I85PREP
⌘ K
FCP FortiClient EMS 7.4 study materials
FCP FortiClient EMS 7.4 study resources

FCP FortiClient EMS 7.4 practice questions

One question at a time. Build your FCP FortiClient EMS 7.4 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment and Initial Configuration

Which FortiClient EMS deployment model installs the EMS server and its database on Fortinet's cloud infrastructure, removing the need to maintain on-premises server hardware?

  1. FortiClient EMS on-premises
  2. FortiClient EMS Cloud Correct answer.
  3. FortiClient EMS standalone with an external SQL cluster
  4. FortiClient EMS in FortiGate proxy mode

Explanation

FortiClient EMS Cloud is the hosted deployment in which Fortinet operates the EMS server and its database, so the customer does not provision or patch server infrastructure. The on-premises model instead requires the administrator to install EMS and its database on their own hardware or virtual machine.

Question 2Deployment and Initial Configuration

A company wants FortiClient endpoints to register with EMS automatically the moment the FortiClient package is installed, without the user typing a server address. Which configuration supports this?

  1. Publish the EMS address in DNS SRV records for the endpoint domain
  2. Embed the EMS address in a custom FortiClient installer using the EMS deployment package Correct answer.
  3. Configure a FortiGate to redirect all HTTPS traffic to EMS
  4. Enable FortiClient telemetry on each endpoint after installation

Explanation

EMS can build a customized FortiClient installer (a deployment package) that already contains the EMS server address and enrollment settings, so endpoints check in automatically after install. This is the standard way to make registration silent and hands-off for end users.

Question 3Deployment and Initial Configuration

Which protocol and port does a FortiClient endpoint use by default to communicate with FortiClient EMS?

  1. UDP 541
  2. TCP 10443
  3. TCP 8013
  4. TCP 443 Correct answer.

Explanation

FortiClient endpoints connect to EMS over HTTPS on TCP port 443 by default, which is also the port used when the EMS address is entered during registration. This port must be reachable from endpoints to the EMS server for registration and policy updates.

Question 4Deployment and Initial Configuration

An administrator is preparing an on-premises FortiClient EMS 7.4 server. Which database does EMS require for its configuration and endpoint data?

  1. A bundled PostgreSQL database or a supported external Microsoft SQL Server Correct answer.
  2. A FortiAnalyzer log database
  3. A MySQL or MariaDB instance
  4. An Oracle Database instance

Explanation

FortiClient EMS stores its data in a database that can be the bundled PostgreSQL instance installed with EMS or a supported external Microsoft SQL Server deployment. Oracle, MySQL, and FortiAnalyzer are not supported EMS databases.

Question 5Deployment and Initial Configuration

Which component must be deployed so that FortiClient endpoints can receive security profiles and web-filtering policy from EMS even when they are off the corporate network?

  1. FortiClient EMS with endpoint control profiles assigned to endpoints Correct answer.
  2. A FortiGate in transparent mode
  3. A FortiSwitch managed by EMS
  4. A FortiAnalyzer collector

Explanation

EMS pushes endpoint control profiles, including web filter and other security settings, to registered FortiClients, and those profiles continue to apply when the endpoint is off-network. The FortiGate and FortiAnalyzer do not deliver endpoint security profiles to roaming FortiClients.

Question 6Deployment and Initial Configuration

During EMS initial setup, which step assigns the administrator account used to log in to the EMS management console?

  1. Creating an admin account in the EMS setup wizard or Settings Correct answer.
  2. Logging in with the FortiClient endpoint local user
  3. Using the FortiGate super_admin credentials
  4. Importing an LDAP administrator automatically

Explanation

The EMS administrator account is defined during initial setup or later under EMS Settings, and it is the credential used for the management console. LDAP and FortiGate credentials are not automatically created as EMS admins during setup.

Question 7Deployment and Initial Configuration

An administrator needs endpoints to be grouped by department so different web-filter profiles apply to each group. Which EMS object should be used to organize endpoints?

  1. FortiGate policy routes
  2. FortiClient license pools
  3. Endpoint groups Correct answer.
  4. Workgroups defined in Active Directory only

Explanation

EMS endpoint groups let administrators organize registered FortiClients and assign profiles to each group, enabling per-department policy. Active Directory workgroups alone do not control EMS profile assignment, and FortiGate routing is unrelated.

