Free Practice Questions for Fortinet FCSS_LED_AR-7.6 Exam

FortiLink NACis the NAC (Network Access Control) engine built into FortiGate when it manages FortiSwitch devices.

It performs:

✔Automated device onboarding

Automatically detects new devices connecting to switches.

Uses MAC, vendor, DHCP fingerprinting, or IoT database to classify devices.

No manual VLAN assignment required.

✔Security posture verification

Works with FortiClient EMS, ZTNA tags, IoT detection.

Applies policies based on:

Device type

User role

Endpoint compliance

IoT vulnerability status

✔Dynamic VLAN assignment

Automatically moves devices into proper VLANs, quarantine networks, or guest zones.

✔Integration with LAN Edge & Zero Trust

Uses FortiGate + FortiSwitch + FortiAP to enforce zero-trust access.

This matches the LAN Edge 7.6 Architect explanation of FortiLink NAC.

❌Why other answers are wrong

A. Extend security policies across FortiGate firewalls

Not NAC. That refers to Security Fabric or SD-WAN.

C. Apply manual firewall rules

FortiLink NAC is specifically designed toautomateaccess control.

D. Manually place devices in VLANs

NAC eliminates manual VLAN assignment — it is dynamic.

According to the Fortinet LAN Edge architecture regarding device discovery and management:

FortiLink Discovery Mechanism: Managed FortiSwitches are designed to be discovered automatically by the FortiGate switch controller. For this discovery to occur, a management IP address must be assigned to the switch so it can communicate with the FortiGate via the FortiLink protocol.

DHCP Requirement: All FortiGate devices include a factory-default FortiLink interface. Once this interface is configured with an IP address and netmask, the FortiGate automatically establishes a DHCP scope dedicated to assigning IP addresses and other network parameters to the connected managed switches.

Troubleshooting Discovery: If a FortiSwitch does not appear in the interface, it indicates a failure in the initial discovery phase. The most common cause is the switch failing to receive an IP address. Therefore, the first logical troubleshooting step is to verify that the FortiGate ' s DHCP server on the FortiLink interface is active and successfully leasing an IP address to the FortiSwitch.

Authorization: Once the switch receives an IP and is discovered, it will typically show as " Unauthorized " until the administrator manually authorizes it (unless " Automatically authorize devices " is enabled). If it doesn ' t appear at all, the issue precedes authorization and likely relates to basic IP connectivity provided by DHCP.

Analysis of Incorrect Options:

A: Security policies on the FortiGate control traffic passing through the firewall (transit traffic), not the management traffic between the FortiGate itself and its managed switches.

B: While static IPs are technically possible, the standard architectural design for LAN Edge relies on DHCP for plug-and-play functionality; manually assigning a static IP is a more advanced step, not the first troubleshooting action.

D: Internet access is not required for the FortiSwitch to be managed locally by a FortiGate via FortiLink.

WithAD machine authenticationvia FortiAuthenticator:

When a machine successfully authenticates, FortiAuthenticator records:

Machine account / identity

MAC addressof the device

Associated IP and session info

To handle sleep/hibernation:

FortiAuthenticator keeps acache of authenticated MAC addressesfor a configured timeout.

When the device wakes up and sends traffic again, FortiAuthenticator/FSSO can still treat it as authenticated as long as its MAC is in cache, so access is maintained without forcing a full machine re-auth immediately.

This matches optionD.

A(guest VLAN) is not the standard behavior here.

B(WoL) is unrelated.

C(IP-based) would break as IPs can change; MAC-based caching is what’s used.

In FortiLink NAC for LAN Edge:

When a device first connects, it is placed into theonboarding VLAN.

NAC policies then classify the device (by MAC, OS, user, EMS tag, etc.).

If a NAC policy matches, the device may be moved to anaccess VLANorquarantine VLAN.

Ifno NAC policy matches, the device simplystays in the onboarding VLAN.

FortiOS / LAN Edge documentation describes the onboarding VLAN as thedefault VLAN for unknown or unclassified devices, until NAC policy evaluation moves them elsewhere.