Valid NSE5_FNC_AD_7.6 Practice Test Dumps with 100% Passing Guarantee [Jun-2026]
NSE5_FNC_AD_7.6 PDF Dumps Are Helpful To produce Your Dreams Correct QA's
NEW QUESTION # 20
Refer to the exhibits.
What would happen if the highlighted port with connected hosts was placed in both the Forced Registration and Forced Remediation port groups?
- A. Enforcement would be applied only to rogue hosts
- B. Only the higher ranked enforcement group would be applied.
- C. Multiple enforcement groups could not contain the same port.
- D. Both types of enforcement would be applied
Answer: B
Explanation:
In FortiNAC-F, Port Groups are used to apply specific enforcement behaviors to switch ports. When a port is assigned to an enforcement group, such as Forced Registration or Forced Remediation, FortiNAC-F overrides normal policy logic to force all connected adapters into that specific state. The exhibit shows a port (IF#13) with "Multiple Hosts" connected, which is a common scenario in environments using unmanaged switches or hubs downstream from a managed switch port.
According to the FortiNAC-F Administrator Guide, it is possible for a single port to be a member of multiple port groups. However, when those groups have conflicting enforcement actions-such as one group forcing a registration state and another forcing a remediation state-FortiNAC-F utilizes a ranking system to resolve the conflict. In the FortiNAC-F GUI under Network > Port Management > Port Groups, each group is assigned a rank. The system evaluates these ranks, and only the higher ranked enforcement group is applied to the port. If a port is in both a Forced Registration group and a Forced Remediation group, the group with the numerical priority (rank) will dictate the VLAN and access level assigned to all hosts on that port.
This mechanism ensures consistent behavior across the fabric. If the ranking determines that "Forced Registration" is higher priority, then even a known host that is failing a compliance scan (which would normally trigger Remediation) will be held in the Registration VLAN because the port-level enforcement takes precedence based on its rank.
"A port can be a member of multiple groups. If more than one group has an enforcement assigned, the group with the highest rank (lowest numerical value) is used to determine the enforcement for the port. When a port is placed in a group with an enforcement, that enforcement is applied to all hosts connected to that port, regardless of the host's current state." - FortiNAC-F Administration Guide: Port Group Enforcement and Ranking.
NEW QUESTION # 21
When creating a user or host profile, which three criteria can you apply? (Choose three.)
- A. Location
- B. Host or user attributes
- C. An applied access policy
- D. Host or user group memberships
- E. Adapter current VLAN
Answer: A,B,D
Explanation:
The User/Host Profile is the primary mechanism in FortiNAC-F for identifying and categorizing endpoints to determine their level of network access. According to the FortiNAC-F Administration Guide, a profile is built using a combination of criteria that define "Who" is connecting, "What" device they are using, and "Where" they are located on the network.
The three main categories of criteria available in the configuration are:
Host or User Attributes (B): This includes specific details such as the host's operating system, the user's role (e.g., Employee, Contractor), or custom attributes assigned to the record.
Host or User Group Memberships (A): Profiles can be configured to match endpoints that are members of specific internal FortiNAC groups or synchronized directory groups (like LDAP or Active Directory groups). This allows for broad policy application based on organizational structure.
Location (E): The "Where" component allows administrators to restrict a profile match to specific physical or logical areas of the network, such as a particular switch, a group of ports, or a specific SSID.
Criteria like an "applied access policy" (D) are the outcome of a profile match rather than a criterion used to define the profile itself. Similarly, the "Adapter current VLAN" (C) is a dynamic state that changes based on enforcement and is not a standard static identifier used for profile matching.
"User/Host Profiles are used to identify the hosts and users to which a policy will apply. Profiles are created by selecting various criteria in the Who/What (Attributes and Groups) and Where (Locations) sections. Attributes can include Host Role, User Role, and OS. Group memberships allow matching based on internal or directory-based groups. Location criteria allow for filtering based on the device or port where the host is connected." - FortiNAC-F Administration Guide: User/Host Profile Configuration.
