100% Free FCP_FAC_AD-6.5 Files For passing the exam Quickly UPDATED Dec 22, 2025
FCP_FAC_AD-6.5 Dumps Questions Study Exam Guide
NEW QUESTION # 41
What happens when a certificate is revoked? (Choose two.)
- A. Revoked certificates are automatically added to the CRL
- B. All certificates signed by a revoked CA certificate are automatically revoked
- C. External CAs will periodically query FortiAuthenticator and automatically download revoked certificates
- D. Revoked certificates cannot be reinstated for any reason
Answer: A,B
NEW QUESTION # 42
Refer to the exhibit.
Portal policy
An administrator has a captive portal configuration on their FortiGate that directs users to a portal page on FortiAuthenticator. A user whose laptop has an IP address of 10.0.1.85 and is connected through the Guest SSID, is failing to load the portal page.
What is the most likely cause of the problem?
- A. The host IP address is not in the required range.
- B. The host is connected to a prohibited SSID.
- C. The IP address is incorrect for the SSID.
- D. The portal page will only be presented to wired hosts.
Answer: B
Explanation:
The second portal rule condition explicitly uses Not with the SSID value "Guest", which means that users connected through the Guest SSID are excluded from accessing the portal, causing the failure for this user.
NEW QUESTION # 43
An employee lost their assigned token and needs to authenticate to a resource which requires two factor authentication. The user does not have access to SMS or email.
How can an administrator provide access for the user?
- A. Enable and provide an emergency code to the user
- B. Refresh the FTM provisioning status for the user
- C. Generate and provide an HOTP to the user
- D. Disable two-factor authentication on the resource
Answer: A
Explanation:
An administrator can issue an emergency code in FortiAuthenticator, which temporarily bypasses the user's lost token and allows them to authenticate when two-factor authentication is required but no token, SMS, or email is available.
NEW QUESTION # 44
What is the function of RADIUS profiles and realms in authentication?
- A. They provide secure encryption for user data
- B. They authenticate users based on their IP addresses
- C. They enable remote access to user files
- D. They manage authentication settings and methods for RADIUS users
Answer: D
NEW QUESTION # 45
What is two-factor authentication (2FA)?
- A. Using two different VPN connections for secure access
- B. Requiring users to provide two different forms of authentication before granting access
- C. Using two different network protocols for authentication
- D. Authenticating users using only their email addresses
Answer: B
NEW QUESTION # 46
Refer to the exhibit.
FortiAuthenticator Topology
What type of FortiAuthenticator configuration is shown in this topology?
- A. Active-active HA
- B. Authentication load balancing nodes
- C. RADIUS proxy
- D. Tiered architecture
Answer: D
Explanation:
The diagram shows a tiered architecture where multiple FortiAuthenticator devices collect authentication data from various sources and forward it to an upper-tier FortiAuthenticator, which consolidates and provides SSO information to FortiGate devices.
NEW QUESTION # 47
You want to monitor FortiAuthenticator system information and receive FortiAuthenticator traps through SNMP.
Which two configurations must be performed after enabling SNMP access on the FortiAuthenticator interface? (Choose two)
- A. Set the tresholds to trigger SNMP traps
- B. Upload management information base (MIB) files to SNMP server
- C. Enable logging services
- D. Associate an ASN, 1 mapping rule to the receiving host
Answer: A,B
NEW QUESTION # 48
Which authentication factor involves something a user knows?
- A. Something a user remembers
- B. Something a user does
- C. Something a user has
- D. Something a user is
Answer: A
NEW QUESTION # 49
What is the advantage of using FortiToken for two-factor authentication?
- A. It can be easily integrated with any third-party authentication service
- B. It's a physical token made of solid gold
- C. It can generate unlimited tokens for free
- D. It doesn't require user interaction for authentication
Answer: D
NEW QUESTION # 50
When creating an administrative user, what capabilities does the Web service access option provide?
- A. Access to the administrative GUI from outside the local subnet
- B. Provides management access for all portal service configurations
- C. Access to web services using the REST API
- D. Management of enabled web services on the FortiAuthenticator interface
Answer: C
Explanation:
The Web service access option grants the administrative user permission to access FortiAuthenticator's web services via the REST API, enabling programmatic management and automation.
NEW QUESTION # 51
FortiAuthenticator has several roles that involve digital certificates.
Which role allows FortiAuthenticator to receive the signed certificate signing requests (CSRs) and send certificate revocation lists (CRLs)?
- A. OCSP server
- B. SCEP server
- C. Remote LDAP server
- D. EAP server
Answer: B
NEW QUESTION # 52
In FortiAuthenticator, what is the purpose of a captive portal?
