A primary application of a quarantine VLAN is to isolate devices that fail security checks, such as 802.1X authentication. When a device attempts to connect to a port configured with an 802.1X policy and fails the Extensible Authentication Protocol (EAP) exchange, the FortiSwitch can be configured to dynamically move that port to a pre-defined quarantine VLAN. This action effectively isolates the non-compliant device from the production network while allowing it limited access, typically to remediation services hosted on the FortiGate. This is a fundamental feature of Fortinet's Network Access Control (NAC) solution.

A. A quarantine VLAN is typically configured on the FortiGate with a DHCP server to assign an IP address for remediation portal access.

C. Using a quarantine VLAN is an action configured within a specific NAC or 802.1X policy; it is not exclusively dependent on a single global setting.

D. The quarantine VLAN must be explicitly added to the allowed-vlans list on the FortiLink trunk to permit traffic between the quarantined device and the FortiGate.

1. FortiOS 7.6.0 Handbook, FortiSwitch Manager, "Configuring 802.1X security policies" section: This section details the configuration of 802.1X policies, including the action to take upon authentication failure. It states, "If you enable set eap-fail-vlan enable, you can select a VLAN to assign to clients that fail EAP authentication." This directly supports the correct answer (B).

2. FortiSwitch 7.6.0 CLI Reference, config switch-controller security-policy 802-1X command: The documentation for this command includes the set eap-fail-vlan {enable | disable} and set eap-fail-vlan-id parameters. These options explicitly provide the functionality to assign a specific VLAN when 802.1X authentication fails, confirming the mechanism described in answer B.

3. FortiOS 7.6.0 Handbook, FortiSwitch Manager, "Configuring NAC policies" section: When describing the "Quarantine" action for a NAC policy, the guide explains that the device can be assigned to a specific VLAN. It also shows that for this to work, a VLAN interface with a DHCP server must be configured on the FortiGate and the VLAN must be allowed on the FortiLink trunk, which refutes options A and D.