A guest network is served by a single firewall policy from the guest interface to the internet, and the administrator wants unauthenticated guests to be redirected to a captive portal that prompts for credentials the moment they open their browser, before any traffic is allowed out. Which three conditions must be in place for the FortiGate to deliver an active-authentication captive portal prompt on this policy? Select THREE.
- AThe firewall policy action is set to accept and a user group is assigned to the policy, so the FortiGate knows which sessions require an authenticated identity. Correct
- BThe matching traffic uses a protocol the FortiGate can intercept and redirect for the prompt, such as HTTP or HTTPS that the captive portal can hijack. Correct
- CCaptive portal is enabled as the authentication method, either on the source interface or on the policy, so unauthenticated sessions are redirected to the portal page. Correct
- DFSSO must be deployed against an Active Directory domain so the FortiGate can learn each guest identity passively from domain logon events.
- EThe policy action must be set to deny so that unauthenticated guest traffic is blocked first and only then offered the portal page.
Why A is correct: Correct: active authentication is driven by an accept policy that carries a user or group, which is what tells the FortiGate to challenge matching sessions rather than pass them anonymously.
Why B is correct: Correct: active authentication relies on intercepting a browser-based protocol to present the portal, so the first traffic the FortiGate can challenge must be HTTP or HTTPS.
Why C is correct: Correct: the portal must be explicitly enabled for that traffic, on the interface or the policy, or the FortiGate has nowhere to redirect unauthenticated guests and simply drops them.
Why D is wrong: This confuses passive single sign-on with active authentication; FSSO learns identities silently from AD logons and is the opposite of prompting guests, who have no domain account at all.
Why E is wrong: A deny policy blocks traffic outright and cannot host authentication; active authentication requires an accept policy, so setting deny would simply drop the guests with no portal shown.