Endpoint policies in EMS are evaluated top-to-bottom; the first policy whose conditions all match is applied.

The “Training” policy is placed above “Sales” and contains two conditions:

1. User = student

2. AD Domain = trainingAD.

The account “student” logging in from a machine joined to trainingAD satisfies both conditions, so EMS immediately assigns the Training policy and stops further evaluation. Therefore only the Training policy is pushed to that endpoint.

A. Sales is lower in the list; evaluation stops once Training matches, so Sales is ignored.

C. The Default policy is applied only if no other policy matches; Training matches, so Default is not used.

D. Policy evaluation does not split on/off-fabric once a higher rule matches; Training alone is assigned.

1. Fortinet, “FortiClient EMS 7.4 Administration Guide,” Sec. “Policy evaluation order,” p. 93.

2. Fortinet, “FortiClient EMS 7.4 Administration Guide,” Example-2 “Selecting policy based on user and domain,” p. 95.

The exhibit shows the configuration for a FortiGate user group named "EMSZTNAALL". The critical line set member "EMS1ZTNA" indicates that the members of this group are defined by an external connector named "EMS1ZTNA". In FortiOS, this syntax is used to reference a FortiClient EMS Connector. Therefore, the FortiGate is configured to dynamically pull endpoint information, such as ZTNA tags which function as groups, from a FortiClient EMS server.

B. FortiGate is configured with local user group: A local user group would list locally defined usernames as members, not a connector object.

C. FortiGate is configured to pull user groups from FortiAuthenticator: The member syntax for a FortiAuthenticator group would reference a FortiAuthenticator server object.

D. FortiGate is configured to pull user groups from AD Server: The member syntax for an AD group would reference an LDAP server object and a group distinguished name (DN).

1. FortiGate CLI Reference 7.4, "config user group," Volume 2, page 1038. The documentation shows that the member attribute can accept the name of a fabric connector, including FortiClient EMS.

2. FortiClient EMS Administration Guide 7.4, "Configuring ZTNA tags and firewall policies," page 235. This section details creating a FortiClient EMS connector on FortiGate and using it as a member in a user group for policy enforcement.

3. ZTNA Deployment Guide 7.4, "Configuring ZTNA tags on FortiGate," page 28. The guide provides an example of creating a user group on FortiGate with the FortiClient EMS connector as a member.

FortiGate needs the FortiClient EMS root CA certificate to establish a trust relationship and validate certificates issued by EMS. When FortiClient EMS acts as a Certificate Authority, it issues certificates to FortiClient endpoints. FortiGate must have the EMS root CA certificate installed to verify the authenticity of these client certificates during authentication. This is a fundamental PKI principle where the validating entity (FortiGate) must trust the issuing CA (EMS) to accept certificates signed by it.

A. To revoke FortiClient client certificates - Certificate revocation is performed by the issuing CA (EMS), not by FortiGate.

B. To sign FortiClient CSR requests - Certificate signing is done by the CA (EMS), not by FortiGate which acts as the validator.

C. To update FortiClient client certificates - Certificate updates/renewals are managed by EMS, not by FortiGate.

- FortiClient EMS 7.0 Administration Guide, Section "Certificate Management", pages 234-236

- FortiGate FortiOS 7.0 Handbook, "PKI Users and Certificates" chapter, pages 412-415

- Fortinet Document Library, "FortiClient EMS Certificate Authority Configuration", Doc ID: FD-50124

The exhibit displays a Zero Trust Tagging rule that applies the "Non-compliant" tag to endpoints meeting specific criteria. To make an endpoint compliant, it must not meet these criteria. The rules for being non-compliant are: 1) having high, critical, or medium severity vulnerabilities, 2) having the Web Filter disabled, and 3) running the Calculator application. Therefore, an administrator must patch the specified vulnerabilities and enable the web filter profile to move the endpoint towards a compliant state.

B. Run Calculator application on the endpoint. This action would trigger one of the non-compliant conditions, making the endpoint non-compliant.

C. Integrate FortiSandbox for infected file analysis. This action is irrelevant as FortiSandbox integration is not a condition in the displayed Zero Trust Tagging rule.

FortiClient EMS 7.4 Administration Guide, "Zero Trust Fabric Connectivity," page 111, "Configuring Zero Trust tagging rules." This section details how rules are created based on endpoint state, such as vulnerability status and feature enablement. An endpoint becomes compliant by negating the conditions defined in the non-compliant tagging rule.

In a Fortinet Security Fabric automation stitch, the FortiGate acts as the central enforcement point. When FortiAnalyzer detects an Indicator of Compromise (IOC), it sends an event trigger to the FortiGate. The FortiGate then executes the configured action, which in this case is to send a notification to quarantine the compromised endpoint. This action can be a webhook to FortiClient EMS or applying a quarantine tag for ZTNA enforcement, but the FortiGate is the component that initiates the action.

A. FortiAnalyzer: FortiAnalyzer detects the IOC and sends the trigger, but it does not execute the quarantine action itself.

B. FortiClient: FortiClient is the endpoint agent that is the target of the quarantine action; it does not initiate it.

C. FortiClient EMS: FortiClient EMS receives the quarantine command from FortiGate and applies it to the endpoint, but it doesn't send the initial notification in the stitch.

