The exhibit shows the configuration for a FortiGate user group named "EMSZTNAALL". The critical line set member "EMS1ZTNA" indicates that the members of this group are defined by an external connector named "EMS1ZTNA". In FortiOS, this syntax is used to reference a FortiClient EMS Connector. Therefore, the FortiGate is configured to dynamically pull endpoint information, such as ZTNA tags which function as groups, from a FortiClient EMS server.

B. FortiGate is configured with local user group: A local user group would list locally defined usernames as members, not a connector object.

C. FortiGate is configured to pull user groups from FortiAuthenticator: The member syntax for a FortiAuthenticator group would reference a FortiAuthenticator server object.

D. FortiGate is configured to pull user groups from AD Server: The member syntax for an AD group would reference an LDAP server object and a group distinguished name (DN).

1. FortiGate CLI Reference 7.4, "config user group," Volume 2, page 1038. The documentation shows that the member attribute can accept the name of a fabric connector, including FortiClient EMS.

2. FortiClient EMS Administration Guide 7.4, "Configuring ZTNA tags and firewall policies," page 235. This section details creating a FortiClient EMS connector on FortiGate and using it as a member in a user group for policy enforcement.

3. ZTNA Deployment Guide 7.4, "Configuring ZTNA tags on FortiGate," page 28. The guide provides an example of creating a user group on FortiGate with the FortiClient EMS connector as a member.