[Jun-2026] Exam NSE5_FNC_AD_7.6: New Brain Dump Professional - ExamsReviews
Free NSE5_FNC_AD_7.6 Exam Dumps to Improve Exam Score
Fortinet NSE5_FNC_AD_7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 16
A healthcare organization is integrating FortiNAC-F with its existing MDM. Communication is failing between the systems.
What could be a probable cause?
- A. SSH communication is failing
- B. Security Fabric traffic is failing
- C. REST API communication is failing
- D. SOAP API communication is failing
Answer: C
Explanation:
The integration between FortiNAC-F and Mobile Device Management (MDM) platforms (such as Microsoft Intune, VMware Workspace ONE, or Jamf) is a critical component for providing visibility into mobile assets that do not connect directly to the managed infrastructure via standard wired or wireless protocols.
According to the FortiNAC-F MDM Integration Guide, the communication between the FortiNAC-F appliance and the MDM server is handled through REST API calls. FortiNAC-F acts as an API client, periodically polling the MDM server to retrieve device metadata, compliance status, and ownership information. If communication is failing, it is most likely because the API credentials (Client ID/Secret) are incorrect, the MDM's API endpoint is unreachable from the FortiNAC-F service port, or the SSL certificate presented by the MDM is not trusted by the FortiNAC-F root store.
While SSH (B) is used for switch CLI management and the Security Fabric (A) uses proprietary protocols for FortiGate synchronization, neither is the primary vehicle for MDM data exchange. SOAP API (D) is an older protocol that has been largely replaced by REST in modern FortiNAC integrations.
"FortiNAC integrates with MDM systems by utilizing REST API communication to query the MDM database for device information. To establish this link, administrators must configure the MDM Service Connector with the appropriate API URL and authentication credentials. If the 'Test Connection' fails, verify that the FortiNAC can reach the MDM provider via the REST API port (usually HTTPS 443)." - FortiNAC-F Administration Guide: MDM Integration and Troubleshooting.
NEW QUESTION # 17
Refer to the exhibit.
A FortiNAC-F N+1 HA configuration is shown.
What will occur if CA-2 fails?
- A. CA-3 will be promoted to a primary and share management responsibilities with CA-1.
- B. CA-3 will continue to operate as a secondary in an N+1 HA configuration.
- C. CA-1 and CA-3 will operate as a 1+1 HA cluster with CA-3 acting as a hot standby.
- D. CA-3 will be promoted to a primary and FortiNAC-F manager will load balance between CA-1 and CA-3.
Answer: B
Explanation:
In an N+1 High Availability (HA) configuration, a single secondary Control and Application (CA) server provides backup for multiple primary CA servers. The FortiNAC-F Manager (FortiNAC-M) acts as the centralized orchestrator for this cluster, monitoring the health of all participating nodes.
According to the FortiNAC-F 7.6.0 N+1 Failover Reference Manual, when a primary CA (such as CA-2 in the exhibit) fails, the secondary CA (CA-3) is automatically promoted by the Manager to take over the specific workload and database functions of that failed primary. Crucially, the documentation specifies that even after this promotion, the system architecture maintains its N+1 logic. The secondary CA effectively "assumes the identity" of the failed primary while continuing to operate within the N+1 framework established by the Manager.
It does not merge with CA-1 to form a traditional 1+1 active/passive cluster (A), nor does it engage in load balancing (D), as FortiNAC-F HA is designed for redundancy and failover rather than active traffic distribution. Furthermore, CA-3 does not "share" management with CA-1 (C); it independently handles the tasks originally assigned to CA-2. Throughout this failover state, the Manager continues to oversee the group, and CA-3 remains the designated secondary unit currently acting in a primary capacity for the downed node until CA-2 is restored.
"In an N+1 Failover Group, the Secondary CA is designed to take over the functionality of any single failed primary component within the group. The FortiNAC Manager monitors the primaries and initiates the failover to the secondary... Once failover occurs, the secondary continues to operate as the backup unit for the failed primary while remaining part of the managed N+1 HA configuration." - FortiNAC-F 7.6.0 N+1 Failover Reference Manual: Failover Behavior Section.
NEW QUESTION # 18
Refer to the exhibit.
What would FortiNAC-F generate if only one of the security fitters is satisfied?
- A. A normal event
- B. A security alarm
- C. A security event
- D. A normal alarm
Answer: A
Explanation:
In FortiNAC-F, Security Triggers are used to identify specific security-related activities based on incoming data such as Syslog messages or SNMP traps from external security devices (like a FortiGate or an IDS). These triggers act as a filtering mechanism to determine if an incoming notification should be escalated from a standard system event to a Security Event.
