Refer to the exhibit, which shows a firewall policy to enable active authentication. When attempting to access an external website using an active authentication method, the user is not presented…

Question

Exhibit

Options

• AThe Service DNS is required in the firewall policy.
• BThe Remote-users group must be set up correctly in the FSSO configuration.
• CNo matching user account exists for this user.
• DThe Remote-users group is not added to the Destination.

• A
  83% (20)
• B
  4% (1)
• C
  4% (1)
• D
  8% (2)

Explanation

Active authentication on FortiGate works by intercepting an HTTP/HTTPS request and redirecting the user to a login portal - but before any web request is made, the browser must first perform a DNS lookup. If DNS is not included as a permitted service in the firewall policy, that initial DNS query is silently blocked, meaning no HTTP connection is ever initiated, and therefore no authentication redirect can be triggered - the user simply sees nothing.

Why the distractors are wrong:

• B is wrong because FSSO is used for passive authentication (domain-based SSO), not active authentication - it's irrelevant to this scenario.
• C is wrong because a missing user account would still allow the login prompt to appear; the user just couldn't successfully log in.
• D is wrong because user groups are added to the Source, not the Destination - and even a misconfigured group affects post-auth traffic, not the appearance of the prompt itself.

Memory tip: Think "no DNS, no prompt" - active auth requires a web redirect, which requires a domain to resolve first. If the policy blocks DNS (port 53/UDP), the chain breaks before authentication ever begins.

No community discussion yet for this question.