Fortinet FCSS_SASE_AD-23 Online Practice Questions and Exam Preparation

Fortinet FCSS_SASE_AD-23 Online Questions & Answers

• Question 1:

  Which secure internet access (SIA) use case minimizes individual workstation or device setup, because you do not needto install FortiClient on endpoints or configure explicit web proxy settings on web browser-based end points?

  A. SIA for inline-CASB users
  B. SIA for agentless remote users
  C. SIA for SSLVPN remote users
  D. SIA for site-based remote users
  B. SIA for agentless remote users

  ---

  Explanation/Reference:

  The Secure Internet Access (SIA) use case that minimizes individual workstation or device setup is SIA for agentless remote users. This use case does not require installing FortiClient on endpoints or configuring explicit web proxy settings on

  web browser-based endpoints, making it the simplest and most efficient deployment.

  SIA for Agentless Remote Users:

  Minimized Setup:

  References:

  FortiOS 7.2 Administration Guide: Details on different SIA deployment use cases and configurations.

  FortiSASE 23.2 Documentation: Explains how SIA for agentless remote users is implemented and the benefits it provides.

• Question 2:

  Which two deployment methods are used to connect a FortiExtender as a FortiSASE LAN extension? (Choose two.)

  A. Connect FortiExtender to FortiSASE using FortiZTP
  B. Enable Control and Provisioning Wireless Access Points (CAPWAP) access on the FortiSASE portal.
  C. Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server
  D. Configure an IPsec tunnel on FortiSASE to connect to FortiExtender.
  A. Connect FortiExtender to FortiSASE using FortiZTP
  C. Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server

  ---

  Explanation/Reference:

  There are two deployment methods used to connect a FortiExtender as a FortiSASE LAN extension:

  Connect FortiExtender to FortiSASE using FortiZTP:

  Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server:

  References:

  FortiOS 7.2 Administration Guide: Details on FortiExtender deployment methods and configurations.

  FortiSASE 23.2 Documentation: Explains how to connect and configure FortiExtender with FortiSASE using FortiZTP and static discovery.

• Question 3:

  When deploying FortiSASE agent-based clients, which three features are available compared to an agentless solution? (Choose three.)

  A. Vulnerability scan
  B. SSL inspection
  C. Anti-ransomware protection
  D. Web filter
  E. ZTNA tags
  A. Vulnerability scan
  B. SSL inspection
  D. Web filter

  ---

  Explanation/Reference:

  When deploying FortiSASE agent-based clients, several features are available that are not typically available with an agentless solution. These features enhance the security and management capabilities for endpoints.

  Vulnerability Scan:

  SSL Inspection:

  Web Filter:

  References:

  FortiOS 7.2 Administration Guide: Explains the features and benefits of deploying agent-based clients.

  FortiSASE 23.2 Documentation: Details the differences between agent-based and agentless solutions and the additional features provided by agent-based deployments.

• Question 4:

  Which two additional components does FortiSASE use for application control to act as an inline-CASB? (Choose two.)

  A. intrusion prevention system (IPS)
  B. SSL deep inspection
  C. DNS filter
  D. Web filter with inline-CASB
  B. SSL deep inspection
  D. Web filter with inline-CASB

  ---

  Explanation/Reference:

  FortiSASE uses the following components for application control to act as an inline-CASB (Cloud Access Security Broker):

  SSL Deep Inspection:

  Web Filter with Inline-CASB:

  References:

  FortiOS 7.2 Administration Guide: Details on SSL deep inspection and web filtering configurations.

  FortiSASE 23.2 Documentation: Explains how FortiSASE acts as an inline-CASB using SSL deep inspection and web filtering.

• Question 5:

  Refer to the exhibit.

  

  A company has a requirement to inspect all the endpoint internet traffic on FortiSASE, and exclude Google Maps traffic from the FortiSASE VPN tunnel and redirect it to the endpoint physical Interface.

  Which configuration must you apply to achieve this requirement?

  A. Exempt the Google Maps FQDN from the endpoint system proxy settings.
  B. Configure a static route with the Google Maps FQDN on the endpoint to redirect traffic
  C. Configure the Google Maps FQDN as a split tunneling destination on the FortiSASE endpoint profile.
  D. Change the default DNS server configuration on FortiSASE to use the endpoint system DNS.
  C. Configure the Google Maps FQDN as a split tunneling destination on the FortiSASE endpoint profile.

  ---

  Explanation/Reference:

  To meet the requirement of inspecting all endpoint internet traffic on FortiSASE while excluding Google Maps traffic from the FortiSASE VPN tunnel and redirecting it to the endpoint's physical interface, you should configure split tunneling.

  Split tunneling allows specific traffic to bypass the VPN tunnel and be routed directly through the endpoint's local interface.

  Split Tunneling Configuration:

  Implementation Steps:

  References:

  FortiOS 7.2 Administration Guide: Provides details on split tunneling configuration. FortiSASE 23.2 Documentation: Explains how to set up and manage split tunneling for specific destinations.

• Question 6:

  Which role does FortiSASE play in supporting zero trust network access (ZTNA) principles9

  A. It offers hardware-based firewalls for network segmentation.
  B. It integrateswith software-defined network (SDN) solutions.
  C. It can identify attributes on the endpoint for security posture check.
  D. It enables VPN connections for remote employees.
  C. It can identify attributes on the endpoint for security posture check.

  ---

  Explanation/Reference:

  FortiSASE supports zero trust network access (ZTNA) principles by identifying attributes on the endpoint for security posture checks. ZTNA principles require continuous verification of user and device credentials, as well as their security

  posture, before granting access to network resources.

  Security Posture Check:

  Zero Trust Network Access (ZTNA):

  References:

  FortiOS 7.2 Administration Guide: Provides information on ZTNA and endpoint security posture checks.

  FortiSASE 23.2 Documentation: Details on how FortiSASE implements ZTNA principles.

• Question 7:

  Refer to the exhibit.

  

  To allow access, which web tiller configuration must you change on FortiSASE?

  A. FortiGuard category-based filter
  B. content filter
  C. URL Filter
  D. inline cloud access security broker (CASB) headers
  C. URL Filter

  ---

  Explanation/Reference:

  The exhibit indicates that the URLhttps://www.bbc.com/is being blocked due to containing a banned word ("fight"). To allow access to this specific URL, you need to adjust the URL filter settings on FortiSASE.

  URL Filtering:

  Modifying URL Filter:

  References:

  FortiOS 7.2 Administration Guide: Provides details on configuring and managing URL filters.

  FortiSASE 23.2 Documentation: Explains how to set up and modify web filtering policies, including URL filters.

• Question 8:

  During FortiSASE provisioning, how many security points of presence (POPs) need to be configured by the FortiSASE administrator?

  A. 3
  B. 4
  C. 2
  D. 1
  D. 1

  ---

  Explanation/Reference:

  During FortiSASE provisioning, the FortiSASE administrator needs to configure at least one security point of presence (PoP). A single PoP is sufficient to get started with FortiSASE, providing the necessary security services and connectivity

  for users.

  Security Point of Presence (PoP):

  Scalability:

  References:

  FortiOS 7.2 Administration Guide: Provides details on the provisioning process for FortiSASE.

  FortiSASE 23.2 Documentation: Explains the configuration and role of security PoPs in the FortiSASE architecture.

• Question 9:

  When you configure FortiSASE Secure Private Access (SPA) with SD-WAN integration, you must establish a routing adjacency between FortiSASE and the FortiGate SD-WAN hub. Which routing protocol must you use?

  A. BGP
  B. IS-IS
  C. OSPF
  D. EIGRP
  A. BGP

  ---

  Explanation/Reference:

  When configuring FortiSASE Secure Private Access (SPA) with SD-WAN integration, establishing a routing adjacency between FortiSASE and the FortiGate SD- WAN hub requires the use of the Border Gateway Protocol (BGP).

  BGP (Border Gateway Protocol):

  Routing Adjacency:

  References:

  FortiOS 7.2 Administration Guide: Provides information on configuring BGP for SD-WAN integration.

  FortiSASE 23.2 Documentation: Details on setting up routing adjacencies using BGP for Secure Private Access with SD-WAN.

• Question 10:

  What are two advantages of using zero-trust tags? (Choose two.)

  A. Zero-trust tags can be used to allow or deny access to network resources
  B. Zero-trust tags can determine the security posture of an endpoint.
  C. Zero-trust tags can be used to create multiple endpoint profiles which can be applied to different endpoints
  D. Zero-trust tags can be used to allow secure web gateway (SWG) access
  A. Zero-trust tags can be used to allow or deny access to network resources
  B. Zero-trust tags can determine the security posture of an endpoint.

  ---

  Explanation/Reference:

  Zero-trust tags are critical in implementing zero-trust network access (ZTNA) policies. Here are the two key advantages of using zero-trust tags:

  Access Control (Allow or Deny):

  Determining Security Posture:

  References:

  FortiOS 7.2 Administration Guide: Provides detailed information on configuring and using zero-trust tags for access control and security posture assessment. FortiSASE 23.2 Documentation: Explains how zero-trust tags are implemented and

  used within the FortiSASE environment for enhancing security and compliance.