According to the FortiNAC-F Administrator Guide and relevant training materials for versions 7.2 and 7.4, the Filter Match setting is the critical logic gate for this process. As seen in the exhibit, the "Filter Match" configuration is set to "All". This means that for the Security Trigger named "Infected File Detected" to "fire" and generate a Security Event or a subsequent Security Alarm, every single filter listed in the Security Filters table must be satisfied simultaneously by the incoming data.
In the provided exhibit, there are two filters: one looking for the Vendor "Fortinet" and another looking for the Sub Type "virus". If only one of these filters is satisfied (for example, a message from Fortinet that does not contain the "virus" subtype), the logic for the Security Trigger is not met. Consequently, FortiNAC-F does not escalate the notification. Instead, it processes the incoming data as a Normal Event, which is recorded in the Event Log but does not trigger the automated security response workflows associated with security alarms.
"The Filter Match option defines the logic used when multiple filters are defined. If 'All' is selected, then all filter criteria must be met in order for the trigger to fire and a Security Event to be generated. If the criteria are not met, the incoming data is processed as a normal event. If 'Any' is selected, the trigger fires if at least one of the filters matches." - FortiNAC-F Administration Guide: Security Triggers Section.
NEW QUESTION # 19
While discovering network infrastructure devices, a switch appears in the inventory topology with a question mark (?) on the icon. What would cause this?
- A. The SNMP ObjectlD is not recognized by FortiNAC-F.
- B. The wrong SNMP community string was entered during discovery.
- C. SNMP is not enabled on the switch.
- D. A read-only SNMP community siring was used.
Answer: A
Explanation:
In FortiNAC-F, the Inventory topology uses specific icons to represent the status and model of discovered network infrastructure. When a switch or other network device is discovered via SNMP, FortiNAC-F retrieves its System ObjectID (sysObjectID) to identify the specific make and model. This OID is then compared against the internal database of supported device mappings.
A question mark (?) icon appearing on a discovered switch indicates that while the discovery process successfully communicated with the device (meaning SNMP credentials were correct), the SNMP ObjectID is not recognized or mapped in the current version of FortiNAC-F. This essentially means the device is "unsupported" by the current software out-of-the-box. Because the OID is unknown, FortiNAC-F does not know which CLI or SNMP command set to use for critical functions like L2 polling (host visibility) or VLAN switching (enforcement). To resolve this, an administrator can manually "Set Device Mapping" to a similar existing model or a "Generic SNMP Device" if only basic L3 visibility is required.
"Discovered devices displaying a '?' icon indicate the currently running version does not have a mapping for that device's System OID (device is not supported). Device mappings are used to manage the device by performing functions such as L2/L3 Polling, Reading, and Switching VLANs." - Fortinet Technical Tip: Options for devices unable to be modeled in Inventory.
NEW QUESTION # 20
A network administrator is troubleshooting a network access issue for a specific host. The administrator suspects the host is being assigned a different network access policy than expected.
Where would the administrator look to identify which network access policy, if any, is being applied to a particular host?
- A. The Port Properties view of the hosts port
- B. The Policy Details view for the host
- C. The Connections view
- D. The Policy Logs view
Answer: B
Explanation:
When troubleshooting network access in FortiNAC-F, it is often necessary to verify exactly why a host has been granted a specific level of access. Since FortiNAC-F evaluates policies from the top down and assigns access based on the first match, an administrator needs a clear way to see the results of this evaluation for a specific live endpoint.
The Policy Details (C) view is the designated tool for this purpose. By navigating to the Hosts > Hosts (or Adapter View) in the Administration UI, an administrator can search for the specific MAC address or IP of the host in question. Right-clicking on the host record reveals a context menu from which Policy Details can be selected. This view provides a real-time "look" into the policy engine's decision for that specific host, showing the Network Access Policy that was matched, the User/Host Profile that triggered the match, and the resulting Network Access Configuration (VLAN/ACL) currently applied.
While Policy Logs (A) provide a historical record of all policy transitions across the system, they are often too high-volume to efficiently find a single host's current state. The Connections view (B) shows the physical port and basic status but lacks the granular policy logic breakdown. The Port Properties (D) view shows the configuration of the switch interface itself, which is only one component of the final access determination.
