to the receiving host
- D. Upload management information base (MIB) files to SNMP server
Answer: A,D
Explanation:
To monitor FortiAuthenticator system information and receive FortiAuthenticator traps through SNMP, two configurations must be performed after enabling SNMP access on the FortiAuthenticator interface:
Set the thresholds to trigger SNMP traps for various system events, such as CPU usage, disk usage, memory usage, or temperature.
Upload management information base (MIB) files to SNMP server to enable the server to interpret the SNMP traps sent by FortiAuthenticator.
NEW QUESTION # 28
When configuring syslog SSO, which three actions must you take, in addition to enabling the syslog SSO method? (Choose three.)
- A. Set the syslog UDP port on FortiAuthenticator.
- B. Select a syslog rule for message parsing.
- C. Define a syslog source.
- D. Set the same password on both the FortiAuthenticator and the syslog server.
- E. Enable syslog on the FortiAuthenticator interface.
Answer: A,B,C
Explanation:
To configure syslog SSO, three actions must be taken, in addition to enabling the syslog SSO method:
Define a syslog source, which is a device that sends syslog messages to FortiAuthenticator containing user logon or logoff information.
Select a syslog rule for message parsing, which is a predefined or custom rule that defines how to extract the user name, IP address, and logon or logoff action from the syslog message.
Set the syslog UDP port on FortiAuthenticator, which is the port number that FortiAuthenticator listens on for incoming syslog messages.
NEW QUESTION # 29
Which of the following is an OATH-based standard to generate event-based, one-time password tokens?
- A. HOTP
- B. TOTP
- C. SOTP
- D. OLTP
Answer: A
Explanation:
Reference:
HOTP stands for HMAC-based One-time Password, which is an OATH-based standard to generate event-based OTP tokens. HOTP uses a cryptographic hash function called HMAC (Hash-based Message Authentication Code) to generate OTPs based on two pieces of information: a secret key and a counter. The counter is incremented by one after each OTP generation, creating an event-based sequence of OTPs.
NEW QUESTION # 30
An administrator wants to keep local CA cryptographic keys stored in a central location.
Which FortiAuthenticator feature would provide this functionality?
- A. REST API
- B. SCEP support
- C. SFTP server
- D. Network HSM
Answer: D
Explanation:
Network HSM is a feature that allows FortiAuthenticator to keep local CA cryptographic keys stored in a central location. HSM stands for Hardware Security Module, which is a physical device that provides secure storage and generation of cryptographic keys. Network HSM allows FortiAuthenticator to use an external HSM device to store and manage the private keys of its local CAs, instead of storing them locally on the FortiAuthenticator device.
NEW QUESTION # 31
......
Free NSE 6 Network Security Specialist NSE6_FAC-6.4 Exam Question: https://www.prepawayexam.com/Fortinet/braindumps.NSE6_FAC-6.4.ete.file.html
NSE6_FAC-6.4 Dumps with Practice Exam Questions Answers: https://drive.google.com/open?id=1KkOb2zRZ8Th4nY6sKrqk83973p_mpfiS