Configure Security Automation NSE6-FORTINAC-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of a custom parser in FortiNAC?

   • ATo replace the need for device integration
   • BTo manage user authentication
   • CTo generate automated responses directly
   • DTo interpret non-standard logs or events from security devices
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses a custom security appliance that sends logs in a JSON format over UDP. The logs contain fields like 'src_mac', 'severity', and 'alert_type'. The security team wants FortiNAC to automatically block devices when the 'alert_type' is 'malware'. What is the FIRST step to achieve this?

   • AAdd the appliance as a security device in FortiNAC.
   • BCreate a security rule that matches the 'malware' alert type.
   • CConfigure a custom parser to extract the relevant fields from the JSON logs.
   • DEnable the appliance's built-in FortiNAC integration.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing company uses a legacy IDS that sends alerts in a proprietary text format. The format includes the device MAC address, a severity level, and a description, but it does not use standard syslog headers. The network team wants FortiNAC to automatically block the offending device when the IDS reports a 'critical' severity alert. What must be done to achieve this?

   • AUse a generic syslog parser and rely on the description field to identify critical alerts.
   • BCreate a custom parser that extracts the MAC address and severity from the IDS messages.
   • CConfigure the IDS to send alerts to FortiNAC using the standard syslog format.
   • DManually block the device each time an alert is received.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In an automated threat response workflow, what is the typical first step after FortiNAC receives a threat event from an integrated security device?

   • ASend an alert to the administrator
   • BQuarantine the device
   • CUpdate the device posture
   • DEvaluate the security rule triggers
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An administrator wants to automatically quarantine a device that is detected as compromised by an integrated firewall. Which FortiNAC feature should be used to implement this automated response?

   • ASecurity rule
   • BDevice profile
   • CCustom parser
   • DNetwork access policy
   Reveal Solution Discussion Select an answer first