"To identify which policy is currently applied to a specific endpoint, use the Policy Details view. Navigate to Hosts > Hosts, select the host, right-click and choose Policy Details. This window displays the specific Network Access Policy, User/Host Profile, and Network Access Configuration currently in effect for that host record." - FortiNAC-F Administration Guide: Policy Details and Troubleshooting.
NEW QUESTION # 21
In which three ways would deploying a FortiNAC-F Manager into a large environment consisting of several FortiNAC-F CAs simplify management? (Choose three.)
- A. Global authentication security policies
- B. Pooled licenses
- C. Global infrastructure device inventory
- D. Global visibility
- E. Global version control
Answer: B,D,E
Explanation:
The FortiNAC-F Manager (FortiNAC-M) is designed as a centralized management platform for large-scale distributed environments where multiple FortiNAC-F Control and Application (CA) appliances are deployed across different sites. According to the FortiNAC-F Manager Administration Guide, the deployment of a Manager simplifies administrative overhead in three specific ways:
First, it provides Global Version Control (B). The Manager serves as a central repository for firmware and software updates, allowing administrators to push specific versions to all managed CAs simultaneously, ensuring consistency across the entire fabric. Second, it enables Pooled Licenses (D). Instead of purchasing and managing individual licenses for every CA, licenses are centralized on the Manager. The Manager then distributes these licenses to the CAs as needed based on their host counts. This "floating" license model optimizes cost and prevents individual sites from running out of capacity while others have excess. Third, it offers Global Visibility (E). The Manager aggregates host and device data from every managed CA into a single console. This "single pane of glass" allows an administrator to search for a specific MAC address or user across the entire global organization without logging into individual servers.
While the Manager can assist with configuration templates, authentication security policies (C) and infrastructure modeling (A) are still predominantly managed at the local CA level to ensure site-specific logic and performance.
"The FortiNAC Manager provides a central management console for multiple FortiNAC-F servers (CAs). Key benefits include: * License Management: Licenses are pooled on the Manager and allocated to managed CAs as needed. * Software Management: Firmware updates can be centrally managed and pushed to all CAs from the Manager. * Centralized Monitoring: Provides a global view of all hosts, adapters, and events across the entire managed environment." - FortiNAC-F Manager Administration Guide: Overview and Benefits.
NEW QUESTION # 22
Refer to the exhibit.
An administrator has configured the DHCP scope for a registration isolation network, but the isolation process isn't working.
What is the problem with the configuration?
- A. The label uses a system-reserved value.
- B. The lease pool does not contain a complete subnet.
- C. The gateway defined for the scope is incorrect.
- D. The domain name server designation is incorrect.
Answer: C
Explanation:
In a FortiNAC-F deployment, the configuration of the DHCP scope for isolation networks (Registration, Remediation, etc.) must perfectly align with the underlying network infrastructure to ensure that isolated hosts can communicate with the FortiNAC appliance. In the provided exhibits, there is a clear discrepancy between the DHCP configuration and the Network Topology.
As shown in the "Network Topology" exhibit, the Registration Network resides on a router interface (or sub-interface) with the IP address 192.168.180.1. This address represents the default gateway for any host placed into the Registration VLAN. However, the "DHCP configuration" exhibit shows the scope "REG-ScopeOne" configured with a Gateway of 10.0.1.254. This 10.0.1.254 address belongs to the management/service network (port2 of FortiNAC), not the registration subnet. If a host in the Registration VLAN receives this incorrect gateway via DHCP, it will attempt to send all off-link traffic to an unreachable IP, preventing it from loading the Captive Portal or communicating with the FortiNAC server.
According to the FortiNAC-F Configuration Wizard Reference, when defining a Layer 3 network scope, the "Gateway" field must contain the IP address of the router interface that acts as the gateway for that specific isolation VLAN. The FortiNAC appliance itself usually sits on a different subnet, and traffic is directed to it via the router's DHCP Relay (IP Helper) and DNS redirection.
"When configuring scopes for a Layer 3 network, the Gateway value must be the IP address of the router interface for that subnet. This allows the host to reach its local gateway to route traffic. If the gateway is misconfigured, the host will be unable to reach the FortiNAC eth1/port2 interface for registration... Ensure the Gateway matches the network topology for the isolation VLAN." - FortiNAC-F Configuration Wizard Reference Manual: DHCP Scopes.
NEW QUESTION # 23
When FortiNAC-F is managing VPN clients connecting through FortiGate, why must the clients run a FortiNAC-F agent?
