Refer to the exhibit, which shows a partial configuration from the remote authentication server. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/FCP_FGT_AD-7.6/page_7_img_1.jpg Why does the FortiGate administrator need this configuration?

To authenticate only the Training user group.

Q: 10

Refer to the exhibit, which shows a partial configuration from the remote authentication server. Why does the FortiGate administrator need this configuration?

Options

Discussion

NoahT Sep 5, 2026 2:02 pm

Fortinet and their weird group mapping again, probably D since filter-id restricts to the "Training" group only.

Taylor R. Sep 8, 2026 8:39 am

Probably D for sure, filter-id always means group match not OU.

Ava W. Sep 3, 2026 4:19 am

Config is matching users based on filter-id, so I’m sticking with D. It’s only authenticating the Training user group, not all users or an OU. Pretty clear from how FortiGate does group matching via RADIUS. Anyone see a reason to pick C here?

Ryan W. Aug 29, 2026 6:10 am

My pick: C, saw similar phrasing in the official guide and practice exams.

Piya Sep 14, 2026 4:23 am

So if the config was using an OU and not the group name in that RADIUS attribute filter, would C actually be correct here?

Jason Sep 6, 2026 10:33 am

Why does Fortinet write so many questions that try to trip us up with OU vs group? D tbh

Ryan N. Aug 28, 2026 10:27 am

C/D? I think D is right since filter-id is group not OU, C looks like the distractor here.

Cameron Aug 31, 2026 8:13 pm

Not sure C works, looks like trap answer. The config is matching by filter-id, so only the Training user group gets authenticated. If it was matching on OU, then maybe C, but with filter-id set it's D. Someone could easily misread that part though.

AaronJ Sep 11, 2026 11:06 pm

D Only the Training user group is authenticated in this config, filter-id ties it to that group specifically.

Emma S. Sep 7, 2026 1:07 am

I don't think it's C here. D fits since the filter-id attribute ties the group directly, not the OU. Some might pick C by mistake if they're thinking about OU matching, but that's not how this config works.

Be respectful. No spam.

Correct Answer:

Explanation

This configuration creates a FortiGate user group named Training. It links this group to a RADIUS server named FAC-RADIUS. The config match stanza is the key component; it instructs the FortiGate to place a user into the Training group only if two conditions are met upon authentication:

1. The user authenticates against the FAC-RADIUS server.

2. The RADIUS server returns an attribute (specified by group-override-attr-type, which is filter-id in this case) with a value that exactly matches the group-name, which is "Training".

Therefore, the entire configuration's purpose is to authenticate users who belong to the "Training" group as defined on the RADIUS server.

Why Incorrect

A. To set up a RADIUS server Secret.

Setting the secret is only one part of the RADIUS server definition, not the overall purpose of the entire configuration, which includes specific group matching logic.

B. To authenticate Any FortiGate user groups.

This is incorrect. The config match section with set group-name "Training" makes the configuration highly specific to matching only the "Training" group, not any group.

C. To authenticate and match the Training OU on the RADIUS server.

This is incorrect. The configuration matches on a RADIUS attribute (filter-id), not an Organizational Unit (OU), which is an object type specific to LDAP/Active Directory.

References

1. FortiOS 7.6.0 Administration Guide

User & Device > User > User Groups > RADIUS user groups. The guide explains: "You can configure a user group for RADIUS users that allows you to match users to the group based on attributes returned by the RADIUS server in its Access-Accept response... When a user authenticates

FortiOS checks the attributes in the RADIUS Access-Accept packet. If the attributes match the user group configuration

the user is considered a member of the group." This directly supports the explanation for answer D.

2. FortiOS 7.6.0 CLI Reference

config user group. The documentation for the config match stanza under config user group specifies the parameters set server-name and set group-name. It states group-name is the "Group name to match." This confirms that the configuration is designed to match a specific group name returned from the RADIUS server

making options B and C incorrect.

3. FortiOS 7.6.0 CLI Reference

config user radius. The documentation for set group-override-attr-type specifies that this setting determines which "RADIUS attribute type to override user group membership." The default is filter-id. This confirms that the mechanism for matching is based on a standard RADIUS attribute

not an LDAP-specific structure like an OU.

Refer to the exhibit, which shows a partial configuration from the remote authentication server. Why does the FortiGate administrator need this configuration?

Premium Access Includes