NSE4 · Question #156
In order to match an identity-based policy, the FortiGate unit checks the IP information. Once inside the policy, the following logic is followed:
The correct answer is A. First, a check is performed to determine if the user's login credentials are valid. Next, the user is. For an identity-based policy, after matching IP information, the FortiGate first validates the user's login credentials to ensure authenticity.
Question
In order to match an identity-based policy, the FortiGate unit checks the IP information. Once inside the policy, the following logic is followed:
Options
- AFirst, a check is performed to determine if the user's login credentials are valid. Next, the user is
- BFirst, user restrictions are determined and port, time, and UTM profiles are applied. Next, a check
- CFirst, the user is checked to determine if they belong to any of the groups defined for that policy.
How the community answered
(29 responses)- A90% (26)
- B3% (1)
- C7% (2)
Why each option
For an identity-based policy, after matching IP information, the FortiGate first validates the user's login credentials to ensure authenticity.
When an identity-based policy is matched based on IP information, the FortiGate's subsequent logic begins by authenticating the user. This means checking if the user's login credentials are valid before applying further policy restrictions or allowing access.
Determining user restrictions or applying port, time, and UTM profiles happens *after* successful authentication, not as the initial step in the identity-based logic.
Checking if a user belongs to groups is part of the authorization process, which follows successful authentication of the user's credentials.
Concept tested: FortiGate identity policy evaluation
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526841/authentication-rules
Topics
Community Discussion
No community discussion yet for this question.