NSE5_FNC_AD_7.6 Practice Questions

In FortiNAC-F, theSecurity Incidentsengine is used to automate responses to security threats reported by external devices. When an administrator wants to enforce a policy, such as quarantining contractors who access restricted websites, they must create aSecurity Rule. A Security Rule acts as the " if-then " logic that correlates incoming security data with the internal host database.

The documentation specifies that a Security Rule consists of three primary configurable components:

User/Host Profile:This identifieswhoorwhatthe rule applies to (in this case, " Contractors " ).

Trigger:This is theeventthat initiates the rule evaluation. In this scenario, the Trigger would be configured to match specific syslog messages or NetFlow data indicating access to prohibited websites. Triggers use filters to match vendor-specific data, such as a " Web Filter " event from a FortiGate.

Action:This defineswhathappens when the Trigger and User/Host Profile are matched. For this scenario, the administrator would select a " Quarantine " action, which instructs FortiNAC-F to move the endpoint to a restricted VLAN or apply a restrictive ACL.

While " Methods " (A) relate to authentication and " Security Strings " (E) are used for specific SNMP or CLI matching, they are not the structural components of a Security Rule in the Security Incidents menu.

" Security Rules are used to perform a specific action based on certain criteria... To configure a Security Rule, navigate toLogs > Security Incidents > Rules. Each rule requires aTriggerto define the event criteria, anActionto define the automated response (such as Quarantine), and aUser/Host Profileto limit the rule to specific groups. " —FortiNAC-F Administration Guide: Security Rules and Incident Management.

Comprehensive and Detailed Explanation From Exact Extract of FortiNAC-F 7.6 Administrator Guide or Knowledge:

Exact Extract:

The FortiNAC-F study guide states that MAC notification traps are preferred because FortiNAC-F does not need to connect back to the infrastructure device every time a link-up or link-down trap is received. The required MAC and port information is already included in the MAC notification trap, which makes database updates faster and uses fewer resources. It also states that hosts and devices connected through hubs or IP phones are seen immediately, even when the downstream device cannot generate link-up or link-down traps.

Technical Deep Dive:

The correct answers are B and C . With link-up/link-down traps, the trap only tells FortiNAC-F that an interface changed state. FortiNAC-F then has to perform an L2 poll against the switch forwarding table to discover which MAC address appeared or disappeared. That means extra SNMP/CLI activity, more delay, and more processing on both FortiNAC-F and the switch. The guide confirms that link traps trigger FortiNAC-F to perform a Layer 2 poll, while MAC notification traps directly contain the learned or removed MAC address and associated port.

Option A is wrong because MAC notification traps are Layer 2 visibility events. They identify MAC address and port , not IP address. IP-to-MAC correlation comes from Layer 3 polling or DHCP fingerprinting, not MAC notification traps. Option D is badly worded and should not be selected: MAC notification traps do provide faster updates, but the processing overhead is reduced, not slightly increased.

Operationally, on supported switches you enable SNMP traps for MAC address-table changes and point the trap destination to FortiNAC-

F.  

The process of moving a host from aRegistration VLANto aProduction VLAN(Access VLAN) is a fundamental part of the FortiNAC-F " VLAN steering " workflow. When a host successfully registers via the captive portal, FortiNAC-F evaluates its Network Access Policies to determine the correct VLAN. If the host remains stuck in the Registration VLAN despite a successful registration, it is typically due to port-level restrictions or the presence of other unregistered devices.

The two most common reasons for this behavior as per the documentation are:

The port default VLAN is the same as the Registration VLAN:If the " Default VLAN " field in the switch port ' s model configuration is set to the same ID as the Registration VLAN, the port will not change state because FortiNAC-F believes it is already in its " normal " or " forced " state.

There is another unregistered host on the same port:FortiNAC-F maintains the security posture of the physical port. If multiple hosts are connected to a single port (e.g., via a hub or unmanaged switch) and at least one host remains " Rogue " (unregistered), FortiNAC-F will generally keep the entire port in the isolation/registration VLAN to prevent the unregistered host from gaining unauthorized access to the production network.

Issues with agents (A, B) typically prevent a host from completing compliance or registration but do not usually result in a " stuck " statusafterregistration has already been marked as successful in the system.

" If a port is identified as havingMultiple Hosts, and those hosts require different levels of access, FortiNAC remains in the most restrictive state (Registration or Isolation) until all hosts on that port are authorized... Additionally, verify theDefault VLANsetting for the port; if the Default VLAN and Registration VLAN match, the system will not trigger a VLAN change upon registration. " —FortiNAC-F Administration Guide: Troubleshooting Host Management.