FCP_FCT_AD-7.4 Practice Questions

The exhibit shows the configuration for a FortiGate user group named "EMSZTNAALL". The critical line set member "EMS1ZTNA" indicates that the members of this group are defined by an external connector named "EMS1ZTNA". In FortiOS, this syntax is used to reference a FortiClient EMS Connector. Therefore, the FortiGate is configured to dynamically pull endpoint information, such as ZTNA tags which function as groups, from a FortiClient EMS server.

B. FortiGate is configured with local user group: A local user group would list locally defined usernames as members, not a connector object.

C. FortiGate is configured to pull user groups from FortiAuthenticator: The member syntax for a FortiAuthenticator group would reference a FortiAuthenticator server object.

D. FortiGate is configured to pull user groups from AD Server: The member syntax for an AD group would reference an LDAP server object and a group distinguished name (DN).

1. FortiGate CLI Reference 7.4, "config user group," Volume 2, page 1038. The documentation shows that the member attribute can accept the name of a fabric connector, including FortiClient EMS.

2. FortiClient EMS Administration Guide 7.4, "Configuring ZTNA tags and firewall policies," page 235. This section details creating a FortiClient EMS connector on FortiGate and using it as a member in a user group for policy enforcement.

3. ZTNA Deployment Guide 7.4, "Configuring ZTNA tags on FortiGate," page 28. The guide provides an example of creating a user group on FortiGate with the FortiClient EMS connector as a member.

The Web Filter profile shown includes a domain entry for “www.facebook.com” with the action Block. According to FortiClient Web Filter behaviour, a Block action prevents access to the exact domain and to every sub-domain beneath it. When users attempt to browse to www.facebook.com (or, for example, m.facebook.com), FortiClient intercepts the HTTP/HTTPS request and returns the block page, so no connection is permitted.

A. Action is Block, not Allow.

C. “Monitor” requires the Monitor action, which is not configured.

D. A warning (Warn) page is only shown when the Warn action is selected; Block denies immediately.

1. FortiClient EMS 7.0 Administration Guide, “Configuring Web Filter profiles – Domain filter actions”, p.139: “Block – FortiClient blocks the specified domain and all its subdomains.”

2. FortiClient 7.0 Endpoint Security Guide, Section 4.3 “Domain filtering behaviour”.

When configuring the FortiClient EMS Fabric Connector on FortiGate, a secure TLS connection is established. FortiGate must validate the identity of the FortiClient EMS server. This is achieved by FortiGate trusting the Certificate Authority (CA) that issued the EMS server's certificate. Therefore, the administrator must export the CA certificate from EMS (often the EMS built-in CA) and import it into FortiGate as a trusted CA certificate to ensure the connection is successfully verified and established.

B. Revoke and update the FortiClient client certificate on EMS. This action relates to individual endpoint clients, not the connection between the FortiGate and the EMS server itself.

C. Import and verify the FortiClient client certificate on FortiGate. FortiGate needs to trust the EMS server, not an individual FortiClient endpoint, for this specific fabric connector configuration.

D. Revoke and update the FortiClient EMS root CA. Revoking the root CA would invalidate the trust chain, preventing a successful connection rather than enabling it.

FortiClient EMS 7.2.2 Administration Guide, "FortiGate Telemetry," page 185. The guide states, "On the FortiGate, you must import the EMS server's certificate authority (CA) certificate so that the FortiGate can verify the EMS server's identity."

Fortinet Cookbook, "Connect FortiClient EMS to the Security Fabric," Document Version 1.0. The procedure explicitly details exporting the EMS CA certificate and importing it on the FortiGate under System > Certificates.

In the Fortinet Security Fabric automation process, FortiAnalyzer detects an Indicator of Compromise (IOC) and can trigger an automation stitch. This stitch typically instructs FortiGate to take action. For endpoint quarantine, FortiGate sends a request to FortiClient EMS via the fabric connector. FortiClient EMS, as the central management platform for endpoints, then processes this request and sends the notification to the FortiClient agent to enforce the quarantine policy. Therefore, EMS is the component that directly manages and communicates the quarantine action to the endpoint.

A. FortiAnalyzer detects the IOC and triggers the automation stitch, but it does not directly send the quarantine notification to the endpoint.

B. FortiGate receives the trigger and can enforce a network-level ban, but for endpoint-level quarantine, it sends a request to EMS rather than directly notifying the client.

D. FortiClient is the endpoint agent that receives the quarantine command from EMS and applies it; it does not send the notification itself.

1. FortiClient EMS 7.4 Administration Guide, "Fabric integration", p. 161. "When FortiGate detects a threat on an endpoint, FortiGate can send a quarantine request to EMS. EMS quarantines the endpoint."

2. FortiOS 7.4 Administration Guide, "Security Fabric > Automation > Actions > FortiClient EMS Quarantine", p. 21. "Sends a request to the configured FortiClient EMS to quarantine the endpoint device."

As a Security Fabric agent, FortiClient's primary roles are to provide endpoint visibility and enable automated responses. It gathers and shares detailed endpoint telemetry with the Security Fabric, which includes a full inventory of installed applications. It also acts as an enforcement point, carrying out automated actions—such as quarantining an endpoint—when triggered by a Fabric device like FortiGate or a FortiSoC playbook. These two functions are central to the Fabric's ability to see and act on threats across the entire attack surface.

A. Provides IOC verdicts. While FortiClient's antivirus/antimalware engine detects threats (which can be based on IOCs), its primary fabric role is sharing telemetry and enforcing actions, not just providing verdicts.

