NSE5_FNC_AD_7.6 Fortinet NSE 5 - FortiNAC-F 7.6 Administrator Free Practice Exam Questions (2026 Updated)

In a FortiNAC-F deployment, the configuration of theDHCP scopefor isolation networks (Registration, Remediation, etc.) must perfectly align with the underlying network infrastructure to ensure that isolated hosts can communicate with the FortiNAC appliance. In the provided exhibits, there is a clear discrepancy between theDHCP configurationand theNetwork Topology.

As shown in the " Network Topology " exhibit, theRegistration Networkresides on a router interface (or sub-interface) with the IP address192.168.180.1. This address represents the default gateway for any host placed into the Registration VLAN. However, the " DHCP configuration " exhibit shows the scope " REG-ScopeOne " configured with aGateway of 10.0.1.254. This 10.0.1.254 address belongs to the management/service network (port2 of FortiNAC), not the registration subnet. If a host in the Registration VLAN receives this incorrect gateway via DHCP, it will attempt to send all off-link traffic to an unreachable IP, preventing it from loading theCaptive Portalor communicating with the FortiNAC server.

According to theFortiNAC-F Configuration Wizard Reference, when defining a Layer 3 network scope, the " Gateway " field must contain the IP address of the router interface that acts as the gateway for that specific isolation VLAN. The FortiNAC appliance itself usually sits on a different subnet, and traffic is directed to it via the router ' s DHCP Relay (IP Helper) and DNS redirection.

" When configuring scopes for a Layer 3 network, theGatewayvalue must be the IP address of the router interface for that subnet. This allows the host to reach its local gateway to route traffic. If the gateway is misconfigured, the host will be unable to reach the FortiNAC eth1/port2 interface for registration... Ensure the Gateway matches the network topology for the isolation VLAN. " —FortiNAC-F Configuration Wizard Reference Manual: DHCP Scopes.

The correct answer is A . In FortiNAC-F, device profiling rules are used primarily to classify unknown or untrusted devices when they are first discovered. The study guide explains that when a device does not already exist in the database, FortiNAC-F adds it, treats it as a rogue, and evaluates it against enabled device profiling rules. It also states that devices are initially evaluated against device profiling rules only if they do not already exist in the database, because this avoids unnecessary repeated evaluation of known devices.

The exhibit also matters: the rules are enabled and set to Automatic registration, but Confirm Rule On Connect is not enabled and Confirm Rule Interval is set to None . That means FortiNAC-F will not automatically revalidate already-profiled or trusted devices every time they connect. Option B is wrong because trusted devices are not repeatedly evaluated unless rule confirmation is configured. Option C is too broad because all hosts are not processed through profiling rules on every connection. Option D is also wrong because changing location does not by itself force automatic device profiling; location can be used as a rule method, but the automatic evaluation described here applies when the rogue device is initially added to the database.

TheUser/Host Profilein FortiNAC-F is the fundamental logic engine used to categorize endpoints for policy assignment. As seen in the exhibit, the configuration uses a combination of Boolean logic operators (ORandAND) to define the " Who/What " attributes.

According to theFortiNAC-F Administrator Guide, attributes grouped together within the same bracket or connected by anORoperator require only one of those conditions to be met. In the exhibit, the first two attributes are " Host Role = Contractor " OR " Host Persistent Agent = Yes " . This forms a single logical block. This block is then joined to the third attribute ( " Host Security Access Value = Contractor " ) by anANDoperator. Consequently, a host must satisfyat least oneof the first two conditionsANDsatisfy the third condition to match the " Who/What " section.

Furthermore, the profile includesLocationandWhen(time) constraints. The exhibit shows the location is restricted to the " Building 1 First Floor Ports " group. The " When " schedule is explicitly set toMon-Fri 6:00 AM - 5:00 PM. For a profile to match,allenabled sections (Who/What, Locations, and When) must be satisfied simultaneously. Therefore, the host must meet the conditional contractor/agent criteria, possess the specific security access value, and connect during the defined 6 AM to 5 PM window.

" User/Host Profiles use a combination of attributes to identify a match. Attributes joined byORrequire any one to be true, while attributes joined byANDmust all be true. If aSchedule(When) is applied, the host must also connect within the specified timeframe for the profile to be considered a match. All criteria in the Who/What, Where, and When sections are cumulative. " —FortiNAC-F Administration Guide: User/Host Profile Configuration.

