FCSS_SASE_AD-25 FCSS - FortiSASE 25 Administrator Questions and Answers

SD-WAN on-ramp with FortiSASE directs branch user internet traffic to the FortiSASE cloud for consistent security enforcement and protection, regardless of the branch location.

According to the FortiOS Administration Guide, when configuring central management, a FortiManager Cloud entitlement must be present and the devices must share the same FortiCloud account for registration. Specifically:

“The FortiManager Cloud button can only be selected if you have a FortiManager Cloud product entitlement.”

“The FortiGate and FortiCloud license are registered to the same account.”

Thus, the two verified requirements are: B (entitlement) and D (same FortiCloud account).

Fortinet documentation makes clear that overlay IDs must be identical on hub and spoke for ADVPN to establish correctly:

“When configuring the root and downstream FortiGates the Fabric Overlay Orchestrator configures… IPsec overlay configuration (hub and spoke ADVPN tunnels).”

“The Fabric root will be the hub and any first-level downstream devices from the Fabric root will be spokes.”

In the scenario:

FortiSASE overlay ID = 100

FortiGate hub overlay ID = 101

Mismatch prevents tunnel establishment. Therefore, the fix is: B. The network overlay ID must match on FortiSASE and the hub.

To exclude specific internet traffic (such as Google Maps) from being tunneled through FortiSASE and instead direct it out the local endpoint interface, you must configure it as a steering bypass destination in the FortiClient endpoint profile. This ensures traffic matching the URL bypasses the FortiSASE tunnel.

When FortiClient is integrated with FortiSASE, it enables vulnerability management and device posture checks, allowing for advanced endpoint compliance enforcement - capabilities not available in standalone secure web gateway (SWG) deployments.

SD-WAN is a networking component included in a SASE solution but not in an SSE solution. SSE focuses solely on security services (like ZTNA, SWG, and CASB), while SASE combines both networking (e.g., SD-WAN) and security into a unified cloud-delivered service.

The Digital Experience Monitoring (DEM) agent on the endpoint performs a trace route to the SaaS application to measure latency, packet loss, and hop-by-hop performance. This helps diagnose where in the path connectivity or performance issues are occurring.

Assigning hubs with different priorities in a FortiSASE SD-WAN deployment allows traffic to be routed through the optimal hub to meet SLA requirements and ensures redundancy by enabling automatic failover if the preferred hub becomes unavailable.

Geofencing allows the administrator to restrict or allow access to FortiSASE services based on the geographic location of the endpoints, effectively blocking connections from specified countries.