Which of the following statements is correct about how the FortiGate unit verifies username and password during user authentication?

The order of authentication checks (local vs. remote) is configurable within user groups or authentication rules and is not a fixed behavior where remote servers are always checked first.

FortiGate supports a hybrid authentication method where a local user account can be created, but its password authentication is specifically configured to be validated against an external authentication server, such as RADIUS or LDAP, allowing centralized password management for local accounts.

If authentication fails with a local password for a locally configured user, the FortiGate unit typically terminates that specific authentication attempt; it does not automatically fall back to querying a remote server unless explicitly configured within an authentication scheme.

FortiGate units can authenticate directly against Active Directory using standard LDAP or RADIUS protocols without requiring specific Fortinet Server authentication software.