I85PREP
⌘ K
FCP FortiNAC-F Administrator study materials
FCP FortiNAC-F Administrator study resources

FCP FortiNAC-F Administrator practice questions

One question at a time. Build your FCP FortiNAC-F Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F appliance must be reachable by managed network devices and end hosts on multiple VLANs. Which interface configuration on the appliance is designed for this management and isolation traffic?

  1. A single untagged port carrying all VLANs
  2. The eth0 interface configured with a management IP and additional VLAN sub-interfaces Correct answer.
  3. The console port configured with an IP address
  4. The FortiGate fabric connector interface only

Explanation

FortiNAC-F uses its primary Ethernet interface (eth0) for management access and can carry VLAN sub-interfaces so the appliance can reach multiple isolated network segments. The console port is for local serial access only and cannot carry IP traffic to the network. Fabric connectors are logical integrations, not physical data paths.

Question 2FortiNAC-F Deployment and Initial Configuration

During initial setup of a FortiNAC-F appliance, what is the purpose of the configuration wizard accessed on first login?

  1. To license FortiCare support contracts
  2. To set hostname, network interfaces, DNS, and time settings before the appliance joins production Correct answer.
  3. To import an existing FortiGate configuration backup
  4. To install FortiNAC OS patches from a USB drive

Explanation

The first-login wizard collects the baseline identity and network parameters - hostname, interface addressing, DNS servers, and time/NTP - so the appliance is reachable and consistent before further configuration. Licensing and patching are separate workflows, and FortiGate backups are not imported into FortiNAC-F.

Question 3FortiNAC-F Deployment and Initial Configuration

An administrator needs to validate that a newly deployed FortiNAC-F appliance has correct time synchronization, because certificate and log correlation depend on it. Which configuration should be verified first?

  1. The SNMP community string on the appliance
  2. The DHCP scope options on the Layer 3 gateway
  3. The RADIUS shared secret
  4. The NTP server settings and the appliance time zone Correct answer.

Explanation

Time accuracy on FortiNAC-F depends on configured NTP servers plus the correct time zone, and both affect certificate validation and log timestamps. RADIUS secrets, DHCP scopes, and SNMP strings do not influence the appliance clock.

Question 4FortiNAC-F Deployment and Initial Configuration

Which FortiNAC-F deployment model places the appliance as a Layer 2 inline device between access switches and the core?

  1. Layer 3 routed deployment
  2. Out-of-band deployment
  3. Inline (Layer 2) deployment Correct answer.
  4. Span/monitor-only deployment

Explanation

In an inline Layer 2 deployment, FortiNAC-F sits in the traffic path between access and core, so it can enforce policy directly. Out-of-band deployments control switches via SNMP or CLI instead, and monitor-only deployments observe mirrored traffic without enforcement.

Question 5FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator wants to integrate the appliance with a FortiGate so that FortiGate can share device and user information. Which feature is used for this integration?

  1. Syslog relay
  2. RADIUS proxy
  3. FortiGuard web filtering service
  4. Fabric connector Correct answer.

Explanation

FortiNAC-F integrates with FortiGate through a fabric connector, which establishes a secure channel for exchanging device, user, and policy information. FortiGuard filtering, RADIUS proxying, and syslog relay serve different purposes and do not provide that integration.

Question 6FortiNAC-F Deployment and Initial Configuration

An administrator is preparing a FortiNAC-F appliance for a production deployment and needs to register the appliance so it can receive support and updates. Which action accomplishes this?

  1. Enabling the SNMP agent on the appliance
  2. Adding the appliance serial number to a FortiGate address object
  3. Configuring a RADIUS client entry on the appliance
  4. Registering the appliance with FortiCare using its serial number Correct answer.

Explanation

FortiNAC-F appliances are licensed and supported through FortiCare registration keyed to the appliance serial number. Address objects, RADIUS clients, and SNMP settings are unrelated to support entitlement and update delivery.

Question 7FortiNAC-F Deployment and Initial Configuration

What is the default administrative access method for performing the very first configuration of a FortiNAC-F appliance that has no network reachability?

