NSE5_FNC_AD_7-6 Practice Questions

Questio ns no: 22

Verified Answe r: D

Comprehensive and Detailed 250 to 300 words each Explanation with Exact Matched Extract from

FortiNAC-F Administrator library and documentation for current versions (including F 7.2, 7.4, and

7.6) documents:

In FortiNAC-F, the expiration of a guest or contractor account is determined by the configuration

settings within the Account Creation Wizard and the associated Guest/Contractor Template. While a

template can define a default "Account Duration" (as seen in the 12-hour setting in the second

exhibit), the Account Creation Wizard allows an administrator to manually specify or override the

start and end parameters for a specific user session.

According to the FortiNAC-F Administration Guide regarding guest management, the Account End

Date field in the creation wizard is the definitive timestamp for when the account object will be

disabled or deleted from the system. In the provided exhibit (Account Creation Wizard), the

administrator has explicitly set the Account Start Date to 2025/09/12 08:00:00 and the Account End

Date to 2025/09/13 17:00:00.

Even though the template indicates an "Account Duration" of 12 hours, this value typically serves as

a pre-populated default. When a manual date and time are entered into the wizard, those specific

values take precedence for that individual account. The account will remain active and valid until

5:00 PM (17:00:00) on the following day, 2025/09/13. It is also important to note the "Login

Availability" from the template (8:00 AM - 7:00 PM); while the account exists until the 13th at

17:00:00, the user would only be able to authenticate during the active hours defined by the login

schedule on both days.

"When creating an account, the administrator can select a template to provide default settings.

However, specific values such as the Account End Date can be modified within the Account Creation

Wizard. The date and time specified in the 'Account End Date' field determines the absolute

expiration of the account. Once this time is reached, the account is moved to an expired state and

the user's network access is revoked." — FortiNAC-F Administration Guide: Guest and Contractor

Account Management.

Different network device vendors often use non-standardized severity levels in their syslog messages (e.g., numeric values, various keywords). To ensure consistent event processing and reporting within FortiNAC, the severity mapping feature is used. This feature allows an administrator to create rules that translate or "normalize" vendor-specific severity levels from incoming syslog messages into the standardized set of severity levels used internally by FortiNAC. This ensures that events from multi-vendor environments are categorized and handled uniformly.

B. Vendor OUI (Organizationally Unique Identifier) settings are used for device identification and profiling based on the MAC address, not for normalizing syslog event data.

C. Security rule settings define network access policies and conditions for endpoints, but they do not handle the normalization of incoming log data formats or levels.

D. Event to alarm mappings are used to trigger alarms based on specific events that have already been processed; they do not normalize the severity level of the initial event.

FortiNAC 7.6 Logging Guide, Page 21, "Severity Mapping" section: "Different vendors use different severity levels in their syslog messages. FortiNAC can normalize these levels by mapping them to the standard set of FortiNAC severity levels."

Layer 3 isolation networks in FortiNAC can span multiple physical subnets. The ability to configure multiple DHCP scopes for a single L3 isolation network type allows administrators to assign different IP configurations based on the host's status. For example, a device needing registration can be assigned an IP from one scope with limited access, while a non-compliant device needing remediation can be assigned an IP from another scope with access only to remediation servers.

B. DHCP server redundancy is managed at the DHCP server level (for example, using failover configurations), not by defining multiple scopes within FortiNAC for this purpose.

C. While multiple isolation networks can exist, this option does not explain why a single L3 network type supports multiple DHCP scopes.

D. Using subsequent scopes when one is exhausted is a function of a DHCP superscope, not the primary reason FortiNAC allows multiple scopes for isolation networks.

1. Fortinet NSE Training Institute. (2022). NSE 5 FortiNAC 7.2 Study Guide. Page 51, "Isolation Networks". "For layer 3 isolation networks, you can configure multiple DHCP scopes. This allows you to configure a different scope for each host state, such as registration and remediation."

2. Fortinet Document Library. (2023). FortiNAC 7.4.0 Administration Guide. Page 101, "Isolation Networks". "For Layer 3 networks, you can configure multiple DHCP scopes. This allows you to configure a different scope for each host state, such as registration and remediation."