The correct answer is D . For FortiGate VPN integration, FortiNAC-F depends on syslog from FortiGate to receive VPN user, IP address, and session information. The FortiNAC-F study guide states that after a remote user successfully authenticates and establishes a VPN connection, FortiGate sends user, IP, and session information to FortiNAC-F using syslog. This keeps FortiNAC-F aware of the VPN session so it can apply the correct access control state and update FortiGate when the device becomes trusted.

Option A is wrong because SNMP traps are commonly used for infrastructure events, link traps, or third-party event inputs, but this VPN workflow uses FortiGate syslog. Option B is wrong because RADIUS accounting can update session information in some NAC workflows, but the FortiGate VPN integration described in the guide uses syslog. Option C is wrong because Security Fabric integration is not the required mechanism for keeping FortiNAC-F updated with VPN session details in this scenario.

The integration between FortiNAC-F and Mobile Device Management (MDM) platforms (such as Microsoft Intune, VMware Workspace ONE, or Jamf) is a critical component for providing visibility into mobile assets that do not connect directly to the managed infrastructure via standard wired or wireless protocols.

According to theFortiNAC-F MDM Integration Guide, the communication between the FortiNAC-F appliance and the MDM server is handled throughREST APIcalls. FortiNAC-F acts as an API client, periodically polling the MDM server to retrieve device metadata, compliance status, and ownership information. If communication is failing, it is most likely because the API credentials (Client ID/Secret) are incorrect, the MDM ' s API endpoint is unreachable from the FortiNAC-F service port, or the SSL certificate presented by the MDM is not trusted by the FortiNAC-F root store.

While SSH (B) is used for switch CLI management and the Security Fabric (A) uses proprietary protocols for FortiGate synchronization, neither is the primary vehicle for MDM data exchange. SOAP API (D) is an older protocol that has been largely replaced by REST in modern FortiNAC integrations.

" FortiNAC integrates with MDM systems by utilizingREST APIcommunication to query the MDM database for device information. To establish this link, administrators must configure the MDM Service Connector with the appropriateAPI URLand authentication credentials. If the ' Test Connection ' fails, verify that the FortiNAC can reach the MDM provider via theREST APIport (usually HTTPS 443). " —FortiNAC-F Administration Guide: MDM Integration and Troubleshooting.

TheN+1 High Availability (HA)architecture was introduced in FortiNAC-F version 7.6 to provide a more scalable and flexible redundancy model compared to the traditional 1+1 active/passive setup. In an N+1 configuration, a single secondary (standby) appliance can provide coverage for multiple primary (active) Control and Application (CA) appliances.

To set up an N+1 HA cluster, there are two fundamental structural requirements:

A FortiNAC-F Manager (FortiNAC-M):Unlike standard 1+1 HA, which can be configured directly between two CAs, N+1 management is centralized. The FortiNAC-M acts as the orchestrator that manages the failover groups, monitors the health of the primaries, and coordinates the promotion of the secondary server if a primary fails.

A FortiNAC-F device designated as a Secondary:The cluster must have one appliance explicitly configured with theSecondary failover role. This device remains in a standby state, receiving database replications from all N primaries in its group until it is called upon to take over the functions of a failed unit.

While a cluster can support multiple primaries (D), it does not strictly require " at least two " to function as an N+1 group; it simply requires N primaries (where N ≥ 1). Additionally, N+1 is typically a Layer 3 managed solution via the Manager, meaning it does not mandate a " dedicated VLAN " for synchronization like some Layer 2 HA deployments.

" In FortiNAC-F 7.6,FortiNAC-Mfunctions as a manager to manage the N+1 Failover Groups... enabling N+M high availability for CAs. To create an N+1 Failover group, you should add thesecondary CAto the FortiNAC-M first, then add the primary CAs. The secondary CA is designed to take over the functionality of any single failed primary component. " —FortiNAC-F 7.6.0 N+1 Failover Reference Manual.

When troubleshooting network access in FortiNAC-F, it is often necessary to verify exactly why a host has been granted a specific level of access. Since FortiNAC-F evaluates policies from the top down and assigns access based on the first match, an administrator needs a clear way to see the results of this evaluation for a specific live endpoint.

