NSE7_SSE_AD-25 Fortinet NSE 7 - FortiSASE 25 Enterprise Administrator Questions and Answers

In the FortiSASE architecture, there are two primary methods for delivering Secure Internet Access (SIA) : Agent-based (using FortiClient) and Agentless (using Secure Web Gateway/SWG).

Use Case Analysis: The scenario describes a contractor—an unmanaged user—who requires temporary access for a web-based application (the POS system). For contractors or guests using personal/non-corporate devices where installing the FortiClient agent is either not feasible or not desired, FortiSASE provides the SIA Agentless deployment model.

Mechanism (SWG & PAC): In this mode, FortiSASE functions as an explicit web proxy . To steer the contractor ' s web traffic (HTTP/HTTPS) to the SASE cloud for inspection, the administrator provides the user with a proxy auto-configuration (PAC) file . The contractor simply configures their browser or operating system to point to the URL of this PAC file.

Security Enforcement: Once the PAC file is applied, all web traffic from the contractor ' s device is redirected to the FortiSASE SWG PoP. Here, the traffic is subject to the organization’s full security stack, including SSL deep inspection, Antivirus, Web Filtering, and Application Control , ensuring that even temporary contractor access is fully secured and logged.

Why other options are incorrect:

Option B (Tunnel Policy): This refers to agent-based access where a VPN tunnel is established. This requires FortiClient, which is generally not used for temporary contractors on unmanaged devices.

Option C (ZTNA Unmanaged): While ZTNA supports agentless access to private applications (SPA), providing internet access (SIA) to an unmanaged endpoint is specifically the role of the SWG/Proxy service.

Option D (Self-registration): While FortiSASE has a User Portal for onboarding, it is a method for user registration/credential management, not the technical traffic-steering mechanism used to provide internet connectivity.

According to the FortiSASE 25 Secure Internet Access Architecture Guide , the SWG (Agentless) approach is the recommended best practice for securing web-only traffic from unmanaged endpoints and third-party contractors.

Zero-trust tags are critical in implementing zero-trust network access (ZTNA) policies. Here are the two key advantages of using zero-trust tags:

Access Control (Allow or Deny):

Zero-trust tags can be used to define policies that either allow or deny access to specific network resources based on the tag associated with the user or device.

This granular control ensures that only authorized users or devices with the appropriate tags can access sensitive resources, thereby enhancing security.

Determining Security Posture:

Zero-trust tags can be utilized to assess and determine the security posture of an endpoint.

Based on the assigned tags, FortiSASE can evaluate the device ' s compliance with security policies, such as antivirus status, patch levels, and configuration settings.

Devices that do not meet the required security posture can be restricted from accessing the network or given limited access.

Based on the provided exhibits, the reason why the Win7-Pro endpoint can no longer access the internet through FortiSASE is due to exceeding the total vulnerability detected threshold. This threshold is used to determine if a device is compliant with the security requirements to access the network.

Endpoint Compliance:

FortiSASE monitors endpoint compliance by assessing various security parameters, including the number of vulnerabilities detected on the device.

The compliance status is indicated by the ZTNA tags and the vulnerabilities detected.

Vulnerability Threshold:

The exhibit shows that Win7-Pro has 176 vulnerabilities detected, whereas Win10-Pro has 140 vulnerabilities.

If the endpoint exceeds a predefined vulnerability threshold, it may be restricted from accessing the network to ensure overall network security.

Impact on Network Access:

Since Win7-Pro has exceeded the vulnerability threshold, it is marked as non-compliant and subsequently loses internet access through FortiSASE.

The FortiSASE endpoint profile enforces this compliance check to prevent potentially vulnerable devices from accessing the internet.

The correct answers are C. Secure SD-WAN and D. Zero trust network access (ZTNA) . In FortiSASE, secure access to private applications is part of Secure Private Access (SPA) . The study guide identifies ZTNA as the SASE technology that provides “secure, explicit, identity-based access,” and explains that applying ZTNA shifts implicit access to explicit control by combining user authentication, continuous identity, context validation, and integration. This directly supports replacing traditional VPN access for private applications.