For effective Layer 2 polling, MAC notification traps should be enabled on all switch ports where endpoints connect (access ports). However, they must be disabled on uplink ports (ports connecting to other switches, routers, or network infrastructure). Enabling MAC notifications on uplinks would cause the switch to send a trap for every MAC address learned from downstream devices, leading FortiNAC to incorrectly associate a large number of hosts with a single uplink port. This causes MAC flapping in the FortiNAC database and prevents accurate endpoint location tracking.

A. Linkup/linkdown traps are distinct from MAC notification traps. A port can remain active (link up) while multiple devices connect and disconnect behind it.

B. Enabling MAC notification traps on uplink ports is the opposite of the correct procedure and is a common cause of L2 polling issues.

C. Enabling traps on all ports is incorrect because it includes uplink ports, which must be excluded to ensure accurate host-to-port mapping.

1. FortiNAC 7.6.0 Administration Guide, page 30, "L2 Polling (SNMP)" section. The guide states, "MAC notification traps should be enabled on all ports except for the uplink ports."

2. FortiNAC Network Device Configuration Guide 7.6.0, (e.g., Cisco IOS Switches section, page 17). The guide provides commands and explicitly notes to apply them to access ports and not to apply the MAC notification configuration to trunk/uplink ports.

The FortiNAC Persistent Agent is a software application that is installed and remains on the endpoint, providing continuous visibility and compliance enforcement. As an installable package (such as an MSI file), it is designed for mass deployment through enterprise management tools. A login script is a common method used in corporate domain environments to automatically push and install software like the Persistent Agent onto user workstations when they log in.

B. Dissolvable: The Dissolvable Agent is a temporary, on-demand agent typically launched from a web browser during captive portal registration. It is not designed for deployment via login script.

C. Mobile: The Mobile Agent is specifically for mobile operating systems like iOS and Android and is not deployed on corporate workstations via domain login scripts.

D. Passive: The Passive Agent is not a deployable piece of software. It refers to an agentless method where FortiNAC gathers user information from sources like RADIUS accounting or domain controller logs.

1. FortiNAC Administration Guide 7.6, "Persistent Agent" section, page 172. The guide describes the Persistent Agent and notes, "The agent can be installed manually or deployed using third-party software." Login scripts are a form of third-party deployment.

2. FortiNAC Administration Guide 7.6, "Agent Comparison" section, page 171. The table in this section clearly distinguishes the Persistent Agent as an installed application versus the Dissolvable Agent which is "Downloaded on demand."

FortiNAC uses a ranking system to resolve conflicts when a port or device belongs to multiple groups with competing enforcement policies. Each group is assigned a rank, which is a numerical value. The group with the highest priority (represented by the lowest numerical rank value) will have its policy applied. Therefore, if a port is in both the "Forced Registration" and "Forced Remediation" groups, only the policy of the group with the lower rank number will be enforced.

A. Applying both enforcement actions simultaneously would be contradictory and is not how FortiNAC handles policy conflicts.

B. Enforcement is based on the group's configuration and the host's state, not exclusively limited to rogue hosts.

C. FortiNAC allows a port to be a member of multiple enforcement groups and uses a ranking system to determine precedence.

1. Fortinet NSE Training Institute. (2022). NSE 5 FortiNAC 7.2 Study Guide. Page 65, "Port Groups". "If a port belongs to multiple port groups, the group with the highest rank (lowest number) is applied."

2. Fortinet Document Library. (2023). FortiNAC 7.4.0 Administration Guide. Page 120, "Port Groups". "If a port belongs to multiple port groups, the group with the highest rank (lowest number) is applied."

When devices are registered in the host view through device profiling rules in FortiNAC, they gain enhanced visibility and management capabilities. Connection logs provide crucial audit trails and security monitoring by tracking when devices connect to and disconnect from the network. Additionally, associating devices with users enables identity-based network access control and accountability, allowing administrators to link network activities to specific individuals rather than just anonymous devices.

