The Study Guide explains the default behavior first: “You must authorize FortiClient EMS on FortiSandbox. FortiSandbox automatically authorizes all FortiClient endpoints managed by an authorized FortiClient EMS.” It then adds the key point for this question: “To change the default FortiClient authorization behavior, use the command shown on this slide to authorize FortiClient endpoints using FortiSandbox CLI. By default, FortiClient inherits its authorization status from the managing EMS or FortiGate.”

Because the question specifically shows the CLI command set device-authorization -a , it is asking about the behavior after changing the default . The default inheritance model described in option A applies before the override. After this command, FortiSandbox is set to authorize FortiClient endpoints directly and automatically , which makes C the correct answer. Option B is incorrect because the command is specifically about FortiClient endpoints , not other devices in general. Option D is too broad and does not match the Study Guide’s explanation, which is limited to FortiClient authorization behavior.