The correct answer is A. Through device profiling rules. The study guide states: ''When a rogue device record is created, the device is evaluated against the enabled device profiling rules.'' It further explains that ''FortiNAC evaluates a device against each rule until a failed, passed, or cannot evaluate result is reached.'' That is the direct evaluation mechanism used for rogue devices in FortiNAC.

The guide also adds that ''Device profiling rules are used to evaluate and classify rogue devices'' and that FortiNAC applies rule methods and classification settings to determine whether the device matches a known type. This is why the other options are incorrect: FortiGuard server queries and the local device database (CIDB) relate to FortiGate device detection workflows, not FortiNAC rogue-device evaluation, and importing a devices list is not the evaluation method described for rogue devices.