NEW QUESTION # 22
During an evaluation of state-based enforcement, an administrator discovers that ports that should not be under enforcement have been added to enforcement groups.
In which view would the administrator be able to identify who added the ports to the groups?
(Selected)
- A. The Event Management view
- B. The Port Changes view
- C. The Admin Auditing view
- D. The Security Events view
Answer: C
Explanation:
In FortiNAC-F, accountability and forensic tracking of configuration changes are managed through the Admin Auditing functionality. When an administrator performs an action that modifies the system state-such as creating a policy, changing a device's status, or adding a switch port to an Enforcement Group-the system generates an audit record. This record is essential for troubleshooting scenarios where unauthorized or accidental configuration changes have occurred, leading to unintended network behavior.
The Admin Auditing view (found under Logs > Admin Auditing) provides a comprehensive log of the "Who, What, and When" for every administrative session. Each entry includes the username of the administrator, the source IP address from which they accessed the FortiNAC-F console, a precise timestamp, and a detailed description of the modification. In the scenario described, where ports have been incorrectly added to enforcement groups, the Admin Auditing view allows a supervisor to filter by the specific "Port" or "Group" object to identify exactly which administrator executed the command.
In contrast, the Event Management view (B) is designed to monitor system and network events, such as RADIUS authentications, host connections, and SNMP trap arrivals. While it tracks system activity, it does not typically log the manual configuration changes performed by admins. The Port Changes view (C) tracks the operational history of a port (such as VLAN assignment changes and host movements) but does not attribute the administrative assignment of the port to a group. Finally, the Security Events view (D) is dedicated to alerts triggered by security rules and external threat feeds.
"Admin Auditing displays a record of all modifications made to the FortiNAC-F system by an administrator. This view includes the administrator's name, the date and time of the change, and a description of the action taken. It is the primary resource for determining which administrative user performed a specific configuration change, such as modifying port group memberships or altering policy settings." - FortiNAC-F Administration Guide: Logging and Auditing Section.
NEW QUESTION # 23
A network administrator is troubleshooting a network access issue for a specific host. The administrator suspects the host is being assigned a different network access policy than expected.
Where would the administrator look to identify which network access policy, if any, is being applied to a particular host?
- A. The Port Properties view of the hosts port
- B. The Policy Details view for the host
- C. The Connections view
- D. The Policy Logs view
Answer: B
Explanation:
When troubleshooting network access in FortiNAC-F, it is often necessary to verify exactly why a host has been granted a specific level of access. Since FortiNAC-F evaluates policies from the top down and assigns access based on the first match, an administrator needs a clear way to see the results of this evaluation for a specific live endpoint.
The Policy Details (C) view is the designated tool for this purpose. By navigating to the Hosts > Hosts (or Adapter View) in the Administration UI, an administrator can search for the specific MAC address or IP of the host in question. Right-clicking on the host record reveals a context menu from which Policy Details can be selected. This view provides a real-time "look" into the policy engine's decision for that specific host, showing the Network Access Policy that was matched, the User/Host Profile that triggered the match, and the resulting Network Access Configuration (VLAN/ACL) currently applied.
While Policy Logs (A) provide a historical record of all policy transitions across the system, they are often too high-volume to efficiently find a single host's current state. The Connections view (B) shows the physical port and basic status but lacks the granular policy logic breakdown. The Port Properties (D) view shows the configuration of the switch interface itself, which is only one component of the final access determination.
"To identify which policy is currently applied to a specific endpoint, use the Policy Details view. Navigate to Hosts > Hosts, select the host, right-click and choose Policy Details. This window displays the specific Network Access Policy, User/Host Profile, and Network Access Configuration currently in effect for that host record." - FortiNAC-F Administration Guide: Policy Details and Troubleshooting.
NEW QUESTION # 24
While deploying FortiNAC-F devices in a 1+1 HA configuration, the administrator has chosen to use the shared IP address option.
Which condition must be met for this type of deployment?
- A. The primary and secondary administrative interfaces are on the same subnet.
- B. There is a direct cable link between FortiNAC-F devices.
- C. The isolation network type is Layer 2.
- D. The isolation network type is layer 3.
Answer: A
Explanation:
In a 1+1 High Availability (HA) deployment, FortiNAC-F supports two primary methods for management access: individual IP addresses or a Shared IP Address (also known as a Virtual IP or VIP). The Shared IP option is part of a Layer 2 HA design, which simplifies administration by providing a single URL or IP that always points to whichever appliance is currently in the "Active" or "In Control" state.
For a Shared IP configuration to function correctly, the Primary and Secondary administrative interfaces (port1) must be on the same subnet. This requirement exists because the Shared IP is a logical address that is dynamically assigned to the physical interface of the active unit. Since only one unit can own the IP at a time, both units must reside on the same broadcast domain (Layer 2) to ensure that ARP requests for the Shared IP are correctly answered and that the gateway remains reachable regardless of which unit is active. If the appliances were on different subnets (a Layer 3 HA design), a shared IP could not be used because it cannot "float" across different network segments; instead, administrators would need to manage each unit via its unique physical IP or use a FortiNAC Manager.
"For L2 HA configurations, click the Use Shared IP Address checkbox and enter the Shared IP Address information... If your Primary and Secondary Servers are not in the same subnet, do not use a shared IP address. The shared IP address moves between appliances during a failover and recovery and requires both units to reside on the same network." - FortiNAC-F High Availability Reference Manual: Shared IP Configuration.
NEW QUESTION # 25
An administrator wants to build a security rule that will quarantine contractors who attempt to access specific websites.
In addition to a user host profile, which Iwo components must the administrator configure to create the security rule? (Choose two.)
- A. Endpoint compliance policy
- B. Trigger
- C. Action
- D. Security String
- E. Methods
Answer: B,C
Explanation:
In FortiNAC-F, the Security Incidents engine is used to automate responses to security threats reported by external devices. When an administrator wants to enforce a policy, such as quarantining contractors who access restricted websites, they must create a Security Rule. A Security Rule acts as the "if-then" logic that correlates incoming security data with the internal host database.
The documentation specifies that a Security Rule consists of three primary configurable components:
User/Host Profile: This identifies who or what the rule applies to (in this case, "Contractors").
Trigger: This is the event that initiates the rule evaluation. In this scenario, the Trigger would be configured to match specific syslog messages or NetFlow data indicating access to prohibited websites. Triggers use filters to match vendor-specific data, such as a "Web Filter" event from a FortiGate.
Action: This defines what happens when the Trigger and User/Host Profile are matched. For this scenario, the administrator would select a "Quarantine" action, which instructs FortiNAC-F to move the endpoint to a restricted VLAN or apply a restrictive ACL.
While "Methods" (A) relate to authentication and "Security Strings" (E) are used for specific SNMP or CLI matching, they are not the structural components of a Security Rule in the Security Incidents menu.
"Security Rules are used to perform a specific action based on certain criteria... To configure a Security Rule, navigate to Logs > Security Incidents > Rules. Each rule requires a Trigger to define the event criteria, an Action to define the automated response (such as Quarantine), and a User/Host Profile to limit the rule to specific groups." - FortiNAC-F Administration Guide: Security Rules and Incident Management.
NEW QUESTION # 26
An administrator wants to control user access to corporate resources by integrating FortiNAC-F with FortiGate using firewall tags defined on FortiNAC-F.
Where would the administrator assign the firewall tag value that will be sent to FortiGate?
