Question 1

Refer to the exhibits. The exhibits show the VAP configuration. Wi-Fi SSIDs. and zone table. Which two statements describe how FortiGate handles VLAN assignment for wireless clients? (Choose two.)

Options :

A : FortiGate will load balance clients using VLAN 101 and VLAN 102 and assign them an IP address from the 10.0.3.0 subnet.

B : All clients connecting to the Corp Zone will receive an IP address from the 10.0.20.0 subnet.

C : Clients connecting to APs in the Floor 1 group will not be able to receive an IP address.

D : Clients connecting to APs in the Office group will be assigned to VLAN 102.

Answer: C,D

Question 2

Refer to the exhibit.Review the exhibits to analyze the network topology, SSID settings, and firewall policies. FortiGate is configured to use an external captive portal for authentication to grant access to a wireless network. During testing, it was found that users attempting to connect to the SSID cannot access the captive portal login page. What configuration change should be made to resolve this issue to allow users to access the captive portal?

Options :

A : Change the SSID security mode to WPA2-Enterprise for authentication.

B : Disable HTTPS redirection for the captive portal authentication page.

C : Exclude FortiAuthenticator and Windows AD address objects from filtering.

D : A firewall policy allowing Guest SSID traffic to reach FortiAuthenticator and Windows AD.

Answer: D

Question 3

Refer to the exhibits.An LDAP server has been successfully configured on FortiGate. which forwards LDAP authentication requests to a Windows Active Directory (AD) server. Wireless users report that they are unable to authenticate. Upon troubleshooting, you find that authentication fails when using MSCHAPv2. What is the most likely reason for this issue?

Options :

A : A firewall policy is missing an LDAP authentication rule.

B : The Windows AD server requires LDAPS (LDAP over SSL) for authentication.

C : The FortiGate LDAP configuration is missing the correct Bind DN.

D : FortiGate does not support MSCHAPv2 for LDAP authentication.

Answer: D

Question 4

A conference center wireless network provides guest access through a captive portal, allowing unregistered users to self-register and connect to the network. The IT team has been tasked with updating the existing configuration to enforce captive portal authentication over a secure HTTPS connection. Which two steps should the administrator take to implement this change? (Choose two.)

Options :

A : Enable HTTP redirect in the user authentication settings.

B : Create a new SSID with the HTTPS captive portal URL.

C : Disable HTTP administrative access on the guest SSID to enforce HTTPS connection.

D : Update the captive portal URL to use HTTPS on FortiGate and FortiAuthenticator.

Answer: A,D