- A. To transparently update The client IP address upon successful authentication
- B. To collect the client IP address and MAC address
- C. To validate the endpoint policy compliance
- D. To collect user authentication details
Answer: B
Explanation:
When FortiNAC-F manages VPN clients through a FortiGate, the agent plays a fundamental role in device identification that standard network protocols cannot provide on their own. In a standard VPN connection, the FortiGate establishes a Layer 3 tunnel and assigns a virtual IP address to the client. While the FortiGate sends a syslog message to FortiNAC-F containing the username and this assigned IP address, it typically does not provide the hardware (MAC) address of the remote endpoint's physical or virtual adapter.
FortiNAC-F relies on the MAC address as the primary unique identifier for all host records in its database. Without the MAC address, FortiNAC-F cannot correlate the incoming VPN session with an existing host record to apply specific policies or track the device's history. By running either a Persistent or Dissolvable Agent, the endpoint retrieves its own MAC address and communicates it directly to the FortiNAC-F service interface. This allows the "IP to MAC" mapping to occur. Once FortiNAC-F has both the IP and the MAC, it can successfully identify the device, verify its status, and send the appropriate FSSO tags or group information back to the FortiGate to lift network restrictions.
Furthermore, while the agent can also perform compliance checks (Option D), the architectural requirement for the agent in a managed VPN environment is primarily driven by the need for session data correlation-specifically the collection of the IP and MAC address pairing.
"Session Data Components: * User ID (collected via RADIUS, syslog and API from the FortiGate). * Remote IP address for the remote user connection (collected via syslog and API from the FortiGate and from the FortiNAC agent). * Device IP and MAC address (collected via FortiNAC agent). ... The Agent is used to provide the MAC address of the connecting VPN user (IP to MAC)." - FortiNAC-F FortiGate VPN Integration Guide: How it Works Section.
NEW QUESTION # 24
An administrator wants to build device profiling rules based on network traffic, but the network session view is not populated with any records.
Which two settings can be enabled to gather network session information? (Choose two.)
- A. Netflow setting on the FortiNAC-F interfaces
- B. Network traffic polling on any modeled infrastructure device
- C. Firewall session polling on modeled FortiGate devices
- D. Layer 3 polling on the infrastructure devices
Answer: A,C
Explanation:
In FortiNAC-F, the Network Sessions view provides a real-time and historical log of traffic flows, including source/destination IP addresses, ports, and protocols. This data is essential for building Device Profiling Rules that rely on "Traffic Patterns" or "Network Footprints" to identify devices (e.g., an IP camera communicating with its specific NVR). If the network session view is empty, the system is not receiving the necessary flow or session data from the network infrastructure.
According to the FortiNAC-F Administration Guide, there are two primary methods to populate this view:
NetFlow/sFlow/IPFIX (C): FortiNAC-F can act as a flow collector. By enabling NetFlow settings on the FortiNAC-F service interface (port2/eth1) and configuring your switches or routers to export flow data to the FortiNAC IP, the system can parse these packets and record sessions.
Firewall Session Polling (B): For environments with FortiGate firewalls, FortiNAC-F can proactively poll the FortiGate via the REST API to retrieve its current session table. This is particularly useful as it provides session visibility without requiring the overhead of configuring NetFlow on every access layer switch.
Settings like Layer 3 Polling (D) only provide ARP table mappings (IP to MAC correlation) and do not provide the detailed flow information required for the session view.
"The Network Sessions view displays information regarding active and inactive network traffic sessions... To populate this view, FortiNAC must receive data through one of the following methods: * NetFlow/sFlow Support: Configure network devices to send flow data to the FortiNAC service interface. * Firewall Session Polling: Enable session polling on modeled FortiGate devices to retrieve session information via API. These records are then used by the Device Profiler to match rules based on traffic patterns." - FortiNAC-F Administration Guide: Network Sessions and Flow Data Collection.
NEW QUESTION # 25
When configuring isolation networks in the configuration wizard, why does a layer 3 network typo allow for mora than ono DHCP scope for each isolation network typo?
- A. Any scopes beyond the first scope are used if the initial scope runs out of IP addresses.
- B. There can be more than one isolation network of each type
- C. Configuring more than one DHCP scope allows for DHCP server redundancy
- D. The layer 3 network type allows for one scope for each possible host status.
Answer: B
Explanation:
In FortiNAC-F, the Layer 3 Network type is specifically designed for deployments where the isolation networks-such as Registration, Remediation, and Dead End-are separated from the FortiNAC appliance's service interface (port2) by one or more routers. This architecture is common in large, distributed enterprise environments where endpoints in different physical locations or branches must be isolated into subnets that are local to their respective network equipment.