Question 8Deployment and Initial Configuration

Which FortiClient EMS feature allows an administrator to create a FortiClient installer that is preconfigured with the EMS server address and a registration key?

  1. Telemetry collector
  2. Vulnerability scan profile
  3. Deployment package Correct answer.
  4. Zero Trust tagging rule

Explanation

The deployment package feature builds a customized FortiClient installer containing the EMS address and optional registration key so endpoints enroll automatically. Telemetry, vulnerability scanning, and tagging rules are separate features that do not produce installers.

Question 9Deployment and Initial Configuration

A FortiClient endpoint shows as unregistered in EMS even though the user entered the EMS address. Which condition most likely prevents registration?

  1. The endpoint has the FortiClient web filter disabled
  2. The endpoint cannot reach the EMS server on TCP 443 Correct answer.
  3. The endpoint is running a licensed FortiClient
  4. The EMS server has more than one endpoint group

Explanation

Registration requires network reachability to the EMS server on the HTTPS port, so a blocked or unreachable TCP 443 connection prevents the endpoint from appearing as registered. Web filter state, group count, and licensing do not block the registration handshake.

Question 10Deployment and Initial Configuration

Which EMS setting controls whether endpoints must present a registration key before they are accepted into EMS?

  1. The registration key configured in EMS settings or the deployment package Correct answer.
  2. The EMS admin password
  3. The FortiClient license activation code
  4. The FortiGate serial number

Explanation

EMS can require a registration key that endpoints must supply during enrollment, and the same key can be embedded in a deployment package. The FortiClient license code, FortiGate serial, and admin password serve different purposes and are not enrollment keys.

Question 11Deployment and Initial Configuration

Which FortiClient EMS capability lets administrators push software installations and run scripts on managed endpoints?

  1. FortiGate IPsec VPN tunnels
  2. FortiGuard web filtering categories
  3. SSL inspection profiles
  4. Endpoint management with software deployment and remote actions Correct answer.

Explanation

EMS endpoint management includes software deployment and remote actions such as running scripts on managed endpoints. Web filtering categories, SSL inspection, and IPsec tunnels are security or connectivity features, not endpoint software deployment tools.

Question 12Deployment and Initial Configuration

An organization wants FortiClient endpoints to obtain an IPsec or SSL VPN configuration automatically from EMS. Which EMS feature supports this?

  1. FortiClient vulnerability scan schedules
  2. VPN provisioning profiles assigned to endpoint groups Correct answer.
  3. FortiGate static routes
  4. EMS backup schedules

Explanation

EMS VPN provisioning profiles deliver VPN configuration, such as IPsec or SSL VPN settings, to endpoints in assigned groups so users do not configure tunnels manually. Static routes, backup schedules, and scan schedules do not provision VPN settings.

Question 13Deployment and Initial Configuration

Which EMS administrative role concept limits what a delegated EMS operator can view and change?

  1. Active Directory organizational units
  2. EMS administrator accounts with assigned profiles or permissions Correct answer.
  3. FortiGate VDOM administrators
  4. FortiClient endpoint user roles

Explanation

EMS supports multiple administrator accounts whose permissions or profiles restrict what each operator can manage in the console. FortiClient users, FortiGate VDOM admins, and AD organizational units are separate constructs that do not govern EMS console permissions.

Question 14Deployment and Initial Configuration

Which action is required on a FortiGate so that it can be authorized and used together with FortiClient EMS for fabric integration?

  1. Import the FortiGate configuration into FortiClient
  2. Bind the FortiGate to an endpoint group
  3. Authorize the FortiGate on the EMS Fabric page or authorize EMS on the FortiGate Correct answer.
  4. Install FortiClient on the FortiGate

Explanation

Fabric integration between FortiGate and EMS requires an authorization step, performed by authorizing the FortiGate in EMS or authorizing EMS on the FortiGate, before the devices trust each other. Importing configuration, binding groups, or installing FortiClient on the FortiGate does not establish the fabric authorization.

Question 15Deployment and Initial Configuration

Which EMS feature allows an administrator to define conditions on endpoint attributes and automatically assign endpoints to groups or apply tags?

