Refer to the exhibit, which shows a partial configuration from the remote authentication server. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/FCP_FGT_AD-7.6/page_7_img_1.jpg Why does the FortiGate administrator need this configuration?

To authenticate only the Training user group.

D for sure. The config specifically ties authentication to just the Training group, not any group or OU. Saw this come up in some Fortinet guides too. Official docs and practice tests cover this scenario pretty well if you want details.

Probably D, I saw a similar config in a practice test. This setup restricts authentication to only the Training user group.

Question 10 - Fortinet FCP_FGT_AD-7.6 Real Exam Questions [Jan 2026 Update]

Q: 10

Refer to the exhibit, which shows a partial configuration from the remote authentication server.

Why does the FortiGate administrator need this configuration?

Options

Correct Answer:

Explanation

This configuration creates a FortiGate user group named Training. It links this group to a RADIUS server named FAC-RADIUS. The config match stanza is the key component; it instructs the FortiGate to place a user into the Training group only if two conditions are met upon authentication:

1. The user authenticates against the FAC-RADIUS server.

2. The RADIUS server returns an attribute (specified by group-override-attr-type, which is filter-id in this case) with a value that exactly matches the group-name, which is "Training".

Therefore, the entire configuration's purpose is to authenticate users who belong to the "Training" group as defined on the RADIUS server.

Why Incorrect

A. To set up a RADIUS server Secret.

Setting the secret is only one part of the RADIUS server definition, not the overall purpose of the entire configuration, which includes specific group matching logic.

B. To authenticate Any FortiGate user groups.

This is incorrect. The config match section with set group-name "Training" makes the configuration highly specific to matching only the "Training" group, not any group.

C. To authenticate and match the Training OU on the RADIUS server.

This is incorrect. The configuration matches on a RADIUS attribute (filter-id), not an Organizational Unit (OU), which is an object type specific to LDAP/Active Directory.

References

1. FortiOS 7.6.0 Administration Guide

User & Device > User > User Groups > RADIUS user groups. The guide explains: "You can configure a user group for RADIUS users that allows you to match users to the group based on attributes returned by the RADIUS server in its Access-Accept response... When a user authenticates

FortiOS checks the attributes in the RADIUS Access-Accept packet. If the attributes match the user group configuration

the user is considered a member of the group." This directly supports the explanation for answer D.

2. FortiOS 7.6.0 CLI Reference

config user group. The documentation for the config match stanza under config user group specifies the parameters set server-name and set group-name. It states group-name is the "Group name to match." This confirms that the configuration is designed to match a specific group name returned from the RADIUS server

making options B and C incorrect.

3. FortiOS 7.6.0 CLI Reference

config user radius. The documentation for set group-override-attr-type specifies that this setting determines which "RADIUS attribute type to override user group membership." The default is filter-id. This confirms that the mechanism for matching is based on a standard RADIUS attribute

not an LDAP-specific structure like an OU.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE