Which firewall authentication methods does FortiGate support? (Choose three.)

FortiGate provides a comprehensive suite of user authentication methods. It supports local password authentication, where user accounts and credentials are stored directly on the FortiGate device itself. For integration with enterprise identity systems, it supports server-based password authentication, connecting to external servers such as RADIUS, LDAP, and TACACS+. To enhance security, FortiGate also natively supports two-factor authentication (2FA), which adds a second layer of verification, commonly implemented using FortiToken (hardware, mobile app, or cloud) in conjunction with a user's primary password. These three methods are fundamental to controlling access through the firewall.

B. Out-of-band authentication is a characteristic of certain 2FA methods (e.g., push notifications), not a distinct authentication method category in FortiOS.

D. FortiGate does not directly process biometric data. It relies on an external authentication server that might use biometrics as a primary or secondary factor.

1. Fortinet. (2022). FortiOS Administration Guide 7.2.0. Document ID: 221011.

Local password authentication (A): Covered under "User & Authentication > Users > Local users" (p. 490).

Server-based password authentication (E): Detailed in "User & Authentication > Authentication Servers" for LDAP (p. 494)

RADIUS (p. 498)

and TACACS+ (p. 502).

Two-factor authentication (C): Explained in the "User & Authentication > Two-factor authentication" section (p. 511)

which describes FortiToken integration.

2. Fortinet. (2023). Fortinet Certified Professional - Security Operations Study Guide for FortiOS 7.2.

Chapter 10

"User Authentication

" explicitly details the three main authentication types: "Local authentication

" "Server-based authentication" (using RADIUS and LDAP as examples)

and "Two-factor authentication." This structure directly validates options A

E

and C as the correct choices.