- A. To encrypt all network traffic for security
- B. To manage hardware resources in the network
- C. To restrict user access to specific websites
- D. To capture and authenticate user credentials before granting access to the network
Answer: D
NEW QUESTION # 53
Which protocol is commonly used for RADIUS single sign-on (RSSO) to integrate third-party logon events with Fortinet Single Sign-On (FSSO)?
- A. SNMP
- B. HTTP
- C. DNS
- D. RADIUS
Answer: D
NEW QUESTION # 54
You are a network administrator with a large wireless environment. FortiAuthenticator acts as the RADIUS server for your wireless controllers. You want specific wireless controllers to authenticate users against specific realms.
How would you satisfy this requirement?
- A. Enable Adaptive Authentication
- B. Define RADIUS clients
- C. RADUIS policy
- D. Create Access point groups
Answer: C
NEW QUESTION # 55
Why would you configure an OCSP responder URL in an end-entity certificate?
- A. To designate a server for certificate status checking
- B. To designate the SCEP server to use for CRL updates for that certificate
- C. To provide the CRL location for the certificate
- D. To identify the end point that a certificate has been assigned to
Answer: A
Explanation:
Configuring an OCSP responder URL in an end-entity certificate designates the server that will be queried to check the real-time revocation status of the certificate.
NEW QUESTION # 56
Which three of the following can be used as SSO sources? (Choose three.)
- A. FortiGate
- B. SSH sessions
- C. FortiClient SSO Mobility Agent
- D. FortiAuthenticator in SAML SP role
- E. RADIUS accounting
Answer: A,C,E
Explanation:
RADIUS accounting can be used by FortiAuthenticator to obtain user identity and session details for SSO.
FortiClient SSO Mobility Agent reports user login events to FortiAuthenticator for SSO.
FortiGate can act as an SSO source by sending user authentication information to FortiAuthenticator.
NEW QUESTION # 57
A device that is 802.1X non-compliant must be connected to the network.
Which authentication method can you use to authenticate the device with FortiAuthenticator?
- A. EAP-TTLS
- B. EAP-TLS
- C. MAC-based authentication
- D. Machine-based authentication
Answer: C
NEW QUESTION # 58
Which of the following is a benefit of using role-based access control (RBAC) in FortiAuthenticator?
- A. It provides granular control over user access based on their roles
- B. It eliminates the need for authentication
- C. It automatically generates strong passwords for users
- D. It assigns the same permissions to all users
Answer: A
NEW QUESTION # 59
An administrator is integrating FortiAuthenticator with an existing RADIUS server with the intent of eventually replacing the RADIUS server with FortiAuthenticator.
How can FortiAuthenticator help facilitate this process?
- A. By configuring the RADIUS accounting proxy
- B. By enabling learning mode in the RADIUS server configuration
- C. By importing the RADIUS user records
- D. By enabling automatic REST API calls from the RADIUS server
Answer: B
NEW QUESTION # 60
A system administrator wants to integrate FortiAuthenticator with an existing identity management system with the goal of authenticating and deauthenticating users into FSSO.
- A. The ability to import and export users from CSV files
- B. SNMP monitoring and traps
- C. REST API
- D. RADIUS learning mode for migrating users
Answer: C
NEW QUESTION # 61
Which of the following is a recommended practice when configuring FortiAuthenticator for deployment?
- A. Using the default factory settings for quicker deployment
- B. Disabling all authentication methods except one
- C. Enabling all available authentication methods for flexibility
- D. Disabling all user roles to simplify access control
Answer: B
NEW QUESTION # 62
An administrator wants users and devices that cannot be identified transparently, such as Android BYOD devices, to be able to register and create their own credentials.
In this case, which FortiAuthenticator user identity discovery method can the administrator use?
- A. SSOMA
- B. Syslog messaging or SAML IdP
- C. Kerberos-based authentication
- D. Portal authentication
Answer: D
Explanation:
Portal authentication allows unidentified users or devices, such as Android BYOD devices, to self-register and create credentials through a captive or guest portal on FortiAuthenticator.
NEW QUESTION # 63
How can a SAML metada file be used?
- A. To defined a list of trusted user names
- B. To resolve the IDP realm for authentication
- C. To correlate the IDP address to its hostname
- D. To import the required IDP configuration
Answer: D
NEW QUESTION # 64
......
FCP_FAC_AD-6.5 Premium Exam Engine - Download Free PDF Questions: https://braindump2go.examdumpsvce.com/FCP_FAC_AD-6.5-valid-exam-dumps.html