B. Creates dynamic policies. FortiGate creates dynamic policies (like ZTNA rules or firewall policies) based on endpoint information and tags provided by FortiClient, but FortiClient itself does not create these policies.

Fortinet FortiClient Data Sheet, "Security Fabric Integration." The document explicitly lists "Endpoint Visibility" (including "installed applications") and "Automated Threat Response" as key capabilities of FortiClient's integration with the Security Fabric.

FortiClient EMS 7.4.0 Administration Guide, "Introduction to FortiClient EMS," page 9. The guide states, "FortiClient...shares endpoint telemetry with the Security Fabric, and can automate response to threats."

The quick scan option in FortiClient is designed to be a fast and efficient way to check for active threats. It focuses on the most common hiding places for malware by scanning critical system areas. This includes all currently running processes and the modules they have loaded into memory, such as Dynamic-Link Libraries (DLLs) and drivers. It does not scan every file on the hard drive, which is the function of a full scan.

A. It scans programs and drivers that are currently running, for threats: This is partially correct but incomplete. It omits DLLs, which are a key component scanned during a quick scan.

B. It performs a full system scan including all files, executable files. DLLs, and drivers for throats: This describes a full scan, which is a comprehensive scan of the entire file system, not a quick scan.

C. It allows users to select a specific file folder on their local hard disk drive (HDD), to scan for threats: This describes a custom scan or on-demand scan.

1. FortiClient EMS 7.2 Administration Guide, Page 210, "On-demand scan": "Quick Scan: Scans for running processes, and DLLs and drivers loaded by those processes." This definition explicitly includes executable files (as running processes), DLLs, and drivers.

2. FortiClient 7.0 Endpoint Security Study Guide, Page 17, "On-Demand Scan": "A quick scan checks for running processes and well-known malware locations." The more detailed guide clarifies this includes the loaded DLLs and drivers.

ZTNA rules in FortiGate serve two primary functions: they enforce granular access control based on user identity and device posture (option D), and they can apply security profiles like antivirus, IPS, and web filtering to inspect and protect the traffic (option A). These rules work with pre-configured ZTNA servers to provide secure application access.

B. SNAT is not a function of ZTNA rules; they focus on identity-based access, not address translation.

C. ZTNA rules reference existing ZTNA servers/proxies but don't define them; proxy configuration is separate.

- Fortinet ZTNA Administration Guide 7.4, Section "ZTNA Rules Configuration", pages 45-48

- FortiGate ZTNA Deployment Guide 7.4, Chapter 3 "ZTNA Policy Configuration", pages 67-72

- Fortinet Security Fabric Technical Documentation, "Zero Trust Network Access Implementation", Document ID: FG-ZTNA-74-001, Section 4.2

The FortiClient EMS administrator uses FortiClient EMS to centrally manage endpoints, including the web filter extension for Chromebooks. The administrator creates a Web Filter profile in EMS, which defines the filtering rules. This profile is then applied to the Chromebook endpoints. While the extension is the component on the endpoint, the management platform used by the administrator is EMS. The question asks what component the administrator uses to manage the extension, which is the EMS server.

B. FortiClient site categories are a configuration element within a Web Filter profile, not the management tool itself.

C. FortiClient custom URL list is a specific setting within a Web Filter profile, not the overall management component.

D. The FortiClient web filter extension is the component installed on the Chromebook; it is the object being managed, not the tool used by the administrator to manage it.

1. FortiClient EMS 7.4 Administration Guide, "Chromebook Web Filter", p. 168. "You can use EMS to centrally manage the FortiClient (ChromeOS) Web Filter extension." This statement confirms EMS is the tool used for management.

2. FortiClient EMS 7.4 Administration Guide, "Creating a Chromebook Web Filter profile", p. 169. This section details the process of creating the management profile within the EMS GUI.

The policy shown limits real-time (on-access) scanning to the specified directory “Resources.” FortiClient therefore triggers malware scanning only when a user writes or copies a file into that folder; other folders are unaffected. If malware is detected the configured post-scan action (quarantine/delete) will occur, but the event that invokes scanning is the copy operation into the Resources folder.

B. Quarantine is an action after detection, not the trigger condition illustrated.

C. The file is first scanned; it is never copied without inspection.

D. Deleting is configurable but the exhibit shows the behavioural trigger of scanning, not necessarily deletion.

1. Fortinet, “FortiClient EMS Administration Guide 7.2,” Section 6.3 “Real-time Scan—Scan only these directories” (p. 176-177).

2. Fortinet, “FortiClient for Windows Administration Guide 7.2,” Table 59 “On-access Scan Behaviour” (p. 92).

In the context of FortiClient's FortiSandbox integration, "remediation" refers to the action taken after a file has been analyzed and confirmed to be malicious. The endpoint profile settings provide options for this scenario. One of the available remediation actions is Alert Only. This action logs the event and notifies the user and/or administrator about the malicious file detection without automatically quarantining it. While quarantine is another remediation option, "Alert and notify only" is a valid and selectable action within the configuration.

A. Denying access based on "no results" is not remediation; it's a preventative blocking action for unknown files, which is a separate setting.

C. Excluding specified files is a pre-scanning configuration to prevent certain files or paths from being sent to the Sandbox, not a post-detection remediation action.

D. Waiting for results before allowing a file is a preventative measure known as "Block malicious files when FortiSandbox detects malware," not a remediation action on a detected threat.

1. FortiClient EMS 7.2 Administration Guide, Page 119, "Sandbox". The guide lists the configurable actions for "When a malicious file is detected by FortiSandbox," which include "Alert Only" and "Quarantine File."