Fortinet FCP_FCT_AD-7.4 Exam Dumps - Actual Questions Answers

Based on the Security Fabric automation settings shown in the exhibit:

The automation stitch is configured with a trigger for a "Compromised Host."

The action specified for this trigger is "Quarantine FortiClient via EMS."

This indicates that when an endpoint is detected as compromised, FortiClient EMS will quarantine the endpoint as part of the automation process.

Therefore, the action taken on compromised endpoints will be to quarantine them through EMS.

References

FortiGate Security 7.2 Study Guide, Automation Stitches and Actions Section

Fortinet Documentation on Configuring Automation Stitches and Quarantine Actions

Observation of Exhibits:

The exhibits show the Zero Trust Tag Monitor on FortiClient EMS and the FortiClient GUI status.

Remote-Client is tagged as "Remote-Endpoints" on the FortiClient EMS Zero Trust Tag Monitor.

Enabling Tag Visibility:

To show the tag on the FortiClient GUI, the endpoint alerts configuration must be adjusted to enable tag visibility.

Verification:

The correct action is to change the endpoint alerts configuration to enable tag visibility, ensuring that the tag appears in the FortiClient GUI.

Based on theFortiClient EMS 7.2/7.4 Administrator Study Guideand theFortiGuard Forensics Service User Guide, the forensics analysis feature is a specialized service that requires specific administrative actions and configuration.

1. The Administrator Must Request Analysis (Answer B)

Manual Initiation: Unlike standard Antivirus or Sandbox scans which occur automatically upon detection, theFortiGuard Forensics Analysisis a service-based investigation.

Workflow: Once a threat is detected or a device is suspected of being compromised, the administrator must navigate to theEndpointspane, select the specific device, and click theRequest Analysisbutton.

Escalation: The administrator then fills out a questionnaire (providing the reason for escalation and issue summary) to submit the logs to the FortiGuard Labs forensic team for manual review.

2. Forensics Features Must be Enabled in the Profile (Answer D)

Two-Step Enabling:

Global Level: First, the feature must be toggled on underSystem Settings > Feature Select > FortiGuard Forensics Analysis.

Profile Level: Crucially, it must be enabled within theEndpoint Profile(specifically underSystem Settings) that is applied to the target endpoints.

Agent Deployment: Toggling this in the profile ensures the FortiClient endpoint prepares the "forensics agent" components required to collect deep-system data (such as the Master File Table, Windows Event Logs, and registry hives) when a request is eventually made.

3. Why Other Options are Incorrect

A. FortiClient sends an alert notification: While FortiClient does send alerts for malicious activity, this is part of the standardEndpoint ControlandMalware Protectionmodules. Theforensics analysisitself is the follow-up investigation performed after such an alert is received and reviewed by an admin.

C. The endpoint is quarantined until completed: Although it is a security "Best Practice" to quarantine a compromised endpoint during an investigation, the forensics analysis process does not programmatically force or require a quarantine state to function. The forensics agent can collect logs from an online, non-quarantined device as long as it has EMS connectivity.