Fortinet Updated NSE6_FNC_AD-7.6 Exam Questions and Answers by rania

In FortiNAC-F, theSecurity Incidentsengine is used to automate responses to security threats reported by external devices. When an administrator wants to enforce a policy, such as quarantining contractors who access restricted websites, they must create aSecurity Rule. A Security Rule acts as the " if-then " logic that correlates incoming security data with the internal host database.

The documentation specifies that a Security Rule consists of three primary configurable components:

User/Host Profile:This identifieswhoorwhatthe rule applies to (in this case, " Contractors " ).

Trigger:This is theeventthat initiates the rule evaluation. In this scenario, the Trigger would be configured to match specific syslog messages or NetFlow data indicating access to prohibited websites. Triggers use filters to match vendor-specific data, such as a " Web Filter " event from a FortiGate.

Action:This defineswhathappens when the Trigger and User/Host Profile are matched. For this scenario, the administrator would select a " Quarantine " action, which instructs FortiNAC-F to move the endpoint to a restricted VLAN or apply a restrictive ACL.

While " Methods " (A) relate to authentication and " Security Strings " (E) are used for specific SNMP or CLI matching, they are not the structural components of a Security Rule in the Security Incidents menu.

" Security Rules are used to perform a specific action based on certain criteria... To configure a Security Rule, navigate toLogs > Security Incidents > Rules. Each rule requires aTriggerto define the event criteria, anActionto define the automated response (such as Quarantine), and aUser/Host Profileto limit the rule to specific groups. " —FortiNAC-F Administration Guide: Security Rules and Incident Management.

When troubleshooting network access in FortiNAC-F, it is often necessary to verify exactly why a host has been granted a specific level of access. Since FortiNAC-F evaluates policies from the top down and assigns access based on the first match, an administrator needs a clear way to see the results of this evaluation for a specific live endpoint.

ThePolicy Details (C)view is the designated tool for this purpose. By navigating to theHosts > Hosts(or Adapter View) in the Administration UI, an administrator can search for the specific MAC address or IP of the host in question. Right-clicking on the host record reveals a context menu from whichPolicy Detailscan be selected. This view provides a real-time " look " into the policy engine ' s decision for that specific host, showing theNetwork Access Policythat was matched, theUser/Host Profilethat triggered the match, and the resultingNetwork Access Configuration(VLAN/ACL) currently applied.

WhilePolicy Logs (A)provide a historical record of all policy transitions across the system, they are often too high-volume to efficiently find a single host ' s current state. TheConnections view (B)shows the physical port and basic status but lacks the granular policy logic breakdown. ThePort Properties (D)view shows the configuration of the switch interface itself, which is only one component of the final access determination.

" To identify which policy is currently applied to a specific endpoint, use thePolicy Detailsview. Navigate toHosts > Hosts, select the host, right-click and choosePolicy Details. This window displays the specificNetwork Access Policy, User/Host Profile, and Network Access Configuration currently in effect for that host record. " —FortiNAC-F Administration Guide: Policy Details and Troubleshooting.

The correct answer is A . In FortiNAC-F, device profiling rules are used primarily to classify unknown or untrusted devices when they are first discovered. The study guide explains that when a device does not already exist in the database, FortiNAC-F adds it, treats it as a rogue, and evaluates it against enabled device profiling rules. It also states that devices are initially evaluated against device profiling rules only if they do not already exist in the database, because this avoids unnecessary repeated evaluation of known devices.

The exhibit also matters: the rules are enabled and set to Automatic registration, but Confirm Rule On Connect is not enabled and Confirm Rule Interval is set to None . That means FortiNAC-F will not automatically revalidate already-profiled or trusted devices every time they connect. Option B is wrong because trusted devices are not repeatedly evaluated unless rule confirmation is configured. Option C is too broad because all hosts are not processed through profiling rules on every connection. Option D is also wrong because changing location does not by itself force automatic device profiling; location can be used as a rule method, but the automatic evaluation described here applies when the rogue device is initially added to the database.

The integration of FortiNAC-F withFortiGate VPNrequires a specific policy workflow to bridge the gap between initial user authentication and full network access. When a user connects to the VPN, the FortiGate typically provides the User ID and IP address, but FortiNAC-F requires aMAC addressto uniquely identify and manage the endpoint ' s record.

According to theFortiGate VPN Integration Guide, theEndpoint Compliance Policyis a mandatory component of this setup because it is used todesignate the required agent type. Because a VPN connection is Layer 3, FortiNAC cannot " see " the MAC address through traditional SNMP or L2 polling. The compliance policy instructs the system to present aCaptive Portalto the remote user, requiring them to download and run either thePersistentorDissolvable Agent. The agent then reports the device ' s MAC address back to FortiNAC, allowing the system to correlate the VPN session with a host record.

Once the agent is running and the MAC is known, FortiNAC-F can evaluate the device ' s security posture (if scanning is configured) and send the necessaryFSSO tagsback to the FortiGate to lift the initial network restrictions. Without the compliance policy to enforce the agent requirement, the connection would remain in an isolated " IP-only " state with no unique hardware identity.

" TheEndpoint Compliance Policyis necessary to control the agent requirement for VPN users. Create a default VPN Endpoint Compliance Policy todistribute an agentvia captive portal for isolated machines. This policy allows the administrator todesignate the required agent type(Persistent or Dissolvable) that will be used to collect the hardware (MAC) address and perform health scans on the remote endpoint. " —FortiNAC FortiGate VPN Integration Guide: Default Endpoint Compliance Policy (Optional) Section.