  1. SNMP write access
  2. HTTPS to the default management IP
  3. Local console connection Correct answer.
  4. SSH over eth0

Explanation

When no network connectivity exists, the local console connection provides direct CLI access to assign initial addressing and settings. SSH and HTTPS require reachable IP addressing, and SNMP is not used for initial configuration.

Question 8FortiNAC-F Deployment and Initial Configuration

An administrator is planning IP addressing for FortiNAC-F. Which statement correctly describes the purpose of the appliance's eth0 interface?

  1. It is dedicated to RADIUS authentication traffic only.
  2. It carries management access and can host VLAN sub-interfaces for network visibility. Correct answer.
  3. It must be configured as a DHCP client in all deployments.
  4. It is reserved for the FortiGate fabric connector only.

Explanation

eth0 is the primary interface used for administrative access and can be subdivided into VLAN interfaces so the appliance can reach isolated segments. It is not restricted to RADIUS, not reserved for the fabric connector, and static addressing is typical in production.

Question 9FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator is adding a Cisco switch as a managed device. Which protocol is most commonly used by FortiNAC-F to read and change VLAN assignments on that switch?

  1. SNMP Correct answer.
  2. SMTP
  3. LDAP
  4. NTP

Explanation

FortiNAC-F uses SNMP (with appropriate read-write credentials) to query managed switches and change VLAN assignments for hosts. SMTP, NTP, and LDAP serve mail, time, and directory functions and do not control switch VLANs.

Question 10FortiNAC-F Deployment and Initial Configuration

When adding a new switch as a managed device in FortiNAC-F, which credential set is required for the appliance to change VLAN assignments on the switch?

  1. Read-only SNMP community and a local user account
  2. An LDAP bind account with read access
  3. A RADIUS shared secret and a TACACS+ key
  4. Read-write SNMP community or CLI credentials with configuration privileges Correct answer.

Explanation

Changing VLANs requires write capability on the switch, so FortiNAC-F needs a read-write SNMP community or CLI credentials with configuration privileges. Read-only SNMP, directory bind accounts, and AAA secrets do not permit configuration changes.

Question 11FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator needs to define the ranges of IP addresses that the appliance considers part of the production network for host discovery and classification. Which configuration object is used?

  1. Network access policy
  2. L3 network definition Correct answer.
  3. RADIUS client
  4. Policy role

Explanation

Layer 3 network definitions tell FortiNAC-F which address ranges belong to the managed network so hosts can be discovered and classified correctly. Policy roles, RADIUS clients, and access policies govern authorization behavior rather than address scope.

Question 12FortiNAC-F Deployment and Initial Configuration

An administrator wants FortiNAC-F to learn about hosts by reading ARP and MAC tables from switches. Which capability must be enabled on the managed devices for this to work?

  1. Port mirroring on every access port
  2. 802.1X supplicant on the appliance
  3. DHCP snooping on all VLANs
  4. SNMP read access to the relevant MIBs Correct answer.

Explanation

FortiNAC-F polls managed switches via SNMP to read ARP and MAC address tables, so SNMP read access to the relevant MIBs is required. Port mirroring, DHCP snooping, and a supplicant on the appliance are not the mechanism for table polling.

Question 13FortiNAC-F Deployment and Initial Configuration

After initial deployment, an administrator notices that FortiNAC-F is not discovering any hosts on a new VLAN. Which configuration item is the most likely cause?

  1. The appliance time zone is set incorrectly
  2. The VLAN's subnet is not included in the L3 network definitions Correct answer.
  3. The appliance hostname does not match DNS
  4. The FortiGate fabric connector is disabled

Explanation

FortiNAC-F only discovers and classifies hosts whose addresses fall inside defined L3 networks, so an undefined subnet leaves hosts invisible. Fabric connector state, time zone, and hostname resolution do not prevent host discovery on a VLAN.

Question 14FortiNAC-F Deployment and Initial Configuration

Which FortiNAC-F component is responsible for receiving authentication requests from network access devices and returning an authorization decision?

