サンプル問題 1： When configuring isolation networks in the configuration wizard, why does a layer 3 network typo allow for mora than ono DHCP scope for each isolation network typo?
A: The layer 3 network type allows for one scope for each possible host status.
B: Configuring more than one DHCP scope allows for DHCP server redundancy
C: There can be more than one isolation network of each type
D: Any scopes beyond the first scope are used if the initial scope runs out of IP addresses.
正解：C
Explanation: In FortiNAC-F, the Layer 3 Network type is specifically designed for deployments where the isolation networks―such as Registration, Remediation, and Dead End―are separated from the FortiNAC appliance's service interface (port2) by one or more routers. This architecture is common in large, distributed enterprise environments where endpoints in different physical locations or branches must be isolated into subnets that are local to their respective network equipment. The reason the Configuration Wizard allows for more than one DHCP scope for a single isolation network type (state) is that there can be more than one isolation network of each type across the infrastructure. For instance, if an organization has three different sites, each site might require its own unique Layer 3 registration subnet to ensure efficient routing and to accommodate local IP address management. By allowing multiple scopes for the "Registration" state, FortiNAC can provide the appropriate IP address, gateway, and DNS settings to a rogue host regardless of which site's registration VLAN it is placed into. When an endpoint is isolated, the network infrastructure (via DHCP Relay/IP Helper) directs the DHCP request to the FortiNAC service interface. FortiNAC then identifies which scope to use based on the incoming request's gateway information. This flexibility ensures that the system is not limited to a single flat subnet for each isolation state, supporting a scalable, multi-routed network topology. "Multiple scopes are allowed for each isolation state (Registration, Remediation, Dead End, VPN, Authentication, Isolation, and Access Point Management). Within these scopes, multiple ranges in the lease pool are also permitted... This configWizard option is used when Isolation Networks are separated from the FortiNAC Appliance's port2 interface by a router." ― FortiNAC-F Configuration Wizard Reference Manual: Layer 3 Network Section.
サンプル問題 2： When FortiNAC-F is managing VPN clients connecting through FortiGate, why must the clients run a FortiNAC-F agent?
A: To transparently update The client IP address upon successful authentication
B: To collect user authentication details
C: To collect the client IP address and MAC address
D: To validate the endpoint policy compliance
正解：C
Explanation: When FortiNAC-F manages VPN clients through a FortiGate, the agent plays a fundamental role in device identification that standard network protocols cannot provide on their own. In a standard VPN connection, the FortiGate establishes a Layer 3 tunnel and assigns a virtual IP address to the client. While the FortiGate sends a syslog message to FortiNAC-F containing the username and this assigned IP address, it typically does not provide the hardware (MAC) address of the remote endpoint's physical or virtual adapter. FortiNAC-F relies on the MAC address as the primary unique identifier for all host records in its database. Without the MAC address, FortiNAC-F cannot correlate the incoming VPN session with an existing host record to apply specific policies or track the device's history. By running either a Persistent or Dissolvable Agent, the endpoint retrieves its own MAC address and communicates it directly to the FortiNAC-F service interface. This allows the "IP to MAC" mapping to occur. Once FortiNAC-F has both the IP and the MAC, it can successfully identify the device, verify its status, and send the appropriate FSSO tags or group information back to the FortiGate to lift network restrictions. Furthermore, while the agent can also perform compliance checks (Option D), the architectural requirement for the agent in a managed VPN environment is primarily driven by the need for session data correlation―specifically the collection of the IP and MAC address pairing. "Session Data Components: • User ID (collected via RADIUS, syslog and API from the FortiGate). • Remote IP address for the remote user connection (collected via syslog and API from the FortiGate and from the FortiNAC agent). • Device IP and MAC address (collected via FortiNAC agent). ... The Agent is used to provide the MAC address of the connecting VPN user (IP to MAC)." ― FortiNAC-F FortiGate VPN Integration Guide: How it Works Section.
サンプル問題 3： An administrator wants to build a security rule that will quarantine contractors who attempt to access specific websites. In addition to a user host profile, which Iwo components must the administrator configure to create the security rule? (Choose two.)
A: Methods
B: Action
C: Endpoint compliance policy
D: Trigger
E: Security String
正解：B, D
Explanation: In FortiNAC-F, the Security Incidents engine is used to automate responses to security threats reported by external devices. When an administrator wants to enforce a policy, such as quarantining contractors who access restricted websites, they must create a Security Rule. A Security Rule acts as the "if-then" logic that correlates incoming security data with the internal host database. The documentation specifies that a Security Rule consists of three primary configurable components: User/Host Profile: This identifies who or what the rule applies to (in this case, "Contractors"). Trigger: This is the event that initiates the rule evaluation. In this scenario, the Trigger would be configured to match specific syslog messages or NetFlow data indicating access to prohibited websites. Triggers use filters to match vendor-specific data, such as a "Web Filter" event from a FortiGate. Action: This defines what happens when the Trigger and User/Host Profile are matched. For this scenario, the administrator would select a "Quarantine" action, which instructs FortiNAC-F to move the endpoint to a restricted VLAN or apply a restrictive ACL. While "Methods" (A) relate to authentication and "Security Strings" (E) are used for specific SNMP or CLI matching, they are not the structural components of a Security Rule in the Security Incidents menu. "Security Rules are used to perform a specific action based on certain criteria... To configure a Security Rule, navigate to Logs > Security Incidents > Rules. Each rule requires a Trigger to define the event criteria, an Action to define the automated response (such as Quarantine), and a User/Host Profile to limit the rule to specific groups." ― FortiNAC-F Administration Guide: Security Rules and Incident Management.
