An administrator must add an authentication server on FortiClient EMS in a different security zone that cannot allow a direct connection. Which…

When FortiClient EMS and an Active Directory (AD) server are in different security zones with restricted direct access, a security device is required to mediate the connection. Deploying a FortiGate between the zones allows an administrator to create specific firewall policies. These policies can securely permit only the necessary traffic, such as LDAPS (TCP/636), from the EMS server to the AD server, while blocking all other unauthorized traffic. This enforces the principle of least privilege and provides a secure, controlled communication path.

B. Configure Active Directory and install FortiClient EMS on the same VM. This bypasses the security zone requirement rather than providing a secure access solution between them.

C. Configure a slave FortiClient EMS on a virtual machine. A slave EMS is for high availability and load balancing, not for securely bridging different network security zones.

D. Configure an Active Directory connector between FortiClient EMS and the Active Directory server. The AD connector is a software component within EMS; it requires network connectivity but does not provide the secure network access itself.

FortiGate / FortiOS 7.4.0 Administration Guide, "Firewall policies," page 681. This section describes how FortiGate uses firewall policies to control traffic between network interfaces, zones, and segments, which is the core of the solution.

FortiClient EMS 7.2.2 Administration Guide, "Adding a directory," page 60. This section notes the requirement for network connectivity to the domain controller, implying that standard network security measures must be in place if they are in different zones.