Fortinet FCSS_SASE_AD-25 Online Practice Questions and Exam Preparation

Fortinet FCSS_SASE_AD-25 Online Questions & Answers

• Question 1:

  Which authentication method overrides any other previously configured user authentication on FortiSASE?

  A. MFA
  B. Local
  C. RADIUS
  D. SSO
  D. SSO

  ---

  Explanation

  Single Sign-On (SSO) overrides any other previously configured user authentication method on FortiSASE, taking precedence for user authentication.

• Question 2:

  Refer to the exhibits.

  

  Antivirus is installed on a Windows 10 endpoint, but the windows application firewall is stopping it from running. What will the endpoint security posture check be?

  A. FortiClient will tag the endpoint as FortiSASE-Non-Compliant.
  B. FortiClient will be unmanaged from FortiSASE due to failed compliance.
  C. FortiClient will trigger network lockdown on the endpoint.
  D. FortiClient will prompt the user to enable antivirus.
  A. FortiClient will tag the endpoint as FortiSASE-Non-Compliant.

  ---

  Explanation

  Although the antivirus is installed, it is not running due to the Windows application firewall blocking it. According to the FortiSASE-Non-Compliant rule, antivirus software must be both installed and running. Since this condition fails, FortiClient assigns the FortiSASE-Non-Compliant tag to the endpoint.

• Question 3:

  Your FortiSASE customer has a small branch office in which ten users will be using their personal laptops and mobile devices to access the internet. Which deployment should they use to secure their internet access with minimal configuration?

  A. Deploy FortiGate as a LAN extension to secure internet access.
  B. Deploy FortiAP to secure internet access.
  C. Deploy FortiClient endpoint agent to secure internet access.
  D. Deploy SD-WAN on-ramp to secure internet access.
  B. Deploy FortiAP to secure internet access.

  ---

  Explanation

  Deploying FortiAP enables secure internet access for unmanaged personal devices in small branch offices with minimal configuration by automatically directing traffic through FortiSASE, eliminating the need for endpoint installation or complex setup.

• Question 4:

  Which two components are part of onboarding a secure web gateway (SWG) endpoint for secure internet access (SIA)? (Choose two.)

  A. proxy auto-configuration (PAC) file
  B. FortiSASE certificate authority (CA) certificate
  C. FortiClient software
  D. tunnel policy
  A. proxy auto-configuration (PAC) file
  C. FortiClient software

  ---

  Explanation

  A PAC file is used to redirect client web traffic through the SWG, and FortiClient software is required to connect endpoints to the FortiSASE service for secure internet access (SIA).

• Question 5:

  What are two benefits of deploying secure private access with SD-WAN? (Choose two.)

  A. a direct access proxy tunnel from FortiClient to the on-premises FortiGate
  B. ZTNA posture check performed by the hub FortiGate
  C. support of both TCP and UDP applications
  D. inline security inspection by FortiSASE
  B. ZTNA posture check performed by the hub FortiGate
  C. support of both TCP and UDP applications

  ---

  Explanation

  Deploying secure private access with SD-WAN enables the hub FortiGate to perform ZTNA posture checks, and supports both TCP and UDP applications over the tunnel, allowing for flexible and secure access to internal resources.

• Question 6:

  What is the benefit of SD-WAN on-ramp deployment with FortiSASE?

  A. To provide access to private applications using the bookmark portal
  B. To provide device compliance checks using ZTNA tags
  C. To secure internet traffic for branch users
  D. To manage branch location endpoints
  C. To secure internet traffic for branch users

  ---

  Explanation

  SD-WAN on-ramp with FortiSASE directs branch user internet traffic to the FortiSASE cloud for consistent security enforcement and protection, regardless of the branch location.

• Question 7:

  What is the recommended method to upgrade FortiClient in a FortiSASE deployment?

  A. Remote users must upgrade the FortiClient manually.
  B. FortiSASE automatically upgrades FortiClient when a new version is released.
  C. The FortiSASE administrator must assign endpoint groups to an endpoint upgrade rule.
  D. The FortiSASE administrator will upload the desired FortiClient version to the FortiSASE portal and push it to endpoints.
  C. The FortiSASE administrator must assign endpoint groups to an endpoint upgrade rule.

  ---

  Explanation

  In FortiSASE, the recommended method to upgrade FortiClient is to configure an endpoint upgrade rule and assign it to specific endpoint groups. This ensures controlled and automated upgrades across managed devices.

• Question 8:

  Which service is included in a secure access service edge (SASE) solution, but not in a security service edge (SSE) solution?

  A. ZTNA
  B. SD-WAN
  C. SWG
  D. CASB
  B. SD-WAN

  ---

  Explanation

  SD-WAN is a networking component included in a SASE solution but not in an SSE solution. SSE focuses solely on security services (like ZTNA, SWG, and CASB), while SASE combines both networking (e.g., SD- WAN) and security into a unified cloud-delivered service.

• Question 9:

  What happens to the logs on FortiSASE that are older than the configured log retention period?

  A. The logs are deleted from FortiSASE.
  B. The logs are indexed and can be stored in a SQL database.
  C. The logs are backed up on FortiCloud.
  D. The logs are compressed and archived.
  A. The logs are deleted from FortiSASE.

  ---

  Explanation

  Once the configured log retention period expires, FortiSASE automatically deletes the older logs to free up storage and maintain compliance with retention policies.

• Question 10:

  Refer to the exhibit.

  

  Based on the configuration shown, in which two ways will FortiSASE process sessions that require FortiSandbox inspection? (Choose two.)

  A. Only endpoints assigned a profile for sandbox detection will be processed by the sandbox feature.
  B. FortiClient quarantines only infected files that FortiSandbox detects as medium level.
  C. All files executed on a USB drive will be sent to FortiSandbox for analysis.
  D. All files will be sent to a on-premises FortiSandbox for inspection.
  A. Only endpoints assigned a profile for sandbox detection will be processed by the sandbox feature.
  C. All files executed on a USB drive will be sent to FortiSandbox for analysis.

  ---

  Explanation

  The sandbox feature applies only to endpoints assigned this profile, and the configuration explicitly enables the submission of all files executed from removable media (like USB drives) to FortiSandbox for analysis.