- A. RADIUS group attribute
- B. Device profiling rule
- C. Logical network
- D. Security rule
Answer: C
Explanation:
Questio ns no: 9
Verified Answe r: B
Comprehensive and Detailed 250 to 300 words each Explanation with Exact Matched Extract from FortiNAC-F Administrator library and documentation for current versions (including F 7.2, 7.4, and 7.6) documents:
In FortiNAC-F, the integration with FortiGate for Security Fabric and Single Sign-On (FSSO) allows the system to communicate the access level of an endpoint directly to the firewall using firewall tags. This eliminates the need for complex VLAN steering in some environments by allowing the FortiGate to apply policies based on these dynamic tags instead of just a physical or virtual network segment.
The actual assignment of the firewall tag value occurs within a Logical Network. In the FortiNAC-F architectural model, a Logical Network acts as a container for "Access Values". When an administrator configures a Logical Network (located under Network > Logical Networks), they define what that network represents-such as "Corporate Access" or "Contractor Limited". Within that definition, they assign the specific Firewall Tag that matches the tag created on the FortiGate. Once a user or host matches a Network Access Policy, FortiNAC-F identifies the associated Logical Network and pushes the defined tag to the FortiGate via the FSSO connector.
It is important to note that while Network Access Policies (and by extension Security Rules) are the logic engines that trigger the assignment, they do not hold the tag value itself. They simply point to a Logical Network, which serves as the central repository for that specific access configuration.
"To assign firewall tags, navigate to Network > Logical Networks. Select the desired logical network and click Edit. Under the Access Value section, select Firewall Tag as the type and enter the tag name exactly as it appears on the FortiGate. When a Network Access Policy matches a host, FortiNAC sends this tag to the FortiGate as an FSSO message." - FortiNAC-F Administration Guide: Logical Networks and Security Fabric Integration.
NEW QUESTION # 27
An administrator manages a corporate environment where all users log into the corporate domain each time they connect to the network. The administrator wants to leverage login scripts to use a FortiNAC-F agent to enhance endpoint visibility Which agent can be deployed as part of a login script?
- A. Passive
- B. Dissolvable
- C. Mobile
- D. Persistent
Answer: D
Explanation:
In a corporate domain environment where "enhanced endpoint visibility" is required, the Persistent Agent is the recommended choice. Unlike the Dissolvable Agent, which is temporary and intended for one-time compliance scans during registration, the Persistent Agent is an "install-and-stay-resident" application.
The Persistent Agent is specifically designed to be distributed through automated enterprise methods, including login scripts, Group Policy Objects (GPO), or third-party software management tools. When deployed via a login script, the agent can be configured to silently install and immediately begin communicating with the FortiNAC-F service interface. Once active, it provides continuous visibility by reporting host details such as logged-on users, installed applications, and adapter information. It also listens for Windows session events (logon/logoff) to trigger automatic single-sign-on (SSO) registration in FortiNAC-F, ensuring that as soon as a user connects to the domain, their device is identified and assigned the correct network access policy.
"The Persistent Agent can be distributed to Windows domain machines via login script or by any other software distribution method your organization might use. The Persistent Agent remains installed on the host at all times. Once the agent is installed it runs in the background and communicates with FortiNAC at intervals established by the FortiNAC administrator." - FortiNAC-F Administration Guide: Persistent Agent Overview.
NEW QUESTION # 28
Refer to the exhibits.
Based on the given configurations and settings, on which date and time would a guest account created at 8:00 AM on 2025/09/12 expire?
- A. 2025/09/12 at 7:00 PM
- B. 2025/09/13 at 17:00:00
- C. 2025/09/12 at 17:00:00
- D. 2025/09/12 at 8:00 PM
Answer: B
Explanation:
Questio ns no: 22
Verified Answe r: D
Comprehensive and Detailed 250 to 300 words each Explanation with Exact Matched Extract from FortiNAC-F Administrator library and documentation for current versions (including F 7.2, 7.4, and 7.6) documents:
In FortiNAC-F, the expiration of a guest or contractor account is determined by the configuration settings within the Account Creation Wizard and the associated Guest/Contractor Template. While a template can define a default "Account Duration" (as seen in the 12-hour setting in the second exhibit), the Account Creation Wizard allows an administrator to manually specify or override the start and end parameters for a specific user session.
