Refer to the exhibit, which shows a partial configuration from the remote authentication server. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/FCP_FGT_AD-7.6/page_7_img_1.jpg Why does the FortiGate administrator need this configuration?

To authenticate only the Training user group.

Q: 10

Refer to the exhibit, which shows a partial configuration from the remote authentication server. Why does the FortiGate administrator need this configuration?

Options

Discussion

NoahT Oct 25, 2026 4:03 am

Fortinet and their weird group mapping again, probably D since filter-id restricts to the "Training" group only.

Taylor R. Oct 27, 2026 10:40 pm

Probably D for sure, filter-id always means group match not OU.

Ava W. Oct 22, 2026 6:20 pm

Config is matching users based on filter-id, so I’m sticking with D. It’s only authenticating the Training user group, not all users or an OU. Pretty clear from how FortiGate does group matching via RADIUS. Anyone see a reason to pick C here?

Ryan W. Oct 17, 2026 8:11 pm

My pick: C, saw similar phrasing in the official guide and practice exams.

Piya Nov 2, 2026 6:23 pm

So if the config was using an OU and not the group name in that RADIUS attribute filter, would C actually be correct here?

Jason Oct 26, 2026 12:33 am

Why does Fortinet write so many questions that try to trip us up with OU vs group? D tbh

Ryan N. Oct 17, 2026 12:28 am

C/D? I think D is right since filter-id is group not OU, C looks like the distractor here.

Cameron Oct 20, 2026 10:14 am

Not sure C works, looks like trap answer. The config is matching by filter-id, so only the Training user group gets authenticated. If it was matching on OU, then maybe C, but with filter-id set it's D. Someone could easily misread that part though.

AaronJ Oct 31, 2026 1:07 pm

D Only the Training user group is authenticated in this config, filter-id ties it to that group specifically.

Emma S. Oct 26, 2026 3:07 pm

I don't think it's C here. D fits since the filter-id attribute ties the group directly, not the OU. Some might pick C by mistake if they're thinking about OU matching, but that's not how this config works.

Be respectful. No spam.

Correct Answer:

Explanation

This configuration creates a FortiGate user group named Training. It links this group to a RADIUS server named FAC-RADIUS. The config match stanza is the key component; it instructs the FortiGate to place a user into the Training group only if two conditions are met upon authentication:
1. The user authenticates against the FAC-RADIUS server.
2. The RADIUS server returns an attribute (specified by group-override-attr-type, which is filter-id in this case) with a value that exactly matches the group-name, which is "Training". Therefore, the entire configuration's purpose is to authenticate users who belong to the "Training" group as defined on the RADIUS server.

Why Incorrect

A. To set up a RADIUS server Secret. Setting the secret is only one part of the RADIUS server definition, not the overall purpose of the entire configuration, which includes specific group matching logic.
B. To authenticate Any FortiGate user groups. This is incorrect. The config match section with set group-name "Training" makes the configuration highly specific to matching only the "Training" group, not any group.
C. To authenticate and match the Training OU on the RADIUS server. This is incorrect. The configuration matches on a RADIUS attribute (filter-id), not an Organizational Unit (OU), which is an object type specific to LDAP/Active Directory.

References

1. FortiOS 7.6.0 Administration Guide, User & Device > User > User Groups > RADIUS user groups. The guide explains: "You can configure a user group for RADIUS users that allows you to match users to the group based on attributes returned by the RADIUS server in its Access-Accept response... When a user authenticates, FortiOS checks the attributes in the RADIUS Access-Accept packet. If the attributes match the user group configuration, the user is considered a member of the group." This directly supports the explanation for answer D.

2. FortiOS 7.6.0 CLI Reference, config user group. The documentation for the config match stanza under config user group specifies the parameters set server-name and set group-name. It states group-name is the "Group name to match." This confirms that the configuration is designed to match a specific group name returned from the RADIUS server, making options B and C incorrect.

3. FortiOS 7.6.0 CLI Reference, config user radius. The documentation for set group-override-attr-type specifies that this setting determines which "RADIUS attribute type to override user group membership." The default is filter-id. This confirms that the mechanism for matching is based on a standard RADIUS attribute, not an LDAP-specific structure like an OU.

Fortinet FCP_FGT_AD-7.6 Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes