Fortinet FCSS_SASE_AD-23 Online Practice Questions and Exam Preparation

Fortinet FCSS_SASE_AD-23 Online Questions & Answers

• Question 1:

  Which role does FortiSASE play in supporting zero trust network access (ZTNA) principles9

  A. It offers hardware-based firewalls for network segmentation.
  B. It integrateswith software-defined network (SDN) solutions.
  C. It can identify attributes on the endpoint for security posture check.
  D. It enables VPN connections for remote employees.
  C. It can identify attributes on the endpoint for security posture check.

  ---

  explanation:

  Explanation/Reference:

  FortiSASE supports zero trust network access (ZTNA) principles by identifying attributes on the endpoint for security posture checks. ZTNA principles require continuous verification of user and device credentials, as well as their security

  posture, before granting access to network resources.

  Security Posture Check:

  Zero Trust Network Access (ZTNA):

  References:

  FortiOS 7.2 Administration Guide: Provides information on ZTNA and endpoint security posture checks.

  FortiSASE 23.2 Documentation: Details on how FortiSASE implements ZTNA principles.

• Question 2:

  Which two deployment methods are used to connect a FortiExtender as a FortiSASE LAN extension? (Choose two.)

  A. Connect FortiExtender to FortiSASE using FortiZTP
  B. Enable Control and Provisioning Wireless Access Points (CAPWAP) access on the FortiSASE portal.
  C. Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server
  D. Configure an IPsec tunnel on FortiSASE to connect to FortiExtender.
  A. Connect FortiExtender to FortiSASE using FortiZTP
  C. Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server

  ---

  explanation:

  Explanation/Reference:

  There are two deployment methods used to connect a FortiExtender as a FortiSASE LAN extension:

  Connect FortiExtender to FortiSASE using FortiZTP:

  Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server:

  References:

  FortiOS 7.2 Administration Guide: Details on FortiExtender deployment methods and configurations.

  FortiSASE 23.2 Documentation: Explains how to connect and configure FortiExtender with FortiSASE using FortiZTP and static discovery.

• Question 3:

  When accessing the FortiSASE portal for the first time, an administrator must select data center locations for which three FortiSASE components? (Choose three.)

  A. Endpoint management
  B. Points of presence
  C. SD-WAN hub
  D. Logging
  E. Authentication
  A. Endpoint management
  B. Points of presence
  D. Logging

  ---

  explanation:

  Explanation/Reference:

  When accessing the FortiSASE portal for the first time, an administrator must select data center locations for the following FortiSASE components:

  Endpoint Management:

  Points of Presence (PoPs):

  Logging:

  References:

  FortiOS 7.2 Administration Guide: Details on initial setup and configuration steps for FortiSASE.

  FortiSASE 23.2 Documentation: Explains the importance of selecting data center locations for various FortiSASE components.

• Question 4:

  Refer to the exhibits.

  

  

  A FortiSASE administrator is trying to configure FortiSASE as a spoke to a FortiGate hub. The tunnel is up to the FortiGale hub. However, the administrator is not able to ping the webserver hosted behind the FortiGate hub.

  Based on the output, what is the reason for the ping failures?

  A. The Secure Private Access (SPA) policy needs to allow PING service.
  B. Quick mode selectors are restricting the subnet.
  C. The BGP route is not received.
  D. Network address translation (NAT) is not enabled on the spoke-to-hub policy.
  B. Quick mode selectors are restricting the subnet.

  ---

  explanation:

  Explanation/Reference:

  The reason for the ping failures is due to the quick mode selectors restricting the subnet. Quick mode selectors define the IP ranges and protocols that are allowed through the VPN tunnel, and if they are not configured correctly, traffic to

  certain subnets can be blocked.

  Quick Mode Selectors:

  Diagnostic Output:

  Configuration Check:

  References:

  FortiOS 7.2 Administration Guide: Provides detailed information on configuring VPN tunnels and quick mode selectors.

  FortiSASE 23.2 Documentation: Explains how to set up and manage VPN tunnels, including the configuration of quick mode selectors.

• Question 5:

  Refer to the exhibit.

  

  To allow access, which web tiller configuration must you change on FortiSASE?

  A. FortiGuard category-based filter
  B. content filter
  C. URL Filter
  D. inline cloud access security broker (CASB) headers
  C. URL Filter

  ---

  explanation:

  Explanation/Reference:

  The exhibit indicates that the URLhttps://www.bbc.com/is being blocked due to containing a banned word ("fight"). To allow access to this specific URL, you need to adjust the URL filter settings on FortiSASE.

  URL Filtering:

  Modifying URL Filter:

  References:

  FortiOS 7.2 Administration Guide: Provides details on configuring and managing URL filters.

  FortiSASE 23.2 Documentation: Explains how to set up and modify web filtering policies, including URL filters.

• Question 6:

  Refer to the exhibits.

  

  A FortiSASE administrator is trying to configure FortiSASE as a spoke to a FortiGate hub. The VPN tunnel does not establish

  Based on the provided configuration, what configuration needs to be modified to bring the tunnel up?

  A. NAT needs to be enabled in the Spoke-to-Hub firewall policy.
  B. The BGP router ID needs to match on the hub and FortiSASE.
  C. FortiSASE spoke devices do not support mode config.
  D. The hub needs IKEv2 enabled in the IPsec phase 1 settings.
  C. FortiSASE spoke devices do not support mode config.

