NSE5_FNC_AD_7.6 Exam Dumps - Fortinet NSE 5 - FortiNAC-F 7.6 Administrator

The correct answer is A . In a FortiNAC-F 1+1 HA deployment, failover from primary to secondary is automatic, but failback to the primary is not automatic . The study guide states that if the primary device or its network connectivity fails, the secondary assumes control automatically, but restoration of a failed-over HA deployment is a manual administrator-driven process. It further explains that after the cause of the failover is resolved, the administrator must use the Resume Control button to transfer control back to the primary server.

That means when the primary comes back online, it does not immediately take over again. The pair can resume HA communication, but the secondary remains the in-control node until an administrator deliberately returns control to the primary. Option B is wrong because FortiNAC-F 1+1 HA is active-passive, not load-balanced. Option C is wrong because the restored primary does not power itself down for maintenance. Option D is a trap: five failed heartbeats are used in failure detection and gateway validation logic, not as an automatic failback timer. The exam point is simple: automatic failover, manual failback .

The integration of FortiNAC-F withFortiGate VPNrequires a specific policy workflow to bridge the gap between initial user authentication and full network access. When a user connects to the VPN, the FortiGate typically provides the User ID and IP address, but FortiNAC-F requires aMAC addressto uniquely identify and manage the endpoint ' s record.

According to theFortiGate VPN Integration Guide, theEndpoint Compliance Policyis a mandatory component of this setup because it is used todesignate the required agent type. Because a VPN connection is Layer 3, FortiNAC cannot " see " the MAC address through traditional SNMP or L2 polling. The compliance policy instructs the system to present aCaptive Portalto the remote user, requiring them to download and run either thePersistentorDissolvable Agent. The agent then reports the device ' s MAC address back to FortiNAC, allowing the system to correlate the VPN session with a host record.

Once the agent is running and the MAC is known, FortiNAC-F can evaluate the device ' s security posture (if scanning is configured) and send the necessaryFSSO tagsback to the FortiGate to lift the initial network restrictions. Without the compliance policy to enforce the agent requirement, the connection would remain in an isolated " IP-only " state with no unique hardware identity.

" TheEndpoint Compliance Policyis necessary to control the agent requirement for VPN users. Create a default VPN Endpoint Compliance Policy todistribute an agentvia captive portal for isolated machines. This policy allows the administrator todesignate the required agent type(Persistent or Dissolvable) that will be used to collect the hardware (MAC) address and perform health scans on the remote endpoint. " —FortiNAC FortiGate VPN Integration Guide: Default Endpoint Compliance Policy (Optional) Section.

In anN+1 High Availability (HA)configuration, a single secondary Control and Application (CA) server provides backup for multiple primary CA servers. The FortiNAC-F Manager (FortiNAC-M) acts as the centralized orchestrator for this cluster, monitoring the health of all participating nodes.

According to theFortiNAC-F 7.6.0 N+1 Failover Reference Manual, when a primary CA (such asCA-2in the exhibit) fails, the secondary CA (CA-3) is automatically promoted by the Manager to take over the specific workload and database functions of that failed primary. Crucially, the documentation specifies that even after this promotion, the system architecture maintains its N+1 logic. The secondary CA effectively " assumes the identity " of the failed primary while continuing to operate within the N+1 framework established by the Manager.

It doesnotmerge with CA-1 to form a traditional 1+1 active/passive cluster (A), nor does it engage in load balancing (D), as FortiNAC-F HA is designed for redundancy and failover rather than active traffic distribution. Furthermore, CA-3 does not " share " management with CA-1 (C); it independently handles the tasks originally assigned to CA-2. Throughout this failover state, the Manager continues to oversee the group, and CA-3 remains the designated secondary unit currently acting in a primary capacity for the downed node until CA-2 is restored.

" In an N+1 Failover Group, theSecondary CAis designed to take over the functionality ofany single failed primary componentwithin the group. The FortiNAC Manager monitors the primaries and initiates the failover to the secondary... Once failover occurs, the secondary continues to operate as the backup unit for the failed primary while remaining part of the managed N+1 HA configuration. " —FortiNAC-F 7.6.0 N+1 Failover Reference Manual: Failover Behavior Section.

In FortiNAC-F, theLayer 3 Network typeis specifically designed for deployments where the isolation networks—such as Registration, Remediation, and Dead End—are separated from the FortiNAC appliance ' s service interface (port2) by one or more routers. This architecture is common in large, distributed enterprise environments where endpoints in different physical locations or branches must be isolated into subnets that are local to their respective network equipment.

The reason the Configuration Wizard allows for more than one DHCP scope for a single isolation network type (state) is thatthere can be more than one isolation network of each typeacross the infrastructure. For instance, if an organization has three different sites, each site might require its own unique Layer 3 registration subnet to ensure efficient routing and to accommodate local IP address management. By allowing multiple scopes for the " Registration " state, FortiNAC can provide the appropriate IP address, gateway, and DNS settings to a rogue host regardless of which site ' s registration VLAN it is placed into.

