FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Questions and Answers

Exhibit Review and Feature Analysis:

The SSID "CORP_DATA" is configured with Tunnel NAC as the "NAC profile" (Network Access Control).

NAC quarantine host is enabled, which means when a station is identified as compromised, it will be placed into quarantine automatically by the FortiAP.

How This Works:

In Security Fabric deployments, when a FortiGate detects a compromised endpoint (via integration with FortiAnalyzer and endpoint telemetry), it can instruct FortiAPs (broadcasting the relevant SSID with NAC enabled) to move compromised clients into a quarantine VLAN or block their network access.

The NAC quarantine feature is specifically designed to isolate infected or non-compliant devices automatically, without waiting for manual SOC action.

Option Explanations:

A: NAC does not simply onboard compromised stations—it isolates or restricts them.

B: Disassociation and permanent blocking is not the default; quarantine is preferred.

C: FortiAnalyzer does generate reports, but this does not describe the action taken by FortiGate or FortiAP.

D: Correct. FortiAPs, following FortiGate's NAC/quarantine policy, will isolate (quarantine) compromised clients on the CORP_DATA SSID.

Channel utilization directly measures how much airtime is consumed by wireless transmissions (including data, management, and interference).

Monitoring channel utilization helps optimize the network by:

Identifying congestion or over-utilized channels.

Allowing channel re-planning and SSID optimization.

The other options (AP firmware, event logs, user count) are helpful, but only channel utilization gives actionable insight for radio resource optimization.

When you need different access levels for various users and device types but want to keep the SSID structure simple, dynamic VLAN assignment is the best practice.

With dynamic VLANs, all clients connect to the same SSID. The RADIUS server (via 802.1X authentication or MAC authentication) assigns each user or device to a specific VLAN based on attributes (like user group, device type, etc.).

This design:

Reduces SSID sprawl.

Allows flexible, scalable, and policy-driven access.

Simplifies management and enhances security.

The other options are either less scalable (multiple SSIDs) or do not provide the required dynamic access control (user groups or NAC alone without VLAN assignment).

When enabling a Security Fabric connection on a FortiGate interface to manage FortiAP devices, the following two types of CAPWAP (Control and Provisioning of Wireless Access Points) communication channels are established:

Control channels:

Correct. The control channel is used for management and control information between the FortiGate (controller) and FortiAP. This includes configuration, monitoring, and state updates.

Data channels:

Correct. The data channel carries client traffic between the FortiAP and FortiGate. This enables the FortiGate to apply security policies, content filtering, and other services to wireless client data.

Analysis of Other Options:

C. Security channels:

There is no specific “security channel” in CAPWAP terminology.

D. Fortlink channels:

FortLink is used for FortiSwitch management, not FortiAPs. CAPWAP is the protocol for FortiAP management.

FortiPresence analytics is a platform for presence analytics—monitoring WiFi user presence, dwell time, and visitor trends in physical spaces.

A: It collects and reports details about on-site guest users, such as visit duration and repeat visits.

C: It enables comparison of current user presence and activity data with historical trends, supporting operational and marketing analysis.

B (reporting potential threats) is not a function of presence analytics.

D (predicting future guest counts) is not a core function; FortiPresence reports on actual and historical data, not predictive analytics.

For advanced wireless troubleshooting:

Capturing air traffic (B): This means performing a wireless packet capture (sniffing), usually via the FortiAP's diagnostic tools (e.g., cw_diag sniff), to see low-level association/authentication issues, interference, or protocol errors.

Reviewing event logs (C): Check event logs on the FortiGate and FortiAP to find authentication failures, disconnections, roaming events, or system messages specific to the wireless station.

A (creating/assigning a new profile) is not typically an advanced troubleshooting step; it's more of a configuration or workaround.

D (collecting power management info) is rarely required except for specific power-saving issues, and is not a primary advanced troubleshooting step.