ThePolicy Details (C)view is the designated tool for this purpose. By navigating to theHosts > Hosts(or Adapter View) in the Administration UI, an administrator can search for the specific MAC address or IP of the host in question. Right-clicking on the host record reveals a context menu from whichPolicy Detailscan be selected. This view provides a real-time " look " into the policy engine ' s decision for that specific host, showing theNetwork Access Policythat was matched, theUser/Host Profilethat triggered the match, and the resultingNetwork Access Configuration(VLAN/ACL) currently applied.

WhilePolicy Logs (A)provide a historical record of all policy transitions across the system, they are often too high-volume to efficiently find a single host ' s current state. TheConnections view (B)shows the physical port and basic status but lacks the granular policy logic breakdown. ThePort Properties (D)view shows the configuration of the switch interface itself, which is only one component of the final access determination.

" To identify which policy is currently applied to a specific endpoint, use thePolicy Detailsview. Navigate toHosts > Hosts, select the host, right-click and choosePolicy Details. This window displays the specificNetwork Access Policy, User/Host Profile, and Network Access Configuration currently in effect for that host record. " —FortiNAC-F Administration Guide: Policy Details and Troubleshooting.

Questions no:22

Verified Answer: D

Comprehensive and Detailed 250 to 300 words each Explanation with Exact Matched Extract from FortiNAC-F Administrator library and documentation for current versions (including F 7.2, 7.4, and 7.6) documents:

In FortiNAC-F, the expiration of a guest or contractor account is determined by the configuration settings within theAccount Creation Wizardand the associatedGuest/Contractor Template. While a template can define a default " Account Duration " (as seen in the 12-hour setting in the second exhibit), theAccount Creation Wizardallows an administrator to manually specify or override the start and end parameters for a specific user session.

According to theFortiNAC-F Administration Guideregarding guest management, theAccount End Datefield in the creation wizard is the definitive timestamp for when the account object will be disabled or deleted from the system. In the provided exhibit (Account Creation Wizard), the administrator has explicitly set theAccount Start Dateto2025/09/12 08:00:00and theAccount End Dateto2025/09/13 17:00:00.

Even though the template indicates an " Account Duration " of 12 hours, this value typically serves as a pre-populated default. When a manual date and time are entered into the wizard, those specific values take precedence for that individual account. The account will remain active and valid until5:00 PM (17:00:00)on the following day,2025/09/13. It is also important to note the " Login Availability " from the template (8:00 AM - 7:00 PM); while the accountexistsuntil the 13th at 17:00:00, the user would only be able to authenticate during the active hours defined by the login schedule on both days.

" When creating an account, the administrator can select a template to provide default settings. However, specific values such as theAccount End Datecan be modified within theAccount Creation Wizard. The date and time specified in the ' Account End Date ' field determines the absolute expiration of the account. Once this time is reached, the account is moved to an expired state and the user ' s network access is revoked. " —FortiNAC-F Administration Guide: Guest and Contractor Account Management.

In FortiNAC-F, theConference Manageris a specialized administrative role designed for delegated administration, often used by receptionists or event organizers to create temporary guest accounts. To maintain security and prevent the over-provisioning of credentials, FortiNAC-F allows for granular restrictions on these accounts.

According to theFortiNAC-F Administration GuideregardingAdministrative Profiles, when an administrator creates a profile for a Conference Manager, they can define specific " Account Limits. " Under the profile settings (located inSystem > Settings > Admin Profiles), there is a field specifically for " Max Accounts. " By entering " 30 " into this field, the administrator ensures that any user assigned to this profile cannot exceed 30 active conference accounts at any given time.

This setting is distinct from the Portal configuration or the Guest templates. While templates define thetypeof account (e.g., duration and access level), theAdministrative Profiledefines thecapabilities and limitationsof the person creating those accounts. This ensures that even if a guest template allows for unlimited registrations, the specific administrator is physically restricted by the system from generating more than the allotted 30.

" Administrative Profiles define what an administrator can see and do within the system. For delegated administration roles like the Conference Manager, the ' Max Accounts ' field in the Administrative Profile is used to specify the maximum number of accounts the user is permitted to create. Once this limit is reached, the user will be unable to generate additional accounts until existing ones expire or are deleted. " —FortiNAC-F Administration Guide: Administrative Profiles and Delegated Administration.

