TEST

Which one of the supported communication methods does FortiNAC usefor initial device identification during discovery?

• A.    LLDP

• B.    SNMP

• C.    API

• D.    SSH

Answer explanation

FortiNAC uses a variety of methods to identify devices on the network, such as Vendor OUI, DHCP fingerprinting, and device profiling12. One of the supported communication methods that FortiNAC uses for initial device identification during discovery is SNMP (Simple Network Management Protocol)3. SNMP is a protocol that allows network devices to exchange information and monitor their status4. FortiNAC can use SNMP to read information from switches and routers, such as MAC addresses, IP addresses, VLANs, and port status3. SNMP can also be used to configure network devices and enforce policies4. References: 1: Identification | FortiNAC 9.4.0 - Fortinet Documentation 2: Device profiling process | FortiNAC8.3.0 | Fortinet Document Library 3: Using FortiNAC to identify medical devices - James Pratt 4: How does FortiNAC identify a new device on the network?

Which three methods can you use to trigger layer 2 polling on FortiNAC? (Choose three)

• A.    Polling scripts

• B.    Link traps

• C.    Manual polling

• D. Scheduled tasks

• E.   Polling using API

Answer explanation

To trigger layer 2 polling on FortiNAC, the three methods are:

A.  Polling scripts: These are scripts configured within FortiNAC to actively poll the network at layer 2 to gather information about connected devices.

C. Manual polling: This involves manually initiating a polling process from the FortiNAC interface to gather current network information.

 

D. Scheduled tasks: Polling can be scheduled as regular tasks within FortiNAC, allowing for automated, periodic collection of network data.

The other options are not standard methods for layer 2 polling in FortiNAC:

B.  Link traps: These are more related to SNMP trap messages rather than layer 2 polling.

E. Polling using API: While APIs are used for various integrations, they are not typically used for initiating layer 2 polling in FortiNAC.

References:

 FortiNAC Layer 2 Polling Documentation.  ConfiguringPollingMethodsinFortiNAC

An administrator is trying to create a separate web tittering profile for off-fabric and on-fabric clients and push it to managed FortiClient devices

• A.    Endpoint policy

• B. ZTNA connection rules

• C.    System settings

• D.    On-fabric rule sets

Answer explanation

Explanation

To create a separate web filtering profile for off-fabric and on-fabric clients and push it to managed FortiClient devices in FortiClient EMS, the feature can be enabled in:

 

A.  Endpoint Policy: This is where administrators can define and manage different policies for FortiClient endpoints. These policies can include settings for web filtering, which can be customized for on-fabric and off-fabric scenarios.

The other options do not directly relate to the creation and management of web filtering profiles:

 

B.  ZTNA Connection Rules: These rules are more focused on access control and do not deal directly with web filtering profiles.

C.  System Settings: This section typically includes overall system configurations rather than specific policy definitions.

 

D.  On-fabric Rule Sets: While important for on-fabric configurations, they don't directly deal with web filtering profiles.

References:

 FortiClient EMS Administration Guide.

 Managing Endpoint Policies in FortiClient EMS.

FortiNAC has alarm mappings configured for MDM compliance failure, and FortiClient EMS is added as a MDM connector When an endpoint is quarantined by FortiClient EMS, what action does FortiNAC perform?

• A.    The host is isolated in the registration VLAN

• B.    The host is marked at risk

• C.    The host is forced to authenticate again

• D. The host is disabled

Answer explanation

Explanation

In the scenario where FortiNAC has alarm mappings configured for MDM (Mobile Device Management) compliance failure and FortiClient EMS (Endpoint Management System) is integrated as an MDM connector, the typical response when an endpoint is quarantined by FortiClient EMS is to isolate the host in the registration VLAN. This action is consistent with FortiNAC's approach to network access control, focusing on ensuring network security and compliance. By moving the non-compliant or quarantined host to a registration VLAN, FortiNAC effectively segregates it from the rest of the network, mitigating potential risks while allowing for further investigation or remediation steps.References:FortiNAC documentation, MDM Compliance and Response Actions.

Which two statements are true regarding certificate-based authentication for ZTNA deployment? (Choose two.)

• A.    FortiGate signs the client certificate submitted by FortiClient.