The guide also states that organizations can integrate FortiSASE with existing FortiGate SD-WAN deployments “to provide remote users access to private resources,” where FortiSASE security POPs act as spokes to the FortiGate SD-WAN hub. In the SPA section, FortiSASE private access is described as using ZTNA and SD-WAN integration for secure cloud and data center application access. SWG and CASB are not the best answers because SWG is for secure internet/web access, while CASB focuses on SaaS visibility and data protection, not private application VPN replacement. SD-WAN on-ramp is a deployment method, not the core SASE technology pair asked for here.

In a FortiSASE deployment, the Secure Private Access (SPA) use case is specifically designed to provide remote users with secure, high-performance connectivity to internal corporate applications hosted in private data centers or public clouds. 5 This is achieved through two primary architectural methods:

SD-WAN Integration (A): FortiSASE integrates natively with existing Fortinet Secure SD-WAN networks. 6 In this architecture, the FortiSASE global PoPs act as spokes that establish automated IPsec tunnels to the organization’s FortiGate SD-WAN hubs. This allows the platform to use intelligent application steering and dynamic routing to find the shortest, most efficient path to private resources, ensuring a superior user experience.

Zero Trust Network Access (ZTNA) (B): FortiSASE provides Universal ZTNA to enforce granular, per-session access control. 7 Unlike traditional VPNs that grant broad network access, ZTNA verifies the user ' s identity and the endpoint ' s security posture (via ZTNA tags) before every application session. This ensures that users only have access to the specific corporate applications they are authorized to use, significantly reducing the attack surface.

Analysis of Other Options: * Thin Edge (C) is a connectivity method used to secure branch offices and micro-branches (typically using FortiExtender), rather than a specific feature for facilitating private corporate application access for individual remote users.

CASB (D) is used for Secure SaaS Access (SSA) to provide visibility and control over third-party cloud applications like Office 365, rather than private applications hosted on-premises.

In a FortiSASE environment, log management is governed by a cloud-native storage policy that prioritizes performance and resource availability.

Retention Policy Framework: All FortiSASE instances come with log retention enabled by default. The standard log retention period is 30 days , though administrators can customize this policy to any duration between 2 and 30 days . This policy applies across all log types, including traffic, security, and event logs.

Automatic Deletion (A): When logs exceed the configured retention threshold, FortiSASE automatically deletes the older logs from the platform. 2 This automatic purging is necessary to free up storage space on the cloud infrastructure and maintain compliance with the organization ' s data lifecycle settings.

Persistence and Recovery: Once logs are deleted due to the expiration of the retention period, they are generally unrecoverable from the FortiSASE platform.

Long-Term Storage Solutions: Because FortiSASE is not designed as a long-term archival solution, customers who need to store logs for months or years for regulatory compliance should configure log forwarding to an external server , such as a FortiAnalyzer or a remote Syslog server.

Analysis of Incorrect Options: * Option B and D: While traditional FortiAnalyzer deployments use SQL indexing and separate " Archive " (raw/compressed) vs. " Analytics " (SQL) tiers, FortiSASE uses a simplified cloud storage model where data is purged rather than archived or tier-shifted upon expiry.

Option C: While FortiSASE is part of the FortiCloud ecosystem, it does not automatically " back up " expired logs to another FortiCloud service; the deletion is final unless external forwarding is active.

In a FortiSASE environment, the ability of a remote user to establish a VPN tunnel is governed not only by their credentials and firewall policies but also by geographic access controls .

Geofencing Mechanism: FortiSASE includes a Geofencing feature (found under Configuration > Restrictions or Configuration > Geofencing in newer versions) that allows administrators to restrict or allow access to SASE services based on the geographic location of the endpoint ' s public IP address.

Connection Failure vs. SSO Success: The scenario describes a situation where users can successfully authenticate via SSO to reach third-party SaaS apps like Office 365 (O365) or Salesforce (SFDC) but cannot connect to the SASE VPN. This occurs because the SSO authentication is handled directly by the Identity Provider (IdP) (e.g., Microsoft Entra ID), which may not have the same geographic restrictions. However, when the FortiClient attempts to establish the tunnel to the FortiSASE Point of Presence (PoP), the SASE gateway checks the Geofencing list . If the country the user is visiting is on the Deny list (or not on the Allow list), the connection is dropped at the " local-in " policy level on the SASE backend, preventing the tunnel from forming.