  1. FortiGuard outbreak alerts
  2. Static route redistribution
  3. Endpoint control tagging rules Correct answer.
  4. SSL VPN portal definitions

Explanation

EMS tagging rules evaluate endpoint attributes and automatically apply tags, which can then drive group membership and policy. Route redistribution, outbreak alerts, and SSL VPN portals are unrelated to endpoint classification.

Question 16Deployment and Initial Configuration

What does the EMS license determine about the number of endpoints that can register?

  1. The license controls the number of FortiGates that can connect
  2. The licensed endpoint count limits how many FortiClients EMS manages Correct answer.
  3. The license limits the number of endpoint groups that can be created
  4. The license sets the maximum number of EMS administrators

Explanation

FortiClient EMS licensing is based on the number of managed endpoints, so the license determines how many FortiClients can be registered and managed. It is not a FortiGate count, admin count, or group count limit.

Question 17Deployment and Initial Configuration

An administrator wants endpoints to be able to download FortiClient updates through EMS rather than from the internet. Which EMS configuration enables this?

  1. Disable FortiClient auto-update on all endpoints
  2. Enable FortiGate web caching
  3. Create an SSL VPN tunnel for updates
  4. Configure EMS as an update or distribution point and point endpoints to it Correct answer.

Explanation

EMS can act as an update distribution point so managed FortiClients retrieve updates from EMS instead of directly from the internet, which is useful in restricted networks. Disabling auto-update, FortiGate web caching, and SSL VPN tunnels do not provide EMS-hosted update delivery.

Question 18Deployment and Initial Configuration

Which statement describes the default behavior of FortiClient EMS regarding endpoint registration approval?

  1. Endpoints register only after a FortiGate pushes a policy
  2. Endpoints register automatically when they can reach EMS and supply any required key Correct answer.
  3. Every endpoint must be manually approved by an administrator before it appears
  4. Endpoints must be added to Active Directory before registering

Explanation

By default endpoints that can reach EMS and provide any required registration key enroll automatically and appear in the console. Manual approval, prior AD membership, and FortiGate policy pushes are not default registration prerequisites.

Question 19Deployment and Initial Configuration

Which EMS component is responsible for collecting and displaying endpoint compliance and vulnerability information?

  1. IPsec phase-1 proposals
  2. Vulnerability management profiles and scans Correct answer.
  3. SSL inspection certificates
  4. FortiGate antivirus profiles

Explanation

EMS vulnerability management uses scan profiles and scans to assess endpoint compliance and vulnerability status and presents the results in the console. FortiGate antivirus profiles, SSL certificates, and IPsec proposals are network security constructs, not endpoint vulnerability assessment tools.

Question 20Deployment and Initial Configuration

An administrator must ensure EMS can send email notifications when endpoints become non-compliant. Which configuration is required?

  1. Install FortiClient on the EMS server
  2. Configure an SMTP server and notification settings in EMS Correct answer.
  3. Enable FortiGate email filtering
  4. Add an LDAP server to EMS

Explanation

EMS sends email notifications through an SMTP server configured in EMS settings, along with the notification triggers. FortiGate email filtering, LDAP, and installing FortiClient on the EMS server do not provide EMS email delivery.

Question 21Deployment and Initial Configuration

Which deployment consideration applies when FortiClient EMS is placed behind a NAT device for internet-facing endpoints?

  1. FortiClient must be reinstalled after each NAT change
  2. Endpoints must connect using UDP instead of HTTPS
  3. Endpoints must be configured with the externally reachable address or port forwarding must be set up Correct answer.
  4. The EMS database must be moved to the FortiGate

Explanation

When EMS sits behind NAT, endpoints need an address they can reach, typically via port forwarding or an externally resolvable address in the deployment package. Switching to UDP, moving the database, or reinstalling clients is not the correct remedy.

Question 22Deployment and Initial Configuration

Which EMS feature allows administrators to enforce application control and USB device control on managed endpoints?

  1. SSL VPN split tunneling
  2. Endpoint control profiles with application and device control settings Correct answer.
  3. FortiGate firewall address objects
  4. FortiAnalyzer reports

Explanation

EMS endpoint control profiles contain settings for application control, USB device control, and other endpoint restrictions that FortiClient enforces locally. FortiGate address objects, VPN split tunneling, and FortiAnalyzer reporting do not enforce endpoint device control.

