A utility's security team is documenting authentication methods for their FortiGate deployment and needs to distinguish active from passive authentication. Which statement correctly describes that distinction?
Select an answer to reveal the explanation.
Short Explanation
Active authentication is the login prompt you actually see and respond to, like typing a username and password into a portal. Passive authentication is the opposite: it works quietly in the background, figuring out who you are from something that already happened, like a domain logon somewhere else. Neither one cares what time of day it is or whether you're wired or wireless.
Full Explanation
Active authentication describes any method where the FortiGate directly challenges the user for credentials at the moment of access — a firewall authentication prompt or a captive portal login are examples — while passive authentication derives the user's identity from an event that already occurred elsewhere, most commonly a domain logon observed via FSSO, without ever interrupting the user with a prompt. This distinction is about how identity is obtained, not about connection medium, VPN type, or time of day, so options tying it to wired-versus-wireless, IPsec-versus-SSL VPN, or business hours all invent constraints that do not exist in FortiOS. Passive authentication trades a small amount of certainty (it trusts that the observed logon event genuinely belongs to the device now generating traffic) for a much better user experience, since domain-joined users never see a prompt. Active authentication is more certain because the credential is supplied at that exact moment, but it interrupts the user's workflow every time a session needs re-verification. A practical caveat: passive methods generally require the user to already be authenticated to some other trusted system (like a domain controller), so they cannot bootstrap identity for a user who has never logged into anything trusted. Confirm which mode a policy uses by checking whether it references an FSSO-derived identity source or a direct authentication scheme.