The reason the Configuration Wizard allows for more than one DHCP scope for a single isolation network type (state) is that there can be more than one isolation network of each type across the infrastructure. For instance, if an organization has three different sites, each site might require its own unique Layer 3 registration subnet to ensure efficient routing and to accommodate local IP address management. By allowing multiple scopes for the "Registration" state, FortiNAC can provide the appropriate IP address, gateway, and DNS settings to a rogue host regardless of which site's registration VLAN it is placed into.
When an endpoint is isolated, the network infrastructure (via DHCP Relay/IP Helper) directs the DHCP request to the FortiNAC service interface. FortiNAC then identifies which scope to use based on the incoming request's gateway information. This flexibility ensures that the system is not limited to a single flat subnet for each isolation state, supporting a scalable, multi-routed network topology.
"Multiple scopes are allowed for each isolation state (Registration, Remediation, Dead End, VPN, Authentication, Isolation, and Access Point Management). Within these scopes, multiple ranges in the lease pool are also permitted... This configWizard option is used when Isolation Networks are separated from the FortiNAC Appliance's port2 interface by a router." - FortiNAC-F Configuration Wizard Reference Manual: Layer 3 Network Section.
NEW QUESTION # 26
When creating a device profiling rule, what are two advantages of registering the device in the host view? (Choose two.)
- A. The devices can be managed as a generic SNMP device.
- B. The devices will have connection logs.
- C. The devices can be associated with a user.
- D. The devices can be polled for connection status.
Answer: B,C
Explanation:
In FortiNAC-F, the Device Profiler is a rule-based engine that evaluates unknown "rogue" devices and classifies them based on fingerprints and behavior. When a profiling rule matches a device, the administrator can configure the rule to automatically register that device. The registration process can place the device record in two primary locations: the Topology View (as a device) or the Host View (as a registered host).
According to the FortiNAC-F Administration Guide, registering a device in the Host View provides significant advantages for identity management and historical tracking. First, the devices can be associated with a user (C). In the FortiNAC database architecture, the Host View is the primary repository for endpoint identity; placing a profiled device here allows the system to link that hardware (MAC address) to a specific user account, whether that user is an employee, guest, or a system-level "owner". This association is essential for Role-Based Access Control (RBAC) and for tracking accountability across the network fabric.
Second, devices registered in the Host View will have connection logs (B). FortiNAC-F maintains a detailed operational history for all host records, including every instance of the device connecting to or disconnecting from a port, its IP address assignments, and the specific policies applied during each session. These logs are invaluable for troubleshooting connectivity issues and for security forensic audits, as they provide a clear timeline of the device's lifecycle on the network. In contrast, devices managed only in the Topology View are typically treated as infrastructure components where the focus is on device availability rather than individual session history.
"Devices that are registered and associated with a user are placed in the Host View and removed from the Profiled Devices window... Placing a device in the Host View allows for the tracking of connection history and the association of the device with a specific identity or user record within the FortiNAC database." - FortiNAC-F Administration Guide: Device Profiler How it Works.
NEW QUESTION # 27
Refer to the exhibits.
What would happen if the highlighted port with connected hosts was placed in both the Forced Registration and Forced Remediation port groups?
- A. Multiple enforcement groups could not contain the same port.
- B. Enforcement would be applied only to rogue hosts
- C. Only the higher ranked enforcement group would be applied.
- D. Both types of enforcement would be applied
Answer: C
Explanation:
In FortiNAC-F, Port Groups are used to apply specific enforcement behaviors to switch ports. When a port is assigned to an enforcement group, such as Forced Registration or Forced Remediation, FortiNAC-F overrides normal policy logic to force all connected adapters into that specific state. The exhibit shows a port (IF#13) with "Multiple Hosts" connected, which is a common scenario in environments using unmanaged switches or hubs downstream from a managed switch port.
According to the FortiNAC-F Administrator Guide, it is possible for a single port to be a member of multiple port groups. However, when those groups have conflicting enforcement actions-such as one group forcing a registration state and another forcing a remediation state-FortiNAC-F utilizes a ranking system to resolve the conflict. In the FortiNAC-F GUI under Network > Port Management > Port Groups, each group is assigned a rank. The system evaluates these ranks, and only the higher ranked enforcement group is applied to the port. If a port is in both a Forced Registration group and a Forced Remediation group, the group with the numerical priority (rank) will dictate the VLAN and access level assigned to all hosts on that port.