  1. The RADIUS service Correct answer.
  2. The DHCP server
  3. The syslog collector
  4. The SNMP trap receiver

Explanation

The RADIUS service on FortiNAC-F receives access requests from network devices and returns accept or reject decisions along with attributes. DHCP, syslog, and SNMP trap handling perform different roles in the deployment.

Question 15FortiNAC-F Deployment and Initial Configuration

An administrator wants to verify that FortiNAC-F can authenticate users against an existing Microsoft Active Directory. Which configuration is required on the appliance?

  1. A local user database with duplicated credentials
  2. A RADIUS client entry for each domain controller
  3. A TACACS+ server entry
  4. An LDAP or Active Directory integration with a bind account Correct answer.

Explanation

FortiNAC-F authenticates against Active Directory through an LDAP/AD integration configured with a bind account that can query the directory. Duplicated local accounts, TACACS+ entries, and RADIUS client entries for domain controllers are not the correct integration method.

Question 16FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator needs to ensure that only authorized switches can send SNMP traps and RADIUS requests to the appliance. Which practice supports this?

  1. Disabling NTP on the appliance
  2. Allowing all SNMP and RADIUS traffic from any source
  3. Using the default SNMP community string
  4. Restricting SNMP and RADIUS sources to known managed device addresses Correct answer.

Explanation

Limiting SNMP and RADIUS sources to known managed devices reduces spoofing and unauthorized control traffic reaching FortiNAC-F. Disabling NTP, allowing any source, or keeping default community strings weakens security rather than hardening it.

Question 17FortiNAC-F Deployment and Initial Configuration

An administrator is planning high availability for FortiNAC-F. Which statement best describes the purpose of deploying a secondary appliance?

  1. It replaces the need for managed device credentials.
  2. It doubles the number of hosts that can be discovered by the primary appliance.
  3. It provides failover so control of managed devices continues if the primary becomes unavailable. Correct answer.
  4. It removes the requirement for NTP synchronization.

Explanation

A secondary FortiNAC-F appliance provides failover so that device control and authentication decisions continue when the primary fails. It does not increase discovery capacity, remove credential requirements, or eliminate the need for consistent time.

Question 18FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F appliance is being deployed in a network where access switches are managed by a separate team. Which deployment model minimizes changes to the existing switch configuration while still allowing enforcement?

  1. Layer 3 routed deployment
  2. Out-of-band deployment using SNMP or CLI control of the switches Correct answer.
  3. Monitor-only deployment without any enforcement
  4. Inline Layer 2 deployment

Explanation

Out-of-band deployment lets FortiNAC-F enforce policy by instructing existing switches over SNMP or CLI, avoiding a physical inline insertion. Inline and routed deployments change the traffic path, and monitor-only mode cannot enforce policy.

Question 19FortiNAC-F Deployment and Initial Configuration

Which FortiNAC-F feature is used to define the actions taken when a host matches a particular classification, such as moving it to a quarantine VLAN?

  1. NTP server list
  2. SNMP community list
  3. L3 network definition
  4. Policy configuration with matching roles and actions Correct answer.

Explanation

Policies in FortiNAC-F match host or user roles and apply actions such as VLAN changes, which is how quarantine and remediation are enforced. L3 network definitions, NTP settings, and SNMP communities do not define enforcement actions.

Question 20FortiNAC-F Deployment and Initial Configuration

An administrator wants FortiNAC-F to place unknown hosts into a registration VLAN automatically. Which combination of configuration elements is required?

  1. A TACACS+ server and a local admin account
  2. A defined L3 network, a policy matching unknown hosts, and a managed device able to change VLANs Correct answer.
  3. An NTP server and a DNS forwarder
  4. A FortiGate fabric connector and a syslog relay

Explanation

Automatic VLAN placement requires the subnet to be defined, a policy that matches unknown hosts, and a managed switch capable of applying the VLAN change. Fabric connectors, time services, and TACACS+ do not perform VLAN enforcement.

