Looking at the provided exhibit which shows the Modify User/Host Profile window, the following

must be true for a host to match the user/host profile:

The host must be connected to a port within the "Building 1 First Floor Ports" group.

The host must fulfill at least one of the following attributes:

Have a role value of "Contractor"

Have an installed persistent agent with the security and access value of "Contractor"

The host must be connected between the specified times of 6 AM and 5 PM on any day of the week.

The profile specifies that the host can match the profile by having any one of the listed attributes

(Role as Contractor, Persistent Agent installed with specific security & access value), and the time

condition must also be met. Therefore, the correct answer is D, which includes "or" conditions for the

role value and persistent agent and specifies the correct time frame.

To allow FortiNAC to process incoming syslog messages from an unknown vendor, two steps must be

taken:

Creation of a customized event parser: This enables FortiNAC to parse and integrate syslog messages

from any vendor or device, as long as the messages are in CSV, CEF, or Tag/Value format​​.

Modeling the device in the Topology view: Any device that sends syslog messages to FortiNAC must

be modeled in this view. FortiNAC will not process syslog or trap messages unless the source address

belongs to a device modeled in the topology​​.

Reference

FortiNAC 7.2 Study Guide, pages 428 and 399

In general, for network switches supporting MAC notification traps, it's advisable to configure these

traps on all ports except uplink ports. Uplink ports are used for connecting to other switches or

network infrastructure devices and typically don't need MAC notification traps, which are more

relevant for end-device connectivity monitoring.

The study guide specifies that MAC notification traps should not be configured on interfaces that are

uplinks. They are the preferred method for learning and updating Layer 2 information and should be

used whenever available, but not on uplink interfaces​​.

To gather a list of installed applications and application details from a host, two methods can be

used:

Agent technology: FortiNAC uses agent technology to collect all installed applications on an

endpoint.

Integration with MDMs (Mobile Device Management systems): MDMs that support application

gathering can be integrated with FortiNAC to collect application information​​.

Reference

FortiNAC 7.2 Study Guide, page 302

In a wireless integration, FortiNAC uses RADIUS to obtain connecting MAC address information. This includes RADIUS requests to FortiNAC and subsequent RADIUS responses from FortiNAC to the requesting device​

Logical networks are assigned to endpoints through device profiling rules in FortiNAC. These

networks appear in device Model Configuration views and are used for endpoint isolation based on

the endpoint’s state or status

Reference: https://docs.fortinet.com/document/fortinac/8.6.0/administrationguide/283146/evaluating-rogue-hosts

Both dissolvable and persistent agents can be used to validate endpoint compliance transparently to

the end user. The persistent agent stays resident on the endpoint and performs scheduled scans in

the background. The dissolvable agent is a run-once agent that dissolves after reporting its results,

leaving no footprint on the endpoint

:

A . Manual Polling: This is when an administrator or network operator initiates a poll manually to

gather information or check the status of the network devices. This can be done for immediate

troubleshooting or assessment.

B . Scheduled Poll Timings: Network management systems often have the capability to schedule

regular polls of devices to check their status or monitor their performance. These scheduled polls can

be set at regular intervals (such as every few minutes, hours, or daily) depending on the

requirements of the network.

E . Linkup and Linkdown Traps: SNMP (Simple Network Management Protocol) traps, like Linkup and

Linkdown, are automated notifications sent from network devices to a management system. A

Linkup trap indicates that a particular interface has become active (up), while a Linkdown trap

indicates that an interface has become inactive (down). These traps can trigger Layer 2 polling to

ascertain the current status of network interfaces and devices.