In a corporate domain environment where " enhanced endpoint visibility " is required, thePersistent Agentis the recommended choice. Unlike the Dissolvable Agent, which is temporary and intended for one-time compliance scans during registration, the Persistent Agent is an " install-and-stay-resident " application.

The Persistent Agent is specifically designed to be distributed through automated enterprise methods, includinglogin scripts, Group Policy Objects (GPO), or third-party software management tools. When deployed via a login script, the agent can be configured to silently install and immediately begin communicating with the FortiNAC-F service interface. Once active, it provides continuous visibility by reporting host details such as logged-on users, installed applications, and adapter information. It also listens for Windows session events (logon/logoff) to trigger automatic single-sign-on (SSO) registration in FortiNAC-F, ensuring that as soon as a user connects to the domain, their device is identified and assigned the correct network access policy.

" The Persistent Agent can be distributed to Windows domain machines vialogin scriptor by any other software distribution method your organization might use. The Persistent Agent remains installed on the host at all times. Once the agent is installed it runs in the background and communicates with FortiNAC at intervals established by the FortiNAC administrator. " —FortiNAC-F Administration Guide: Persistent Agent Overview.

In FortiNAC-F, accountability and forensic tracking of configuration changes are managed through theAdmin Auditingfunctionality. When an administrator performs an action that modifies the system state—such as creating a policy, changing a device ' s status, or adding a switch port to anEnforcement Group—the system generates an audit record. This record is essential for troubleshooting scenarios where unauthorized or accidental configuration changes have occurred, leading to unintended network behavior.

TheAdmin Auditingview (found underLogs > Admin Auditing) provides a comprehensive log of the " Who, What, and When " for every administrative session. Each entry includes the username of the administrator, the source IP address from which they accessed the FortiNAC-F console, a precise timestamp, and a detailed description of the modification. In the scenario described, where ports have been incorrectly added to enforcement groups, the Admin Auditing view allows a supervisor to filter by the specific " Port " or " Group " object to identify exactly which administrator executed the command.

In contrast, theEvent Managementview (B) is designed to monitor system and network events, such as RADIUS authentications, host connections, and SNMP trap arrivals. While it tracks system activity, it does not typically log the manual configuration changes performed by admins. ThePort Changesview (C) tracks the operational history of a port (such as VLAN assignment changes and host movements) but does not attribute the administrative assignment of the port to a group. Finally, theSecurity Eventsview (D) is dedicated to alerts triggered by security rules and external threat feeds.

" Admin Auditing displays a record of all modifications made to the FortiNAC-F system by an administrator. This view includes the administrator ' s name, the date and time of the change, and a description of the action taken. It is the primary resource for determining which administrative user performed a specific configuration change, such as modifying port group memberships or altering policy settings. " —FortiNAC-F Administration Guide: Logging and Auditing Section.

The correct answer is A . FortiNAC-F Manager provides global visibility by collecting user and endpoint visibility information from the FortiNAC-F devices it manages, creating a centralized repository of users, hosts, and adapters. The study guide describes this as a global visibility function where endpoint information received by the Manager includes the local FortiNAC-F device from which the information came, allowing administrators to search and filter endpoint records across managed systems.

The key point is that this is not a real-time host-status trigger. Fortinet’s FortiNAC-F Manager documentation states that FortiNAC Manager controls host and user record replication between managed FortiNAC CA servers and initiates synchronization every five minutes between servers. It also states that global object synchronization uses an interval-based process, not an administrator manually synchronizing each CA for endpoint visibility.

Option B is wrong because host status changes are not treated as immediate real-time updates to every managed FortiNAC-F database. Option C is wrong because manual synchronization applies to global/shared configuration objects, not routine endpoint visibility updates. Option D is wrong because the mechanism is not a CA-side scheduled push to the Manager; the Manager-controlled synchronization/collection process is what maintains the shared endpoint view.

Questions no:9

Verified Answer: B

Comprehensive and Detailed 250 to 300 words each Explanation with Exact Matched Extract from FortiNAC-F Administrator library and documentation for current versions (including F 7.2, 7.4, and 7.6) documents:

In FortiNAC-F, the integration with FortiGate for Security Fabric and Single Sign-On (FSSO) allows the system to communicate the access level of an endpoint directly to the firewall usingfirewall tags. This eliminates the need for complex VLAN steering in some environments by allowing the FortiGate to apply policies based on these dynamic tags instead of just a physical or virtual network segment.