The correct answer is A . FortiNAC-F passes firewall tags to FortiGate through Security Fabric integration so FortiGate can use those values as dynamic address groups in firewall policies. The study guide explains that firewall tags are administrator-defined string values and that FortiNAC-F dynamically assigns them based on a security policy or logical network. More specifically for network access enforcement, it states that the network access configuration defines the logical network , and the logical network defines the firewall tag through the device model configuration .

This is the same mechanism used in VPN and Fabric workflows: the FortiGate device model contains the mappings of logical networks to the actual tags or groups that FortiNAC-F sends to FortiGate. The guide states that FortiNAC-F network access policies and logical networks determine the group or tag information, while the FortiGate model configuration contains the mappings used for the values sent.

Option B is not the best answer because a device profiling rule can classify a device and may cause it to match a policy, but it does not directly define the FortiGate tag value sent for policy enforcement. Option C can apply firewall tags in security automation scenarios, but the standard FortiGate dynamic address group mapping is defined in model configuration. Option D is unrelated; RADIUS attributes are used in RADIUS access responses, not FortiGate Fabric tag propagation.

In FortiNAC-F,MAC notification traps(also known as MAC Move or MAC Change traps) are essential for achieving real-time visibility of endpoint connections and disconnections. When a device connects to a switch port, the switch generates an SNMP trap that informs FortiNAC-F of the new MAC address on that specific interface. This allows FortiNAC-F to immediately initiate the profiling and policy evaluation process without waiting for the next scheduled L2 poll.

According to theFortiNAC-F Administration GuideandSwitch Integrationdocumentation, MAC notification traps should be configured onall ports except uplink ports. Uplink ports are the interfaces that connect one switch to another or to the core network. Because these ports see the MAC addresses of every device on the downstream switches, enabling MAC notification on uplinks would cause the switch to send a massive volume of redundant traps to FortiNAC-F every time any device anywhere in the downstream branch moves or reconnects. This can overwhelm the FortiNAC-F process queue and degrade system performance.

By only enabling these traps on " edge " or " access " ports—where individual endpoints like PCs, printers, and VoIP phones connect—FortiNAC-F receives precise data regarding exactly where a device is physically located. Uplinks should be identified in the FortiNAC-F inventory as " Uplink " or " Learned Uplink, " which tells the system to ignore MAC data seen on those specific ports.

" To ensure accurate host tracking and optimal system performance, SNMP MAC notification traps must be enabled on all access (downlink) ports.Do not enable MAC notification traps on uplink ports, as this will result in excessive and unnecessary trap processing. Uplink ports should be excluded to prevent the system from attempting to map multiple downstream MAC addresses to a single infrastructure interface. " —FortiNAC-F Administration Guide: SNMP Configuration for Network Devices.

The correct answer is C . FortiNAC-F security automation does not rely only on a trigger and action. After a security alert is received and the security trigger is satisfied, FortiNAC-F can also evaluate an associated user/host profile before generating the security alarm and executing the action. The study guide explains that user/host profiles are the same profiles used by security policies and are used in security rules to leverage “who, what, where, and when” visibility information. This is exactly what the question requires: the rule must apply specifically to internal engineers , not every user who triggers the FortiGate web-filter category event.

A compliance policy is wrong because compliance policies evaluate endpoint health, posture, scans, or agent results; they do not scope FortiGate web-filter-triggered automation to a user population. A firewall policy is configured on FortiGate, not as the FortiNAC-F-side matching condition in the security rule. A profiling method is also wrong because profiling methods classify rogue or unknown devices, such as printers, cameras, or phones; they do not identify internal engineers for a security automation workflow. The user/host profile is the correct FortiNAC-F object because it lets the same FortiGate security trigger produce a different response depending on the matched user, host, group, location, or ownership context.

In FortiNAC-F, theDevice Profileris a rule-based engine that evaluates unknown " rogue " devices and classifies them based on fingerprints and behavior. When a profiling rule matches a device, the administrator can configure the rule to automatically register that device. The registration process can place the device record in two primary locations: theTopology View(as a device) or theHost View(as a registered host).

According to theFortiNAC-F Administration Guide, registering a device in theHost Viewprovides significant advantages for identity management and historical tracking. First, the devices can beassociated with a user (C). In the FortiNAC database architecture, the Host View is the primary repository for endpoint identity; placing a profiled device here allows the system to link that hardware (MAC address) to a specific user account, whether that user is an employee, guest, or a system-level " owner " . This association is essential for Role-Based Access Control (RBAC) and for tracking accountability across the network fabric.

