Verified NSE5_FNC_AD-7.6 Q&As – Pass Guarantee NSE5_FNC_AD-7.6 Exam Dumps [Q12-Q33]

NO.12 When preparing network infrastructure devices for visibility, what are the two main advantages of using MAC notification traps on supported devices instead of linkup and linkdown traps? (Choose two.)

Overhead on FortiNAC-F and the infrastructure device will be reduced.

Faster visibility updates with only a slight increase in processing.

MAC notification traps will include IP address information.

Hosts connecting to downstream non-managed hubs will be immediately learned.

NO.13 Refer to the exhibit.

After a successful layer 2 poll, two hosts were learned on the same port. The port is a member of the Role-Based Access and Forced Registration groups. The switch has been configured to leverage a single isolation VLAN.
How will FortiNAC-F manage this port?

The port will be provisioned as an uplink to a hub or unmanaged switch.

The port will be provisioned for the normal state host, but the second host will have access to only the isolation portal page.

The port will be provisioned to the isolation network.

The port will be added to the Access Point Management group.

NO.14 An administrator wants to use FortiNAC-F to prevent internal engineers from accessing specific websites as defined in web filter categories on FortiGate.
In addition to a security trigger and associated action, which configuration must also be defined on FortiNAC-F?

A profiling method

A firewall policy

A compliance policy

A user/host profile

NO.15 Refer to the exhibit.

Given this topology, and a layer 3 registration network configuration, which IP address would be designated in the DHCP relay configuration for the registration network?

192.168.200.10

192.168.100.20

192.168.100.75

192.168.10.254

NO.16 When creating a device profiling rule, what are two advantages of registering the device in the host view? (Choose two.)

The devices can be managed as a generic SNMP device.

The devices will have connection logs.

The devices can be associated with a user.

The devices can be polled for connection status.

In FortiNAC-F, the Device Profiler is a rule-based engine that evaluates unknown “rogue” devices and classifies them based on fingerprints and behavior. When a profiling rule matches a device, the administrator can configure the rule to automatically register that device. The registration process can place the device record in two primary locations: the Topology View (as a device) or the Host View (as a registered host).
According to the FortiNAC-F Administration Guide, registering a device in the Host View provides significant advantages for identity management and historical tracking. First, the devices can be associated with a user (C). In the FortiNAC database architecture, the Host View is the primary repository for endpoint identity; placing a profiled device here allows the system to link that hardware (MAC address) to a specific user account, whether that user is an employee, guest, or a system-level “owner”. This association is essential for Role-Based Access Control (RBAC) and for tracking accountability across the network fabric.
Second, devices registered in the Host View will have connection logs (B). FortiNAC-F maintains a detailed operational history for all host records, including every instance of the device connecting to or disconnecting from a port, its IP address assignments, and the specific policies applied during each session. These logs are invaluable for troubleshooting connectivity issues and for security forensic audits, as they provide a clear timeline of the device’s lifecycle on the network. In contrast, devices managed only in the Topology View are typically treated as infrastructure components where the focus is on device availability rather than individual session history.
“Devices that are registered and associated with a user are placed in the Host View and removed from the Profiled Devices window… Placing a device in the Host View allows for the tracking of connection history and the association of the device with a specific identity or user record within the FortiNAC database.”

NO.17 An administrator wants to continually monitor endpoints for the existence of a specific registry key and the status of a required security service.
Which two requirements must be in place for the administrator to use FortiNAC-F compliance monitors? (Choose two.)

Remediation admin scan

MDM integration

Persistent agent

Custom scan

NO.18 A network administrator is troubleshooting a network access issue for a specific host. The administrator suspects the host is being assigned a different network access policy than expected.
Where would the administrator look to identify which network access policy, if any, is being applied to a particular host?

The Policy Logs view

The Connections view

The Policy Details view for the host

The Port Properties view of the hosts port

NO.19 What must an administrator configure to allow FortiNAC-F to process incoming syslog messages that are not supported by default?