According to the FortiNAC-F Administration Guide regarding guest management, the Account End Date field in the creation wizard is the definitive timestamp for when the account object will be disabled or deleted from the system. In the provided exhibit (Account Creation Wizard), the administrator has explicitly set the Account Start Date to 2025/09/12 08:00:00 and the Account End Date to 2025/09/13 17:00:00.
Even though the template indicates an "Account Duration" of 12 hours, this value typically serves as a pre-populated default. When a manual date and time are entered into the wizard, those specific values take precedence for that individual account. The account will remain active and valid until 5:00 PM (17:00:00) on the following day, 2025/09/13. It is also important to note the "Login Availability" from the template (8:00 AM - 7:00 PM); while the account exists until the 13th at 17:00:00, the user would only be able to authenticate during the active hours defined by the login schedule on both days.
"When creating an account, the administrator can select a template to provide default settings. However, specific values such as the Account End Date can be modified within the Account Creation Wizard. The date and time specified in the 'Account End Date' field determines the absolute expiration of the account. Once this time is reached, the account is moved to an expired state and the user's network access is revoked." - FortiNAC-F Administration Guide: Guest and Contractor Account Management.
NEW QUESTION # 29
Refer to the exhibit.
What will happen to the host of a guest user created from this template if the time of connection is 8:00 PM?
- A. The host will be administratively disabled.
- B. The host will be marked as non-authenticated.
- C. The host will be marked as a rogue device.
- D. The host will be marked as at-risk.
Answer: B
Explanation:
In FortiNAC-F, the Guest & Contractor Template is a configuration object that defines the parameters for accounts created by sponsors or through self-registration. One of the critical security controls within this template is the Login Availability setting. This setting restricts the specific days and times during which a guest or contractor is permitted to authenticate and access the network.
As shown in the exhibit, the "StandardGuest" template has Login Availability set to "Specify Time", with a schedule defined as Mon-Fri, 6:00 AM to 7:00 PM. If a guest user attempts to connect or authenticate at 8:00 PM, which is outside of the permitted window, FortiNAC-F's policy engine will automatically deny the authentication request. When an authentication attempt is denied due to schedule restrictions, the system does not move the host into the "Authenticated" or "Registered" state required for production access. Instead, the host is marked as non-authenticated in the adapter or host view.
This behavior ensures that even if a guest possesses valid credentials, their access is strictly bound by the organizational policy for visitor hours. The host will typically remain in its current isolation or registration VLAN, and the user will see a message on the captive portal indicating that their account is not currently authorized for login. It is important to distinguish this from "at-risk" (C), which relates to security scan failures, or "rogue" (B), which typically refers to unknown devices that have not yet been associated with a valid account or profiling rule.
"Login Availability defines the timeframe during which the guest or contractor account is valid for network access. This schedule is enforced at the time of authentication. If a user attempts to log in outside of the designated window, the authentication is rejected by the system. Consequently, the host record will reflect a non-authenticated status, and the device will remain restricted to the isolation or registration network until a valid login window is reached." - FortiNAC-F Administration Guide: Guest and Contractor Templates Section.
NEW QUESTION # 30
In which three ways would deploying a FortiNAC-F Manager into a large environment consisting of several FortiNAC-F CAs simplify management? (Choose three.)