Question 23Deployment and Initial Configuration

Which initial configuration step ensures EMS can resolve FortiGuard services for updates and ratings?

  1. Assign a static IP to every endpoint
  2. Disable the EMS firewall
  3. Enable FortiClient telemetry on the FortiGate
  4. Configure DNS and ensure outbound access to FortiGuard services Correct answer.

Explanation

EMS needs working DNS resolution and outbound connectivity to FortiGuard so it can retrieve updates and ratings. Disabling the firewall, assigning endpoint static IPs, or enabling FortiGate telemetry does not provide FortiGuard access.

Question 24Deployment and Initial Configuration

An administrator wants to migrate an existing on-premises EMS deployment to a new server while keeping endpoint registrations. Which approach is appropriate?

  1. Move only the EMS license file to the new server
  2. Reinstall FortiClient on every endpoint and re-register manually
  3. Delete all endpoint groups and rebuild them on the new server
  4. Back up EMS and restore the backup on the new server, then repoint endpoints if the address changes Correct answer.

Explanation

EMS backups capture configuration and registration data, so restoring the backup on the new server preserves endpoint records, and endpoints are repointed if the EMS address changes. Reinstalling clients, deleting groups, or moving only the license loses the existing configuration and registrations.

Question 25Deployment and Initial Configuration

Which EMS object associates a set of configuration settings, such as web filter and antivirus options, with endpoints?

  1. A FortiGate policy
  2. An LDAP group
  3. An endpoint profile Correct answer.
  4. A FortiClient license

Explanation

Endpoint profiles in EMS bundle settings such as web filter, antivirus, and other endpoint options and are assigned to endpoint groups. FortiGate policies, LDAP groups, and licenses do not carry these endpoint configuration settings.

Question 26Deployment and Initial Configuration

A company wants EMS to authenticate administrators against its existing Microsoft Entra ID tenant instead of local EMS accounts. Which EMS configuration area is used to set up this identity provider integration?

  1. Single Sign-On configuration under administrative settings Correct answer.
  2. Chassis/HA settings for the EMS server cluster
  3. FortiGuard subscription settings for the EMS license
  4. Endpoint Control settings for the managed endpoint groups

Explanation

EMS supports SAML-based single sign-on so administrators can authenticate with an external identity provider such as Microsoft Entra ID; the SSO configuration is where the IdP metadata and administrator mapping are defined. Local EMS accounts remain available but are not used when SSO is enforced for console login.

Question 27Deployment and Initial Configuration

An administrator wants FortiClient EMS to obtain a publicly trusted TLS certificate automatically rather than importing a self-signed one. Which EMS capability supports this?

  1. Built-in ACME/Let's Encrypt certificate enrollment for the EMS web server Correct answer.
  2. EMS database backup to an external SMB share
  3. FortiClient telemetry gateway mode on port 8013
  4. FortiGate fabric authorization of the EMS serial number

Explanation

EMS 7.4 can request and renew a certificate from an ACME provider such as Let's Encrypt so endpoints and browsers see a trusted certificate on the EMS console and telemetry connections. Importing a CA-issued certificate manually is still supported as an alternative.

Question 28Deployment and Initial Configuration

An administrator installs EMS on a Windows server and needs endpoints on the internet to reach it. The server sits behind a firewall performing source NAT, and the public address differs from the EMS server address. Which configuration must be adjusted so endpoints connect successfully?

  1. Change the EMS telemetry port to 443 and disable the EMS console port
  2. Configure the EMS server's public/external address so installers and endpoints use the NAT address Correct answer.
  3. Enable FortiGate fabric authorization on the EMS server before registration
  4. Set the EMS hostname to the server's private address and disable telemetry

Explanation

When EMS is behind NAT, the address endpoints use to reach it differs from the server's own interface address, so the external (public) address must be defined in EMS. Installers generated afterwards and endpoint connections then point to the reachable address instead of the private one.

Question 29Deployment and Initial Configuration

An administrator wants newly imaged endpoints to receive FortiClient and register with EMS without any user interaction, using a GPO-deployed MSI. Which installer option must be included so the endpoint registers with EMS during installation?

