Use Available User Onboarding Methods NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which component is essential for SWG mode to function as an agentless onboarding method?

   • AA mechanism to redirect user web traffic to the FortiGate proxy.
   • BA FortiClient agent installed on every user device.
   • CA RADIUS server that is mandatory for all SWG deployments.
   • DA dedicated hardware load balancer to distribute traffic.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has multiple authentication servers: an LDAP server for user accounts, a RADIUS server for network access, and a SAML IdP for cloud applications. The SD-WAN administrator wants to configure user onboarding for VPN access. The requirement is to use the SAML IdP for VPN authentication, but also to verify that the user is a member of a specific group defined in LDAP. How should the administrator configure this?

   • AUse SAML for both authentication and group membership, and do not query LDAP.
   • BUse RADIUS for authentication and configure the RADIUS server to return group membership.
   • CUse SAML for authentication and configure the FortiGate to query LDAP for group membership after authentication.
   • DUse LDAP for authentication and configure the FortiGate to use SAML for group lookup.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization wants to provide VPN access to users using their existing Microsoft 365 credentials. They want to avoid maintaining a separate password database on the FortiGate. Which authentication method should be configured for the VPN policy?

   • ASAML SSO with Microsoft Entra ID (Azure AD) as the identity provider.
   • BLocal user accounts with passwords synced from Microsoft 365.
   • CLDAP authentication against the on-premises Active Directory.
   • DRADIUS authentication against the on-premises RADIUS server.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In agent-based mode, what is the primary role of the FortiClient agent in the user onboarding process?

   • AIt replaces the need for any authentication server by storing all user credentials locally on the endpoint.
   • BIt acts as a transparent proxy that intercepts all user traffic without requiring any client software.
   • CIt only handles VPN tunnel establishment and does not participate in user identity verification.
   • DIt provides the user identity and device posture information to the FortiGate for policy enforcement.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses a RADIUS server for 802.1X network authentication. The SD-WAN administrator wants to reuse this RADIUS server to authenticate users for VPN onboarding. What must be configured on the FortiGate?

   • AA SAML identity provider configuration with the RADIUS server as the IdP.
   • BAn LDAP server object pointing to the RADIUS server.
   • CA RADIUS server object with the server IP, shared secret, and authentication port.
   • DA local user database with accounts synchronized from the RADIUS server.
   Reveal Solution Discussion Select an answer first