What does an administrator need to configure in order to quarantine FortiClient endpoints using FortiAnalyzer playbooks? (Choose one answer)

A. Authorize FortiAnalyzer on FortiClient as a Fabric device.
B. Enable automation stitch on FortiAnalyzer.
C. Add FortiClient EMS as a fabric connector on FortiAnalyzer.
D. Use an API key to integrate FortiAnalyzer with FortiClient EMS.

Correct Answer: D

Brave-Dump Clients Votes

D 50%

C 50%

Comments

Anonymous99 2025-08-13 12:46:31

Selected Answers: D

Refer FCP - FortiClient EMS 7.4 Administrator Study_Guide pg 295

Anonymous User 2026-01-18 04:23:01

Selected Answers: C

I think it C. Question asked "what need to configure". If you read on the study guide 295, Analyzer send API to run scan/create incident.

skouba 2026-02-11 00:38:34

Selected Answers: C

it comunicates over API, but the question is what you need to configure and the missing part is EMS fabric connector on FAZ. I love this stupid questions with 2 possible correct answers :-(

FME 2026-03-19 20:16:15

Selected Answers: D

To quarantine a FortiClient endpoint using FortiAnalyzer playbooks, you must have an integrated setup where FortiClient EMS 7.x manages endpoints and forwards logs to FortiAnalyzer. Key prerequisites include active telemetry, configured log forwarding, and API integration between FortiAnalyzer and FortiClient EMS to automate quarantine actions via SOC automation playbooks