When an endpoint is isolated, the network infrastructure (via DHCP Relay/IP Helper) directs the DHCP request to the FortiNAC service interface. FortiNAC then identifies which scope to use based on the incoming request ' s gateway information. This flexibility ensures that the system is not limited to a single flat subnet for each isolation state, supporting a scalable, multi-routed network topology.

" Multiple scopes are allowed for each isolation state (Registration, Remediation, Dead End, VPN, Authentication, Isolation, and Access Point Management). Within these scopes, multiple ranges in the lease pool are also permitted... This configWizard option is used when Isolation Networks are separated from the FortiNAC Appliance ' s port2 interface by a router. " —FortiNAC-F Configuration Wizard Reference Manual: Layer 3 Network Section.

The correct answer is A . The exhibit shows two adapters learned on the same wired port: one appears as a rogue/unknown host, and the other is associated with the Lab Hosts rule. The port is in both Role-Based Access and Forced Registration . FortiNAC-F state-based control takes precedence over policy-based provisioning, and the study guide states that when a rogue host connects to a port in the Forced Registration group, FortiNAC-F isolates that host by moving it into the registration captive network. The guide also explains that the Isolation network can be used as a single network for abnormal host states while still presenting state-specific portal pages.

Because this is a wired switch port using VLAN-based control, FortiNAC-F cannot put one host on the production VLAN and the other host on the isolation portal VLAN at the same time on the same access port. The VLAN change applies to the port, not independently to each MAC address behind that port. Therefore, the presence of the rogue host on a Forced Registration port causes the port to be provisioned to the isolation network. Option B is technically unrealistic for this access-port scenario. Option C is wrong because two MAC addresses alone do not make the port an uplink; FortiNAC-F uses uplink logic for infrastructure-device MACs, manually marked uplinks, or a threshold such as more than 20 MAC addresses. Option D is unrelated because Access Point Management is not triggered by learning two wired hosts on a port.

The correct answer is A . In FortiNAC-F, device profiling rules are used primarily to classify unknown or untrusted devices when they are first discovered. The study guide explains that when a device does not already exist in the database, FortiNAC-F adds it, treats it as a rogue, and evaluates it against enabled device profiling rules. It also states that devices are initially evaluated against device profiling rules only if they do not already exist in the database, because this avoids unnecessary repeated evaluation of known devices.

The exhibit also matters: the rules are enabled and set to Automatic registration, but Confirm Rule On Connect is not enabled and Confirm Rule Interval is set to None . That means FortiNAC-F will not automatically revalidate already-profiled or trusted devices every time they connect. Option B is wrong because trusted devices are not repeatedly evaluated unless rule confirmation is configured. Option C is too broad because all hosts are not processed through profiling rules on every connection. Option D is also wrong because changing location does not by itself force automatic device profiling; location can be used as a rule method, but the automatic evaluation described here applies when the rogue device is initially added to the database.

The correct answers are B and C . The persistent agent is the strongest fit because it is installed and stays resident on the endpoint. The study guide states that after deployment, the persistent agent communicates back to FortiNAC-F every 15 minutes and performs scheduled scans in the background, transparent to the end user. That directly satisfies the requirement for recurring compliance scans without user involvement.

The passive agent can also scan Windows domain end stations without end-user interaction. The guide states that the passive agent is deployed through login/logoff scripts and administrative templates, and that passive agent registration can register and scan hosts associated with LDAP or Active Directory users. If enabled, the passive agent scans the host to verify compliance with the appropriate endpoint policy.

Option A is wrong because the dissolvable agent is a run-once agent that requires manual end-user interaction in the captive portal, then removes itself after reporting results. Option D is not the best answer for this requirement because the mobile agent is specifically for Android onboarding and is manually installed; it is not the general solution for daily compliance scanning of all end stations.

In FortiNAC-F, theInventory topologyuses specific icons to represent the status and model of discovered network infrastructure. When a switch or other network device is discovered via SNMP, FortiNAC-F retrieves itsSystem ObjectID (sysObjectID)to identify the specific make and model. This OID is then compared against the internal database of supported device mappings.

Aquestion mark (?)icon appearing on a discovered switch indicates that while the discovery process successfully communicated with the device (meaning SNMP credentials were correct), theSNMP ObjectID is not recognizedor mapped in the current version of FortiNAC-F. This essentially means the device is " unsupported " by the current software out-of-the-box. Because the OID is unknown, FortiNAC-F does not know which CLI or SNMP command set to use for critical functions like L2 polling (host visibility) or VLAN switching (enforcement). To resolve this, an administrator can manually " Set Device Mapping " to a similar existing model or a " Generic SNMP Device " if only basic L3 visibility is required.

" Discovered devices displaying a ' ? ' iconindicate the currently running version does not have a mapping for that device ' sSystem OID(device is not supported). Device mappings are used to manage the device by performing functions such as L2/L3 Polling, Reading, and Switching VLANs. " —Fortinet Technical Tip: Options for devices unable to be modeled in Inventory.