Endpoint Profiles and Security Features
This domain tests whether you can translate a business requirement into a FortiClient profile and identify which feature or license is needed. Exam questions often describe a control objective, such as blocking removable media or filtering web categories, and ask where it is configured.
Profile anatomy
- A FortiClient profile is a container of endpoint settings. It can include antivirus, web filtering, application firewall, USB/removable media control, VPN, ZTNA, vulnerability scan, patch management, sandbox submission, and remote access settings.
- Profiles are assigned to endpoints, users, or groups. A default profile can cover unassigned endpoints, while specific profiles handle departments or exceptions.
- Many settings can differ for on-net and off-net conditions. For example, web filtering can be stricter when the endpoint is outside the corporate network.
- Lock and tamper-protection options prevent users from disabling security features. Use them deliberately, because they also make local troubleshooting harder.
Feature rules
- Antivirus: enable real-time scanning, scheduled scans, signature updates, cloud lookup, and quarantine actions. Signature age is also used by compliance rules.
- Web filtering: block or allow categories and URLs, and configure warning pages. The profile determines whether filtering is enforced on-net, off-net, or both.
- Application firewall: control applications by category or signature, not just by port.
- USB/removable media: allow, block, or read-only; exceptions can be made for specific device classes.
- Sandbox: suspicious files can be submitted to FortiSandbox for analysis when the integration is configured.
- ZTNA and VPN settings are delivered through the profile, but the actual access policy is enforced by the ZTNA gateway/proxy or VPN gateway.
Worked example
Finance requires USB storage blocked except for encrypted company devices, real-time antivirus, and blocking of gambling and malware web categories. The administrator creates a Finance profile with USB set to block, adds an exception for the approved encrypted device class, enables real-time antivirus with cloud lookup, and blocks the two web categories. The profile is assigned to the Finance AD group. Reasoning: each requirement maps to a specific profile section, and group assignment keeps the policy maintainable.
Traps that cost marks
- Assuming a feature works without the matching FortiClient license.
- Assigning a profile but forgetting that an unregistered endpoint cannot receive it.
- Enabling lock settings and then expecting users to fix their own connectivity issues.
- Setting web filtering only for off-net when the requirement covers all locations.
- Creating overlapping profiles without checking which assignment takes precedence.