Refer to the exhibits.

Based on the configuration shown in the exhibits:

There are three endpoint policies configured: Training, Sales, and Default.

The "Training" policy is assigned to the "trainingAD.training.lab" group.

The "Sales" policy is assigned to "All Groups" and "trainingAD.training.lab/student."

The "Default" policy has no specific groups assigned.

When someone logs in with the user account "student" on an endpoint in the "trainingAD" domain:

The "Training" policy is specifically assigned to the "trainingAD.training.lab" group.

The "Sales" policy includes "trainingAD.training.lab/student" but not the general "trainingAD.training.lab" group.

The system will prioritize the most specific match for the group.

Therefore, FortiClient EMS will assign the "Training" policy to the "student" account logging into the "trainingAD" domain as it matches the group "trainingAD.training.lab" directly.

References

FortiClient EMS 7.2 Study Guide, Endpoint Policy Configuration Section

FortiClient EMS Documentation on Group Policy Assignment and Matching