Verification and Resolution: To resolve this, the administrator must verify the Geofencing settings and ensure that the countries where the traveling users are located are permitted to connect. If the feature is enabled with a " Deny " list, the specific country must be removed from that list; if it uses an " Allow " list, the country must be added.

Analysis of Other Options:

Option A: Firewall policies govern traffic after the tunnel is established; they cannot resolve a failure to connect the tunnel itself.

Option B: Restarting the device is a general troubleshooting step but will not bypass a server-side geographic block.

Option D: While keeping clients updated is a best practice, the issue described (specific to overseas travel while other functions work) points to a configuration restriction rather than a software bug.

1. DLP Data Pattern

2. DLP Dictionary

3. DLP Sensor

4. DLP Profile

The FortiSASE Data Loss Prevention (DLP) framework follows a hierarchical object-oriented structure. When creating a custom DLP rule using Regular Expressions (Regex), the administrator must build the components from the most granular level upward to the policy level.

DLP Data Pattern: This is the first step where the actual Regex string is defined. The pattern specifies what specific data string (e.g., a specific credit card format or employee ID) the engine should look for.

DLP Dictionary: Once the pattern is created, it must be added to a Dictionary. The dictionary acts as a container that groups one or more data patterns together for easier management.

DLP Sensor: The dictionary is then linked to a DLP Sensor. Within the sensor, you define the " Rule " which specifies the dictionary to use and the action to take (such as block, log, or quarantine) when a match occurs.

DLP Profile: Finally, the sensor is applied to a DLP Profile. This profile is the high-level object that is ultimately selected within a FortiSASE Security Policy to inspect traffic for sensitive data.

FortiSASE supports zero trust network access (ZTNA) principles by identifying attributes on the endpoint for security posture checks. ZTNA principles require continuous verification of user and device credentials, as well as their security posture, before granting access to network resources.

Security Posture Check:

FortiSASE can evaluate the security posture of endpoints by checking for compliance with security policies, such as antivirus status, patch levels, and configuration settings.

This ensures that only compliant and secure devices are granted access to the network.

Zero Trust Network Access (ZTNA):

ZTNA is based on the principle of " never trust, always verify, " which requires continuous assessment of user and device trustworthiness.

FortiSASE plays a crucial role in implementing ZTNA by performing these security posture checks and enforcing access control policies.

In a FortiSASE environment, the Unified FortiClient agent is the critical component that fulfills the requirement for " always-on " connectivity and security for remote users.

Persistent Encrypted Tunnels : The Unified FortiClient maintains a persistent, always-on connection to the FortiSASE infrastructure. 4 This is typically achieved through an auto-connect VPN tunnel (SSL or IPsec) that initiates as soon as the user logs into their device and has internet access.

Continuous Security Enforcement : By staying connected to a nearby FortiSASE Point of Presence (PoP), the endpoint ensures that all traffic is inspected. This allows the organization to enforce a consistent security posture—including Web Filtering, Antivirus, and Application Control—regardless of whether the user is at home, in a coffee shop, or traveling.

Zero-Trust Integration : Beyond simple connectivity, the unified agent supports Universal ZTNA . It continuously verifies the identity of the user and the security posture of the device before granting access to specific applications, thereby satisfying modern zero-trust security mandates.

Comparison of Other Components :

SD-WAN on-ramp (B) : Used primarily to integrate existing branch office SD-WAN networks with the SASE cloud for private application access.

Secure Web Gateway (C) : While a feature of the SASE PoP, the agentless SWG deployment (using PAC files) does not provide the same level of " always-on " persistent tunnel protection as the FortiClient agent.

Thin-branch SASE extension (D) : Focused on securing small branch locations (using FortiAP or FortiExtender) where individual client agents may not be deployed on every device.

In FortiSASE, the Software Installations page (located under Network > Managed Endpoints ) provides a centralized view of all software inventory reported by the FortiClient agents. This feature is essential for administrators to maintain visibility into the environment and identify potentially unwanted applications (PUA) or unauthorized software installed on remote devices.

