Important Fortinet NSE5_FNC_AD_7.6 Exam Questions

Answer: D

Explanation:

The User/Host Profile in FortiNAC-F is the fundamental logic engine used to categorize endpoints for policy assignment. As seen in the exhibit, the configuration uses a combination of Boolean logic operators (OR and AND) to define the 'Who/What' attributes.

According to the FortiNAC-F Administrator Guide, attributes grouped together within the same bracket or connected by an OR operator require only one of those conditions to be met. In the exhibit, the first two attributes are 'Host Role = Contractor' OR 'Host Persistent Agent = Yes'. This forms a single logical block. This block is then joined to the third attribute ('Host Security Access Value = Contractor') by an AND operator. Consequently, a host must satisfy at least one of the first two conditions AND satisfy the third condition to match the 'Who/What' section.

Furthermore, the profile includes Location and When (time) constraints. The exhibit shows the location is restricted to the 'Building 1 First Floor Ports' group. The 'When' schedule is explicitly set to Mon-Fri 6:00 AM - 5:00 PM. For a profile to match, all enabled sections (Who/What, Locations, and When) must be satisfied simultaneously. Therefore, the host must meet the conditional contractor/agent criteria, possess the specific security access value, and connect during the defined 6 AM to 5 PM window.

'User/Host Profiles use a combination of attributes to identify a match. Attributes joined by OR require any one to be true, while attributes joined by AND must all be true. If a Schedule (When) is applied, the host must also connect within the specified timeframe for the profile to be considered a match. All criteria in the Who/What, Where, and When sections are cumulative.' --- FortiNAC-F Administration Guide: User/Host Profile Configuration.

Answer: C, D

Explanation:

The process of moving a host from a Registration VLAN to a Production VLAN (Access VLAN) is a fundamental part of the FortiNAC-F 'VLAN steering' workflow. When a host successfully registers via the captive portal, FortiNAC-F evaluates its Network Access Policies to determine the correct VLAN. If the host remains stuck in the Registration VLAN despite a successful registration, it is typically due to port-level restrictions or the presence of other unregistered devices.

The two most common reasons for this behavior as per the documentation are:

The port default VLAN is the same as the Registration VLAN: If the 'Default VLAN' field in the switch port's model configuration is set to the same ID as the Registration VLAN, the port will not change state because FortiNAC-F believes it is already in its 'normal' or 'forced' state.

There is another unregistered host on the same port: FortiNAC-F maintains the security posture of the physical port. If multiple hosts are connected to a single port (e.g., via a hub or unmanaged switch) and at least one host remains 'Rogue' (unregistered), FortiNAC-F will generally keep the entire port in the isolation/registration VLAN to prevent the unregistered host from gaining unauthorized access to the production network.

Issues with agents (A, B) typically prevent a host from completing compliance or registration but do not usually result in a 'stuck' status after registration has already been marked as successful in the system.

'If a port is identified as having Multiple Hosts, and those hosts require different levels of access, FortiNAC remains in the most restrictive state (Registration or Isolation) until all hosts on that port are authorized... Additionally, verify the Default VLAN setting for the port; if the Default VLAN and Registration VLAN match, the system will not trigger a VLAN change upon registration.' --- FortiNAC-F Administration Guide: Troubleshooting Host Management.

Answer: C

Explanation:

When troubleshooting network access in FortiNAC-F, it is often necessary to verify exactly why a host has been granted a specific level of access. Since FortiNAC-F evaluates policies from the top down and assigns access based on the first match, an administrator needs a clear way to see the results of this evaluation for a specific live endpoint.

The Policy Details (C) view is the designated tool for this purpose. By navigating to the Hosts > Hosts (or Adapter View) in the Administration UI, an administrator can search for the specific MAC address or IP of the host in question. Right-clicking on the host record reveals a context menu from which Policy Details can be selected. This view provides a real-time 'look' into the policy engine's decision for that specific host, showing the Network Access Policy that was matched, the User/Host Profile that triggered the match, and the resulting Network Access Configuration (VLAN/ACL) currently applied.

