Explain How to Deploy and Configure Fortinet Single Sign-On (FSSO) NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A user reports that they cannot access a resource that is allowed by an FSSO-based firewall policy. The user is logged in to the domain and can access other resources. The FortiGate shows the user's IP address in the FSSO monitor, but the user is not mapped to the correct group. The DC agent is installed on the primary DC, and the collector agent is running. Which troubleshooting step should the administrator take first?

   • ARestart the DC agent service on the domain controller.
   • BCheck if the user's workstation is in the same subnet as the FortiGate.
   • CClear the FSSO session for the user and have them log in again.
   • DVerify that the user's group membership is correctly synchronized in the FSSO group list.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An administrator has configured FSSO with collector agent mode. The FortiGate is connected to the collector agent, and users are mapped correctly. However, the administrator notices that the collector agent is not receiving login events from one of the DC agents. The DC agent is running and shows no errors. Which troubleshooting step should the administrator take first?

   • ARestart the collector agent service on the collector server.
   • BVerify that the DC agent is configured with the correct collector agent IP address and password.
   • CCheck if the DC agent has permission to read the security event log.
   • DCheck the FortiGate's FSSO monitor to see if the user is mapped.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In FSSO DC agent mode, what is the primary function of the DC agent installed on a domain controller?

   • ATo monitor domain controller security event logs and capture user login events
   • BTo enforce firewall policies by blocking unauthorized users at the domain controller
   • CTo authenticate users by validating their passwords against Active Directory
   • DTo act as a proxy between the FortiGate and the domain controller for LDAP queries
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization with a single Active Directory domain wants to enforce user-based firewall policies on their FortiGate. They have decided to use FSSO with DC agent mode. During a pilot, they notice that users who log in to workstations that are not in the same subnet as the FortiGate are not being mapped to the correct user group. The DC agent is installed on the primary domain controller. Which action should the administrator take to resolve this issue?

   • AConfigure the FortiGate to poll the domain controller for user logins every 30 seconds.
   • BEnable the 'User IP address' option in the FSSO policy to use the workstation's IP.
   • CInstall the DC agent on all domain controllers that authenticate users.
   • DChange the FSSO mode to collector agent mode and install the collector on a separate server.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a typical step when configuring the collector agent for FSSO?

   • AEnabling the 'Audit logon events' setting on the collector agent server
   • BInstalling the collector agent on the FortiGate itself
   • CConfiguring the collector agent to monitor the security event log on the domain controller
   • DSpecifying the FortiGate's IP address and port for communication
   Reveal Solution Discussion Select an answer first