According to theFortiClient EMS 7.4 Administration Guide, for an organization to integrate with an identity management infrastructure while enforcing administrative access with Multi-Factor Authentication (MFA), the primary supported methods for remote administrator authentication areRADIUSandSAML.
1. RADIUS (Answer B)
Identity Integration:FortiClient EMS allows administrators to addRADIUS serversas an authentication source under theAdministration > Authentication Serverssection.
MFA Support:RADIUS is a standard protocol for enforcing MFA. In this scenario, FortiClient EMS acts as a RADIUS client to an external MFA provider (such as FortiAuthenticator, RSA Authentication Manager, or Duo).
Workflow:When an administrator attempts to log in to the EMS console, EMS sends an Access-Request to the RADIUS server. If the provider requires MFA, it can challenge the user (via push notification or token code) before sending an Access-Accept back to EMS.
2. SAML (Answer D)
Modern Identity Management:SAML (Security Assertion Markup Language) is the preferred method for integrating with modern cloud and on-premises Identity Providers (IdPs) likeMicrosoft Entra ID (formerly Azure AD),Okta,AD FS, orFortiAuthenticator.
Native MFA Enforcement:By using SAML SSO, the authentication and MFA process are handled entirely by the IdP. The EMS server acts as the Service Provider (SP). When an admin logs in, they are redirected to the IdP, where the company's existing MFA policies (Conditional Access, etc.) are enforced before the user is granted access back to the EMS console.
EMS Configuration:The curriculum details specific SAML SSO configurations for various IdPs under theSAML SSOsection of the Administration Guide.
3. Why Other Options are Incorrect/Insufficient
A. LDAPS:While FortiClient EMS supports importing users fromActive Directory (ADDS)via LDAP/LDAPS for endpoint management and basic admin login, standard LDAPS does not natively support or enforce an MFA challenge-response workflow in the same integrated way that RADIUS or SAML does for administrative console access.
C. TACACS:TACACS+ is primarily used for device administration on networking equipment (like FortiGate) and is not a listed or standard method for administrative authentication within the FortiClient EMS software documentation.
Submit