A Syslog Service Connector

A Security Action

A Security Event Parser

A Log Receiver

NO.20 When creating a user or host profile, which three criteria can you apply? (Choose three.)

Host or user group memberships

Host or user attributes

Adapter current VLAN

An applied access policy

Location

NO.21 Refer to the exhibit.

When configuring guest access using a network access policy, where would an administrator configure the Guest-VLAN value?

In the Model configuration

In the Guest portal configuration

In the User/Host profile

In the Guest template

NO.22 Refer to the exhibits. What would happen if the highlighted port with connected hosts was placed in both the Forced Registration and Forced Remediation port groups?

Both types of enforcement would be applied

Enforcement would be applied only to rogue hosts

Multiple enforcement groups could not contain the same port.

Only the higher ranked enforcement group would be applied.

NO.23 While discovering network infrastructure devices, a switch appears in the inventory topology with a question mark (?) on the icon. What would cause this?

The wrong SNMP community string was entered during discovery.

The SNMP ObjectlD is not recognized by FortiNAC-F.

A read-only SNMP community siring was used.

SNMP is not enabled on the switch.

NO.24 An administrator wants to use FortiNAC-F to prevent internal engineers from accessing specific websites as defined in web filter categories on FortiGate.
In addition to a security trigger and associated action, which configuration must also be defined on FortiNAC-F?

A profiling method

A user/host profile

A compliance policy

A firewall policy

NO.25 An administrator wants to control user access to corporate resources by integrating FortiNAC-F with FortiGate using firewall tags defined on FortiNAC-F.
Where would the administrator assign the firewall tag value that will be sent to FortiGate?

RADIUS group attribute

Logical network

Device profiling rule

Security rule

NO.26 Refer to the exhibit. If a host is connected to a port in the Building 1 First Floor Ports group, what must also be true to match this user/host profile?

The host must have a role value of contractor, an installed persistent agent or a security access value of contractor, and be connected between 6 AM and 5 PM.

The host must have a role value of contractor or an installed persistent agent, a security access value of contractor, and be connected between 9 AM and 5 PM.

The host must have a role value of contractor or an installed persistent agent or a security access value of contractor, and be connected between 6 AM and 5 PM.

The host must have a role value of contractor or an installed persistent agent and a security access value of contractor, and be connected between 6 AM and 5 PM.

NO.27 During an evaluation of state-based enforcement, an administrator discovers that ports that should not be under enforcement have been added to enforcement groups.
In which view would the administrator be able to identify who added the ports to the groups?

The Admin Auditing view

The Event Management view

The Port Changes view

The Security Events view

NO.28 Which two statements are true about integrating a third-party device using SNMP traps from that device as input to generate an event? (Choose two.)

The sending device must be modeled in the inventory topology.

set allowaccess snmp must be configured using the CLI on the FortiNAC-F receiving interface.

The IP address OID and MAC address OID must be configured in the trap MIB file.

The sending device must support SNMPv3.

NO.29 In a wireless integration, what method does FortiNAC use to obtain connecting MAC address information?

SNMP traps

RADIUS

Endstation traffic monitoring

Link traps

NO.30 Refer to the exhibits.

Given the current configuration, what would happen if a contractor triggered two of the defined security filters?

A security alarm and two security events would be generated.

Three security events and one security alarm would be generated.

A security event and a security alarm would be generated.

Two security events would be generated, but no security alarm would be generated.

NO.31 While troubleshooting a network connectivity issue, an administrator determines that a device was being automatically provisioned to an incorrect VLAN.
Where would the administrator look to identify when and why FortiNAC-F made the network access change?

The Port Changes view

The Security Event view

The Reports view

The Admin Auditing view

NO.32 Which two actions must the administrator perform to allow FortiNAC-F to process incoming syslog messages from an unknown vendor? (Choose two.)

The device must have an event parser created for it.

The device sending the messages must be modeled in the Network Inventory view

The device must be added as a server in the Host view

The device must be added as a log receiver in FortiNAC-F.

NO.33 Refer to the exhibit.

When a contractor account is created using this template, which value is set in the accounts Role field?