Second, devices registered in the Host View will haveconnection logs (B). FortiNAC-F maintains a detailed operational history for all host records, including every instance of the device connecting to or disconnecting from a port, its IP address assignments, and the specific policies applied during each session. These logs are invaluable for troubleshooting connectivity issues and for security forensic audits, as they provide a clear timeline of the device ' s lifecycle on the network. In contrast, devices managed only in the Topology View are typically treated as infrastructure components where the focus is on device availability rather than individual session history.

" Devices that are registered and associated with a user are placed in theHost Viewand removed from the Profiled Devices window... Placing a device in the Host View allows for the tracking ofconnection historyand the association of the device with a specificidentity or user recordwithin the FortiNAC database. " —FortiNAC-F Administration Guide: Device Profiler How it Works.

In FortiNAC-F, theGuest & Contractor Templateis a configuration object that defines the parameters for accounts created by sponsors or through self-registration. One of the critical security controls within this template is theLogin Availabilitysetting. This setting restricts the specific days and times during which a guest or contractor is permitted to authenticate and access the network.

As shown in the exhibit, the " StandardGuest " template hasLogin Availabilityset to " Specify Time " , with a schedule defined asMon-Fri, 6:00 AM to 7:00 PM. If a guest user attempts to connect or authenticate at8:00 PM, which is outside of the permitted window, FortiNAC-F ' s policy engine will automatically deny the authentication request. When an authentication attempt is denied due to schedule restrictions, the system does not move the host into the " Authenticated " or " Registered " state required for production access. Instead, the host ismarked as non-authenticatedin the adapter or host view.

This behavior ensures that even if a guest possesses valid credentials, their access is strictly bound by the organizational policy for visitor hours. The host will typically remain in its current isolation or registration VLAN, and the user will see a message on the captive portal indicating that their account is not currently authorized for login. It is important to distinguish this from " at-risk " (C), which relates to security scan failures, or " rogue " (B), which typically refers to unknown devices that have not yet been associated with a valid account or profiling rule.

" Login Availabilitydefines the timeframe during which the guest or contractor account is valid for network access. This schedule is enforced at the time of authentication. If a user attempts to log in outside of the designated window, the authentication is rejected by the system. Consequently, the host record will reflect anon-authenticatedstatus, and the device will remain restricted to the isolation or registration network until a valid login window is reached. " —FortiNAC-F Administration Guide: Guest and Contractor Templates Section.

The correct answers are B and C . The persistent agent is the strongest fit because it is installed and stays resident on the endpoint. The study guide states that after deployment, the persistent agent communicates back to FortiNAC-F every 15 minutes and performs scheduled scans in the background, transparent to the end user. That directly satisfies the requirement for recurring compliance scans without user involvement.

The passive agent can also scan Windows domain end stations without end-user interaction. The guide states that the passive agent is deployed through login/logoff scripts and administrative templates, and that passive agent registration can register and scan hosts associated with LDAP or Active Directory users. If enabled, the passive agent scans the host to verify compliance with the appropriate endpoint policy.

Option A is wrong because the dissolvable agent is a run-once agent that requires manual end-user interaction in the captive portal, then removes itself after reporting results. Option D is not the best answer for this requirement because the mobile agent is specifically for Android onboarding and is manually installed; it is not the general solution for daily compliance scanning of all end stations.

The correct answer is C . The Port Changes view is the correct troubleshooting location when FortiNAC-F changes endpoint network access, such as moving a switch port into a different VLAN. The study guide states that any time FortiNAC-F changes network access for an endpoint, the change is documented in Network > Port Changes . This view shows the date and time of the change, whether a CLI configuration was executed, the reason for the change, the role or access policy that caused it, the port that was changed, and the VLAN the port was changed to.

This directly matches the troubleshooting requirement in the question: the administrator needs to know when the VLAN change happened and why FortiNAC-F made that network access decision. Option A , Security Event view, is used for security-related events, not detailed port-level VLAN-change history. Option B , Reports view, is too broad and not the operational audit trail for a specific access change. Option D , Admin Auditing, tracks administrative actions, but an automatic policy-driven VLAN assignment is documented under Port Changes, not primarily as an admin audit event.