100%合格率保証付きで最高のNSE6_FAC-6.4試験でリアル問題PDFがある[2024年04月]
NSE6_FAC-6.4問題集で2024年最新のFortinet NSE6_FAC-6.4試験問題
Fortinet NSE6_FAC-6.4の試験は、120分以内に完了する必要がある60の複数選択質問で構成されています。この試験は英語と日本語で入手でき、ピアソンvueテストセンターで撮影できます。試験に合格し、Fortinet NSE 6 -Fortiauthenticator 6.4認定を獲得するには、個人は70％の最低スコアを達成する必要があります。
Fortinet NSE6_FAC-6.4試験は、FortiAuthenticatorソリューションを徹底的に理解することが必要な厳しい認定資格です。受験者は、FortiAuthenticatorソリューションの展開や管理に実践的な経験を持っている必要があります。この認定資格は、業界で高く評価され、世界的な主要組織によって認められています。ネットワークセキュリティの分野で、FortiAuthenticatorソリューションの専門知識を示すことでキャリアを発展させるために優れた方法です。
質問 # 28
Which two capabilities does FortiAuthenticator offer when acting as a self-signed or local CA? (Choose two)
- A. Creating, signing, and revoking of X.509 certificates
- B. Validating other CA CRLs using OSCP
- C. Importing other CA certificates and CRLs
- D. Merging local and remote CRLs using SCEP
正解：A、C
解説：
FortiAuthenticator can act as a self-signed or local CA that can issue certificates to users, devices, or other CAs. It can also import other CA certificates and CRLs to trust them and validate their certificates. It can also create, sign, and revoke X.509 certificates for various purposes, such as VPN authentication, web server encryption, or wireless security. It cannot validate other CA CRLs using OCSP or merge local and remote CRLs using SCEP because these are protocols that require communication with external CAs. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372408/certificate-management
質問 # 29
What capability does the inbound proxy setting provide?
- A. It allows FortiAuthenticator the ability to round robin load balance remote authentication servers.
- B. It allows FortiAuthenticator to determine the origin source IP address after traffic passes through a proxy for system access,
- C. It allows FortiAuthenticator to act as a proxy for remote authentication servers.
- D. It allows FortiAuthenticator system access to authenticating users, based on a geo IP address designation.
正解：B
解説：
The inbound proxy setting provides the ability for FortiAuthenticator to determine the origin source IP address after traffic passes through a proxy for system access. The inbound proxy setting allows FortiAuthenticator to use the X-Forwarded-For header in the HTTP request to identify the original client IP address. This can help FortiAuthenticator apply the correct authentication policy or portal policy based on the source IP address.
質問 # 30
Which EAP method is known as the outer authentication method?
- A. PEAP
- B. EAP-TLS
- C. MSCHAPV2
- D. EAP-GTC
正解：A
解説：
PEAP is known as the outer authentication method because it establishes a secure tunnel between the client and the server using TLS. The inner authentication method, such as EAP-GTC, EAP-TLS, or MSCHAPV2, is then used to authenticate the client within the tunnel.
質問 # 31
When configuring syslog SSO, which three actions must you take, in addition to enabling the syslog SSO method? (Choose three.)
- A. Set the syslog UDP port on FortiAuthenticator.
- B. Enable syslog on the FortiAuthenticator interface.
- C. Define a syslog source.
- D. Set the same password on both the FortiAuthenticator and the syslog server.
- E. Select a syslog rule for message parsing.
正解：A、C、E
解説：
To configure syslog SSO, three actions must be taken, in addition to enabling the syslog SSO method:
Define a syslog source, which is a device that sends syslog messages to FortiAuthenticator containing user logon or logoff information.
Select a syslog rule for message parsing, which is a predefined or custom rule that defines how to extract the user name, IP address, and logon or logoff action from the syslog message.
Set the syslog UDP port on FortiAuthenticator, which is the port number that FortiAuthenticator listens on for incoming syslog messages.