• B.    The default action for empty certificates is block

• C.    Certificate actions can be configured only on the FortiGate CLI

• D.    Client certificate configuration is a mandatory component for ZTNA

Answer explanation

Explanation

Certificate-based authentication is a method of verifying the identity of a device or user by using a digital certificate issued by a trusted authority. For ZTNA deployment, certificate-based authentication is used to ensure that only authorized devices and users can access the protected applications or resources.

B. The default action for empty certificates is block. This is true because ZTNA requires both device and user verification before granting access. If a device does not have a valid certificate issued by the ZTNA CA, it will be blocked by the ZTNA gateway. This prevents unauthorized or compromised devices from accessing the network.

D. Client certificate configuration is a mandatory component for ZTNA. This is true because ZTNA relies on client certificates to identify and authenticate devices. Client certificates are generated by the ZTNA CA and contain the device ID, ZTNA tags, and other information. Client certificates are distributed to devices by the ZTNA management server (such as EMS) and are used to establish a secure connection with the ZTNA gateway.

A. FortiGate signs the client certificate submitted by FortiClient. This is false because FortiGate does not sign the client certificates. The client certificates are signed by the ZTNA CA, which is a separate entity from FortiGate. FortiGate only verifies the client certificates and performs certificate actions based on the ZTNA tags.

C. Certificate actions can be configured only on the FortiGate CLI. This is false because certificate actions can be configured on both the FortiGate GUI and CLI. Certificate actions are the actions that FortiGate takes based on the ZTNA tags in the client certificates. For example, FortiGate can allow, block, or redirect traffic based on the ZTNA tags.

References :=

 1: Technical Tip: ZTNA for Corporate hosts with SAML authentication and FortiAuthenticator as IDP  2: Zero Trust Network Access - Fortinet

An administrator wants to prevent direct host-to-host communication at layer 2 and use only FortiGate to inspect all the VLAN traffic What three things must the administrator configure on FortiGate to allow traffic between the hosts? (Choose three.)

• A. Configure proxy ARP to allow traffic

• B.    Block intra-VLAN traffic in the VLAN interface settings

• C.    Add the VLAN interface to a software switch

• D.    Configure static routes to allow subnets

• E.   Configure a firewall policy to allow the desired traffic between hosts

Answer explanation

Explanation

To prevent direct host-to-host communication at layer 2 and use only FortiGate to inspect all the VLAN traffic, an administrator must configure:

 

B. Block intra-VLAN traffic in the VLAN interface settings: This setting prevents direct communication between hosts within the same VLAN, forcing traffic to be routed through FortiGate for inspection.

 

D. Configure static routes to allow subnets: By setting up static routes, the administrator ensures that traffic between different subnets is correctly routed through the FortiGate for inspection and policy enforcement.

 

E. Configure a firewall policy to allow the desired traffic between hosts: Firewall policies on the FortiGate will dictate what traffic is permitted between hosts, ensuring that only authorized traffic is allowed.

The other options are not typically required for this setup:

 

A. Configure proxy ARP to allow traffic: Proxy ARP is not necessary for this scenario as it involves answering ARP requests on behalf of another host, which is not relevant to blocking intra-VLAN traffic.

 

C. Add the VLAN interface to a software switch: This would create a switch-like environment on the FortiGate, which is counterproductive to the goal of preventing direct host-to-host communication at layer 2.

References:

 FortiGate VLAN Configuration Guide.

 Blocking Intra-VLAN Communication in FortiGate.

In which FortiNAC configuration stage do you define endpoint compliance?

• A.    Device onboarding

• B. Management configuration

• C.    Policy configuration

• D.    Network modeling

Answer explanation

Endpoint compliance is defined in the policy configuration stage of FortiNAC. Endpoint compliance policies specify which endpoint compliance configuration and user/host profile are applied to a host based on its location, user, and device type. Endpoint compliance configurations define whether a host is required to download an agent and undergo a scan, permitted access with no scan, or denied access. The scan parameters and security actions are also configured in the endpoint compliance configurations. Therefore, to define endpoint compliance, you need to create and assign endpoint compliance policies and configurations in the policy configuration stage of

FortiNAC. References := https://docs.fortinet.com/document/fortinac/9.4.0/administration-guide/985922/endpoi https://docs.fortinet.com/document/fortinac/9.4.0/fortinac-manager/161887/endpoint-compliance-configurations

With the increase in loT devices, which two challenges do enterprises face? (Choose two.)