Software Inventory Reporting: FortiClient sends the endpoint ' s software inventory to FortiSASE upon initial registration and updates the portal whenever a change—such as an installation, update, or removal—occurs on the endpoint.

Available Information (Vendor): When viewing the global list of applications, the portal displays detailed metadata for each software entry. This includes the Vendor of the software and its specific version, allowing administrators to differentiate between reputable enterprise applications and suspicious third-party utilities.

Available Information (Endpoint Association): The interface includes an Endpoint Count field that indicates how many devices have a specific application installed. By selecting a specific application and using the View Endpoints action, the administrator can see a list of every individual endpoint where that software is currently active.

Incorrect Options: While license management is a general feature of the ecosystem, the Software Installations page itself does not track the license status of individual third-party applications (Option B). Similarly, while FortiSASE monitors traffic, the Software Installations inventory page does not report on the usage frequency (how often a user opens or uses the app) of the installed binaries (Option D).

By leveraging this inventory, administrators can proactively manage risk by identifying endpoints that possess high-risk software and taking remediation steps or applying ZTNA posture tags based on the presence of specific unauthorized software.

FortiSASE is designed as a unified, single-vendor solution that specifically targets the convergence of networking and security to address the modern challenges of a distributed enterprise. 2

Multicloud and SaaS Adoption: FortiSASE addresses the surge in cloud-first strategies by providing Next-Generation Dual-Mode CASB (Cloud Access Security Broker). 3 This feature uses both inline and API-based inspection to provide comprehensive visibility into sanctioned and unsanctioned SaaS applications (Shadow IT), ensuring that data is protected regardless of whether it resides in AWS, Azure, Google Cloud, or SaaS platforms like Microsoft 365.

Hybrid Workforce: To support a workforce that moves between the home, the office, and public spaces, FortiSASE delivers consistent security posture . 5 It replaces the inconsistent experience of legacy VPNs with a geographically dispersed network of over 150 Points of Presence (PoPs), ensuring low-latency access to applications while maintaining high-performance SSL inspection and threat detection for all remote users.

Zero Trust Integration: Central to the FortiSASE architecture is Universal ZTNA (Zero Trust Network Access). 7 Unlike traditional VPNs that grant broad network access, ZTNA applies the principle of " never trust, always verify " . It grants access on a per-session, per-application basis, continuously verifying the device posture and user identity before and during application access. 9 This shift from implicit to explicit trust significantly reduces the internal attack surface and mitigates the risk of lateral movement by attackers.

By integrating these components into a single operating system ( FortiOS ) and managed via a single console, FortiSASE simplifies IT operations while delivering the visibility and control required for today ' s multicloud and hybrid environments.

When deploying FortiSASE agent-based clients, several features are available that are not typically available with an agentless solution. These features enhance the security and management capabilities for endpoints.

Vulnerability Scan:

Agent-based clients can perform vulnerability scans on endpoints to identify and remediate security weaknesses.

This proactive approach helps to ensure that endpoints are secure and compliant with security policies.

SSL Inspection:

Agent-based clients can perform SSL inspection to decrypt and inspect encrypted traffic for threats.

This feature is critical for detecting malicious activities hidden within SSL/TLS encrypted traffic.

Web Filter:

Web filtering is a key feature available with agent-based clients, allowing administrators to control and monitor web access.

This feature helps enforce acceptable use policies and protect users from web-based threats.

FortiSASE hides user information when viewing and analyzing logs by hashing data using salt. This approach ensures that sensitive user information is obfuscated, enhancing privacy and security.

Hashing Data with Salt:

Hashing data involves converting it into a fixed-size string of characters, which is typically a hash value.

Salting adds random data to the input of the hash function, ensuring that even identical inputs produce different hash values.

This method provides enhanced security by making it more difficult to reverse-engineer the original data from the hash value.

Security and Privacy:

Using salted hashes ensures that user information remains secure and private when stored or analyzed in logs.

This technique is widely used in security systems to protect sensitive data from unauthorized access.

