Quick Answer
The answer is the FortiNAC Enforcement Engine. This component is responsible for enforcing quarantine policy by dynamically changing a non-compliant device’s VLAN or applying ACLs on network infrastructure, such as switches or wireless controllers, to isolate it from the rest of the network. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of how FortiNAC’s policy-driven architecture separates detection from enforcement; a common trap is confusing the Enforcement Engine with the FortiNAC Controller or the Persistent Agent, which only report compliance status but do not execute the network change. To remember, think of the Enforcement Engine as the “bouncer” that physically moves a device to quarantine, while the Controller merely manages the rules. A useful mnemonic is “EE enforces, CC controls”—the Enforcement Engine executes, the Controller coordinates.
This NSE7 practice question tests your understanding of advanced vpn and zero trust. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization wants to implement Network Access Control (NAC) using FortiNAC. The goal is to automatically quarantine any device that does not have the latest antivirus definitions. Which FortiNAC component enforces this policy?
FortiNAC Collector
Why wrong: Collector gathers data from network devices, not enforcement.
FortiNAC Profiler
Why wrong: Profiler identifies devices but does not enforce.
FortiNAC Enforcement Engine
The Enforcement Engine applies the policy actions (e.g., quarantine) based on compliance state.
FortiNAC Portal
Why wrong: Portal is for guest registration, not enforcement.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
FortiNAC Enforcement Engine
FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.
Key principle: A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
FortiNAC Collector
Why it's wrong here
Collector gathers data from network devices, not enforcement.
FortiNAC Profiler
Why it's wrong here
Profiler identifies devices but does not enforce.
FortiNAC Enforcement Engine
Why this is correct
The Enforcement Engine applies the policy actions (e.g., quarantine) based on compliance state.
Related concept
Access ports place end devices into a single VLAN.
FortiNAC Portal
Why it's wrong here
Portal is for guest registration, not enforcement.
Common exam traps
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Detailed technical explanation
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Real-world example
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related NSE7 questions on switching, trunking, and access-port configuration.
Advanced VPN and Zero Trust — study guide chapter
Learn the concepts, then practise the questions
Advanced VPN and Zero Trust practice questions
Targeted practice on this topic area only
All NSE7 questions
1,000 questions across all exam domains
Fortinet NSE 7 Advanced Security NSE7 study guide
Full concept coverage aligned to exam objectives
NSE7 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE7 questions linked to Advanced Networking and SD-WAN.
Practise NSE7 questions linked to Advanced VPN and Zero Trust.
Practise NSE7 questions linked to Enterprise Firewall and VDOMs.
Practise NSE7 questions linked to Advanced Threat Protection.
Practise NSE7 questions linked to Troubleshooting and Diagnostics.
Practise NSE7 questions linked to NSE7 fundamentals.
Practise NSE7 questions linked to NSE7 scenario.
Practise NSE7 questions linked to NSE7 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Advanced VPN and Zero Trust — This question tests Advanced VPN and Zero Trust — Access ports place end devices into a single VLAN..
The correct answer is: FortiNAC Enforcement Engine — FortiNAC uses policies to define security requirements. The Enforcement Engine applies the policy by changing the VLAN or applying ACLs on network devices to quarantine non-compliant endpoints.
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related NSE7 questions on switching, trunking, and access-port configuration.
Access ports place end devices into a single VLAN.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 21, 2026
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.