Helping Hand Questions for FCP_FCT_AD-7.2

FortiClient communicates directly with FortiClient EMS to continuously share device status information through ZTNA telemetry.

Observation of Logs:

The logs show a policy named "Fortinet-Training" being applied to the endpoint.

Evaluating Policies:

The log entries indicate that the "Fortinet-Training" policy was received and applied.

Conclusion:

Based on the logs, the currently applied policy on the FortiClient endpoint is "Fortinet-Training".

References:

FortiClient EMS policy configuration and log analysis documentation from the study guides.

Block Malicious Website has nothing to do with infected files. Since Realtime Protection is OFF, it will be allowed without being scanned.

Based on the settings shown in the exhibit:

Realtime Protection:OFF

Dynamic Threat Detection:OFF

Block malicious websites:ON

Threats Detected:75

The "Realtime Protection" setting is crucial for preventing infected files from being downloaded and executed. Since "Realtime Protection" is OFF, FortiClient will not actively scan files being downloaded. The setting "Block malicious websites" is intended to prevent access to known malicious websites but does not scan files for infections.

Therefore, when a user tries to download an infected file, FortiClient will allow the file to download without scanning it due to the Realtime Protection being OFF.

References

FortiClient EMS 7.2 Study Guide, Antivirus Protection Section

Fortinet Documentation on FortiClient Real-time Protection Settings

When FortiClient is installed on a Windows Server, the default behavior for real-time protection control is:

Real-time protection is disabled:By default, FortiClient does not enable real-time protection on server installations to avoid potential performance impacts and because servers typically have different security requirements compared to client endpoints.

Thus, real-time protection is disabled by default on Windows Server installations.

References

FortiClient EMS 7.2 Study Guide, Real-time Protection Section

Fortinet Documentation on FortiClient Default Settings for Server Installations