Fortinet NSE6_FNC-7.2 Exam Questions Instant Access

Question 1

Where should you configure MAC notification traps on a supported switch?

AConfigure them only after you configure linkup and linkdown traps.

BConfigure them on all ports on the switch.

CConfigure them only on ports set as 802 1g trunks.

DConfigure them on all ports except uplink ports.

Answer : C

In general, for network switches supporting MAC notification traps, it's advisable to configure these traps on all ports except uplink ports. Uplink ports are used for connecting to other switches or network infrastructure devices and typically don't need MAC notification traps, which are more relevant for end-device connectivity monitoring.

The study guide specifies that MAC notification traps should not be configured on interfaces that are uplinks. They are the preferred method for learning and updating Layer 2 information and should be used whenever available, but not on uplink interfaces.

Question 2

Which group type can have members added directly from the FortiNAC Control Manager?

AAdministrator

BDevice

CPort

DHost

Answer : B

The study guide explains that there are six different types of groups in FortiNAC, including device, host, IP phone, port, user, and administrator groups. Groups created by administrative users or imported as a result of an LDAP integration can be used to organize elements but do not enforce any type of control or functionality directly

Question 3

Which system group will force at-risk hosts into the quarantine network, based on point of connection?

APhysical Address Filtering

BForced Quarantine

CForced Isolation

DForced Remediation

Answer : D

Forced Quarantine, study guide 7.2 pag 245 and 248

Question 4

When FortiNAC is managing FortiGate VPN users, why is an endpoint compliance policy necessary?

ATo confirm installed security software

BTo validate the VPN user credentials

CTo designate the required agent type

DTo validate the VPN client being used

Answer : A

Question 5

Refer to the exhibit.

What would happen if the highlighted port with connected hosts was placed in both the Forced Registration and Forced Remediation port groups?

AMultiple enforcement groups could not contain the same port.

BOnly the higher ranked enforcement group would be applied.

CBoth types of enforcement would be applied.

DEnforcement would be applied only to rogue hosts.

Answer : B

In systems like FortiNAC, when a port is designated to be in multiple enforcement groups, it is common for only the higher-priority or higher-ranked group's policies to be applied. This is to prevent conflicting enforcement actions from being attempted on the same port. Although the specific details of the priority or ranking system are not provided in the extracted references, the principle of hierarchical policy enforcement suggests that only the policies of the higher-ranked group would be applied to the port.

Reference

FortiNAC documentation would typically outline this behavior in sections discussing port group enforcement or policy application.

Question 6

Which agent is used only as part of a login script?

AMobile

BPassive

CPersistent

DDissolvable

Answer : B

In the context of network access control systems like FortiNAC, a dissolvable agent is typically a piece of software that is executed on the endpoint as part of a login script or when a user accesses a captive portal. It runs once to gather information or enforce policies and then removes itself from the system, hence the term 'dissolvable.'

Reference

FortiNAC documentation on agent deployment and types of agents.

Question 7

Which two things must be done to allow FortiNAC to process incoming syslog messages from an unknown vendor? (Choose two.)

AA security event parser must be created for the device.

BThe device sending the messages must be modeled in the Network Inventory view.

CThe device must be added as a patch management server.

DThe device must be added as a log receiver.

Answer : A, B

To allow FortiNAC to process incoming syslog messages from an unknown vendor, two steps must be taken:

Creation of a customized event parser: This enables FortiNAC to parse and integrate syslog messages from any vendor or device, as long as the messages are in CSV, CEF, or Tag/Value format.

Modeling the device in the Topology view: Any device that sends syslog messages to FortiNAC must be modeled in this view. FortiNAC will not process syslog or trap messages unless the source address belongs to a device modeled in the topology.

Reference

FortiNAC 7.2 Study Guide, pages 428 and 399

Fortinet NSE 6 - FortiNAC 7.2 NSE6_FNC-7.2 Exam Questions