  1. A FortiClient configuration backup file placed in the install directory
  2. A FortiToken activation code embedded in the MSI file name
  3. A command-line switch supplying the EMS address and registration key Correct answer.
  4. An XML profile containing only antivirus and web filter settings

Explanation

The FortiClient MSI accepts command-line parameters that specify the EMS server address (and optionally a registration key) so the endpoint registers silently during installation, which is what mass deployment through GPO requires. Settings profiles applied later come from EMS rather than from the installer.

Question 30Deployment and Initial Configuration

After EMS installation, an administrator notices that endpoints register successfully but FortiGuard category ratings and software updates are not arriving. The server can reach the internet through a proxy, and the proxy requires authentication. Which configuration is required in EMS to restore these services?

  1. Add the proxy to the FortiClient profile's web-filter exemption list
  2. Increase the number of licensed endpoints in the EMS license
  3. Authorize the FortiGate in Fabric Devices so it forwards FortiGuard traffic
  4. Configure the EMS proxy settings with the proxy address, port, and credentials Correct answer.

Explanation

EMS itself must reach FortiGuard for ratings, signatures, and updates, so when a proxy sits between EMS and the internet the proxy must be defined in EMS with any required credentials. Endpoint-side exemptions or FortiGate fabric authorization do not give the EMS server outbound access.

Question 31Endpoint Registration and Provisioning

In FortiClient EMS, which component is responsible for generating the invitation that an endpoint uses to enroll with the EMS server?

  1. The FortiGate that the endpoint's traffic passes through
  2. The FortiClient installer package itself
  3. The FortiClientEMSCloud licensing portal
  4. The FortiClient EMS server, which issues a time-limited enrollment invitation Correct answer.

Explanation

Enrollment invitations are created and signed by the EMS server; the invitation embeds the server address and a token so the endpoint can register securely. FortiGate and the installer play no role in issuing that token.

Question 32Endpoint Registration and Provisioning

An administrator wants endpoints to enroll without emailing invitations. Which FortiClient EMS capability supports this?

  1. A DHCP option pushed by the gateway
  2. A Windows Group Policy Object that contains the token
  3. An enrollment URL or key that users enter in FortiClient Correct answer.
  4. Manual XML profile import on each endpoint

Explanation

EMS can expose an enrollment URL or enrollment key that the user types into FortiClient, avoiding per-user email invitations. The client then contacts EMS directly to complete registration.

Question 33Endpoint Registration and Provisioning

Which protocol and port does FortiClient use by default to communicate with an on-premises FortiClient EMS 7.4 server for management traffic?

  1. UDP 4500 over IPsec NAT-T
  2. TCP 8013 over SOAP
  3. TCP 541 over the FGFM tunnel
  4. TCP 443 over HTTPS Correct answer.

Explanation

FortiClient EMS listens for endpoint management and telemetry over HTTPS on TCP 443 by default. FGFM (541) is used between FortiGate and FortiManager, and 8013 is the legacy FortiGuard update port.

Question 34Endpoint Registration and Provisioning

What is the purpose of an endpoint's registration in FortiClient EMS?

  1. To bind the endpoint to an EMS record so profiles, telemetry, and policies can be delivered to it Correct answer.
  2. To replace the endpoint's local antivirus with a cloud scanner
  3. To enroll the endpoint in the FortiGate's routing table
  4. To assign the endpoint a static IP address from the EMS DHCP scope

Explanation

Registration creates an EMS record that associates the endpoint with the server, enabling profile deployment, telemetry collection, and centralized management. EMS does not hand out IP addresses or modify FortiGate routing.

Question 35Endpoint Registration and Provisioning

Which FortiClient EMS object groups endpoints so that different configuration profiles can be applied to different populations?

  1. Endpoint groups Correct answer.
  2. License pools
  3. Administrator accounts
  4. Workgroups

Explanation

Endpoint groups are containers used to organize registered endpoints and to scope profile assignment. Administrators, licenses, and workgroups do not serve this targeting function.

Question 36Endpoint Registration and Provisioning

During enrollment, what does FortiClient verify to confirm it is contacting the legitimate EMS server?