Question 21FortiNAC-F Deployment and Initial Configuration

When configuring a FortiNAC-F appliance to use an external DHCP server, what must be configured so that the appliance can correlate a host's IP address with its MAC address?

  1. The appliance must read DHCP lease information or receive it through an integration Correct answer.
  2. The appliance must use a static ARP entry for every host
  3. The DHCP server must be FortiNAC-F itself
  4. The appliance must disable ARP polling

Explanation

To correlate IP and MAC addresses with an external DHCP server, FortiNAC-F must obtain lease information through a supported integration or by reading it from the server. Making FortiNAC-F the DHCP server is one option but not a requirement, and disabling ARP polling or using static ARP entries does not provide lease correlation.

Question 22FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator is troubleshooting why a managed switch shows as unreachable. Which item should be verified first?

  1. The FortiGate fabric connector status
  2. The appliance's SMTP relay settings
  3. The switch's SNMP community and the appliance's ability to reach the switch management IP Correct answer.
  4. The Active Directory bind account password

Explanation

Reachability and SNMP credentials are the fundamental requirements for FortiNAC-F to manage a switch, so they should be verified first. Fabric connector status, directory credentials, and mail relay settings do not determine switch reachability.

Question 23FortiNAC-F Deployment and Initial Configuration

Which statement correctly describes the role of a FortiNAC-F appliance in a network access control deployment?

  1. It provides only syslog storage for compliance reporting.
  2. It acts as a firewall between the internet and the data center.
  3. It replaces all Layer 2 switches with its own forwarding hardware.
  4. It discovers and classifies endpoints and enforces access policy through network devices. Correct answer.

Explanation

FortiNAC-F provides network access control by discovering and classifying endpoints, then enforcing policy through managed network devices. It does not replace switches, act as an internet firewall, or function solely as a log store.

Question 24FortiNAC-F Deployment and Initial Configuration

An administrator is configuring FortiNAC-F for the first time and wants to verify that the appliance can communicate with a FortiGate for fabric integration. Which item is essential?

  1. The appliance must use the same SNMP community as the FortiGate.
  2. The FortiGate must be running the same FortiOS version as the appliance's FortiNAC-F build.
  3. The FortiGate must be in NAT mode with all policies disabled.
  4. The appliance must be configured with the FortiGate's address and appropriate credentials or API access. Correct answer.

Explanation

Fabric integration requires FortiNAC-F to know the FortiGate's address and to authenticate with appropriate credentials or API access. Version parity, disabled policies, and matching SNMP communities are not requirements for the integration.

Question 25FortiNAC-F Deployment and Initial Configuration

What is the recommended practice for administrative access to a newly deployed FortiNAC-F appliance before it is exposed to the production network?

  1. Disable logging to reduce load during setup
  2. Change default credentials and restrict management access to trusted networks Correct answer.
  3. Leave the default administrator password unchanged for convenience
  4. Enable all management protocols on all interfaces

Explanation

Changing default credentials and limiting management access to trusted networks are baseline hardening steps before production exposure. Enabling all protocols, keeping default passwords, or disabling logging weakens security and auditability.

Question 26FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator is deploying a new appliance and needs to understand how the persistent configuration and appliance state are stored on the FortiNAC-F platform. Which statement correctly describes the underlying platform characteristics of FortiNAC-F?

  1. It runs as a FortiOS VDOM feature that is enabled with a single CLI command on an existing FortiGate
  2. It is a cloud-only service that cannot be deployed on-premises
  3. It requires an external Microsoft SQL Server database before any configuration can be performed
  4. It runs as a hardened Linux-based appliance image on FortiGate hardware or a VM, with appliance configuration and data stored on the appliance's own managed storage Correct answer.

Explanation

FortiNAC-F is delivered as a purpose-built Linux-based appliance image that can run on supported FortiGate hardware models or as a virtual machine. Its configuration and operational data are stored locally on the appliance's managed storage rather than requiring an external database. Understanding this platform model is fundamental before planning backups, upgrades, and resource sizing.

