A regional utility's NOC wants engineers to prove their identity before a firewall policy allows them onto the internet from the control-center LAN, rather than just letting any device on that subnet browse freely. What does adding firewall authentication to that policy actually change?
Select an answer to reveal the explanation.
Short Explanation
Think of firewall authentication like a badge reader on a door that used to just be unlocked for anyone on that hallway. Instead of trusting whichever laptop plugs into the control-center jack, the policy now asks who is sitting at it and matches rules to that identity or the group they belong to. That's what lets the NOC give one engineer broader access than a contractor on the same subnet.
Full Explanation
Firewall authentication binds a policy's match criteria to an identified user or user group rather than relying purely on source IP, interface, or subnet. Once enabled, the FortiGate prompts for credentials (or consumes an identity learned passively) and then evaluates which policy applies based on that user's group membership, letting the NOC separate engineers, contractors, and vendors on the same physical LAN into different access outcomes. The wrong options fail on mechanism: authentication does not change what a security profile inspects, does not itself add encryption to the session, and does not substitute for antivirus or web filtering — those are separate profile types applied independently of who the user is. Authentication only answers the question 'who is this traffic for,' which then feeds into policy selection; the actual inspection, NAT, and logging behavior of the matched policy still depends on its other settings. A caveat worth remembering: a policy with authentication enabled and no matching identified user simply denies the session rather than falling back to IP-based matching. To verify this on a live FortiGate, check the policy's source field for a user or group object instead of an address object, and confirm the session log shows the authenticated username rather than just an IP.