NSE4_FGT-7.0 · Question #156
Refer to the exhibit. The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration. How will FortiGate handle user authentication for traffic that…
The correct answer is C. Authentication is enforced at a policy level; all users will be prompted for authentication. FortiGate enforces user authentication at the firewall policy level, meaning all users from the LAN interface whose traffic matches an authentication-requiring policy will be prompted for authentication.
Question
Refer to the exhibit. The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration. How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
Exhibits
Options
- AIf there is a full-through policy in place, users will not be prompted for authentication.
- BUsers from the Sales group will be prompted for authentication and can authenticate successfully
- CAuthentication is enforced at a policy level; all users will be prompted for authentication.
- DUsers from the HR group will be prompted for authentication and can authenticate successfully
How the community answered
(43 responses)- A7% (3)
- B5% (2)
- C74% (32)
- D14% (6)
Why each option
FortiGate enforces user authentication at the firewall policy level, meaning all users from the LAN interface whose traffic matches an authentication-requiring policy will be prompted for authentication.
A 'full-through policy' without authentication requirements would not prompt users, but this option incorrectly assumes such a policy is universally applied or negates the potential for other policies requiring authentication.
While users from the Sales group might be prompted, assuming they 'can authenticate successfully' is an unsupported assertion without knowing the backend authentication system's configuration and the users' credentials.
FortiGate applies user authentication requirements at the firewall policy level; if a policy matching traffic from the LAN interface has authentication configured (e.g., using an identity-based policy or explicit authentication settings), all users attempting to traverse that policy will be prompted to authenticate.
Similar to the Sales group, assuming users from the HR group 'can authenticate successfully' is an unsupported assertion without full details of the authentication backend and user credentials.
Concept tested: FortiGate identity-based firewall policy authentication
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/990333/firewall-authentication-on-a-policy
Topics
Community Discussion
No community discussion yet for this question.