When creating a remote administrator account on FortiAnalyzer that authenticates against an external server like LDAP or RADIUS, you have the option to set a local password. This local password serves as a fallback authentication mechanism. If the external authentication server becomes unavailable or unreachable for any reason, the administrator can still log in to the FortiAnalyzer using the username and this locally configured password, ensuring continued administrative access to the device.

B. This password authenticates FortiAnalyzer against the LDAP server. Incorrect. The credentials for FortiAnalyzer to bind to the LDAP server for queries are configured within the LDAP server profile settings, not in individual administrator accounts.

C. This password is set to comply with FortiAnalyzer password policy. Incorrect. While the password must adhere to the policy if set, the reason for its existence is for fallback access, not merely to satisfy a policy requirement.

D. This password is required because this is a restricted user. Incorrect. The fallback password option is available for all remote administrator accounts, regardless of their assigned access profile (restricted or superadmin).

1. FortiAnalyzer Administration Guide 7.4

Page 113

Section: "Creating administrators".

The guide states: "For remote users

you can optionally set a password. The password provides backup authentication in case the remote authentication server is unavailable. If you do not set a password

and the remote authentication server is unavailable

the user cannot log in." This directly supports the correct answer (A).

2. FortiAnalyzer Administration Guide 7.4

Page 120

Section: "LDAP".

This section details the configuration of the LDAP server connection itself

including the Username and Password for the bind type

which authenticates FortiAnalyzer to the LDAP server. This shows that option B is incorrect as those credentials are set elsewhere.