- A. Global authentication security policies
- B. Global infrastructure device inventory
- C. Global visibility
- D. Pooled licenses
- E. Global version control
Answer: C,D,E
Explanation:
The FortiNAC-F Manager (FortiNAC-M) is designed as a centralized management platform for large-scale distributed environments where multiple FortiNAC-F Control and Application (CA) appliances are deployed across different sites. According to the FortiNAC-F Manager Administration Guide, the deployment of a Manager simplifies administrative overhead in three specific ways:
First, it provides Global Version Control (B). The Manager serves as a central repository for firmware and software updates, allowing administrators to push specific versions to all managed CAs simultaneously, ensuring consistency across the entire fabric. Second, it enables Pooled Licenses (D). Instead of purchasing and managing individual licenses for every CA, licenses are centralized on the Manager. The Manager then distributes these licenses to the CAs as needed based on their host counts. This "floating" license model optimizes cost and prevents individual sites from running out of capacity while others have excess. Third, it offers Global Visibility (E). The Manager aggregates host and device data from every managed CA into a single console. This "single pane of glass" allows an administrator to search for a specific MAC address or user across the entire global organization without logging into individual servers.
While the Manager can assist with configuration templates, authentication security policies (C) and infrastructure modeling (A) are still predominantly managed at the local CA level to ensure site-specific logic and performance.
"The FortiNAC Manager provides a central management console for multiple FortiNAC-F servers (CAs). Key benefits include: * License Management: Licenses are pooled on the Manager and allocated to managed CAs as needed. * Software Management: Firmware updates can be centrally managed and pushed to all CAs from the Manager. * Centralized Monitoring: Provides a global view of all hosts, adapters, and events across the entire managed environment." - FortiNAC-F Manager Administration Guide: Overview and Benefits.
NEW QUESTION # 31
Refer to the exhibit.
If a host is connected to a port in the Building 1 First Floor Ports group, what must also be true to match this user/host profile?
- A. The host must have a role value of contractor, an installed persistent agent or a security access value of contractor, and be connected between 6 AM and 5 PM.
- B. The host must have a role value of contractor or an installed persistent agent, a security access value of contractor, and be connected between 9 AM and 5 PM.
- C. The host must have a role value of contractor or an installed persistent agent and a security access value of contractor, and be connected between 6 AM and 5 PM.
- D. The host must have a role value of contractor or an installed persistent agent or a security access value of contractor, and be connected between 6 AM and 5 PM.
Answer: C
Explanation:
The User/Host Profile in FortiNAC-F is the fundamental logic engine used to categorize endpoints for policy assignment. As seen in the exhibit, the configuration uses a combination of Boolean logic operators (OR and AND) to define the "Who/What" attributes.
According to the FortiNAC-F Administrator Guide, attributes grouped together within the same bracket or connected by an OR operator require only one of those conditions to be met. In the exhibit, the first two attributes are "Host Role = Contractor" OR "Host Persistent Agent = Yes". This forms a single logical block. This block is then joined to the third attribute ("Host Security Access Value = Contractor") by an AND operator. Consequently, a host must satisfy at least one of the first two conditions AND satisfy the third condition to match the "Who/What" section.
Furthermore, the profile includes Location and When (time) constraints. The exhibit shows the location is restricted to the "Building 1 First Floor Ports" group. The "When" schedule is explicitly set to Mon-Fri 6:00 AM - 5:00 PM. For a profile to match, all enabled sections (Who/What, Locations, and When) must be satisfied simultaneously. Therefore, the host must meet the conditional contractor/agent criteria, possess the specific security access value, and connect during the defined 6 AM to 5 PM window.
"User/Host Profiles use a combination of attributes to identify a match. Attributes joined by OR require any one to be true, while attributes joined by AND must all be true. If a Schedule (When) is applied, the host must also connect within the specified timeframe for the profile to be considered a match. All criteria in the Who/What, Where, and When sections are cumulative." - FortiNAC-F Administration Guide: User/Host Profile Configuration.
NEW QUESTION # 32
An administrator wants FortiNAC-F to return a group of user-defined RADIUS attributes in RADIUS responses.
Which condition must be true to achieve this?
- A. RADIUS accounting must be enabled on the FortiNAC-F RADIUS server configuration.
- B. The device models in the inventory view must be configured for proxy-based authentication.
- C. Inbound RADIUS requests must contain the Calling-Station-ID attribute.