The actual assignment of the firewall tag value occurs within aLogical Network. In the FortiNAC-F architectural model, a Logical Network acts as a container for " Access Values " . When an administrator configures a Logical Network (located underNetwork > Logical Networks), they define what that network represents—such as " Corporate Access " or " Contractor Limited " . Within that definition, they assign the specificFirewall Tagthat matches the tag created on the FortiGate. Once a user or host matches aNetwork Access Policy, FortiNAC-F identifies the associated Logical Network and pushes the defined tag to the FortiGate via the FSSO connector.

It is important to note that whileNetwork Access Policies(and by extensionSecurity Rules) are the logic engines thattriggerthe assignment, they do not hold the tag value itself. They simply point to a Logical Network, which serves as the central repository for that specific access configuration.

" To assign firewall tags, navigate toNetwork > Logical Networks. Select the desired logical network and clickEdit. Under theAccess Valuesection, selectFirewall Tagas the type and enter the tag name exactly as it appears on the FortiGate. When a Network Access Policy matches a host, FortiNAC sends this tag to the FortiGate as an FSSO message. " —FortiNAC-F Administration Guide: Logical Networks and Security Fabric Integration.

FortiNAC-F serves as a central manager for security events originating from a diverse ecosystem of third-party security appliances, such as FortiGate, Check Point, and Cisco. Each vendor utilizes its own internal scale forseverity levelswithin syslog messages (e.g., Check Point uses a 1–5 scale, while others may use 0–7). To provide a consistent response regardless of the source, FortiNAC-F usesSeverity Mappingsto normalize these incoming values.

According to theFortiNAC-F Administration Guide, severity mappings allow the administrator to translate vendor-specific threat levels into standardizedFortiNAC Security Levels(such as High, Medium, or Low Violation). When a syslog message arrives, the parser extracts the vendor ' s severity code, and the system immediately references theSecurity Event Severity Level Mappingstable to determine how that event should be categorized internally. This normalization is vital because it allows a singleSecurity Alarmto be configured to respond to any " High Violation " event, whether it was reported as a " Critical " by one vendor or a " Level 5 " by another. Without these mappings, the administrator would have to create separate, redundant security rules for every vendor to account for their different naming conventions and numerical scales.

" Each vendor defines its own severity levels for syslog messages. The following table shows the equivalent FortiNAC security level... To normalize these events, configure theSeverity Level Mappingsfound in the device integration guides. This allows FortiNAC to generate a consistent security event that can then trigger an alarm regardless of the reporting vendor ' s specific terminology. " —FortiNAC-F Administration Guide: Vendor Severity Levels and Syslog Management.

In FortiNAC-F, theInventory topologyuses specific icons to represent the status and model of discovered network infrastructure. When a switch or other network device is discovered via SNMP, FortiNAC-F retrieves itsSystem ObjectID (sysObjectID)to identify the specific make and model. This OID is then compared against the internal database of supported device mappings.

Aquestion mark (?)icon appearing on a discovered switch indicates that while the discovery process successfully communicated with the device (meaning SNMP credentials were correct), theSNMP ObjectID is not recognizedor mapped in the current version of FortiNAC-F. This essentially means the device is " unsupported " by the current software out-of-the-box. Because the OID is unknown, FortiNAC-F does not know which CLI or SNMP command set to use for critical functions like L2 polling (host visibility) or VLAN switching (enforcement). To resolve this, an administrator can manually " Set Device Mapping " to a similar existing model or a " Generic SNMP Device " if only basic L3 visibility is required.

" Discovered devices displaying a ' ? ' iconindicate the currently running version does not have a mapping for that device ' sSystem OID(device is not supported). Device mappings are used to manage the device by performing functions such as L2/L3 Polling, Reading, and Switching VLANs. " —Fortinet Technical Tip: Options for devices unable to be modeled in Inventory.

The correct answer is A . FortiNAC-F passes firewall tags to FortiGate through Security Fabric integration so FortiGate can use those values as dynamic address groups in firewall policies. The study guide explains that firewall tags are administrator-defined string values and that FortiNAC-F dynamically assigns them based on a security policy or logical network. More specifically for network access enforcement, it states that the network access configuration defines the logical network , and the logical network defines the firewall tag through the device model configuration .

This is the same mechanism used in VPN and Fabric workflows: the FortiGate device model contains the mappings of logical networks to the actual tags or groups that FortiNAC-F sends to FortiGate. The guide states that FortiNAC-F network access policies and logical networks determine the group or tag information, while the FortiGate model configuration contains the mappings used for the values sent.

Option B is not the best answer because a device profiling rule can classify a device and may cause it to match a policy, but it does not directly define the FortiGate tag value sent for policy enforcement. Option C can apply firewall tags in security automation scenarios, but the standard FortiGate dynamic address group mapping is defined in model configuration. Option D is unrelated; RADIUS attributes are used in RADIUS access responses, not FortiGate Fabric tag propagation.