Security posture tags are a fundamental component of FortiSASE zero-trust access control. They allow administrators to classify endpoints dynamically according to security conditions and use those classifications in access policies.
Option B is correct because security posture tags can be referenced in policies that permit or deny access to applications and network resources. For example, an organization can allow access to a sensitive application only when an endpoint has an approved antivirus configuration and meets defined compliance requirements.
Option C is correct because posture tagging rules assess endpoint security attributes, including operating system information, installed software, antivirus status, running processes, and vulnerability conditions.
The evaluation process involves FortiSASE distributing tagging rules to FortiClient, FortiClient evaluating those rules locally, and the results being reported to FortiSASE. FortiSASE then dynamically applies the corresponding tags to the endpoint.
Option A is incorrect because posture tags are not primarily designed for continuous CPU, memory, or system resource monitoring.
Option D is incorrect because assigning endpoint profiles to user groups is a separate endpoint-management mechanism. Security posture tags classify device conditions rather than simply representing endpoint profile assignments.
This architecture enables continuous, context-sensitive policy enforcement without requiring administrators to manually update policies whenever an endpoint ' s compliance state changes.
[References: FortiSASE 25 Enterprise Administrator Study Guide, pages 47–48, Security Posture Tags and Workflow; FortiSASE-Sovereign 26.2.a Administration Guide, pages 83–85, ZTNA Tagging., ==========, ]
