As part of a company policy, all end stations must be scanned for compliance each...

The correct answers are B and C . The persistent agent is the strongest fit because it is installed and stays resident on the endpoint. The study guide states that after deployment, the persistent agent communicates back to FortiNAC-F every 15 minutes and performs scheduled scans in the background, transparent to the end user. That directly satisfies the requirement for recurring compliance scans without user involvement.

The passive agent can also scan Windows domain end stations without end-user interaction. The guide states that the passive agent is deployed through login/logoff scripts and administrative templates, and that passive agent registration can register and scan hosts associated with LDAP or Active Directory users. If enabled, the passive agent scans the host to verify compliance with the appropriate endpoint policy.

Option A is wrong because the dissolvable agent is a run-once agent that requires manual end-user interaction in the captive portal, then removes itself after reporting results. Option D is not the best answer for this requirement because the mobile agent is specifically for Android onboarding and is manually installed; it is not the general solution for daily compliance scanning of all end stations.