About the Exam

This exam evaluates knowledge of Fortinet identity management and LAN edge products for wired and wireless networks. It tests the ability to deploy, administer, and operate secure access implementations using products such as FortiOS, FortiSwitch, FortiAP, FortiAuthenticator, FortiManager, FortiAnalyzer, and FortiAIOps. It is intended for network and security professionals responsible for the design, administration, and support of Fortinet identity management and LAN edge devices. Fortinet's release notices list the exam's last delivery date as July 15, 2026.

Exam Topics

Authentication0%
Central management0%
Zero-trust LAN access0%

How to Use This Practice Exam

Browse — Read each question, select your answer, and reveal the explanation.
Exam Mode — Simulate real exam conditions with a timed session and score report.
Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF

Learn More

Last updated May 12, 2026 at 4:12 PM

Topic filter

Question status

Question sort

Questions per page

QuestionQ1

Authentication

Refer to the exhibit.

Question Image

The exhibit displays an LDAP server configuration in which the full content of the Username setting is expanded. The administrator configured LDAP on FortiGate and is troubleshooting authentication problems. As part of troubleshooting, the administrator runs dsquery user -samid student on the Windows Active Directory (AD) server at IP address 10.0.1.10 and receives this output: CN=student,CN=Users,DC=trainingAD,DC=training,DC=lab.

Based on the dsquery output, which FortiGate LDAP setting is misconfigured?

Explanation

The Distinguished Name is the LDAP search base for locating directory objects. It must include the account’s actual directory path. The configured value omits DC=trainingAD; the correct base is CN=Users,DC=trainingAD,DC=training,DC=lab. This mismatch prevents a proper user lookup even though the LDAP server connection succeeds.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Authentication

See the exhibit.

Question Image

Port2 on the FortiSwitch is configured with an 802.1X authentication security policy, but a device connected to port2 cannot access the network. The administrator collected the displayed diagnose output to investigate the problem.

Which two scenarios could explain why the device is unable to obtain network access?

Choose two

Explanation

An 802.1X-controlled port grants normal network access only after the connected supplicant completes EAP authentication. With zero EAP exchanges recorded and MAC Authentication Bypass disabled, a device that either lacks an enabled 802.1X configuration or does not support 802.1X cannot authenticate and remains unauthorized. The reAuth=3600 setting is a reauthentication timer, and no guest VLAN is configured or assigned.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Central management

How can FortiAIOps assist in optimizing network performance in an SD-Branch deployment with FortiGate, FortiSwitch, and FortiAP?

Explanation

FortiAIOps uses AI/ML analytics and correlated telemetry from FortiGates, FortiSwitches, and FortiAPs to detect anomalies, identify likely network issues, and provide insights and recommended remedial actions that help optimize performance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Central management

You must deploy FortiAPs at remote sites and want to prevent high latency by reducing interference from the FortiGate.

Which SSID traffic mode is most appropriate for this deployment?

Explanation

Bridge mode forwards WLAN traffic locally through the FortiAP’s Ethernet/LAN connection instead of tunneling it to the FortiGate. This is commonly used for remote AP deployments when traffic should not traverse the FortiGate, reducing WAN-related latency. Fortinet WLAN configurations

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Authentication

Refer to the following exhibits.

Question Image

You are configuring FortiAuthenticator to authenticate wireless users through Active Directory via LDAP. The users send authentication requests to FortiAuthenticator through RADIUS, and FortiAuthenticator acts as the back-end authentication server.

On FortiGate, a RADIUS server that points to FortiAuthenticator is configured. Although FortiGate successfully connects to the RADIUS server, wireless-user authentication fails.

After reviewing the configurations on both FortiGate and FortiAuthenticator, you determine that the RADIUS Service Policy appears misconfigured.

Which configuration step might be missing?

Explanation

PEAP/EAP-MSCHAPv2 wireless authentication requires Windows AD domain authentication in the RADIUS policy’s Identity Sources. This makes FortiAuthenticator authenticate through NTLM after joining the AD domain, rather than using the default LDAP authentication process.

Learn more

FortiAuthenticator Administration Guide — Policies

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ6

Authentication

A network administrator is configuring a RADIUS server on FortiGate for remote-user authentication. The administrator configures FortiGate to forward authentication requests to FortiAuthenticator, which then proxies them to a Windows Active Directory (AD) server through LDAP.

What is the primary benefit of using FortiAuthenticator in this configuration?

Explanation

FortiAuthenticator bridges the protocol mismatch between RADIUS challenge-response authentication and LDAP-based Active Directory authentication. This addresses the CHAP-to-LDAP dilemma and enables MSCHAPv2 authentication.