Fortinet Updated NSE6_FNC_AD-7.6 Exam Questions and Answers by malcolm

The correct answer is A . The exhibit shows two adapters learned on the same wired port: one appears as a rogue/unknown host, and the other is associated with the Lab Hosts rule. The port is in both Role-Based Access and Forced Registration . FortiNAC-F state-based control takes precedence over policy-based provisioning, and the study guide states that when a rogue host connects to a port in the Forced Registration group, FortiNAC-F isolates that host by moving it into the registration captive network. The guide also explains that the Isolation network can be used as a single network for abnormal host states while still presenting state-specific portal pages.

Because this is a wired switch port using VLAN-based control, FortiNAC-F cannot put one host on the production VLAN and the other host on the isolation portal VLAN at the same time on the same access port. The VLAN change applies to the port, not independently to each MAC address behind that port. Therefore, the presence of the rogue host on a Forced Registration port causes the port to be provisioned to the isolation network. Option B is technically unrealistic for this access-port scenario. Option C is wrong because two MAC addresses alone do not make the port an uplink; FortiNAC-F uses uplink logic for infrastructure-device MACs, manually marked uplinks, or a threshold such as more than 20 MAC addresses. Option D is unrelated because Access Point Management is not triggered by learning two wired hosts on a port.

The correct answer is A . In the exhibit, Guest-VLAN is selected as the network access policy Configuration . That policy configuration points to a logical network, but the actual access value for that logical network is not defined inside the guest template, user/host profile, or guest portal. The FortiNAC-F study guide explains that logical networks translate policy-level names into device-specific access values, and those values are configured in the Model Configuration of the infrastructure device. It specifically states that device-specific configurations for infrastructure devices associate the configuration values with the devices, and that after a logical network is created, it appears within the model configuration of each modeled infrastructure device.

So, Guest-VLAN is the logical network selected by the network access policy, while the actual VLAN ID, VLAN name, SSID role, controller group, or vendor-specific access value is configured under the relevant switch, AP, controller, or firewall Model Configuration . Option B is wrong because the guest template defines guest account properties such as role, security/access value, password settings, account duration, and login availability. Option C is wrong because the user/host profile defines the matching condition for guests. Option D is wrong because the guest portal controls onboarding or login behavior, not the infrastructure access value used to provision the endpoint.

The correct answer is D . FortiNAC-F limits what a sponsor can create and manage through the administrator profile assigned to that sponsor. The study guide explains that sponsors can be restricted to specific guest or contractor templates and that the Manage Guests settings in the admin profile define whether the sponsor can manage all accounts, no accounts, or only accounts they created. It also states that allowed templates are defined in the admin profile, meaning each department can be given access only to its own contractor template.

The contractor template defines account fields, role values, authentication method, account duration, and related account properties, but it does not by itself restrict what a sponsor can manage. Portal settings control how users interact with the captive portal or kiosk page, not sponsor administrative scope. A user/host profile is used for matching users or hosts in policy decisions; it does not delegate sponsor permissions. For departmental separation, the administrator must create sponsor-specific administrative profiles that allow only the appropriate templates and account-management scope.