FCP-FGT-AD - Firewall policies and authentication (20% of the exam) - Section 2.4

Explain how to deploy and configure Fortinet Single Sign-On (FSSO) for identity-based policy enforcement.

Describe the Fortinet Single Sign-On architecture, distinguishing the DC agent and collector agent roles and how they pass Windows logon events to FortiGate for passive authentication. Apply FSSO to identity-based firewall policies so users are matched by group membership without re-authenticating.

FSSOFortinet Single Sign-OnDC agentcollector agentpassive authentication

Practice question for this objective

Free sampleFirewall policies and authenticationhard

A FortiGate receives FSSO logon information from a Windows collector agent, but no users appear as authenticated in identity-based firewall policies. The administrator confirms the collector agent shows active workstation logons. On the FortiGate the FSSO group filter and the polling connection are configured. What is the most likely reason the logons are not usable in policy?

AThe FortiGate is missing a local user account for each domain user, which FSSO requires before a logon can be matched to a policy.
BSSL inspection is disabled on the identity policy, so the FortiGate cannot read the user identity from the session.
CThe collector agent is using TCP 8000 instead of TCP 8002, so the FortiGate silently drops the logon records.
DThe user groups carrying the logons are not included in the FSSO group filter that controls which groups the collector agent forwards to this FortiGate. Correct

Recognise that the FSSO group filter governs which AD group logons the collector agent forwards to a FortiGate for policy matching. FSSO maps source IPs to users and their AD groups, but only groups permitted by the group filter are forwarded to a given FortiGate. If the user's group is absent from the filter, the FortiGate has no mapping to evaluate, so identity-based policies never match even though the collector agent sees the logon.

Why A is wrong: This is tempting because local users exist for other auth methods, but FSSO is passive and maps users by group membership reported from AD; it does not require per-user local accounts on the FortiGate.

Why B is wrong: SSL inspection decrypts traffic content and is unrelated to how FSSO associates a source IP with a logged-on user; identity comes from the collector agent mapping, not from inspecting the session.

Why C is wrong: TCP 8000 is the default collector-agent-to-FortiGate port and TCP 8002 is used between the DC agent and collector agent, so this reverses the roles; a wrong port would break the connection entirely, not deliver logons the agent can see while policy stays empty.

Why D is correct: The collector agent only forwards logon events for groups permitted by the group filter; if the relevant AD groups are excluded, the FortiGate never learns those mappings and cannot match them in policy.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in Firewall policies and authentication

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

Confirm that the FortiGate has an LDAP server object pointing at the domain controllers, because the collector agent cannot read logon events until the FortiGate completes its own LDAP bind.
Why it is wrong: Tempting because LDAP is used for group lookups, but the FortiGate LDAP bind is unrelated to whether DC agents deliver logon events to the collector; the collector logon monitor would still populate without any FortiGate LDAP object.
The DC agent maintains the active TCP connection to the FortiGate and pushes finished user-to-group mappings directly to the firewall on port 8000.
Why it is wrong: This is tempting because the FortiGate does receive mappings over a connection, but the DC agent never talks to the FortiGate; only the collector agent holds that connection.
Create an FSSO user group, add the LDAP server, and rely on the collector agent to push only the chosen security group's members into the FortiGate.
Why it is wrong: Tempting because FSSO can use group filtering, but an FSSO group depends on the collector agent and Active Directory polling, which is a different mechanism from binding the LDAP server directly to a firewall group.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.