"The firewall policy matches and redirects client requests to the access proxy VIP"https://docs.fortinet.com/document/fortigate/7.0.0/new-features/194961/basic-ztna-configuration

FortiClient communicates directly with FortiClient EMS to continuously share device status information through ZTNA telemetry.

https://community.fortinet.com/t5/FortiClient/Technical-Note-FortiClient-fails-to-install-from-FortiClient-EMS/ta-p/193680

The deployment service error message may be caused by any of the following. Try eliminating them all, one at a time.

1. Wrong username or password in the EMS profile

2. Endpoint is unreachable over the network

3. Task Scheduler service is not running

4. Remote Registry service is not running

5. Windows firewall is blocking connection

Requirement Analysis:

The administrator needs to maintain a software vulnerability scan on endpoints without showing the feature on FortiClient.

Evaluating Options:

Disabling the feature in the deployment package or endpoint profile would remove the functionality entirely, which is not desired.

Using the default endpoint profile may not meet the specific requirement of hiding the feature.

Clicking the hide icon on the vulnerability scan profile assigned to the endpoint will keep the feature active but hidden from the user's view.

Conclusion:

The correct action is to click the hide icon on the vulnerability scan profile assigned to the endpoint (C).

Based on theFortiClient EMS 7.2/7.4 Administration Guideand the provided exhibit of theSystem Settings Profile, the expected behavior for an invalid certificate connection is determined by theInvalid Certificate Actionsetting.

1. Analysis of the Exhibit

Location:The exhibit shows theSystem Settings Profile(specifically the "Default" profile).

Setting:At the bottom under theEndpoint Controlsection, the fieldInvalid Certificate Actionis configured.

Selected Action:The dropdown forInvalid Certificate Actiondisplays awarning icon(an orange triangle with an exclamation mark). In the FortiClient EMS GUI, this specific icon corresponds to the"Warn"action.

2. Verified Behavior (Option C)

According to the curriculum documents regardingEndpoint Communication Security:

Warn Action Behavior:When theInvalid Certificate Actionis set toWarn, FortiClient is instructed to display a warning message to the end user if the EMS server certificate is untrusted, expired, or has a hostname mismatch.

User Prompt:The warning message explicitly asks the user whether they wish to proceed with the connection despite the security risk or terminate the attempt.

Connection Logic:If the user manually accepts the warning, FortiClient will establish the Telemetry connection and "remember" the certificate for future sessions to avoid repeated prompts for that specific server.

3. Why Other Options are Incorrect

A. FortiClient is blocked:This behavior only occurs if the administrator selects the"Deny"action in the profile.

B. Additional password required:The password field shown at the top of the exhibit is for"Require Password to Disconnect From EMS", which prevents users from manually unregistering, but it does not bypass or resolve certificate errors.

D. EMS pushes a valid certificate:EMS cannot "push" a valid identity certificate to resolve a failed TLS handshake; a valid certificate must be manually installed on the EMS server by the administrator.

FortiClient supports initiating the following VPN types from the Windows command prompt:

IPSec VPN:FortiClient can establish IPSec VPN connections using command line instructions.

SSL VPN:FortiClient also supports initiating SSL VPN connections from the Windows command prompt.

These two VPN types can be configured and initiated using specific command line parameters provided by FortiClient.

References

FortiClient EMS 7.2 Study Guide, VPN Configuration Section

Fortinet Documentation on Command Line Options for FortiClient VPN