While Policy Logs (A) provide a historical record of all policy transitions across the system, they are often too high-volume to efficiently find a single host's current state. The Connections view (B) shows the physical port and basic status but lacks the granular policy logic breakdown. The Port Properties (D) view shows the configuration of the switch interface itself, which is only one component of the final access determination.

'To identify which policy is currently applied to a specific endpoint, use the Policy Details view. Navigate to Hosts > Hosts, select the host, right-click and choose Policy Details. This window displays the specific Network Access Policy, User/Host Profile, and Network Access Configuration currently in effect for that host record.' --- FortiNAC-F Administration Guide: Policy Details and Troubleshooting.

Answer: A

Explanation:

In FortiNAC-F, the Guest & Contractor Template is a configuration object that defines the parameters for accounts created by sponsors or through self-registration. One of the critical security controls within this template is the Login Availability setting. This setting restricts the specific days and times during which a guest or contractor is permitted to authenticate and access the network.

As shown in the exhibit, the 'StandardGuest' template has Login Availability set to 'Specify Time', with a schedule defined as Mon-Fri, 6:00 AM to 7:00 PM. If a guest user attempts to connect or authenticate at 8:00 PM, which is outside of the permitted window, FortiNAC-F's policy engine will automatically deny the authentication request. When an authentication attempt is denied due to schedule restrictions, the system does not move the host into the 'Authenticated' or 'Registered' state required for production access. Instead, the host is marked as non-authenticated in the adapter or host view.

This behavior ensures that even if a guest possesses valid credentials, their access is strictly bound by the organizational policy for visitor hours. The host will typically remain in its current isolation or registration VLAN, and the user will see a message on the captive portal indicating that their account is not currently authorized for login. It is important to distinguish this from 'at-risk' (C), which relates to security scan failures, or 'rogue' (B), which typically refers to unknown devices that have not yet been associated with a valid account or profiling rule.

'Login Availability defines the timeframe during which the guest or contractor account is valid for network access. This schedule is enforced at the time of authentication. If a user attempts to log in outside of the designated window, the authentication is rejected by the system. Consequently, the host record will reflect a non-authenticated status, and the device will remain restricted to the isolation or registration network until a valid login window is reached.' --- FortiNAC-F Administration Guide: Guest and Contractor Templates Section.

Answer: A

Explanation:

FortiNAC-F serves as a central manager for security events originating from a diverse ecosystem of third-party security appliances, such as FortiGate, Check Point, and Cisco. Each vendor utilizes its own internal scale for severity levels within syslog messages (e.g., Check Point uses a 1--5 scale, while others may use 0--7). To provide a consistent response regardless of the source, FortiNAC-F uses Severity Mappings to normalize these incoming values.

According to the FortiNAC-F Administration Guide, severity mappings allow the administrator to translate vendor-specific threat levels into standardized FortiNAC Security Levels (such as High, Medium, or Low Violation). When a syslog message arrives, the parser extracts the vendor's severity code, and the system immediately references the Security Event Severity Level Mappings table to determine how that event should be categorized internally. This normalization is vital because it allows a single Security Alarm to be configured to respond to any 'High Violation' event, whether it was reported as a 'Critical' by one vendor or a 'Level 5' by another. Without these mappings, the administrator would have to create separate, redundant security rules for every vendor to account for their different naming conventions and numerical scales.

'Each vendor defines its own severity levels for syslog messages. The following table shows the equivalent FortiNAC security level... To normalize these events, configure the Severity Level Mappings found in the device integration guides. This allows FortiNAC to generate a consistent security event that can then trigger an alarm regardless of the reporting vendor's specific terminology.' --- FortiNAC-F Administration Guide: Vendor Severity Levels and Syslog Management.