FCSS_SASE_AD-25 FCSS - FortiSASE 25 Administrator Questions and Answers

Deploying secure private access with SD-WAN enables the hub FortiGate to perform ZTNA posture checks, and supports both TCP and UDP applications over the tunnel, allowing for flexible and secure access to internal resources.

The self-registration portal is the recommended method for granting temporary internet access to contractors or guests. It provides a simple and secure way for the contractor to authenticate and access the internet without requiring full endpoint management or policy configuration.

Remote Browser Isolation (RBI) protects users by executing their web browsing sessions in a remote, secure container, preventing malicious content from reaching the local device.

The FortiClient Administration Guide states that on-net rules determine when an endpoint is in a trusted location. If the endpoint matches the configured subnet, the client is considered on-net, and therefore bypasses auto-connect.

“Device registration and on-net status information for a device that is running FortiClient appears only on the FortiGate that applies the FortiClient profile to that device.”

Since 192.168.13.101 falls inside the trusted subnet 192.168.13.0/24, the endpoint is treated as on-net → it will be exempted from auto-connect.

ZTNA enforces least-privileged access by verifying user identity and device posture before granting access to specific corporate applications, even when protected by an on-premises FortiGate.

The sandbox feature applies only to endpoints assigned this profile, and the configuration explicitly enables the submission of all files executed from removable media (like USB drives) to FortiSandbox for analysis.

FortiSASE releases network lockdown when the endpoint re-establishes the tunnel connection or when it is verified as compliant through ZTNA tag evaluation, ensuring it meets security posture requirements.

Although the antivirus is installed, it is not running due to the Windows application firewall blocking it. According to the FortiSASE-Non-Compliant rule, antivirus software must be both installed and running. Since this condition fails, FortiClient assigns the FortiSASE-Non-Compliant tag to the endpoint.

Assigning hubs with different priorities in a FortiSASE SD-WAN deployment allows traffic to be routed through the optimal hub to meet SLA requirements and ensures redundancy by enabling automatic failover if the preferred hub becomes unavailable.

According to the FortiOS Administration Guide, when configuring central management, a FortiManager Cloud entitlement must be present and the devices must share the same FortiCloud account for registration. Specifically:

“The FortiManager Cloud button can only be selected if you have a FortiManager Cloud product entitlement.”

“The FortiGate and FortiCloud license are registered to the same account.”

Thus, the two verified requirements are: B (entitlement) and D (same FortiCloud account).