ZTA-v7.2

1. Refer to the exhibit.

-

• -

• -

• -

• -

• Based on the ZTNA logs provided, which statement is true?

• • B. An authentication scheme is configured.

• • D. Traffic is allowed by firewall policy 1.

• • A. The Remote_User ZTNA tag has matched the ZTNA rule.

• • C. The external IP for ZTNA server is 10.122.0.139.

2. 2. Refer to exhibit.

3. -

4. -

5. -

6. -

7. -

8. Which statement is true about the hr endpoint?

• • D. The endpoint has been marked at risk.

• • B. The endpoint is disabled.

• • A. The endpoint is a rogue device.

• • C. The endpoint is unauthenticated.

3. 3. Which two types of configuration can you associate with a user/host profile on FortiNAC? (Choose two.)

• • C. Inventory

• • A. Service Connectors

• • D. Endpoint compliance

• • B. Network Access

4. 4. Which statement is true regarding a FortiClient quarantine using FortiAnalyzer playbooks?

• • B. FortiAnalyzer discovers malicious activity in the logs and notifies FortiGate.

• • D. FortiClient sends logs to FortiAnalyzer.

• • A. FortiGate sends a notification to FortiClient EMS to quarantine the endpoint.

• • C. FortiAnalyzer sends an API to FortiClient EMS to quarantine the endpoint.

5. 5. An administrator is trying to create a separate web filtering profile for off-fabric and on-fabric clients and push it to managed FortiClient devices.
   Where can you enable this feature on FortiClient EMS?

• • B. ZTNA connection rules

• • D. On-fabric rule sets

• • A. Endpoint policy

• • C. System settings

6. 6. Refer to the exhibit.

7. -

8. -

9. -

10. -

11. -

12. Which port group membership should you enable on FortiNAC to isolate rogue hosts?

• • B. Forced Registration

• • D. Reset Forced Registration

• • A. Forced Authentication

• • C. Forced Remediation

7. 7. Which statement is true about disabled hosts on FortiNAC?

• • D. They are placed in the dead end VLAN.

• • B. They are placed in the authentication VLAN to reauthenticate.

• • A. They are quarantined and placed in the remediation VLAN.

• • C. They are marked as unregistered rogue devices.

8. 8. Refer to the exhibits.

9. -

10. -

11. -

12. -

13. -

14. Which statement is true about the configuration shown in the exhibit?

• • B. If the FortiClient EMS server certificate is invalid, FortiClient connects silently.

• • D. default_ZTNARoot CA signs the FortiClient certificate for the SSL connectivity to FortiClient EMS.

• • A. The domain that FortiClient is connecting to should match the domain to which the certificate is issued.

• • C. The connection from FortiClient to FortiClient EMS uses TCP and TLS 1.2.

9. 9. Which factor is a prerequisite on FortiNAC to add a Layer 3 router to its inventory?

• • B. Allow FTP access to the FortiNAC database from the router.

• • D. SNMP or CLI access to the router to carry out remote tasks.

• • A. Allow HTTPS access from the router to the FortiNAC eth0 IP address.

• • C. The router responding to ping requests from the FortiNAC eth1 IP address.

10. 10. Which statement is true about FortiClient EMS in a ZTNA deployment?

• • B. Provides network and user identity authentication services.

• • D. Acts as ZTNA access proxy for managed endpoints.

• • A. Uses endpoint information to grant or deny access to the network.

• • C. Generates and installs client certificates on managed endpoints.