Free FCP-FCT-AD-7-2 sample questions

Correct answer: The FortiGate acting as the ZTNA access proxy.

In a Fortinet ZTNA solution, the FortiGate acts as the access proxy and enforcement point. It receives the connection request, queries the FortiClient EMS for the endpoint's posture tags, and then evaluates its ZTNA policy rules to either grant or deny access. FortiClient reports the posture, and EMS manages the tags, but FortiGate makes the final enforcement decision.

Correct answer: A configuration profile containing the EMS server IP address was not deployed alongside the installer.

For macOS deployments via MDM, the FortiClient installer package (.pkg) itself does not contain the EMS server information. A separate configuration profile (.mobileconfig) must be created and deployed to the endpoints. This profile contains the necessary settings, including the EMS IP address, to allow the client to register.

Correct answer: The compliance rule action is set to 'Monitor' instead of 'Quarantine'.

For a compliance rule to take an enforcement action like quarantine, the action must be explicitly set to 'Quarantine'. If it is set to 'Monitor', EMS will detect the non-compliance and report it, but it will not automatically isolate the device. Since vulnerabilities are being reported but no quarantine is happening, this is the most probable cause.

Correct answers: A Google Workspace (formerly G Suite) administrator account.; The FortiClient EMS server must be publicly accessible via HTTPS.

Correct answer: True

True. The FortiClient Configurator tool allows an administrator to customize the FortiClient MSI installer. This includes embedding the EMS server IP address, pre-configuring features, and setting a silent installation flag, which simplifies mass deployment through tools like GPO or SCCM.

Correct answer: A ZTNA server, a firewall policy with the 'Developers' user group as the source, and a ZTNA tag for the OS version.

A correct ZTNA rule on FortiGate requires a ZTNA server object defining the destination, a firewall policy that specifies the source user/group (from AD) and the ZTNA server as the destination, and includes the EMS ZTNA tag for posture checking (approved OS version). This combination ensures both user identity and device posture are verified.

Correct answer: Enable 'Block HTTP and HTTPS traffic by IP address'.

The Web Filter profile's category-based blocking works on domain names. To prevent users from bypassing this by using a website's direct IP address, the 'Block HTTP and HTTPS traffic by IP address' option must be explicitly enabled. This ensures that any web requests made directly to an IP are also blocked.

Correct answer: The FQDN or IP address of the SQL Server and the necessary service account credentials.

When installing FortiClient EMS and opting to use an external Microsoft SQL Server, the setup wizard requires the server's address (either FQDN or IP), the port (if not the default), and authentication credentials (like a service account) that have sufficient permissions to create and manage the EMS database.

Correct answer: Use the 'Diagnostic Tool' within the FortiClient console to check the connection status to EMS.

The FortiClient console on the endpoint has a built-in 'Diagnostic Tool'. This tool provides a quick and easy way to verify the client's connection status to the EMS server, check the last profile update time, and see if any communication errors are logged. This is the most efficient first step to diagnose profile update issues directly from the client side.

Correct answer: To manage the FortiClient EMS services, such as starting, stopping, and checking their status from the command line.

The `fctservctl.exe` command-line utility is the FortiClient EMS Service Controller. It is used to manage the core services of the EMS server itself. Administrators can use it to stop, start, restart, and query the status of all related services, which is particularly useful for troubleshooting and scripted maintenance.