I have problems with this.
If you review the page 143, there are only two correct answers, but it says "choose three".
A is incorrect. Point 6: FortiClient checks the endpoint using the provided zero trust tagging rules and sends back the results to FortiClient EMS. Note that it says "zero trust tagging RULES". Not "ZTNA tags"
B is incorrect. Point 4: Zero-trust tagging rules are configured in FortiClient EMS, based on criteria such as certificates, the logged in domain, files present, OS versions, running processes, registry keys, and so on. Note that it says "Zero-trust tagging rules are configured in FortiClient EMS". Not "ZTNA tags are configured in FortiClient".
C is correct. Point 9: Network access is provided to the endpoint, based on the zero-trust tagging rules.
(this answer continues)
D is correct. Point 3: FortiClient EMS sends the endpoint information received through FortiClient Telemetry to FortiOS.
E is incorrect. Point 8: FortiOS can receive the dynamic endpoint groups from FortiClient EMS and use them to create Dynamic firewall policies. Note it says that it's FortiOS who creates Dynamic firewall policies. It is not FortiClient EMS who creates dynamic policies using ZTNA tags.
So, C and D are right. One is missing.
The only thing that comes to my mind is that "A" is correct, but it is not written correctly. It should say "FortiClient checks the endpoint using the ztna TAGGING RULES (and not "tags") provided by FortiClient EMS". This way, "A" would be correct.
This slide shows how FortiClient-EMS and FortiGate check for compliance:
FortiClient-EMS is connected to FortiGate as a participant in the Security Fabric.
FortiClient Telemetry attempts to connect to FortiClient-EMS. Based on the FortiClient-EMS configuration, FortiClient may receive an SSL certificate from EMS to verify the connection.
FortiClient-EMS sends the endpoint information received through FortiClient Telemetry to FortiOS.
Zero-trust tagging rules are configured in FortiClient-EMS, based on criteria such as certificates, the logged in domain, files present, OS versions, running processes, registry keys.
FortiClient-EMS sends zero-trust tagging rules to the endpoint.
FortiClient checks the endpoint using the provided zero trust tagging rules and sends back the results to FortiClient-EMS.
FortiClient-EMS dynamically groups the endpoint, based on the zero-trust tagging rules.
FortiOS can receive the dynamic endpoint groups from FortiClient-EMS and use them to create dynamic firewall policies.
Network access is provided to the endpoint, based on the zero-trust tagging rules.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
lucient
8 months, 2 weeks agolucient
8 months, 2 weeks agoFikachew
1 year agolil_pc1972
1 year, 1 month ago