Question 27FortiNAC-F Deployment and Initial Configuration

An administrator has completed the initial setup of a FortiNAC-F appliance and must confirm the software version and build before opening a support case. Where in the FortiNAC-F administrative UI can the running version information be verified?

  1. In the Settings or About area of the administrative UI, where the appliance version and build are displayed Correct answer.
  2. Only by opening a TAC case and asking support to read it from the license server
  3. In the DHCP server lease table of the appliance
  4. Only from the FortiGate that hosts the appliance, using the FortiOS dashboard widget

Explanation

The FortiNAC-F administrative UI exposes the appliance version and build information in its settings/about area, which is the standard place to confirm the running release. Administrators should record this before upgrades and when engaging support. It does not depend on an external license server or a parent FortiGate dashboard.

Question 28FortiNAC-F Deployment and Initial Configuration

A FortiNAC-F administrator wants to integrate the appliance with the corporate directory so that network users can be authenticated and matched to their group membership. Which configuration step is required on FortiNAC-F before user and group lookups against Active Directory will succeed?

  1. Configure the domain controllers as managed switches
  2. Define an LDAP or Active Directory connection with the correct server address, base DN, and bind credentials, then synchronize the directory Correct answer.
  3. Enable SNMPv3 on the domain controllers
  4. Add every user manually to a local user group on the appliance

Explanation

FortiNAC-F integrates with Active Directory through an LDAP/AD connection that specifies the server, base distinguished name, and bind account, followed by a synchronization of users and groups. This allows the appliance to resolve identities and group membership for policy decisions. SNMP and local user lists are unrelated to directory integration.

Question 29FortiNAC-F Deployment and Initial Configuration

An administrator is preparing a FortiNAC-F appliance for a network where the access layer switches are managed by another team and cannot be modified. Which deployment approach best fits this constraint while still allowing the appliance to enforce policy?

  1. Deploy FortiNAC-F as a DHCP relay only, with no switch integration
  2. Deploy FortiNAC-F inline between the core and access layer so all traffic is forced through the appliance
  3. Deploy FortiNAC-F in an out-of-band mode using SNMP read access and RADIUS/802.1X integration where the switch configuration permits it Correct answer.
  4. Require the other team to replace all access switches with FortiSwitch models before any deployment

Explanation

When switch configuration is controlled by another team, FortiNAC-F can still operate in an out-of-band model using SNMP read access for visibility and RADIUS/802.1X or VLAN-change integration where the switch owners allow it. This minimizes required changes while enabling policy enforcement. Inline deployment and full switch replacement are far more disruptive than necessary.

Question 30FortiNAC-F Deployment and Initial Configuration

During planning for a FortiNAC-F deployment, the administrator must decide how the appliance will obtain time synchronization, because certificate validation and log correlation depend on accurate clocks. Which configuration on FortiNAC-F best ensures consistent time across the appliance and its managed devices?

  1. Disable time synchronization so that log timestamps reflect local device uptime
  2. Set the appliance clock from the browser workstation each time an administrator logs in
  3. Configure the appliance to synchronize with approved internal NTP servers and ensure managed devices use the same time source Correct answer.
  4. Rely on the default time of the appliance and adjust it manually after each reboot

Explanation

Accurate, consistent time is required for certificate validation, RADIUS operations, and correlating events across FortiNAC-F and the devices it manages. Pointing the appliance and managed devices at the same approved internal NTP servers keeps clocks aligned. Manual adjustment and disabled synchronization produce drift and unreliable logs.

Question 31Network Device Integration and SNMP/CLI Modeling

When FortiNAC-F models a switch for VLAN assignment, which SNMP credential set is required to read and write VLAN membership on the device?

  1. A read-write community string (or SNMPv3 user with write view) Correct answer.
  2. A RADIUS shared secret configured on the switch
  3. The device's enable secret for CLI access
  4. A read-only community string only

Explanation

VLAN changes are pushed to the switch over SNMP, so FortiNAC needs write access to the relevant OIDs. A read-only credential can inventory the device but cannot move a port into a VLAN. The enable secret is used only for CLI-based models, and a RADIUS secret authenticates supplicants, not management traffic.