質問 # 32
What happens when a certificate is revoked? (Choose two)
- A. All certificates signed by a revoked CA certificate are automatically revoked
- B. Revoked certificates cannot be reinstated for any reason
- C. Revoked certificates are automatically added to the CRL
- D. External CAs will priodically query Fortiauthenticator and automatically download revoked certificates
正解：A、C
解説：
When a certificate is revoked, it means that it is no longer valid and should not be trusted by any entity. Revoked certificates are automatically added to the certificate revocation list (CRL) which is published by the issuing CA and can be checked by other parties. If a CA certificate is revoked, all certificates signed by that CA are also revoked and added to the CRL. Revoked certificates can be reinstated if the reason for revocation is resolved, such as a compromised private key being recovered or a misissued certificate being corrected. External CAs do not query FortiAuthenticator for revoked certificates, but they can use protocols such as SCEP or OCSP to exchange certificate information with FortiAuthenticator. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372408/certificate-management
質問 # 33
You are a Wi-Fi provider and host multiple domains.
How do you delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device?
- A. Create multiple directory trees on FortiAuthenticator
- B. Create realms.
- C. Automatically import hosts from each domain as they authenticate.
- D. Create user groups
正解：B
解説：
Realms are a way to delegate user accounts, user groups and permissions per domain when they are authenticating on a single FortiAuthenticator device. A realm is a logical grouping of users and groups based on a common attribute, such as a domain name or an IP address range. Realms allow administrators to apply different authentication policies and settings to different groups of users based on their realm membership.
質問 # 34
Which interface services must be enabled for the SCEP client to connect to Authenticator?
- A. OCSP
- B. SSH
- C. REST API
- D. HTTP/HTTPS
正解：D
解説：
HTTP/HTTPS are the interface services that must be enabled for the SCEP client to connect to FortiAuthenticator. SCEP stands for Simple Certificate Enrollment Protocol, which is a method of requesting and issuing digital certificates over HTTP or HTTPS. FortiAuthenticator supports SCEP as a certificate authority (CA) and can process SCEP requests from SCEP clients. To enable SCEP on FortiAuthenticator, the HTTP or HTTPS service must be enabled on the interface that receives the SCEP requests.
質問 # 35
At a minimum, which two configurations are required to enable guest portal services on FortiAuthenticator? (Choose two)
- A. Configuring a RADIUS client
- B. Configuring at least on post-login service
- C. Configuring a portal policy
- D. Configuring an external authentication portal
正解：B、C
解説：
To enable guest portal services on FortiAuthenticator, you need to configure a portal policy that defines the conditions for presenting the guest portal to users and the authentication methods to use. You also need to configure at least one post-login service that defines what actions to take after a user logs in successfully, such as sending an email confirmation, assigning a VLAN, or creating a user account. Configuring a RADIUS client or an external authentication portal are optional steps that depend on your network setup and requirements. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management
質問 # 36
Which network configuration is required when deploying FortiAuthenticator for portal services?
- A. Fortigate must be setup as default gateway for FortiAuthenticator
- B. One of the DNS servers must be a FortiGuard DNS server
- C. Policies must have specific ports open between FortiAuthenticator and the authentication clients
- D. FortiAuthenticator must have the REST API access enable on port1
正解：C
解説：
When deploying FortiAuthenticator for portal services, such as guest portal, sponsor portal, user portal or FortiToken activation portal, the network configuration must allow specific ports to be open between FortiAuthenticator and the authentication clients. These ports are:
TCP 80 for HTTP access
TCP 443 for HTTPS access
TCP 389 for LDAP access
TCP 636 for LDAPS access
UDP 1812 for RADIUS authentication
UDP 1813 for RADIUS accounting
質問 # 37
Which two statements about the EAP-TTLS authentication method are true? (Choose two)
- A. Uses mutual authentication
- B. Uses digital certificates only on the server side
- C. Requires an EAP server certificate
- D. Support a port access control (wired) solution only
正解：B、C
解説：
EAP-TTLS is an authentication method that uses digital certificates only on the server side to establish a secure tunnel between the server and the client. The client does not need a certificate but can use any inner authentication method supported by the server, such as PAP, CHAP, MS-CHAP, or EAP-MD5. EAP-TTLS requires an EAP server certificate that is issued by a trusted CA and installed on the FortiAuthenticator device acting as the EAP server. EAP-TTLS supports both wireless and wired solutions for port access control. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372412/eap-ttls
質問 # 38
An administrator wants to keep local CA cryptographic keys stored in a central location.
Which FortiAuthenticator feature would provide this functionality?
