NSE7_ZTA-7.2 Exam Questions Tutorials

 User/host profiles are used to map sets of hosts and users to different types of policies or rules on FortiNAC. Among the options given, network access and endpoint compliance are the two types of configuration that can be associated with a user/host profile. Network access configuration determines the VLAN, CLI configuration or VPN group that is assigned to a host or user based on their profile. Endpoint compliance configuration defines the policies that checkthe host or user for compliance status, such as antivirus, firewall, patch level, etc. Service connectors and inventory are not types of configuration, but features of FortiNAC that allow integration with other services and devices, and collection of host and user data, respectively. References := User/host profiles | FortiNAC 9.4.0 - Fortinet Documentation and User/host profiles | FortiNAC 9.4.0 - Fortinet Documentation

The method used to install a passive agent on an endpoint is:

• D. Installed by user or deployment tools: Passive agents are typically installed on endpoints either manually by users or automatically through deployment tools used by the organization.

The other options do not accurately describe the installation of passive agents:

• A. Deployed by using a login/logout script: This is not the standard method for deploying passive agents.
• B. Agent is downloaded from Playstore: This is more relevant for mobile devices and does not represent the general method for passive agent installation.
• C. Agent is downloaded and run from captive portal: This method is not typically used for installing passive agents.

References:

• FortiNAC Agent Deployment Guide.
• Installation Methods for Passive Agents in FortiNAC.

According to the FortiNAC documentation1, disabled hosts are placed in the dead end VLAN, which is a special VLAN that isolates them from the production network. This is done to prevent unauthorized or compromised hosts from accessing network resources or spreading malware. The dead end VLAN must be configured in the AP model or the SSID configuration, and the state must be enforced23. Disabled hosts can be enabled again by the administrator or by reauthenticating through the FortiNAC portal. References := 1: Enable or disable hosts | FortiNAC 9.4.0 - Fortinet Documentation 2: Technical Tip: Disabled wireless hosts not isolated - FortiNAC 3: Technical Tip: Disabled wired hosts not isolated - FortiNAC

In the scenario where FortiNAC has alarm mappings configured for MDM (Mobile Device Management) compliance failure and FortiClient EMS (Endpoint Management System) is integrated as an MDM connector, the typical response when an endpoint is quarantined by FortiClient EMS is to isolate the host in the registration VLAN. This action is consistent with FortiNAC's approach to network access control, focusing on ensuring network security and compliance. By moving the non-compliant or quarantined host to a registration VLAN, FortiNAC effectively segregates it from the rest of the network, mitigating potential risks while allowing for further investigation or remediation steps.References:FortiNAC documentation, MDM Compliance and Response Actions.