FCP_FAC_AD-6.5 : BUNDLE PACK LEARNING TOOLS INCLUDED

Certification
This exam is part of the Fortinet Certified Professional - Network Security certification track. This certification validates your ability to secure networks and applications by deploying, managing, and monitoring Fortinet network security products.
Visit the Cybersecurity Certification page for information about certification requirements.

Exam
The FCP—FortiAuthenticator 6.5 Administrator exam evaluates your knowledge of, and expertise with, FortiAuthenticator devices.
The exam tests applied knowledge of FortiAuthenticator configuration, operation, and day-to-day administration, and includes the administration of users, PKI certificates, configuration extracts, and troubleshooting captures.
Once you pass the exam, you will receive the following exam badge:

Exam Details
Exam name FCP—FortiAuthenticator 6.5 Administrator
Exam series FCP_FAC_AD-6.5
Time allowed 60 minutes
Exam questions 30 multiple-choice questions
Scoring Pass or fail. A score report is available from your
Language English
Product version FortiAuthenticator 6.5

Exam Topics
Successful candidates have applied knowledge and skills in the following areas and tasks:

* FortiAuthenticator management
* Perform deployment configuration on FortiAuthenticator
* Explain and configure administrative accounts and roles
* Configure advanced system settings
* Configure and manage user accounts
* Certificate management
* Describe key concepts of PKI and digital certificates
* Use the FortiAuthenticator certificate management service to generate local certificates
* Implement automatic certificate management services
* Active authentication (RADIUS, LDAP, 802.1x, Portal Services)
* Implement RADIUS profiles and realms for RADIUS authentication
* Configure and manage supported remote authentication services
* Use FortiAuthenticator portal services to authenticate local and remote users
* Configure tokens and two-factor authentication
* Single sign-on
* Use local authentication events for Fortinet Single Sign-On (FSSO)
* Use third-party logon events via RADIUS single sign-on (RSSO), tags, and logs to generate FSSO events
* Implement SAML roles on FortiAuthenticator for the SAML SSO service

Training Resources
The following resources are recommended for attaining the knowledge and skills that are covered on the exam. The recommended training is available as a foundation for exam preparation. In addition to training, you are strongly encouraged to
have hands-on experience with the exam topics and objectives.

* FCP - FortiAuthenticator 6.5 Administrator course and hands-on labs
* FortiAuthenticator 6.5—Administration Guide

Experience
One year of experience with Identity, Credential, and Access Management (ICAM), and certificate management.
Minimum of six months of hands-on experience with FortiAuthenticator.

Sample Question and Answers

QUESTION 1
Which three of the following can be used as SSO sources? (Choose three.)

A. RADIUS accounting
B. FortiClient SSO Mobility Agent
C. SSH sessions
D. FortiGate
E. FortiAuthenticator in SAML SP role

Answer: A, B, D

Explanation:
RADIUS accounting can be used by FortiAuthenticator to obtain user identity and session details for SSO.
FortiClient SSO Mobility Agent reports user login events to FortiAuthenticator for SSO.
FortiGate can act as an SSO source by sending user authentication information to FortiAuthenticator.

QUESTION 2
You have implemented two-factor authentication to enhance security to sensitive enterprise systems.
How could you bypass the need for two-factor authentication for users accessing form specific secured networks?

A. Enable Adaptive Authentication in the portal policy.
B. Specify the appropriate RADIUS clients in the authentication policy.
C. Create an admin realm in the authentication policy.
D. Enable the Resolve user geolocation from their IP address option in the authentication policy

Answer: A

Explanation:
Enabling Adaptive Authentication in the portal policy allows FortiAuthenticator to apply contextual
rules, such as bypassing two-factor authentication when users connect from specific secured networks.

QUESTION 3
When configuring an active-passive HA deployment, what is the recommended data synchronization path?

A. Dedicated fiber channel
B. Same VLAN
C. Dedicated point-to-point VPN connection
D. Direct cable connection

Answer: D

Explanation:
A direct cable connection is the recommended data synchronization path in an active-passive HA
deployment because it provides the fastest, most reliable, and secure method for synchronizing data
between FortiAuthenticator units without depending on external network infrastructure.

QUESTION 4
Which FSSO discovery method transparently detects logged off users without having to rely on external features such as WMI polling?

A. RADIUS accounting
B. FortiClient SSO mobility agent
C. DC polling
D. Windows AD polling

Answer: B

Explanation:
The FortiClient SSO Mobility Agent runs on the endpoint and communicates login and logoff events
directly to FortiAuthenticator, allowing transparent detection of logged-off users without relying on
external mechanisms like WMI polling.

QUESTION 5
When performing a remote LDAP server integration with FortiAuthenticator, how do server type templates assist with the integration?

A. They autopopulate the simple and regular bind settings.
B. They automatically set the LDAP user auto provisioning settings.
C. They populate the query element fields with defined attribute and class values.
D. They define the connection security and domain authentication settings for each LDAP server you integrate with.

Answer: C

Explanation:
Server type templates in FortiAuthenticator assist LDAP integration by prepopulating the query