  ---

  explanation:

  Explanation/Reference:

  The VPN tunnel between the FortiSASE spoke and the FortiGate hub is not establishing due to the configuration of mode config, which is not supported by FortiSASE spoke devices. Mode config is used to assign IP addresses to VPN clients

  dynamically, but this feature is not applicable to FortiSASE spokes.

  Mode Config in IPsec:

  Configuration Adjustment:

  Steps to Disable Mode Config:

  References:

  FortiOS 7.2 Administration Guide: Provides details on configuring IPsec VPNs and mode config settings.

  FortiSASE 23.2 Documentation: Explains the supported configurations for FortiSASE spoke devices and VPN setups.

• Question 7:

  A FortiSASE administrator is configuring a Secure Private Access (SPA) solution to share endpoint information with a corporate FortiGate.

  Which three configuration actions will achieve this solution? (Choose three.)

  A. Add the FortiGate IP address in the secure private access configuration on FortiSASE.
  B. Use the FortiClient EMS cloud connector on the corporate FortiGate to connect to FortiSASE
  C. Register FortiGate and FortiSASE under the same FortiCloud account.
  D. Authorize the corporate FortiGate on FortiSASE as a ZTNA access proxy.
  E. Apply the FortiSASE zero trust network access (ZTNA) license on the corporate FortiGate.
  A. Add the FortiGate IP address in the secure private access configuration on FortiSASE.
  B. Use the FortiClient EMS cloud connector on the corporate FortiGate to connect to FortiSASE
  C. Register FortiGate and FortiSASE under the same FortiCloud account.

  ---

  explanation:

  Explanation/Reference:

  To configure a Secure Private Access (SPA) solution to share endpoint information between FortiSASE and a corporate FortiGate, you need to take the following steps:

  Add the FortiGate IP address in the secure private access configuration on FortiSASE:

  Use the FortiClient EMS cloud connector on the corporate FortiGate to connect to FortiSASE:

  Register FortiGate and FortiSASE under the same FortiCloud account:

  References:

  FortiOS 7.2 Administration Guide: Provides details on configuring Secure Private Access and integrating with FortiGate.

  FortiSASE 23.2 Documentation: Explains how to set up and manage connections between FortiSASE and corporate FortiGate.

• Question 8:

  Refer to the exhibits.

  

  

  A FortiSASE administrator has configured an antivirus profile in the security profile group and applied it to the internet access policy. Remote users are still able to download the eicar.com-zip file from https://eicar.org. Traffic logs show traffic is allowed by the policy.

  Which configuration on FortiSASE is allowing users to perform the download?

  A. Web filter is allowing the traffic.
  B. IPS is disabled in the security profile group.
  C. The HTTPS protocol is not enabled in the antivirus profile.
  D. Force certificate inspection is enabled in the policy.
  A. Web filter is allowing the traffic.

  ---

  explanation:

  Explanation/Reference:

  Based on the provided exhibits and the configuration details, the reason why users are still able to download the eicar.com-zip file despite having an antivirus profile applied is due to the Web Filter allowing the traffic. Here is the step-by-step

  detailed explanation:

  Web Filtering Logs Analysis:

  Security Profile Group Configuration:

  Antivirus Profile Configuration:

  Policy Configuration:

  References:

  FortiGate Security 7.2 Study Guide: Provides details on the precedence of web filtering over antivirus in security profiles.

  Fortinet Knowledge Base: Detailed explanation of web filtering and antivirus profiles interaction.

• Question 9:

  Which two advantages does FortiSASE bring to businesses with multiple branch offices? (Choose two.)

  A. It offers centralized management for simplified administration.
  B. It enables seamless integration with third-party firewalls.
  C. it offers customizable dashboard views for each branch location
  D. It eliminates the need to have an on-premises firewall for eachbranch.
  A. It offers centralized management for simplified administration.
  D. It eliminates the need to have an on-premises firewall for eachbranch.

  ---

  explanation:

  Explanation/Reference:

  FortiSASE brings the following advantages to businesses with multiple branch offices:

  Centralized Management for Simplified Administration:

  Eliminates the Need for On-Premises Firewalls:

  References:

  FortiOS 7.2 Administration Guide: Provides information on the benefits of centralized management and cloud-based security solutions. FortiSASE 23.2 Documentation: Explains the advantages of using FortiSASE for businesses with multiple

  branch offices, including reduced need for on-premises firewalls.

• Question 10:

  When deploying FortiSASE agent-based clients, which three features are available compared to an agentless solution? (Choose three.)

  A. Vulnerability scan
  B. SSL inspection
  C. Anti-ransomware protection
  D. Web filter
  E. ZTNA tags
  A. Vulnerability scan
  B. SSL inspection
  D. Web filter

  ---

  explanation:

  Explanation/Reference:

  When deploying FortiSASE agent-based clients, several features are available that are not typically available with an agentless solution. These features enhance the security and management capabilities for endpoints.

  Vulnerability Scan:

  SSL Inspection:

  Web Filter:

  References:

  FortiOS 7.2 Administration Guide: Explains the features and benefits of deploying agent-based clients.

  FortiSASE 23.2 Documentation: Details the differences between agent-based and agentless solutions and the additional features provided by agent-based deployments.