While discovering network infrastructure devices, a switch appears in the inventory topology with a question mark (?) on the icon.
What would cause this?
AThe wrong SNMP community string was entered during discovery.
BThe SNMP ObjectID is not recognized by FortiNAC-F.
CA read-only SNMP community string was used.
DSNMP is not enabled on the switch.
An administrator manages a corporate environment where all users log into the corporate domain each time they connect to the network. The administrator wants to leverage login scripts to use a FortiNAC-F agent to enhance endpoint visibility.
Which agent can be deployed as part of a login script?
APersistent
BDissolvable
CMobile
DPassive
An administrator wants to build a security rule that will quarantine contractors who attempt to access specific websites.
In addition to a user host profile, which two components must the administrator configure to create the security rule? (Choose two.)
AMethods
BAction
CEndpoint compliance policy
DTrigger
ESecurity String
A network administrator is troubleshooting a network access issue for a specific host. The administrator suspects the host is being assigned a different network access policy than expected.
Where would the administrator look to identify which network access policy, if any, is being applied to a particular host?
AThe Policy Logs view
BThe Connections view
CThe Policy Details view for the host
DThe Port Properties view of the hosts port
A user was attempting to register their host through the registration captive portal. After successfully registering, the host remained in the registration VLAN.
Which two conditions would cause this behavior? (Choose two.)
AThe wrong agent is installed.
BThere is no agent installed on the host.
CThe port default VLAN is the same as the Registration VLAN.
DThere is another unregistered host on the same port.
When configuring isolation networks in the configuration wizard, why does a layer 3 network type allow for more than one DHCP scope for each isolation network type?
AThe layer 3 network type allows for one scope for each possible host status.
BConfiguring more than one DHCP scope allows for DHCP server redundancy.
CThere can be more than one isolation network of each type.
DAny scopes beyond the first scope are used if the initial scope runs out of IP addresses.
When FortiNAC-F is managing VPN clients connecting through FortiGate, why must the clients run a FortiNAC-F agent?
ATo transparently update the client IP address upon successful authentication
BTo collect user authentication details
CTo collect the client IP address and MAC address
DTo validate the endpoint policy compliance
When creating a device profiling rule, what are two advantages of registering the device in the host view? (Choose two.)
AThe devices can be managed as a generic SNMP device.
BThe devices will have connection logs.
CThe devices can be associated with a user.
DThe devices can be polled for connection status.
How can an administrator configure FortiNAC-F to normalize incoming syslog event levels across vendors?
AConfigure severity mappings.
BConfigure the vendor OUI settings.
CConfigure the security rule settings.
DConfigure event to alarm mappings.
Refer to the exhibit.
What would FortiNAC-F generate if only one of the security filters is satisfied?
AA normal alarm
BA security event
CA security alarm
DA normal event
An administrator wants FortiNAC-F to return a group of user-defined RADIUS attributes in RADIUS responses.
Which condition must be true to achieve this?
AThe requesting device must support RFC 5176.
BInbound RADIUS requests must contain the Calling-Station-ID attribute.
CThe device models in the inventory view must be configured for proxy-based authentication.
DRADIUS accounting must be enabled on the FortiNAC-F RADIUS server configuration.
When configuring FortiNAC-F to manage FortiGate VPN users, an endpoint compliance policy must be created for the integration.
Why is the endpoint compliance policy necessary for this type of integration?
ATo designate the required agent type
BTo validate the VPN user credentials
CTo confirm the installed endpoint certificate
DTo validate the VPN client being used
An administrator wants to build device profiling rules based on network traffic, but the network session view is not populated with any records.
Which two settings can be enabled to gather network session information? (Choose two.)
ANetwork traffic polling on any modeled infrastructure device
BFirewall session polling on modeled FortiGate devices
CNetflow setting in the FortiNAC-F interfaces
DLayer 3 polling on the infrastructure devices
An organization wants to add a FortiNAC-F Manager to simplify their large FortiNAC-F deployment.
Which two policy types can be managed globally? (Choose two.)
AAuthentication
BEndpoint Compliance
CSupplicant EasyConnect
DNetwork Access
When creating a user or host profile, which three criteria can you apply? (Choose three.)
AHost or user group memberships
BHost or user attributes
CAdapter current VLAN
DAn applied access policy
ELocation
While deploying FortiNAC-F devices in a 1+1 HA configuration, the administrator has chosen to use the shared IP address option.
Which condition must be met for this type of deployment?
AThe isolation network type is Layer 3.
BThere is a direct cable link between FortiNAC-F devices.
CThe primary and secondary administrative interfaces are on the same subnet.
DThe isolation network type is Layer 2.
What must an administrator configure to allow FortiNAC-F to process incoming syslog messages that are not supported by default?
AA Syslog Service Connector
BA Security Action
CA Security Event Parser
DA Log Receiver
Refer to the exhibit.
What will happen to the host of a guest user created from this template if the time of connection is 8:00 PM?
AThe host will be marked as non-authenticated.
BThe host will be marked as a rogue device.
CThe host will be marked as at-risk.
DThe host will be administratively disabled.
Refer to the exhibit.
If a host is connected to a port in the Building 1 First Floor Ports group, what must also be true to match this user/host profile?
AThe host must have a role value of contractor, an installed persistent agent of a security access value of contractor, and be connected between 6 AM and 5 PM.
BThe host must have a role value of contractor or an installed persistent agent, a security access value of contractor, and be connected between 9 AM and 5 PM.
CThe host must have a role value of contractor or an installed persistent agent or a security access value of contractor, and be connected between 6 AM and 5PM.
DThe host must have a role value of contractor or an installed persistent agent and a security access value of contractor, and be connected between 6 AM and 5PM.
Refer to the exhibits.
Based on the given configurations and settings, on which date and time would a guest account created at 8:00 AM on 2025/09/12 expire?
A2025/09/12 at 8:00 PM
B2025/09/12 at 7:00 PM
C2025/09/12 at 17:00:00
D2025/09/13 at 17:00:00
During an evaluation of state-based enforcement, an administrator discovers that ports that should not be under enforcement have been added to enforcement groups.
In which view would the administrator be able to identify who added the ports to the groups?
AThe Admin Auditing view
BThe Event Management view
CThe Port Changes view
DThe Security Events view
Refer to the exhibit.
An administrator wants to use FortiNAC-F to automatically provision printers throughout their organization. Each building uses its own local VLAN for printers.
Which FortiNAC-F feature would allow this to be accomplished with a single network access policy?
ADynamic host groups
BLogical networks
CDevice profiling rules
DPreferred VLAN designations
Where should you configure MAC notification traps on a supported switch?
AOnly on ports that generate linkup and linkdown traps
BOnly on ports defined as learned uplinks
COn all ports on the switch
DOn all ports except uplink ports
Refer to the exhibit.
What will occur if CA-2 fails?
ACA-1 and CA-3 will operate as a 1+1 HA cluster with CA-3 acting as a hot standby.
BCA-3 will continue to operate as a secondary in an N+1 HA configuration.
CCA-3 will be promoted to a primary and share management responsibilities with CA-1.
DCA-3 will be promoted to a primary and FortiNAC-F manager will load balance between CA-1 and CA-3.
Preview
