FCSS_SASE_AD-25 FCSS - FortiSASE 25 Administrator Questions and Answers

FortiSASE hides user information in logs by using hashing, which anonymizes sensitive data such as usernames or IP addresses while still allowing for consistent tracking and analysis.

ZTNA replaces traditional VPNs by enforcing identity- and posture-based access to private applications. SD-WAN on-ramp integrates with FortiSASE to securely route traffic from branch users to private applications over the SASE fabric, ensuring secure and optimized access.

The Digital Experience Monitor (DEM) in FortiSASE measures and monitors network performance from the FortiSASE Points of Presence (PoPs) to specific SaaS or cloud applications, helping identify and troubleshoot performance issues across the service path.

SD-WAN allows efficient and secure routing of traffic from users to corporate applications, while ZTNA enables secure access control and verification for users connecting to internal resources, both of which are essential for Secure Private Access (SPA) in FortiSASE.

FortiSASE extends secure internet access to users regardless of their location and streamlines the management and provisioning of security policies and services for microbranch offices with unmanaged devices.

Geofencing allows the administrator to restrict or allow access to FortiSASE services based on the geographic location of the endpoints, effectively blocking connections from specified countries.

The sandbox feature applies only to endpoints assigned this profile, and the configuration explicitly enables the submission of all files executed from removable media (like USB drives) to FortiSandbox for analysis.

Deploying FortiSASE with FortiGate ZTNA access proxy enables efficient access to private applications with reduced latency and supports both agentless and agent-based ZTNA methods for flexible access control.

The SSL inspection mode is set to certificate inspection, which only inspects SSL/TLS headers and does not allow full scanning of encrypted content. Without full (deep) inspection, the antivirus profile cannot scan or block malicious files (like eicar.com-zip) delivered over HTTPS, allowing the download to proceed.

The FortiSASE BGP learned routes do not include the 10.160.160.0/24 subnet (server network). Although the FortiGate hub is advertising this route (10.160.160.0/24) to FortiSASE, it is not visible in the FortiSASE BGP route table - indicating a routing issue. Without this route, FortiSASE cannot forward traffic from FortiClient to the server.

The “Automatically patch vulnerabilities” option is disabled in the endpoint profile. Additionally, the Vulnerability Dashboard shows the patching status as “Manual patching required.” This means an administrator must manually initiate the patching process remotely using FortiSASE.

Deploying FortiAP enables secure internet access for unmanaged personal devices in small branch offices with minimal configuration by automatically directing traffic through FortiSASE, eliminating the need for endpoint installation or complex setup.