Refer to the exhibits.

Examine the FortiGate RSSO configuration shown in the exhibit.
FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages through port3. The incoming RADIUS accounting messages contain the username in the User-Name attribute and group membership in the Class attribute. You must ensure that the users are authenticated through these RADIUS accounting messages and accurately mapped to their respective RSSO user groups.
Which three critical configurations must you implement on the FortiGate device? (Choose three.)

• A. The RADIUS Attribute Value setting configured for an RSSO user group should match the class RADIUS attribute value in the RADIUS accounting message.
• B. The rsso-endpoint-attribute CLI setting in the RSSO agent configuration should be set to User- Name.
• C. The sso-attribute CLI setting in the RSSO agent configuration should be set to Class.
• D. Device detection and Security Fabric Connection should be enabled on port3
• E. RSSO user groups should be assigned to all firewall policies.

Refer to the exhibits.


Examine the network diagram and packet capture shown in the exhibit.
During packet capture analysis, a RADIUS Access-Request packet was detected being sent from FortiSwitch to FortiAuthenticator and passing through FortiGate. The capture shows that the User-Name attribute in the RADIUS Access-Request packet contains the client MAC address.
Why is the client MAC address contained in the User-Name attribute of the RADIUS Access- Request packet?

• A. FortiAuthenticator is authenticating the client based on the device hostname.
• B. FortiAuthenticator is performing machine authentication
• C. FortiGate is authenticating the client using 802.1X authentication.
• D. MAC address-based authentication is being used for the client through MAC Authentication Bypass (MAB).

How does Syslog SSO on FortiAuthenticator establish user identity?

• A. By parsing syslog messages from network devices to extract user login events and associate them with IP addresses
• B. By using predefined user credentials stored on ForitAuthenticator
• C. By directly communicating with the domain controller to retrieve user login events
• D. By intercepting and decrypting network traffic to extract user credentials

You've configured the FortiLink interface, and the DHCP server is enabled by default. The resulting DHCP server settings are shown in the exhibit. What is the role of the vci-string setting in this configuration?

• A. To ignore DHCP requests coming from FortiSwitch and FortiExtender devices.
• B. To restrict the IP address assignment to devices that have FortiSwitch or FortiExtender as their hostname.
• C. To reserve IP addresses for FortiSwitch and FortiExtender devices.
• D. To connect, devices must match the VCI string; otherwise, they will not receive an IP address.

Refer to the exhibit.

Which shows the WTP profile configuration.
The AP profile is assigned to two FAP-231F APs that are installed in an open plan area.
The first AP has 32 clients associated with the 5 GHz radios and 22 clients associated with the
2.4 GHz radio. The second AP has 12 clients associated with the 5 GHz radios and 20 clients associated with the 2.4 GHz radio.
A dual-band-capable client enters the area near the first AP and the first AP measures the new client at - 33 dBm signal strength. The second AP measures the new client at -43 dBm signal strength.
If the new client attempts to conned to the student 01 wireless network, which AP radio will the client be associated with?

• A. The second AP 2.4 GHz interface is preferred over 5 GHz for better speed and lower interference.
• B. The first AP 5 GHz interface because it has a stronger signal.
• C. The first AP 2.4 GHz interface provides a stronger signal, which clients often prioritize.
• D. The second AP 5 GHz interface has fewer clients, which ensures better performance despite the weaker signal.