- A. REST API
- B. Network HSM
- C. SCEP support
- D. SFTP server
正解：B
解説：
Network HSM is a feature that allows FortiAuthenticator to keep local CA cryptographic keys stored in a central location. HSM stands for Hardware Security Module, which is a physical device that provides secure storage and generation of cryptographic keys. Network HSM allows FortiAuthenticator to use an external HSM device to store and manage the private keys of its local CAs, instead of storing them locally on the FortiAuthenticator device.
質問 # 39
Which two are supported captive or guest portal authentication methods? (Choose two)
- A. Apple ID
- B. Linkedln
- C. Instagram
- D. Email
正解：B、D
解説：
FortiAuthenticator supports various captive or guest portal authentication methods, including social media login with Linkedln, Facebook, Twitter, Google+, or WeChat; email verification; SMS verification; voucher code; username and password; and MAC address bypass. Apple ID and Instagram are not supported as authentication methods. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372404/guest-management/372405/authentication-methods
質問 # 40
You have implemented two-factor authentication to enhance security to sensitive enterprise systems.
How could you bypass the need for two-factor authentication for users accessing form specific secured networks?
- A. Enable the Resolve user geolocation from their IP address option in the authentication policy.
- B. Create an admin realm in the authentication policy
- C. Specify the appropriate RADIUS clients in the authentication policy
- D. Enable Adaptive Authentication in the portal policy
正解：D
解説：
Adaptive Authentication is a feature that allows administrators to bypass the need for two-factor authentication for users accessing from specific secured networks. Adaptive Authentication uses geolocation information from IP addresses to determine whether a user is accessing from a trusted network or not. If the user is accessing from a trusted network, FortiAuthenticator can skip the second factor of authentication and grant access based on the first factor only.
質問 # 41
Which two statement about the RADIUS service on FortiAuthenticator are true? (Choose two)
- A. Only local users can be authenticated through RADIUS
- B. RADIUS users can migrated to LDAP users
- C. Two-factor authentication cannot be enforced when using RADIUS authentication
- D. FortiAuthenticator answers only to RADIUS client that are registered with FortiAuthenticator
正解：B、D
解説：
Two statements about the RADIUS service on FortiAuthenticator are true:
RADIUS users can be migrated to LDAP users using the RADIUS learning mode feature. This feature allows FortiAuthenticator to learn user credentials from an existing RADIUS server and store them locally as LDAP users for future authentication requests.
FortiAuthenticator answers only to RADIUS clients that are registered with FortiAuthenticator. A RADIUS client is a device that sends RADIUS authentication or accounting requests to FortiAuthenticator. A RADIUS client must be added and configured on FortiAuthenticator before it can communicate with it.
質問 # 42
Which three of the following can be used as SSO sources? (Choose three)
- A. FortiAuthenticator in SAML SP role
- B. SSH Sessions
- C. FortiClient SSO Mobility Agent
- D. RADIUS accounting
- E. Fortigate
正解：C、D、E
解説：
FortiAuthenticator supports various SSO sources that can provide user identity information to other devices in the network, such as FortiGate firewalls or FortiAnalyzer log servers. Some of the supported SSO sources are:
FortiClient SSO Mobility Agent: A software agent that runs on Windows devices and sends user login information to FortiAuthenticator.
FortiGate: A firewall device that can send user login information from various sources, such as FSSO agents, captive portals, VPNs, or LDAP servers, to FortiAuthenticator.
RADIUS accounting: A protocol that can send user login information from RADIUS servers or clients, such as wireless access points or VPN concentrators, to FortiAuthenticator.
SSH sessions and FortiAuthenticator in SAML SP role are not valid SSO sources because they do not provide user identity information to other devices in the network. Reference: https://docs.fortinet.com/document/fortiauthenticator/6.4/administration-guide/372410/single-sign-on
質問 # 43
......
無料NSE6_FAC-6.4別格な問題集をダウンロード：https://www.passtest.jp/Fortinet/NSE6_FAC-6.4-shiken.html
NSE6_FAC-6.4合格保証がつく問題集で合格できるNSE6_FAC-6.4試験：https://drive.google.com/open?id=1NJSSxft4MzhSSIJBWM-5DBT7EEB3Ym9C