According to the FortiClient EMS 7.4 Administration Guide, for an organization to integrate with an identity management infrastructure while enforcing administrative access with Multi-Factor Authentication (MFA), the primary supported methods for remote administrator authentication are RADIUS and SAML.

1. RADIUS (Answer B)

Identity Integration: FortiClient EMS allows administrators to add RADIUS servers as an authentication source under the Administration > Authentication Servers section.

MFA Support: RADIUS is a standard protocol for enforcing MFA. In this scenario, FortiClient EMS acts as a RADIUS client to an external MFA provider (such as FortiAuthenticator, RSA Authentication Manager, or Duo).

Workflow: When an administrator attempts to log in to the EMS console, EMS sends an Access-Request to the RADIUS server. If the provider requires MFA, it can challenge the user (via push notification or token code) before sending an Access-Accept back to EMS.

2. SAML (Answer D)

Modern Identity Management: SAML (Security Assertion Markup Language) is the preferred method for integrating with modern cloud and on-premises Identity Providers (IdPs) like Microsoft Entra ID (formerly Azure AD), Okta, AD FS, or FortiAuthenticator.

Native MFA Enforcement: By using SAML SSO, the authentication and MFA process are handled entirely by the IdP. The EMS server acts as the Service Provider (SP). When an admin logs in, they are redirected to the IdP, where the company's existing MFA policies (Conditional Access, etc.) are enforced before the user is granted access back to the EMS console.

EMS Configuration: The curriculum details specific SAML SSO configurations for various IdPs under the SAML SSO section of the Administration Guide.

3. Why Other Options are Incorrect/Insufficient

A . LDAPS: While FortiClient EMS supports importing users from Active Directory (ADDS) via LDAP/LDAPS for endpoint management and basic admin login, standard LDAPS does not natively support or enforce an MFA challenge-response workflow in the same integrated way that RADIUS or SAML does for administrative console access.

C . TACACS: TACACS+ is primarily used for device administration on networking equipment (like FortiGate) and is not a listed or standard method for administrative authentication within the FortiClient EMS software documentation.