Question 1

Which two policy types can be created on a FortiNAC Control Manager? (Choose two.)

Accepted Answer

Network Access policies as a common type of policy in FortiNAC, used to dynamically provision access to connecting endpoints. While Authentication is typically
a policy type in network access control systems like FortiNAC

Question 2

Which two things must be done to allow FortiNAC to process incoming syslog messages from an unknown vendor? (Choose two.)

Accepted Answer

To allow FortiNAC to process incoming syslog messages from an unknown vendor, two steps must be taken:
? Creation of a customized event parser: This enables FortiNAC to parse and integrate syslog messages from any vendor or device, as long as the messages are
in CSV, CEF, or Tag/Value format.
? Modeling the device in the Topology view: Any device that sends syslog messages to FortiNAC must be modeled in this view. FortiNAC will not process syslog or
trap messages unless the source address belongs to a device modeled in the topology.
References
? FortiNAC 7.2 Study Guide, pages 428 and 399

Question 3

Which three are components of a security rule? (Choose three.)

Accepted Answer

Components of a security rule in FortiNAC include:
? Trigger: The condition or event that initiates the evaluation of the rule.
? User or Host Profile: A requirement that can be added to a rule to specify the user or host profile that must be matched.
? Action: The activities or responses that FortiNAC performs when the rule is matched.
References
? FortiNAC 7.2 Study Guide, page 419

Question 4

By default, if more than 20 hosts are seen connected on a single port simultaneously, what will happen to the port?

Accepted Answer

Admin Guide p. 754: Threshold Uplink—The Uplink mode has been set as Dynamic and FortiNAC has determined that the number of MAC addresses on the port
exceeds the System Defined Uplink count. All hosts read on this port are ignored.

Question 5

Where should you configure MAC notification traps on a supported switch?

Accepted Answer

In general, for network switches supporting MAC notification traps, it's advisable to configure these traps on all ports except uplink ports. Uplink ports are used for
connecting to other switches or network infrastructure devices and typically don't need MAC notification traps, which are more relevant for end-device connectivity
monitoring.
The study guide specifies that MAC notification traps should not be configured on interfaces that are uplinks. They are the preferred method for learning and
updating Layer 2 information and should be used whenever available, but not on uplink interfaces.

Question 6

Which connecting endpoints are evaluated against all enabled device profiling rules?

Accepted Answer

FortiNAC process to classify rogue devices and create an organized inventory of known trusted registered devices.
Reference: https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/9529d49c-892c11e9-81a4-00505692583a/FortiNAC_Device_Profiler_Configuration.pdf
Based on FortiNAC's approach to device profiling and rule evaluation, rogue devices are evaluated against enabled device profiling rules each time they connect.
This consistent evaluation ensures that rogue devices are properly classified and handled according to the latest network policies each time they attempt to access
the network.
References
FortiNAC documentation on device profiling and rule evaluation.

Question 7

In an isolation VLAN which three services does FortiNAC supply? (Choose three.)

Accepted Answer

In an isolation VLAN, FortiNAC supplies DHCP and DNS services. The guide specifies that FortiNAC has a DHCP scope defined for a particular VLAN and should
be the only DHCP server available to hosts on that VLAN. Additionally, hosts on the VLAN would get a DNS server configuration of the FortiNAC IP for that VLAN

Question 8

What causes a host's state to change to "at risk"?

Accepted Answer

Failure – Indicates that the host has failed the scan. This option can also be set manually. When the status is set to Failure the host is marked "At Risk" for the
selected scan.
Reference: https://docs.fortinet.com/document/fortinac/8.3.0/administration-guide/241168/host-health-and-scanning
p. 244 of the Study Guide, "A state of at-risk indicates the host has failed a scan. This could be a compliance scan or an administrative scan."

Question 9

While troubleshooting a network connectivity issue, an administrator determines that a device was being automatically provisioned to an incorrect VLAN.
Where would the administrator look to determine when and why FortiNAC made the network access change?

Accepted Answer

Correct answer: C

Question 10

Which system group will force at-risk hosts into the quarantine network, based on point of connection?

Accepted Answer

Forced Quarantine, study guide 7.2 pag 245 and 248