• A. Bandwidth consumption due to added overhead of loT

• B.    Maintaining a high performance network

• C.    Unpatched vulnerabilities in loT devices

• D.    Achieving full network visibility

Answer explanation

Explanation

With the increase in IoT devices, enterprises face many challenges in securing and managing their network and data. Two of the most significant challenges are:

 Unpatched vulnerabilities in IoT devices (Option C): IoT devices are often vulnerable to cyber attacks due to their increased exposure to the internet and their limited computing resources. Some of the security challenges in IoT include weak password protection, lack of regular patches and updates, insecure interfaces, insufficient data protection, and poor IoT device management12. Unpatched vulnerabilities in IoT devices can allow hackers to exploit them and compromise the network or

data. For example, the Mirai malware infected IoT devices by using default credentials and created a massive botnet that launched DDoS attacks on internet services2.

 Achieving full network visibility (Option D): IoT devices can generate a large amount of data that needs to be collected, processed, and analyzed. However, many enterprises lack the tools and capabilities to monitor and manage the IoT devices and data effectively. This can result in poor performance, inefficiency, and security risks. Achieving full network visibility means having a clear and comprehensive view of all the IoT devices, their status, their connectivity, their data flow, and their potential threats. This can help enterprises optimize their network performance, ensure data quality and integrity, and detect and prevent any anomalies or attacks3.

References := 1: Challenges in Internet of things (IoT) - GeeksforGeeks 2: Top IoT security issues and challenges (2022) – Thales 3: 7 challenges in IoT and how to overcome them - Hologram

Which statement is true about FortiClient EMS in a ZTNA deployment?

• A.    Uses endpoint information to grant or deny access to the network

• B.    Provides network and user identity authentication services

• C.    Generates and installs client certificates on managed endpoints

• D.    Acts as ZTNA access proxy for managed endpoints

Answer explanation

Explanation

In a ZTNA (Zero Trust Network Access) deployment, FortiClient EMS:

 

A.  Uses endpoint information to grant or deny access to the network: FortiClient EMS plays a critical role in ZTNA by using information about the endpoint, such as its security posture and compliance status, to determine whether to grant or deny network access.

The other options do not accurately represent the role of FortiClient EMS in ZTNA:

 

B.  Provides network and user identity authentication services: While it contributes to the overall ZTNA strategy, FortiClient EMS itself does not directly provide authentication services.

 

C.  Generates and installs client certificates on managed endpoints: Certificate management is typically handled by other components in the ZTNA framework.

 

D.  Acts as ZTNA access proxy for managed endpoints: FortiClient EMS does not function as an access proxy; its role is more aligned with endpoint management and policy enforcement.

References:

 FortiClient EMS in Zero Trust Network Access Deployment.  Role of FortiClient EMS in ZTNA.

Which configuration is required for FortiNAC to perform an automated incident response based on the FortiGate traffic?

• A.    FortiNAC should be added as a participant in the Security Fabric

• B.    FortiNAC requires read-write SNMP access to FortiGate.

• C.    FortiNAC should be configured as a syslog server on FortiGate

• D.    FortiNAC requires HTTPS access to FortiGate for API calls

Answer explanation

Explanation

For FortiNAC to perform automated incident response based on FortiGate traffic, the required configuration is:

 

A.  FortiNAC should be added as a participant in the Security Fabric: By integrating FortiNAC into the Fortinet Security Fabric, it can respond to incidents based on traffic analysis performed by FortiGate. This allows for coordinated and automated responses to security events.

The other options are not specifically required for automated incident response in this context:

 

B.  FortiNAC requires read-write SNMP access to FortiGate: While SNMP access is important for certain functions, it is not the key requirement for this

specific use case.

 

C.  FortiNAC should be configured as a syslog server on FortiGate: Configuring FortiNAC as a syslog server is useful for log collection but not specifically for automated incident response based on traffic.

 

D.  FortiNAC requires HTTPS access to FortiGate for API calls: HTTPS access for API calls is important for integration, but it is not the primary requirement for automated incident response based on FortiGate traffic analysis.

References:

 FortiNAC Integration with FortiGate for Incident Response.  Fortinet Security Fabric Documentation.