  1. The server's TLS certificate presented during the HTTPS connection Correct answer.
  2. The FortiGate serial number returned in an HTTP header
  3. The endpoint's own hostname resolution cache
  4. The server's MAC address on the local subnet

Explanation

FortiClient establishes an HTTPS connection and validates the EMS server certificate, which is why the certificate must be trusted by the endpoint. MAC addresses and FortiGate serial numbers are not used for this trust decision.

Question 37Endpoint Registration and Provisioning

Which FortiClient EMS feature lets an administrator preconfigure FortiClient settings and deliver them automatically after registration?

  1. An SNMP community string
  2. A Windows registry backup
  3. A FortiGate firewall address object
  4. A configuration profile assigned to an endpoint group Correct answer.

Explanation

Configuration profiles hold FortiClient settings and are assigned to endpoint groups so they are pushed to registered endpoints. Firewall objects, SNMP strings, and registry backups are unrelated to EMS profile delivery.

Question 38Endpoint Registration and Provisioning

What does FortiClient EMS use to identify a registered endpoint uniquely even if its hostname changes?

  1. The endpoint's default gateway
  2. The endpoint's assigned EMS GUID Correct answer.
  3. The endpoint's current IP address
  4. The endpoint's logged-in username

Explanation

EMS assigns a GUID that uniquely identifies the endpoint record, so hostname or IP changes do not create duplicate records. IP addresses and usernames are not stable unique identifiers.

Question 39Endpoint Registration and Provisioning

An administrator needs endpoints on a remote branch to reach an on-premises EMS server without exposing the EMS console to the internet. Which approach fits FortiClient EMS 7.4?

  1. Open the EMS management GUI to all internet sources
  2. Deploy a FortiGate as a local proxy and publish only the EMS enrollment and telemetry service Correct answer.
  3. Disable TLS on EMS so branch clients can connect
  4. Require branch users to VPN into the head office before every enrollment

Explanation

A common pattern is to expose only the necessary EMS service through a FortiGate or reverse proxy so remote endpoints can enroll and send telemetry without exposing the full management interface. Disabling TLS or forcing a VPN for every enrollment is not required or advisable.

Question 40Endpoint Registration and Provisioning

A user reports that FortiClient shows 'unregistered' after clicking an enrollment link. The link was generated three days earlier. What is the most likely cause?

  1. The enrollment invitation has expired Correct answer.
  2. The EMS server license has been exhausted
  3. The FortiGate has blocked all HTTPS traffic
  4. The endpoint's antivirus definitions are outdated

Explanation

Enrollment invitations are time-limited, so an invitation generated days earlier may have expired before use. The administrator should generate a fresh invitation or use the enrollment URL/key instead.

Question 41Endpoint Registration and Provisioning

After registering a new endpoint, an administrator notices the device appears twice in EMS with different GUIDs. Which action best explains and resolves this?

  1. The endpoint was enrolled twice, so delete the stale record and keep the active GUID Correct answer.
  2. EMS duplicates records by design and no action is needed
  3. The endpoint was assigned to two groups, so reassign both groups
  4. The endpoint has two network adapters, so both records must be merged automatically

Explanation

Duplicate records usually indicate the endpoint enrolled more than once, for example after a reinstall or a second invitation. Removing the stale record and retaining the active GUID cleans up the inventory. Multiple adapters or group assignments do not create separate GUIDs.

Question 42Endpoint Registration and Provisioning

Which EMS setting determines whether newly registered endpoints are placed in a default group automatically?

  1. The FortiClient license activation code
  2. The endpoint's DNS suffix search list
  3. The FortiGate's DHCP reservation table
  4. The default endpoint group configured in EMS settings Correct answer.

Explanation

EMS can be configured with a default group so that endpoints without an explicit assignment land in a known container. License codes, DHCP reservations, and DNS suffixes do not control group placement.

Question 43Endpoint Registration and Provisioning

An administrator wants to deploy FortiClient to Windows endpoints and have them auto-enroll without user interaction. Which combination achieves this?

  1. An email invitation sent to each user individually
  2. A FortiGate web filter profile that redirects users to EMS
  3. A manual installation followed by each user clicking 'Register'
  4. A software deployment tool that installs FortiClient with the EMS enrollment parameters preconfigured Correct answer.

