StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Firewall authentication

Practice question 165 of 440 · hard

LDAPS TCP 636 connects successfully and LDAP server identity checking is enabled. FortiGate trusts the issuer, but the certificate identifies dc2.lab.local while the configured server name is dc1.lab.local. What remains wrong?

Choose the single best answer.

  1. A.The server certificate identity does not match the contacted name
  2. B.The LDAP username attribute must match the certificate hostname
  3. C.The service account password must equal the CA certificate name
  4. D.Successful TCP connection and issuer trust make the name check unnecessary
Show the answer and explanation

✓ Correct answer

  • The server certificate identity does not match the contacted name

With identity checking enabled, issuer trust and server-name matching are separate requirements. The user search attribute and bind password do not fix the certificate identity, and TCP reachability does not waive TLS validation.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.