In the Fortinet SASE architecture, Zero Trust Network Access (ZTNA) tags (which have been renamed to Security Posture Tags starting with FortiClient/EMS 7.4.0) play a critical role in continuous posture assessment. These tags are dynamic metadata assign 8 ed to an endpoint based on specific conditions or " tagging rules " defined in the FortiSASE Endpoint Management Service (EMS).

Posture Determination: The FortiClient agent, installed on the endpoint, monitors the device for various security attributes—such as whether an antivirus is running, the presence of specific registry keys, OS version, or the absence of critical vulnerabilities.

SIA (Secure Internet Access) Use Case: In SIA scenarios, FortiSASE uses these tags within security policies to control internet access. For example, a policy may allow full internet access only to endpoints tagged as " Compliant " while redirecting " Non-Compliant " devices to a restricted remediation portal.

SPA (Secure Private Access) Use Case: In SPA (specifically ZTNA Proxy mode), the tags are synchronized from FortiSASE to the corporate FortiGate (acting as the ZTNA Access Proxy). 12 When a user attempts to access a private application, the FortiGate checks the endpoint ' s client certificate and its synchronized ZTNA tags. 13 If the endpoint does not meet the required posture (e.g., it is missing a required " Domain-Joined " tag), access is denied at the session level.

According to the FortiSASE 25 Enterprise Administrator Study Guide , ZTNA tags are fundamental to the " Zero Trust " principle because they move beyond static identity (username/password) to verify the real-time security state of the device before granting access to either the internet or internal private resources.

The provided exhibit (image_57e69d.jpg) displays the Software Installations dashboard within the FortiSASE portal. This dashboard is a key component of the endpoint visibility and management features provided by the integrated FortiClient EMS functionality.

Visible Metadata: The output provides a granular list of all software detected on managed endpoints, including the application Name , the Vendor (e.g., Igor Pavlov, Microsoft Corporation, Adobe), the specific Version currently installed, and critical timestamps such as First Detected and Last Installed .

Administrative Utility: This information allows an administrator to audit the software environment effectively. By reviewing these details, they can identify unwanted software (PUA), shadow IT, or outdated software versions that may possess known vulnerabilities.

Actions Available: While the primary view is informational, the presence of the View Endpoints button (visible in the top-left) allows administrators to pivot from a specific application to a list of all individual devices where that software is present, facilitating targeted remediation.

Analysis of Incorrect Options:

Option A: While FortiSASE manages profiles and tags, this specific " Software Installations " view is focused purely on software inventory.

Option B: Although the " First Detected " date is visible, FortiSASE does not support " automatic patching " of third-party software directly from this inventory screen.

Option C: The dashboard shows what is installed, not the " latest available " version in the market, nor does it provide a mechanism to " push updates " to these third-party applications.

To ensure that organizational SaaS applications (such as Microsoft 365, Salesforce, or AWS Console) are only accessible to users who are currently connected and protected by FortiSASE, administrators utilize Source IP Anchoring and IP-based access control .

Consistent Egress IPs: Every FortiSASE instance is assigned a set of dedicated public IP addresses (egress IPs) for each Security Point of Presence (PoP). Regardless of where a remote user is physically located, when they connect to a specific FortiSASE PoP, all their traffic destined for the internet or SaaS applications will appear to originate from that PoP ' s dedicated egress IP.

Whitelisting and Conditional Access: Administrators can retrieve the list of these dedicated egress IPs from the FortiSASE portal (typically found under the Support or Region IP list). These IPs are then configured as " Trusted Locations " or " Named Locations " within the SaaS provider ' s security settings (e.g., Microsoft Entra ID Conditional Access).

Enforcement Mechanism: Once the SaaS portal is configured to only permit logins from the FortiSASE egress IP ranges, any user attempting to access the application without being connected to the FortiSASE VPN will be denied access because their source IP will be their local ISP address rather than the trusted SASE IP. This effectively mandates the use of the SASE security stack for all corporate SaaS interactions.

Analysis of Incorrect Options:

Option A: CNAPP (Cloud-Native Application Protection Platform) is used for securing cloud-native applications and infrastructure, not for managing egress IP whitelisting for external SaaS providers.