Question 32Network Device Integration and SNMP/CLI Modeling

In FortiNAC-F, which element must exist before a newly discovered switch can be modeled and controlled for network access?

  1. A device record created in the Model Configuration view Correct answer.
  2. A DHCP scope reservation for the switch management IP
  3. A FortiGate firewall policy referencing the switch
  4. A local user account on the switch matching the FortiNAC admin

Explanation

FortiNAC only manages devices that exist in its model configuration; discovery alone does not grant control. The administrator adds or imports the device, assigns a vendor/model, and supplies credentials. Firewall policies, DHCP reservations, and mirrored local accounts are not prerequisites for modeling.

Question 33Network Device Integration and SNMP/CLI Modeling

A Cisco switch is added to FortiNAC-F but shows as unsupported during modeling. What is the most direct first step to resolve this?

  1. Change the FortiNAC management IP address
  2. Disable SNMP traps on the switch
  3. Convert the switch to CLI-only modeling immediately
  4. Verify the device is mapped to a supported vendor/model definition and that its OID matches Correct answer.

Explanation

FortiNAC selects a device mapping based on the vendor and model OID reported by the device. If the OID does not match a known definition, the device is treated as unsupported. Confirming the correct mapping, or importing an updated definition, resolves the mismatch. Changing FortiNAC addressing or disabling traps does not affect model support.

Question 34Network Device Integration and SNMP/CLI Modeling

Which SNMP operation does FortiNAC-F primarily use to learn the MAC addresses currently visible on a switch port?

  1. Reading the device's running configuration via SNMP
  2. Walking the bridge MIB forwarding table Correct answer.
  3. Polling the sysUpTime object
  4. Sending SNMP SET requests to the port

Explanation

FortiNAC correlates MAC addresses to ports by walking the bridge MIB (dot1dTpFdbTable) and related tables. SET requests are used to change state, not to read learned addresses. sysUpTime only reports uptime, and SNMP cannot retrieve a full running configuration.

Question 35Network Device Integration and SNMP/CLI Modeling

An administrator wants FortiNAC-F to react quickly when a host plugs into a switch port, instead of waiting for the next polling cycle. Which configuration supports this?

  1. Enable SNMP link-state traps from the switch to FortiNAC Correct answer.
  2. Shorten the DHCP lease time on the switch
  3. Enable LLDP on the uplink only
  4. Increase the SNMP polling interval

Explanation

Link-state traps (linkUp/linkDown) let the switch notify FortiNAC immediately when a port changes state, triggering faster evaluation. Changing lease times or polling intervals affects timing indirectly and more slowly. LLDP on the uplink does not provide per-port event notification to FortiNAC.

Question 36Network Device Integration and SNMP/CLI Modeling

For a switch model that FortiNAC-F manages through CLI, which credential is used to enter configuration mode and issue VLAN commands?

  1. The FortiNAC appliance's own admin password
  2. A guest RADIUS account
  3. A privileged (enable) account with the required privilege level Correct answer.
  4. A read-only SNMP community string

Explanation

CLI modeling logs in over SSH or Telnet and must reach privileged configuration mode to change VLANs. That requires an account with sufficient privilege level and, on many platforms, an enable password. SNMP communities, appliance passwords, and guest accounts cannot execute configuration commands.

Question 37Network Device Integration and SNMP/CLI Modeling

When configuring CLI modeling for a switch in FortiNAC-F, which setting defines the exact command text FortiNAC sends to place a port into a VLAN?

  1. The DHCP relay address
  2. The trap destination list
  3. The SNMP community index
  4. The VLAN assignment command template in the device model Correct answer.

Explanation

CLI-based control relies on command templates in the device model that FortiNAC fills in with variables such as interface and VLAN ID. The templates must match the switch's CLI syntax exactly. SNMP indexes, trap destinations, and DHCP relay settings do not carry CLI command text.

Question 38Network Device Integration and SNMP/CLI Modeling

A switch has both SNMP and CLI credentials configured in FortiNAC-F. Which statement describes how FortiNAC typically uses them?