Explanation

Silent installation combined with preconfigured enrollment parameters lets endpoints register automatically at install time. Manual clicks, web filter redirects, and per-user email invitations all require user action.

Question 44Endpoint Registration and Provisioning

A FortiClient endpoint cannot reach EMS at the configured address. Which troubleshooting step is most appropriate first?

  1. Reset the EMS administrator password
  2. Renew the FortiGate's UTM license
  3. Confirm the endpoint resolves the EMS hostname and can reach TCP 443 on the EMS server Correct answer.
  4. Reinstall the endpoint's operating system

Explanation

Basic connectivity checks-name resolution and reachability of the EMS service port-isolate whether the problem is network, DNS, or server-side. Reinstalling the OS or resetting credentials does not address a connection failure.

Question 45Endpoint Registration and Provisioning

Which statement correctly describes the relationship between FortiClient EMS and FortiGate in endpoint provisioning?

  1. FortiGate assigns GUIDs to endpoints during registration
  2. EMS manages endpoint configuration, while FortiGate can consume EMS endpoint information for policy enforcement Correct answer.
  3. EMS requires a FortiGate to issue enrollment invitations
  4. FortiGate replaces EMS for endpoint profile delivery

Explanation

EMS is the endpoint management authority, and FortiGate can integrate with EMS to use endpoint identity and compliance data in firewall policy. FortiGate does not deliver EMS profiles or assign endpoint GUIDs.

Question 46Endpoint Registration and Provisioning

An endpoint registered with EMS is later moved to a different endpoint group. What is the expected effect on profile delivery?

  1. The endpoint receives the profiles assigned to its new group on the next check-in Correct answer.
  2. The endpoint keeps only the old group's profiles permanently
  3. The endpoint loses its GUID and appears unregistered
  4. The endpoint must re-enroll to receive any profile

Explanation

EMS evaluates group membership when the endpoint checks in, so moving the endpoint changes which assigned profiles apply. Re-enrollment is not required and the GUID persists.

Question 47Endpoint Registration and Provisioning

Which condition must be met for FortiClient to complete EMS registration when using certificate-based trust?

  1. The endpoint must trust the certificate chain presented by the EMS server Correct answer.
  2. The endpoint must have a FortiToken assigned
  3. The endpoint must use a static IP address
  4. The endpoint must be joined to the same Active Directory domain as EMS

Explanation

Certificate-based trust requires the endpoint to trust the issuing chain of the EMS server certificate. Domain membership, static addressing, and FortiTokens are not prerequisites for registration.

Question 48Endpoint Registration and Provisioning

A security team wants to confirm which endpoints have registered but never received a configuration profile. Which EMS view or attribute helps identify them?

  1. Endpoint records showing group membership without an applied profile Correct answer.
  2. The endpoint's Windows event log
  3. The EMS license usage report
  4. The FortiGate DHCP lease table

Explanation

EMS endpoint records show group membership and applied profiles, so endpoints in a group with no assigned profile stand out. License reports, DHCP leases, and local event logs do not show profile assignment state.

Question 49Endpoint Registration and Provisioning

Which FortiClient EMS deployment model removes the need to host the EMS server on-premises?

  1. FortiClient EMS on a FortiManager VM
  2. FortiClient EMS on a FortiAnalyzer appliance
  3. FortiClient EMS Cloud Correct answer.
  4. FortiClient EMS on a FortiGate

Explanation

FortiClient EMS Cloud is the hosted deployment option, so no on-premises EMS server is required. FortiGate, FortiManager, and FortiAnalyzer are not EMS hosting platforms.

Question 50Endpoint Registration and Provisioning

An administrator wants endpoints to enroll using a shared key rather than unique invitations. Which EMS configuration supports this?

  1. An enrollment key defined on the EMS server and entered in FortiClient Correct answer.
  2. A Windows Hello for Business PIN
  3. A per-endpoint certificate installed manually
  4. A FortiGate one-time password delivered by SMS

Explanation

EMS can define an enrollment key that users enter in FortiClient to register without individual invitations. Per-endpoint certificates, SMS OTPs, and Windows Hello PINs are not EMS enrollment-key mechanisms.