A field contractor working on billing-system integration was mistakenly added to the utility's 'Substation-Vendors' group instead of the 'Back-Office-Contractors' group. What is the most direct consequence for that contractor's firewall-authenticated sessions?
Select an answer to reveal the explanation.
Short Explanation
Group membership is what steers a person's traffic to a particular policy, so putting someone in the wrong group is like handing them the wrong keycard — it opens doors they shouldn't have and locks the ones they need. The contractor doesn't get denied outright; they just end up with substation access instead of back-office access. That mismatch can sit unnoticed until someone audits who can reach what.
Full Explanation
Because firewall policies match on user-group membership, an incorrectly assigned group does not typically cause an outright authentication failure — the user still authenticates successfully and the FortiGate still finds a matching policy, just the wrong one, granting substation-network access to someone who should only reach back-office billing systems. This is a meaningfully different (and more dangerous) failure mode than a total access denial, because nothing in the session immediately signals that something is wrong; the connection succeeds, just to the wrong segment. The idea that FortiOS treats all groups as equivalent is incorrect — group identity is precisely the mechanism policies use to differentiate access levels, and that differentiation is the entire point of using groups instead of one flat policy. FortiOS also has no automatic group-correction feature; group membership is administratively assigned and stays exactly as configured until a person changes it. Blocking authentication entirely would only happen if the account itself were disabled or locked, not from a group mismatch. The operational caveat here is that group assignment errors are a real-world access-control risk precisely because they fail open into an unintended but still valid policy rather than failing closed. Regularly auditing group membership against job role is the concrete check that catches this.