What is the primary function of FortiLink NAC in a LAN environment?
Answer(s): B
FortiLink NACis the NAC (Network Access Control) engine built into FortiGate when it manages FortiSwitch devices.It performs:Automated device onboardingAutomatically detects new devices connecting to switches.Uses MAC, vendor, DHCP fingerprinting, or IoT database to classify devices.No manual VLAN assignment required.Security posture verificationWorks with FortiClient EMS, ZTNA tags, IoT detection.Applies policies based on:Device typeUser roleEndpoint complianceIoT vulnerability statusDynamic VLAN assignmentAutomatically moves devices into proper VLANs, quarantine networks, or guest zones.Integration with LAN Edge & Zero TrustUses FortiGate + FortiSwitch + FortiAP to enforce zero-trust access.This matches the LAN Edge 7.6 Architect explanation of FortiLink NAC.Why other answers are wrongA . Extend security policies across FortiGate firewallsNot NAC. That refers to Security Fabric or SD-WAN.C . Apply manual firewall rulesFortiLink NAC is specifically designed toautomateaccess control.D . Manually place devices in VLANsNAC eliminates manual VLAN assignment -- it is dynamic.
Refer to the exhibits.Examine the FortiGate configuration, FortiAnalyzer logs, and FortiGate widget shown in the exhibits.Security Fabhc quarantine automation has been configured to isolate compromised devices automatically. FortiAnalyzer has been added to the Security Fabric, and an automation stitch has been configured to quarantine compromised devices.To test the setup, a device with the IP address 10.0.2.1 that is connected through a managed FortiSwitch attempts to access a malicious website. The logs on FortiAnalyzer confirm that the event was recorded, but the device does not appear in the FortiGate quarantine widget.Which two reasons could explain why FortiGate is not quarantining the device? (Choose two.)
Answer(s): C,D
In this scenario:FortiGate + FortiAnalyzer are part of theSecurity FabricAnAutomation Stitchis configured:Trigger:Compromised Host High(IOC from FortiAnalyzer)Action:Quarantine on FortiSwitch + FortiAPA test device10.0.2.1visits a malicious website.FortiAnalyzer logs show the event, butFortiGate does NOT quarantine the device.This means theautomation did not receive an IOC trigger, OR theFabric did not classify it as a compromise.Let's evaluate each answer option.C. The malicious website is not recognized as an indicator of compromise (IOC) by FortiAnalyzer.Correct.For FortiGate to quarantine a device:FortiAnalyzer must classify the event as aCompromised Host High / Medium / CriticalFortiAnalyzer must generate anIOC eventFortiGate must receive that IOC through the FabricEven though the FAZ log shows:Action = blockedCategory = Malicious WebsitesThat doesNOTautomatically mean an IOC was generated.A blocked website event isnot always an IOCunless:It is included in theIOC databaseFAZ'sAnalytics / UTM / IOCengine marks it as a compromiseThus, if FAZ only logs a "Malicious Website" event butdoes not classify it as an IOC,
When the MAC address of a device is placed in quarantine on FortiSwitch, what happens to its egress traffic?
Answer(s): A
When a device'sMAC address is quarantinedon a FortiSwitch (via FortiLink NAC, fabric automation, or manual quarantine), FortiSwitch enforces quarantine using thequarantine VLAN, also called theaccess VLANinside FortiSwitch NAC operations.FortiSwitch behavior is defined in LAN Edge documentation:Quarantined devices are moved into an"access VLAN" reserved for isolation.This VLAN isstatically defined on the FortiGate NAC policy, and switch ports dynamically reassign the quarantined MAC into that VLAN.All egress traffic from the quarantined MAC is forced into this VLAN, preventing access to the production network.Thus, the correct description is:Traffic is sent to an access VLAN.Options B, C, and D are incorrect because:Quarantine doesnotreassign to native VLAN.It doesnotsend untagged traffic arbitrarily.It doesnotforward traffic to allowed VLANs
Which statement about generating a certificate signing request (CSR) for a CER certificate is true?
The FortiOS documentation explicitly states that a CSR used for certificate signing must contain accurate and valid fields, especially:Common Name (CN)Organization (O)Country (C)Public key parametersAccording to the FortiGate certificate section:Incorrect CSR field information can cause the CA to reject the request.Reasons include:The CA validates identity and organizational information.Missing or malformed data invalidates PKI requirements.The CSR is not corrected automatically by the CA.Therefore:A is correct.Options BD contradict PKI principles:B is false: CAs do not issue certificates with mismatched identity fields for public trust.C is false: CSR fields are not only for internal use; they define certificate identity.D is false: CAs do not auto-correct CSR fields.
Why is it critical to maintain NTP synchronization between FortiGate and FortiSwitch when FortiLink is configured?
Answer(s): C
FortiGate and FortiSwitchmust share synchronized timewhen operating in FortiLink mode.Documented reasons in FortiOS:Accurate time synchronization is required for logs, authentication events, and fabric correlations.Why it's critical:802.1X EAP and RADIUS timestamp validationNAC policy enforcement timestampsCertificate validationLog correlation in Security Fabric / FortiAnalyzerIncorrect options:A: Firmware synchronization does NOT require NTP.B: Switch-to-switch communication does not depend on NTP.D: Standalone mode is unrelated to time sync.
Post your Comments and Discuss Fortinet FCSS_LED_AR-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_LED_AR-7.6 content, but please register or login to continue.