According to theFortiClient EMS 7.2/7.4 Administration Guideand theZTNA Deployment Guide, the administrator can configureSecurity posture tags(also known asZero Trust Network Access (ZTNA) tags in recent versions) to detect and group endpoints based on specific compliance criteria, including vulnerability severity levels.
1. How Security Posture Tags Work for Vulnerabilities:
* Tagging Rules: Under theSecurity Posture Tags(orZero Trust Tags) section in EMS, an administrator creates a new rule set and adds a rule.
* Rule Type: The administrator selects theVulnerable Devicesrule type.
* Severity Levels: Within this rule, the administrator can specify theSeverity Level(such asCritical,High
,Medium, orLow). EMS dynamically applies the tag to any endpoint where the vulnerability scan detects at least one vulnerability matching or exceeding that severity level.
* Dynamic Grouping: These tags allow for dynamic grouping of endpoints, which can then be synchronized with a FortiGate to enforce access control based on the device's current security posture.
2. Why Other Options are Incorrect:
* A. Outbreak alert tags: While FortiGuard Outbreak alerts can be used in tagging, they specifically target endpoints vulnerable to a particular "outbreak" or high-profile threat currently active in the wild, rather than providing a general mechanism for all vulnerability severity levels.
* B. Classification tags: These tags are typically used for broader endpoint identification (like department or location) and sending information to FortiAnalyzer for reporting, rather than real-time security posture compliance based on vulnerability scans.
* C. Fabric tags: "Fabric" usually refers to the integration between Fortinet devices (the Security Fabric).
While tags are shared across the Fabric, the specific tags configuredwithinEMS for endpoint detection based on posture are categorized as Security Posture/Zero Trust tags.
3. Curriculum References:
* FortiClient EMS Administration Guide (Zero Trust Tagging Rules section): Explicitly details the
"Vulnerable Devices" rule type and its severity options.
* EMS Study Guide (Compliance & Vulnerability): Describes using these tags to ensure endpoints meet minimum security standards before being granted access to the network.