Option B: While ZTNA is a secure access method, it is primarily used for Private Applications hosted by the organization, not for third-party public SaaS portals which rely on standard IP or identity-based conditional access.

Option C: SPA hubs are designed for Secure Private Access (connecting to a corporate data center), not for managing access to public SaaS applications.

SSL deep inspection (DPI) is a critical security function that allows FortiSASE to decrypt and inspect the actual payload of encrypted traffic (such as HTTPS, SMTPS, and FTPS) to identify and block hidden threats.

The Role of the CA: For this process to occur, FortiSASE must act as a " man-in-the-middle " by intercepting the SSL session, decrypting it for inspection, and then re-encrypting it before sending it to the endpoint. 2 To re-encrypt the traffic, FortiSASE acts as a Certificate Authority (CA) and signs a new certificate for the destination website on the fly.

Certificate Types: This CA role can be fulfilled using the default self-signed certificate provided by Fortinet (typically Fortinet_CA_SSL) or a certificate issued by an organization ' s internal/private CA . Publicly trusted third-party CAs (like DigiCert or Let ' s Encrypt) do not sell CA-capable certificates that can be used for this type of inspection.

Client Machine Requirement: Because the endpoint’s browser or operating system will not natively trust a certificate signed by a private or self-signed CA, the root CA certificate must be imported into the Trusted Root Certification Authorities store on all managed client machines. Failure to do so results in persistent certificate warnings or blocked connections for the end user.

Supported Features: Once enabled, SSL deep inspection provides the necessary visibility for high-level security features to function, including Antivirus , Web Filtering , Data Loss Prevention (DLP) , File Filter , and Application Control .

The correct answer is D . The FortiSASE study guide explains that SPA allows a FortiSASE POP to act as a spoke and connect to a FortiGate hub. It states that you can use FortiSASE SPA so that a POP connects to either a standalone hub using IPsec or to an existing Fortinet SD-WAN deployment . It also states that the BGP protocol is established through IPsec links for dynamic route exchange, which gives FortiSASE remote users access to private resources. For hub deployments running FortiOS 7.4.5 or later, the guide explains that an easy configuration key can simplify SPA setup on FortiSASE by automatically populating key fields in the FortiGate hub configuration.

The wrong options contradict the guide. Option A is false because FortiSASE does not apply SNAT for remote VPN user and edge device traffic destined for SPA hubs, and FortiSASE spokes support IKEv2, not IKEv1. Option B confuses agentless ZTNA with SD-WAN private access. Option C is wrong because SPA uses IPsec and BGP, and the easy configuration key is for SPA hub setup, not for securing general web traffic.

In a default FortiSASE deployment, endpoints are typically onboarded using a shared invitation code sent via email. While this code simplifies deployment, it can represent a security risk if the code is leaked or intercepted, as any device with the code could potentially register with the SASE management service.

User Verification (SAML SSO): To mitigate this risk, administrators can enable user verification as an additional layer of security. 3 When this feature is enforced, entering the invitation code is no longer sufficient to complete registration.

Authentication Workflow: After the end user enters the invitation code in FortiClient, they are prompted to provide their corporate credentials via a SAML SSO login. 5 FortiSASE acts as the Service Provider (SP), while an external identity provider (IdP) such as Microsoft Entra ID, Okta, or FortiAuthenticator verifies the user ' s identity.

Security Benefit: This ensures that only authenticated users —not just anyone with a valid code—can successfully register an endpoint and receive the organization ' s security and VPN profiles. It prevents unauthorized " shadow " endpoints from joining the managed environment.

Incorrect Options:

Option A: Security posture tags are used after registration to determine if an endpoint is compliant (e.g., checking if an antivirus is active); they do not secure the registration process itself.

Option C and D: Device identification and application inventory are monitoring and visibility features that occur once the endpoint is already managed.

Refer to the exhibit. Based on the configuration shown in image_595357.jpg , FortiSASE will process sessions requiring FortiSandbox inspection in the following two ways:

A. Only endpoints assigned a profile for sandbox detection will be processed by the sandbox feature.

C. All files executed on a USB drive will be sent to FortiSandbox for analysis.

Answer: A, C

The provided exhibit displays an Endpoint Profile configuration specifically for the Sandbox module. This profile controls how the FortiClient agent on remote endpoints interacts with the integrated FortiSASE cloud sandbox engine.

