An administrator wants to build a security rule that will quarantine contractors who attempt to access specific websites. In addition to a user host…

A security rule in FortiNAC is fundamentally composed of a trigger and an action. The trigger defines the event that initiates the rule, such as a user accessing a specific website. The action specifies the response FortiNAC should take when the trigger's conditions are met, such as quarantining the host. The question already states a user host profile (the "who") is configured, so the administrator must define the "when" (Trigger) and the "what to do" (Action) to complete the rule.

A. Methods: Methods are used for host profiling to gather information about an endpoint, not for defining the logic of a security rule itself.

C. Endpoint compliance policy: This defines a state of compliance. While it can be used as a trigger, the specific trigger here is a web access attempt, not a compliance failure.

E. Security String: This is not a standard component for building security rules in FortiNAC. Triggers and actions are the correct terminology.

1. FortiNAC Administration Guide 7.6, "Security Policies" section, page 278. The guide states, "Security policies are comprised of a trigger, an action, and a schedule." This confirms that triggers and actions are the essential components.