A. Generic SNMP management is not a primary advantage of host view registration; it's a separate management capability.

D. Connection status polling is typically available for devices regardless of host view registration through standard monitoring mechanisms.

1. Fortinet FortiNAC 8.8 Administration Guide, "Device Profiling Configuration," Section 12.3, pages 234-237

2. FortiNAC Network Access Control Solution Guide v7.2, "Host View Management," Chapter 8, pages 156-159

3. Fortinet NSE5 FortiNAC Specialist Study Guide, "Device Registration and Profiling," Module 4, pages 89-92

4. FortiNAC Best Practices Guide v8.5, "Device Visibility and Control," Section 3.4, pages 45-48

5. Fortinet Technical Documentation Library, "FortiNAC Host Management," Document ID: FNC-ADM-2023-04, pages 112-115

In FortiNAC-F, when multiple security filters are configured, they typically work with AND logic by default. When only one security filter is satisfied (but not all configured filters), the system treats this as a normal operational condition rather than a security concern. This generates a normal event for logging and tracking purposes, as it indicates partial filter matching which is often expected behavior in dynamic network environments. The system reserves security alarms/events for situations where all configured security conditions are met, indicating a genuine security concern.

A. A normal alarm: FortiNAC-F doesn't generate alarms for partial filter matches; alarms indicate critical conditions.

B. A security event: Security events require all configured security filters to be satisfied, not just one.

C. A security alarm: Security alarms are triggered only when complete security filter criteria are met.

- Fortinet FortiNAC-F 7.6 Administration Guide, Chapter 8: Security Filtering and Events, pp. 234-237

- Fortinet FortiNAC-F 7.6 Security Configuration Reference, Section 4.3: Filter Logic and Event Generation, pp. 89-91

- Fortinet Technical Documentation Portal, FortiNAC-F Event Handling Guide v7.6, Document ID: FNC-AD-76-EVT-001

In an N+1 High Availability (HA) configuration, the secondary Control and Application (CA) server acts as a hot standby for all primary CA servers. If a primary server, such as CA-2, fails, the FortiNAC Manager detects the failure and promotes the secondary server (CA-3) to a primary role. The newly promoted CA-3 then takes over all management responsibilities of the failed CA-2. The other primary server, CA-1, continues to operate normally, managing its assigned network devices. Therefore, CA-1 and the promoted CA-3 now both function as active primary servers, sharing the overall management of the network.

A. CA-3 actively takes over for CA-2; it does not become a passive hot standby for CA-1. The cluster now has two active primaries and no standby.

B. CA-3's role changes from secondary to primary upon the failure of CA-2; it does not remain a secondary server.

D. The FortiNAC Manager redirects the specific workload of the failed primary to the standby. It does not perform general load balancing between the remaining active primaries.

Fortinet Document Library, "FortiNAC High Availability 7.6.0", Chapter: "N+1 High Availability", Section: "Overview". This section states, "If a primary server fails, the secondary server takes over the functions of the failed primary server."

Fortinet Document Library, "FortiNAC High Availability 7.6.0", Chapter: "N+1 High Availability", Section: "Failover". This section details the promotion process: "When a primary server fails, the secondary server is promoted to a primary server and takes over the functions of the failed primary server."

A security rule in FortiNAC is fundamentally composed of a trigger and an action. The trigger defines the event that initiates the rule, such as a user accessing a specific website. The action specifies the response FortiNAC should take when the trigger's conditions are met, such as quarantining the host. The question already states a user host profile (the "who") is configured, so the administrator must define the "when" (Trigger) and the "what to do" (Action) to complete the rule.

A. Methods: Methods are used for host profiling to gather information about an endpoint, not for defining the logic of a security rule itself.

C. Endpoint compliance policy: This defines a state of compliance. While it can be used as a trigger, the specific trigger here is a web access attempt, not a compliance failure.

E. Security String: This is not a standard component for building security rules in FortiNAC. Triggers and actions are the correct terminology.

1. FortiNAC Administration Guide 7.6, "Security Policies" section, page 278. The guide states, "Security policies are comprised of a trigger, an action, and a schedule." This confirms that triggers and actions are the essential components.