Fortinet nse6_fac-64 Exam Dumps

Question 6 of 30

Which network configuration is required when depioying FortiAuthenticator for portal services?

One of the DNS servers must be a FortiGuard DNS server

Policies must have specific ports open between FortiAuthenticator and the authentication clients

FortiGate must be set up as the default gateway for FortiAuthenticator

FortiAuthenticator must have the REST API access enabled on port 1

Correct Answer: B

When deploying FortiAuthenticator for portal services, it is essential to ensure that policies have specific ports open between FortiAuthenticator and the authentication clients. This configuration is crucial for enabling communication and facilitating authentication processes between the clients and FortiAuthenticator.

Question 7 of 30

You are a FortiAuthenticator administrator for a large organization. Users who are configured to use FortiToken 200 for two-factor authentication can no longer authenticate. You have verified that only the users with two-factor authentication are experiencing the issue.

What can cause this issue?

FortiToken 200 license has expired.

One of the FortiAuthenticator devices in the active-active cluster has failed.

Time drift between FortiAuthenticator and hardware tokens.

FortiAuthenticator has lost contact with the FortiToken Cloud servers.

Correct Answer: C

Time drift between FortiAuthenticator and hardware tokens can cause users to no longer authenticate. If the internal clocks of FortiAuthenticator and the FortiToken 200 devices are not synchronized, the one-time passwords (OTPs) generated by the tokens will not match the expected values, leading to authentication failures. Ensuring time synchronization or configuring time drift tolerance can resolve this issue.

Question 8 of 30

Why would you configure an OCSP responder URL in an end-entity certificate?

To designate the SCEP server to use for CRL updates for that certificate

To identify the end point that a certificate has been assigned to

To designate a server for certificate status checking

To provide the CRL location for the certificate

Correct Answer: C

Configuring an OCSP responder URL in an end-entity certificate is necessary to designate a server for certificate status checking. OCSP stands for Online Certificate Status Protocol, which helps verify whether a certificate is valid or has been revoked in real-time. The specified OCSP responder URL points to the server that can provide the status of the certificate.

Question 9 of 30

An administrator wants to keep local CA cryptographic keys stored in a central location.

Which FortiAuthenticator feature would provide this functionality?

SCEP support

REST API

Network HSM

SFTP server

Correct Answer: C

To keep local CA cryptographic keys stored in a central location, the FortiAuthenticator feature required is Network HSM (Hardware Security Module). Network HSMs are designed to protect and manage digital keys for strong authentication, ensuring that cryptographic keys are securely stored and managed in a centralized in a hardware device.

Question 10 of 30

Which option correctly describes an SP-initiated SSO SAML packet flow for a host without a SAML assertion?

Principal contacts service provider, service provider redirects principal to identity provider, after successful authentication identity provider redirects principal to service provider.

Principal contacts identity provider and is redirected to service provider, principal establishes connection with service provider, service provider validates authentication with identity provider.

Principal contacts identity provider and authenticates, identity provider relays principal to service provider after valid authentication.

Service provider contacts identity provider, identity provider validates principal for service provider, service provider establishes communication with principal.

Correct Answer: A

In an SP-initiated Single Sign-On (SSO) SAML flow, when a principal (user) does not have a SAML assertion, the correct sequence is as follows: The principal first contacts the service provider. Since the principal does not have a SAML assertion, the service provider redirects the principal to the identity provider. The identity provider then authenticates the principal. After successful authentication, the identity provider sends the principal back to the service provider with the necessary SAML assertion. This sequence ensures that the user is authenticated by the identity provider before accessing services from the service provider.