1. FortiGate Administration Guide 7.4, "Automation stitches," page 1238. The guide explains that stitches consist of a trigger and one or more actions, which are configured and executed on the FortiGate.

2. FortiAnalyzer Administration Guide 7.4, "Event handlers," page 321. This section describes how FortiAnalyzer generates events that can be used as triggers for automation stitches on a FortiGate.

3. Fortinet Security Fabric Cookbook 7.4, "Automatically quarantine a compromised host," page 15. This recipe explicitly shows the FortiGate as the action component that quarantines a device based on a trigger from FortiAnalyzer.

The exhibit displays two deployment profiles. Deployment-2 is configured with the action "Upgrade" and targets both an Active Directory (AD) group named "AD-Group" and a workgroup named "Workgroup". Therefore, this profile is set to upgrade existing FortiClient installations on endpoints within both of these specified groups. The action and targets are clearly defined in the profile's configuration shown.

B. Deployment-1 targets an "AD group", not an "AO group". The action is correct (Install), but the target group name is misrepresented.

C. The action for Deployment-2 is "Upgrade", not "Install". This profile is intended to update existing clients, not perform new installations.

D. Deployment-1's action is "Install", not "Upgrade", and it targets an AD group, not a workgroup.

1. FortiClient EMS 7.4 Administration Guide, "Creating a deployment package" section, page 113. This section details the configuration options for deployment profiles, including setting the action to "Install" or "Upgrade" and defining targets such as AD groups or workgroups.

The policy shown limits real-time (on-access) scanning to the specified directory “Resources.” FortiClient therefore triggers malware scanning only when a user writes or copies a file into that folder; other folders are unaffected. If malware is detected the configured post-scan action (quarantine/delete) will occur, but the event that invokes scanning is the copy operation into the Resources folder.

B. Quarantine is an action after detection, not the trigger condition illustrated.

C. The file is first scanned; it is never copied without inspection.

D. Deleting is configurable but the exhibit shows the behavioural trigger of scanning, not necessarily deletion.

1. Fortinet, “FortiClient EMS Administration Guide 7.2,” Section 6.3 “Real-time Scan—Scan only these directories” (p. 176-177).

2. Fortinet, “FortiClient for Windows Administration Guide 7.2,” Table 59 “On-access Scan Behaviour” (p. 92).

The endpoint record list is populated only after the client presents a certificate that FortiGate successfully authenticates.

If Remote-Client sends a certificate that cannot be validated against the CA chain or does not meet the rule’s certificate criteria, the TLS handshake fails; FortiGate drops the connection and never creates an endpoint entry, so diagnose endpoint record list shows nothing. This indicates a failure in client-certificate authentication.

A. If no connection attempt occurred, no access-proxy log entries would be present; the question implies a connection attempt.

B. An empty certificate is rejected at the TLS layer; FortiGate logs “no certificate” rather than “authentication failed”.

C. “Invalid certificate” refers to format errors; the most common operational cause is failed authentication, not malformed cert.

1. Fortinet, “FortiOS 7.4 Zero-Trust Network Access,” Sec. “Client certificate troubleshooting,” p. 133.

2. Fortinet, “FortiOS 7.4 CLI Reference,” cmd: diagnose endpoint record list – description, p. 2113.

3. Fortinet, “FortiOS 7.4 Log Reference,” TLS client-auth failure messages, p. 456.

When the FortiClient EMS web console (GUI) is inaccessible, the primary tool for initial investigation and diagnostics is the command-line interface (CLI) on the EMS server itself. The EMS installation includes a set of CLI tools that allow an administrator to check the status of essential services (including the web server), review configurations, and perform diagnostic tests without relying on the web interface. This is the standard procedure for troubleshooting when a server's GUI becomes unresponsive.

B. Web server logs are located on the EMS server's file system, not within the PostgreSQL database server. This option misidentifies the source of the logs.

C. This option is not viable because the premise of the question is that the administrator has already lost access to the FortiClient EMS GUI.

D. While a log generator from the support site is a valid tool for collecting comprehensive data for a support ticket, it is not the primary, built-in tool for initial investigation.

1. FortiClient EMS 7.4 Administration Guide, "Appendix A: CLI commands" section, p. 288. This appendix documents the available CLI commands for managing and troubleshooting the EMS server, such as femssystem status to check service states, which is a critical first step when the GUI is down.

2. Fortinet Certified Professional - FortiClient EMS Study Guide, "Troubleshooting" module. This official courseware emphasizes using the CLI for initial diagnostics when the web console is unavailable.

FortiClient provides three distinct antivirus scanning modes to suit different security and performance needs. A 'Quick Scan' checks critical system areas and running processes for active threats. A 'Full Scan' performs an exhaustive check of all files and folders on the endpoint. A 'Custom Scan' allows the user or administrator to specify particular files or folders to be scanned, offering flexibility for targeted checks.

A. Proxy scan is an inspection method used by FortiGate firewalls to scan traffic as it passes through the proxy, not a local endpoint scan type in FortiClient.

D. Flow scan (flow-based inspection) is a high-speed inspection mode used by FortiGate firewalls, which analyzes traffic as it flows, rather than a local endpoint AV scan.

- FortiClient 7.4 Administration Guide, page 101, "Malware Protection": "You can configure FortiClient to run a quick, full, or custom malware scan on the endpoint."