FCSS_LED_AR-7.6 questions and answers

The problem states:

FortiGate receives RADIUS accounting messages on port3 .

User-Nameattribute contains the username.

Classattribute contains the group membership.

Goal: authenticate users through RSSO and map them to the correct user groups.

To achieve this, three critical components must be configured:

#A. RADIUS Attribute Value in the RSSO group must match the Class attribute

This is mandatory because:

RSSO user groups on FortiGate match users based on the value inside the RADIUS attribute (usually Class).

For group assignment to work, FortiGate must compare:

RSSO User Group # RADIUS Class Attribute Value

This is exactly how FortiGate maps RSSO users to groups .

#D. RSSO agent's sso-attribute must be set to Class
The sso-attribute defines which RADIUS attribute contains the group information .

Because group membership is carried in:

#Class attribute

You must configure:

config user radius

set sso-attribute Class

end

This tells FortiGate:

"Use the Class attribute to derive user group membership."

#E. rsso-endpoint-attribute must be set to User-Name This identifies which RADIUS attribute carries the actual username .

In this scenario:

RADIUS accounting messages contain the username in User-Name .

So the correct setting is:

config user radius

set rsso-endpoint-attribute User-Name end

This ensures the RSSO user object uses the correct username.

#Incorrect Options Explained

B. Assign RSSO user groups to all firewall policies

Not required.

You only assign them to policies where RSSO authentication is used.

C. Device detection and Security Fabric Connection should be enabled on port3

Totally irrelevant to RSSO.

RSSO only needs RADIUS accounting, not device detection or Fabric services.

With AD machine authentication, FortiAuthenticator maintains continuity across short disruptions (sleep/ hibernation) by caching the endpoint identity (commonly MAC-based) for a configurable timeout. When the endpoint resumes activity, the cached entry can still be treated as authenticated until the cache expires,
avoiding immediate full reauth.
Why the other options are incorrect: A is not the standard mechanism for sleep/hibernation continuity.
B is unrelated to authentication state tracking.
C is unreliable because IPs can change and is not the primary method described for maintaining the authenticated state.

When FortiAuthenticator is used as an FSSO agent based on syslog , it must:

Parse incoming syslog messagesfrom devices (firewalls, WLAN controllers, VPN concentrators, etc.).

Extract identity fieldssuch as:

Username

IP address

Login/logout event indicators

Syslog matching rules on FortiAuthenticator define:

Which syslog messages are relevant (by facility, message pattern, or regex).

How to capture specific fields (username, IP, group, event type).

FortiAuthenticator then uses this parsed data to inject logon sessions into FSSO , so FortiGate can apply identity-based policies.

Thus, the role of syslog matching rules is exactly as described in C

A: Group mapping is handled separately via directory groups / FSSO config, not directly by matching rules.

B: Enforcement of authentication policies is done on FortiGate, not directly by the matching rules.

D: While irrelevant logs can be ignored via rules, the primary purpose is parsing and extraction , not generic filtering.

In this design, FortiAuthenticator receives RADIUS accounting (RSSO) messages , looks up the user in LDAP to get group information, then injects FSSO logon events toward all FortiGate devices.

From the exhibits we know:

FortiAuthenticator is receiving RADIUS accounting from the RADIUS server.

LDAP queries are successful and return group membership.

But FortiGate does not receive FSSO logons , so identity-based policies are not applied.

For FortiAuthenticator to create an FSSO logon, the RADIUS accounting record must be correctlyparsed into at least :

Username

Client IP address

These are mapped from the RADIUS attributes in the RADIUS Accounting SSO client configuration (for example, User-Name and Framed-IP-Address). If these are not defined or mapped incorrectly, FortiAuthenticator can see the accounting packet but cannot build a valid FSSO session , so no update is sent to FortiGate.

Thus the most likely root cause is:

# The RADIUS Username and Client IPv4 attributes are not correctly defined for that RADIUS Accounting
SSO client (optionA).

Other options conflict with the scenario:

B. LDAP is already successfully returning groups.

C. FSSO user group attribute is separate; even without it, FSSO logons would still be created (just without
group mapping).

D. The interface receiving RADIUS accounting, so it is clearly enabled. is

In this scenario:

FortiGate + FortiAnalyzer are part of theSecurity Fabric

An Automation Stitch is configured:

Trigger:Compromised Host ?High(IOC from FortiAnalyzer)

Action:Quarantine on FortiSwitch + FortiAP

A test device 10.0.2.1 visits a malicious website.

FortiAnalyzer logs show the event, but FortiGate does NOT quarantine the device .

This means the automation did not receive an IOC trigger , OR the Fabric did not classify it as a compromise .

Let's evaluate each answer option.

#C. The malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.

#Correct.

For FortiGate to quarantine a device:

FortiAnalyzer must classify the event as aCompromised Host # High / Medium / Critical

FortiAnalyzer must generate anIOC event

FortiGate must receive that IOC through the Fabric

Even though the FAZ log shows:

Action = blocked

Category = Malicious Websites

# That does NOT automatically mean an IOC was generated.

A blocked website event is not always an IOC unless:

It is included in theIOC database

FAZ's Analytics / UTM / IOC engine marks it as a compromise Thus, if FAZ only logs a "Malicious Website" event but does not classify it as an IOC ,

FortiAnalyzer requires a specific license to evaluate Indicators of Compromise (IOC).

From the FortiAnalyzer 7.4.1 Administration Guide :

IOC identification requires theThreat Detection Servicelicense on FortiAnalyzer.

This license enables:

IOC database updates

Compromised host detection

Event correlation based on FortiGuard threat intelligence

Fabric-wide IOC automation triggers

Why the other answers are incorrect:

A: IoT Security add-on is unrelated to IOC rules.

B: There is no IOC subscription license type for FortiAnalyzer.

C: FAZ-Basic license does NOT include IOC detection.

In FortiGate captive portal workflows (local or external), FortiGate inserts a hidden per-session token into the redirect. That token must be returned unchanged in the HTTPS POST request so FortiGate can associate the login submission with the correct intercepted session.
The required parameter is magic: It is generated per captive portal session.
It ties the POST submission back to the original user session (IP/interface/session context).
If the external portal does not preserve and resend it exactly, FortiGate rejects the login as invalid or
"session not found".
Why the other options are incorrect:
A. username -- user input field; not a session integrity token.

B. redir -- used for post-login redirection; not used to validate the session.
D. email -- optional field in some guest flows; not used for session validation.

When FortiAPs connect to FortiGate over IPsec tunnels , this is treated similarly to WAN/MPLS deployments.

In these scenarios, FortiGate must know that CAPWAP must traverse a non-L2 transport.

FortiAP profiles include:

set mpls-connection enable

This setting is required so that:

FortiGate can encapsulate CAPWAP inside the transport tunnel

Remote FortiAPs can establish CAPWAP even when behind routed/IPsec networks

Without this option, the FortiGate detects the AP but cannot bring CAPWAP UP , leaving the AP in "discovered/unauthorized" or "offline" state.

Why others are wrong

A. Static route# Discovery already succeeds, so routing is not the issue.

C. Reduce MTU# Sometimes useful for IPsec, but not required for CAPWAP establishment.

D. Firmware upgrade# Firmware mismatch would show "Managed (upgrade required)," not CAPWAP
tunnel failure.

Therefore, set mpls-connection enable is the required fix.