  1. SNMP is used for polling and traps, and CLI may be used for configuration changes requiring commands Correct answer.
  2. SNMP is used only for configuration and CLI only for polling
  3. Only one protocol can be configured per device model
  4. CLI is used for polling and SNMP only for authentication

Explanation

SNMP is efficient for reading state and receiving traps, while CLI is often needed for configuration tasks that SNMP cannot perform cleanly. FortiNAC can combine both on a single device model. The roles are not reversed, and multiple protocols may coexist on one model.

Question 39Network Device Integration and SNMP/CLI Modeling

Which object in the FortiNAC-F device model identifies the specific VLANs FortiNAC is allowed to assign on a managed switch?

  1. The defined VLANs (VLAN IDs) associated with the switch model Correct answer.
  2. The NTP server address
  3. The switch serial number
  4. The FortiNAC host name

Explanation

FortiNAC must know which VLAN IDs exist and are permitted on the switch so it can map roles to VLANs during enforcement. These VLAN definitions are part of the switch's model configuration. Host name, serial number, and NTP settings do not define assignable VLANs.

Question 40Network Device Integration and SNMP/CLI Modeling

An administrator adds a new VLAN to the switch CLI but FortiNAC-F still cannot assign it. What should be checked first?

  1. That the switch has a default route
  2. That the FortiNAC appliance clock is synchronized
  3. That the guest network is enabled
  4. That the VLAN ID is defined in the FortiNAC switch model and mapped in the relevant role Correct answer.

Explanation

A VLAN must exist both on the switch and in FortiNAC's model, and the enforcement role must reference it. Without the model definition and role mapping, FortiNAC has nothing to assign. Clock sync, default routes, and guest network settings do not control VLAN availability in the model.

Question 41Network Device Integration and SNMP/CLI Modeling

What is the purpose of a device profiling or fingerprinting definition when integrating endpoints in FortiNAC-F?

  1. To classify endpoints by characteristics so the correct network access policy is applied Correct answer.
  2. To replace SNMP polling of the switch
  3. To assign IP addresses to endpoints
  4. To encrypt management traffic to the switch

Explanation

Profiling collects attributes such as MAC OUI, DHCP fingerprints, and open ports to classify a device type. The classification then drives which role and VLAN the endpoint receives. It does not provide addressing, encryption, or replace switch polling.

Question 42Network Device Integration and SNMP/CLI Modeling

Which SNMP version setting on a managed switch determines whether FortiNAC-F can use authentication and encryption for polling?

  1. SNMPv3 with an auth/priv user Correct answer.
  2. SNMPv2c with a read-only community
  3. SNMPv1 with a public community
  4. SNMPv2c with a private community

Explanation

Only SNMPv3 supports authentication and privacy (encryption) of management exchanges. SNMPv1 and v2c rely on plaintext community strings with no encryption. Therefore v3 with an auth/priv user is the correct choice when security of polling is required.

Question 43Network Device Integration and SNMP/CLI Modeling

After changing the SNMP community string on a switch, FortiNAC-F shows the device as unreachable. What is the most likely cause?

  1. The endpoint's DHCP lease expired
  2. The FortiNAC license expired
  3. The switch's MAC address table was cleared
  4. The credential stored in the FortiNAC device model no longer matches the switch Correct answer.

Explanation

FortiNAC polls the switch using the credential in its device model; if the switch's community string changes and the model is not updated, polling fails. Clearing the MAC table or a DHCP lease expiry would not break SNMP reachability. A license issue would typically affect broader functionality, not a single device's SNMP poll.

Question 44Network Device Integration and SNMP/CLI Modeling

Which action best verifies that FortiNAC-F can read a switch's MAC address table before enabling enforcement?

  1. Ping the switch from the FortiNAC CLI
  2. Check that the switch has LLDP enabled
  3. Confirm the switch's STP priority
  4. Run a poll or test of the device model and confirm MAC entries are returned Correct answer.