This mechanism ensures consistent behavior across the fabric. If the ranking determines that "Forced Registration" is higher priority, then even a known host that is failing a compliance scan (which would normally trigger Remediation) will be held in the Registration VLAN because the port-level enforcement takes precedence based on its rank.
"A port can be a member of multiple groups. If more than one group has an enforcement assigned, the group with the highest rank (lowest numerical value) is used to determine the enforcement for the port. When a port is placed in a group with an enforcement, that enforcement is applied to all hosts connected to that port, regardless of the host's current state." - FortiNAC-F Administration Guide: Port Group Enforcement and Ranking.
NEW QUESTION # 28
An administrator has created several device profiling rules and evaluated all existing devices in the database. Some of the devices appear in the profiled devices view because they matched a rule, but they remain unknown and the registration column in the profiled devices view shows "No".
What is the most likely cause?
- A. The devices have persistent agents installed, and the point of connection has PA optimization enabled.
- B. The devices match more than one device profiling rule.
- C. The device profiling rule has registration set to manual.
- D. The confirm device profiling rule option is not enabled.
Answer: D
Explanation:
In FortiNAC-F, Device Profiling Rules are used to automatically identify and categorize devices (such as IP cameras, printers, or IoT devices) based on fingerprints like DHCP fingerprints, OIDs, or MAC prefixes. When a device matches a rule, it appears in the Profiled Devices view.
However, matching a rule does not automatically register the device in the database unless the rule is configured to do so. If the devices appear in the view but remain "Unknown" and show "No" in the registration column, it indicates that the "Confirm" (or "Auto-register") action has not been triggered. In the Device Profiling Rule configuration, there is a setting called "Allow Auto-Approval" or "Confirm". If this is not enabled, the system identifies the device but waits for an administrator to manually approve the match before changing the host status from "Unknown" to "Registered".
This is a common "safety" configuration used during the initial deployment phase to ensure that the profiling rules are accurate before the system begins automatically granting network access based on those matches.
"If a device matches a rule but is not registered, check the rule configuration. The Confirm option (within the Method or Rule settings) determines if the system automatically registers the device upon a match. If Confirm is not enabled, the device will remain in the 'Profiled' state with a registration status of 'No' until an administrator manually promotes the device." - FortiNAC-F Administration Guide: Device Profiling Rules.
NEW QUESTION # 29
While deploying FortiNAC-F devices in a 1+1 HA configuration, the administrator has chosen to use the shared IP address option.
Which condition must be met for this type of deployment?
- A. The primary and secondary administrative interfaces are on the same subnet.
- B. The isolation network type is Layer 2.
- C. There is a direct cable link between FortiNAC-F devices.
- D. The isolation network type is layer 3.
Answer: A
Explanation:
In a 1+1 High Availability (HA) deployment, FortiNAC-F supports two primary methods for management access: individual IP addresses or a Shared IP Address (also known as a Virtual IP or VIP). The Shared IP option is part of a Layer 2 HA design, which simplifies administration by providing a single URL or IP that always points to whichever appliance is currently in the "Active" or "In Control" state.
For a Shared IP configuration to function correctly, the Primary and Secondary administrative interfaces (port1) must be on the same subnet. This requirement exists because the Shared IP is a logical address that is dynamically assigned to the physical interface of the active unit. Since only one unit can own the IP at a time, both units must reside on the same broadcast domain (Layer 2) to ensure that ARP requests for the Shared IP are correctly answered and that the gateway remains reachable regardless of which unit is active. If the appliances were on different subnets (a Layer 3 HA design), a shared IP could not be used because it cannot "float" across different network segments; instead, administrators would need to manage each unit via its unique physical IP or use a FortiNAC Manager.
"For L2 HA configurations, click the Use Shared IP Address checkbox and enter the Shared IP Address information... If your Primary and Secondary Servers are not in the same subnet, do not use a shared IP address. The shared IP address moves between appliances during a failover and recovery and requires both units to reside on the same network." - FortiNAC-F High Availability Reference Manual: Shared IP Configuration.
NEW QUESTION # 30
......
Powerful NSE5_FNC_AD_7.6 PDF Dumps for NSE5_FNC_AD_7.6 Questions: https://www.examsreviews.com/NSE5_FNC_AD_7.6-pass4sure-exam-review.html
2026 Realistic NSE5_FNC_AD_7.6 Dumps Exam Tips Test Pdf Exam Material: https://drive.google.com/open?id=16-JWM8zscQfcRGSIu6IuD2kK42A_CwoR