- D. The requesting device must support RFC 5176.
Answer: C
Explanation:
In FortiNAC-F, the RADIUS Attribute Groups feature allows administrators to return customized RADIUS attributes (such as specific VLAN IDs, filter IDs, or vendor-specific attributes) in an Access-Accept packet sent back to a network device. This is particularly useful for supporting "Generic RADIUS" devices that are not natively supported but can be managed using standard AVPairs.
According to the FortiNAC-F Generic RADIUS Wired Cookbook and the RADIUS Attribute Groups section of the Administration Guide, there is one critical prerequisite for this feature to function: the inbound RADIUS request must contain the Calling-Station-ID attribute. The Calling-Station-ID typically contains the MAC address of the connecting endpoint. Because FortiNAC-F is a host-centric system, it uses the MAC address as the unique identifier to look up the host record, evaluate the associated Network Access Policy, and determine which Logical Network (and thus which Attribute Group) should be applied. If the incoming request lacks this attribute, FortiNAC-F cannot reliably identify the host and, as a safety mechanism, will not include any user-defined RADIUS attributes in the response. This ensures that unauthorized or unidentifiable devices do not receive privileged access through misapplied attributes.
"Configure a set of attributes that must be included in the RADIUS Access-Accept packet returned by FortiNAC... Requirement: Inbound RADIUS request must contain Calling-Station-Id. Otherwise, FortiNAC will not include the RADIUS attributes. This attribute is used to identify the host and its current state within the FortiNAC database." - FortiNAC-F 7.6.0 Generic RADIUS Wired Cookbook: Configure RADIUS Attribute Groups.
NEW QUESTION # 33
When configuring FortiNAC-F to manage FortiGate VPN users, an endpoint compliance policy must be created for the integration.
Why is the endpoint compliance policy necessary for this type of integration?
- A. To designate the required agent type
- B. To validate the VPN user credentials
- C. To confirm the installed endpoint certificate
- D. To validate the VPN client being used
Answer: A
Explanation:
The integration of FortiNAC-F with FortiGate VPN requires a specific policy workflow to bridge the gap between initial user authentication and full network access. When a user connects to the VPN, the FortiGate typically provides the User ID and IP address, but FortiNAC-F requires a MAC address to uniquely identify and manage the endpoint's record.
According to the FortiGate VPN Integration Guide, the Endpoint Compliance Policy is a mandatory component of this setup because it is used to designate the required agent type. Because a VPN connection is Layer 3, FortiNAC cannot "see" the MAC address through traditional SNMP or L2 polling. The compliance policy instructs the system to present a Captive Portal to the remote user, requiring them to download and run either the Persistent or Dissolvable Agent. The agent then reports the device's MAC address back to FortiNAC, allowing the system to correlate the VPN session with a host record.
Once the agent is running and the MAC is known, FortiNAC-F can evaluate the device's security posture (if scanning is configured) and send the necessary FSSO tags back to the FortiGate to lift the initial network restrictions. Without the compliance policy to enforce the agent requirement, the connection would remain in an isolated "IP-only" state with no unique hardware identity.
"The Endpoint Compliance Policy is necessary to control the agent requirement for VPN users. Create a default VPN Endpoint Compliance Policy to distribute an agent via captive portal for isolated machines. This policy allows the administrator to designate the required agent type (Persistent or Dissolvable) that will be used to collect the hardware (MAC) address and perform health scans on the remote endpoint." - FortiNAC FortiGate VPN Integration Guide: Default Endpoint Compliance Policy (Optional) Section.
NEW QUESTION # 34
......
Cover NSE5_FNC_AD_7.6 Exam Questions Make Sure You 100% Pass: https://www.practicedump.com/NSE5_FNC_AD_7.6_actualtests.html
New NSE5_FNC_AD_7.6 exam Free Sample Questions to Practice: https://drive.google.com/open?id=1OGl_sGFUaHpJz9g79IbInMqwVl5a9wvr