Profile Assignment (A): In the FortiSASE architecture, security and endpoint settings are organized into profiles that must be explicitly assigned to users or user groups via endpoint policies. Consequently, the sandbox detection and remediation features are active only on those endpoints that have been assigned this specific endpoint profile . If an endpoint is not assigned a profile with sandbox enabled, it will not submit files for analysis.

Removable Media Analysis (C): Under the File Submission Options , the toggle for All Files Executed from Removable Media is enabled (shown in blue). Since USB drives are the most common form of removable media, this configuration ensures that any file executed from a USB drive is intercepted by FortiClient and submitted to the FortiSASE sandbox for behavioral analysis before being allowed to run, protecting the endpoint from offline-delivered threats.

Understanding Verdict Levels (B): The exhibit shows the Action is set to Quarantine and the Sandbox Detection Verdict Level is set to Medium . This configuration functions as a threshold; FortiClient will quarantine any file that receives a verdict of Medium or higher (including High and Malicious). Option B is incorrect because it claims only medium-level files are quarantined, which ignores the high-risk and malicious files that would also be blocked.

Sandbox Mode (D): The Sandbox Mode is clearly set to FortiSASE , which utilizes the built-in cloud-native sandbox. This contradicts Option D, which suggests the use of an on-premises or standalone sandbox appliance.

The correct answer is D. Web filter with inline-CASB . The FortiSASE study guide states that FortiCASB provides cloud-based and API-based capabilities for deep inspection of SaaS applications, enabling monitoring, analysis, and reporting. It also states that FortiSASE provides inline CASB functionality with a web filter and application control security features , while DLP protects data at rest and in motion.

This question specifically describes restricting Microsoft Office 365 access by tenant, meaning users should be allowed to access company-approved Microsoft 365 resources but blocked from logging in to non-company or personal resources. Fortinet’s FortiSASE documentation describes this exact use case as “restricted SaaS access,” where organizations restrict access to Microsoft Office 365, Google Workspace, and similar SaaS services by tenant to block non-company login attempts and prevent access to non-approved cloud resources. Fortinet’s Office 365 example confirms this is implemented through FortiSASE Web Filter with Inline-CASB, using inline-CASB headers to allow corporate domains and deny personal accounts.

Integrating FortiManager with FortiSASE allows for central management of configuration objects like addresses and 5 security 6 profiles. For this integration to function correctly, the following key prerequisites must be met:

Same FortiCloud Account: A fundamental requirement for the integration is that both 10 the FortiSASE instance and the FortiManager (whether physical, VM, or Cloud) must be registered under the same FortiCloud (FortiCare) account . This common identity allows the platforms to securely discover and authorize each other for synchronization.

Supported Firmware Version: The FortiManager must run a firmware version that is compatible with the FortiSASE release. According to the FortiSASE 25 Enterprise Administrator Study Guide , FortiManager version 7.4.4 or later is generally required to support the specific API connectors and object synchronization logic used by current FortiSASE environments. Using an unsupported version may result in synchronization failures or missing configuration features.

Management Logic: Once these prerequisites are met, the administrator can enable " Central Management " in the FortiSASE portal. This creates a one-way synchronization where FortiManager acts as the source of truth for objects like Security Profile Groups, ensuring consistent security posture across both the SASE cloud and on-premises FortiGates.

FortiSASE brings the following advantages to businesses with multiple branch offices:

Centralized Management for Simplified Administration:

FortiSASE provides a centralized management platform that allows administrators to manage security policies, configurations, and monitoring from a single interface.

This simplifies the administration and reduces the complexity of managing multiple branch offices.

Eliminates the Need for On-Premises Firewalls:

FortiSASE enables secure access to the internet and cloud applications without requiring dedicated on-premises firewalls at each branch office.

This reduces hardware costs and simplifies network architecture, as security functions are handled by the cloud-based FortiSASE solution.