Integrate Third-Party Devices Using Syslog and SNMP NSE6-FORTINAC-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An organization wants only the network security team to receive email alerts about critical security events, while the helpdesk team should only receive alerts about device onboarding issues. What FortiNAC feature should be used to control which users receive which notifications?

   • AAdministrative groups
   • BDevice profiles
   • CNetwork access policies
   • DEvent log filters
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A hospital has a mix of medical devices. Some devices send syslog messages, and others send SNMP traps. The security team wants to quarantine any device that sends a syslog message containing 'SECURITY_VIOLATION' OR an SNMP trap with OID 1.3.6.1.4.1.999.1. The quarantine action should be logged and the security team notified. What is the most efficient way to configure this in FortiNAC?

   • ACreate a single event that matches both the syslog message and the SNMP trap, then create one automated response that triggers on that event.
   • BCreate one automated response that triggers on any syslog message or SNMP trap from the medical devices and applies the quarantine policy.
   • CCreate a syslog parser rule for the syslog message and an SNMP trap rule for the trap, then create a single automated response that triggers on both rules.
   • DCreate two separate events: one for the syslog message and one for the SNMP trap. Create two automated responses, each triggering on one event, both applying the same quarantine policy and sending a notification to the security team.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An administrator wants FortiNAC to proactively check the status of a third-party network device at regular intervals to detect if it goes offline. Which SNMP mechanism should be configured to achieve this?

   • ASNMP traps
   • BSNMP community strings
   • CSNMP polling
   • DSNMP informs
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of an automated response that FortiNAC can be configured to perform when a policy rule is triggered?

   • AModifying the device's firmware
   • BReconfiguring the device's SNMP community string
   • CQuarantining a device
   • DChanging the device's MAC address
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company has POS terminals that send syslog messages to FortiNAC. A syslog parser rule already maps the message 'CARD_READER_FAIL' to the event 'POS_Error'. The security team now wants to automatically isolate any POS terminal that generates this event. What is the required configuration in FortiNAC?

   • ACreate an automated response that triggers on the 'POS_Error' event and applies a quarantine policy to the device.
   • BModify the existing syslog parser rule to include a quarantine action in addition to mapping to the event.
   • CConfigure an SNMP trap receiver to listen for the 'CARD_READER_FAIL' message and trigger a quarantine.
   • DCreate a new syslog parser rule for 'CARD_READER_FAIL' that maps to a quarantine policy instead of the 'POS_Error' event.
   Reveal Solution Discussion Select an answer first