Explanation

A successful poll that returns MAC-to-port entries confirms both reachability and correct SNMP read access to the bridge MIB. A simple ping only proves IP reachability. LLDP and STP settings are unrelated to whether FortiNAC can read the forwarding table.

Question 45Network Device Integration and SNMP/CLI Modeling

When FortiNAC-F cannot read a switch's MAC table but SNMP polling of system information succeeds, which cause is most plausible?

  1. The community string lacks access to the bridge MIB subtree Correct answer.
  2. The FortiNAC appliance is out of disk space
  3. The switch's management IP changed
  4. The endpoint has a static IP address

Explanation

SNMP views can restrict access to specific OID subtrees, so system objects may be readable while the bridge MIB is denied. This produces successful polls with missing MAC data. An IP change would break all polling, and disk space or endpoint addressing would not selectively block the bridge MIB.

Question 46Network Device Integration and SNMP/CLI Modeling

Which configuration on the switch ensures SNMP traps from the device reach FortiNAC-F?

  1. A static route to the FortiNAC subnet
  2. A DHCP helper address pointing to FortiNAC
  3. An ACL permitting HTTPS from FortiNAC
  4. FortiNAC's IP configured as an SNMP trap (host) destination on the switch Correct answer.

Explanation

Traps are unsolicited notifications sent to configured destinations, so the switch must list FortiNAC as a trap host. Routing, HTTPS ACLs, and DHCP helper addresses do not direct SNMP traps to FortiNAC. Without the trap destination, FortiNAC relies only on polling.

Question 47Network Device Integration and SNMP/CLI Modeling

A FortiNAC-F administrator needs to model a switch whose vendor definition is not included by default. What is the appropriate approach?

  1. Disable enforcement for all switches
  2. Import or create a device definition that matches the switch's OID and command syntax Correct answer.
  3. Rely solely on DHCP fingerprinting
  4. Use the generic definition and ignore mismatches

Explanation

When a vendor definition is missing, FortiNAC requires a matching definition for the device's OID and, for CLI control, the correct command syntax. Importing or creating that definition enables modeling. Disabling enforcement or ignoring mismatches leaves the device uncontrolled, and DHCP fingerprinting profiles endpoints rather than switches.

Question 48Network Device Integration and SNMP/CLI Modeling

Which FortiNAC-F feature maps an endpoint to a network access role based on attributes gathered from multiple sources such as DHCP and switch data?

  1. The syslog forwarder
  2. The NTP synchronization service
  3. The policy and role engine that evaluates endpoint attributes Correct answer.
  4. The SNMP trap receiver

Explanation

FortiNAC evaluates collected endpoint attributes against policy to determine the role, which then maps to a VLAN or access decision. The trap receiver collects events, NTP synchronizes time, and syslog forwarding exports logs; none of these make the access decision.

Question 49Network Device Integration and SNMP/CLI Modeling

Why does FortiNAC-F require accurate time synchronization with managed switches when correlating SNMP traps and syslog events?

  1. Timestamps are used to order events correctly during troubleshooting and correlation Correct answer.
  2. NTP is required to encrypt SNMPv3
  3. Clock drift changes the switch's MAC address table
  4. Time sync assigns VLAN IDs automatically

Explanation

Event correlation depends on consistent timestamps so that traps and syslog messages can be ordered and matched. Without synchronized clocks, events may appear out of sequence. NTP does not encrypt SNMPv3, assign VLANs, or alter MAC learning.

Question 50Network Device Integration and SNMP/CLI Modeling

Which statement about reading a switch's VLAN membership table via SNMP in FortiNAC-F is accurate?

  1. The VLAN table is irrelevant to enforcement
  2. FortiNAC assigns VLANs by reading the table without any write access
  3. FortiNAC reads VLAN membership to correlate ports and VLANs with learned MAC addresses Correct answer.
  4. VLAN membership is learned only from DHCP

Explanation

FortiNAC reads VLAN membership tables to understand which ports belong to which VLAN, then correlates that with MAC addresses. Reading alone does not assign VLANs; write access is needed for changes. DHCP and the VLAN table serve different purposes and do not replace each other.