FCP_FCT_AD-7.2 Exam Dumps : FCP-FortiClient EMS 7.2 Administrator

Based on the Security Fabric automation settings shown in the exhibit:

The automation stitch is configured with a trigger for a "Compromised Host."

The action specified for this trigger is "Quarantine FortiClient via EMS."

This indicates that when an endpoint is detected as compromised, FortiClient EMS will quarantine the endpoint as part of the automation process.

Therefore, the action taken on compromised endpoints will be to quarantine them through EMS.

References

FortiGate Security 7.2 Study Guide, Automation Stitches and Actions Section

Fortinet Documentation on Configuring Automation Stitches and Quarantine Actions

Observation of Logs:

The logs show a policy named "Fortinet-Training" being applied to the endpoint.

Evaluating Policies:

The log entries indicate that the "Fortinet-Training" policy was received and applied.

Conclusion:

Based on the logs, the currently applied policy on the FortiClient endpoint is "Fortinet-Training".

References:

FortiClient EMS policy configuration and log analysis documentation from the study guides.

FortiClient communicates directly with FortiClient EMS to continuously share device status information through ZTNA telemetry.