FCSS FortiSASE 25 Administrator flashcards
FCSS FortiSASE 25 Administrator · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- FortiSASE tenant region
- The geographic PoP location chosen at tenant creation that determines where user traffic egresses. It cannot be changed in place; a different region requires a new tenant and re-onboarding.
- FortiSASE licensing unit
- Licensing is per active user seat. Connected endpoints consume seats, while disabled or inactive users do not, so sizing uses the active user population rather than device count.
- SAML group claim mapping
- SSO passes group membership from the identity provider as SAML claims. FortiSASE policy matches those group names, so IdP group names must align with the groups referenced in policy.
- Endpoint invitation registration
- A user joins the tenant by redeeming an emailed invitation or a preconfigured installer containing tenant settings. Self-registration without a valid invitation is not permitted.
- Secure Private Access
- A FortiSASE capability that publishes internal applications to remote users through the cloud PoP, using a tunnel from a FortiGate private access node to reach internal subnets.
- Private access node tunnel
- An IPSec tunnel between a FortiGate (private access node) and FortiSASE. It carries user requests from the PoP to internal resources and must route to all published subnets.
- SD-WAN cloud on-ramp
- Branch FortiGate builds an IPSec overlay to the FortiSASE PoP, and SD-WAN rules steer selected traffic into it based on application or destination, with failover on SLA breach.
- Split tunnel scope
- A client or branch setting that sends only matching destinations to the PoP while other traffic stays local. It reduces latency and PoP load but limits inspection coverage.
- FortiGuard category action
- Web-filter profiles act on FortiGuard URL categories. Rules are evaluated in order and the first match wins, so exempt rules placed early override later blocks.
- Unrated category
- Newly registered or unrecognized domains receive the Unrated rating. Without an explicit policy for Unrated, these sites are neither clearly allowed nor blocked by category.
- Static URL filter precedence
- Exact URL or wildcard entries in the static URL filter override FortiGuard category actions, letting administrators force allow or block for specific destinations.
- SafeSearch enforcement
- A web-filter option that forces safe results on supported search engines. It does not filter other sites and only applies to providers that support the setting.
- Certificate inspection
- An SSL mode that reads only the server certificate fields such as CN and SNI without decrypting payload. It enables domain-level filtering but not URL path or content inspection.
- Deep SSL inspection
- Full TLS interception using a FortiSASE CA. The endpoint must trust that CA; otherwise browsers show certificate errors and inspection fails or is bypassed.
- SSL inspection exemption
- A list of categories or destinations excluded from deep inspection to prevent breakage of certificate-pinned or sensitive applications such as banking and healthcare portals.
- DNS filtering sinkhole
- FortiGuard DNS returns a block response for denied categories. It only works if endpoints use the provided DNS and DNS-over-HTTPS is disabled or intercepted.
- Antivirus file size limit
- The antivirus profile stops scanning files exceeding the configured size threshold. Oversized files pass unscanned, so the limit must match the risk tolerance.
- IPS over TLS
- Intrusion prevention inspects decrypted payloads. For HTTPS traffic, signature coverage depends on deep inspection being enabled; without it, only metadata is visible.
- Application control signature
- Application control identifies traffic by signature rather than port. Without SSL decryption it sees fewer applications because only SNI-level information is available.
- FortiSASE Client tunnel
- The endpoint agent builds the secure tunnel to the PoP. It can be standalone or managed by EMS, and it carries traffic subject to the tenant's policy and profiles.
- ZTNA per-application access
- ZTNA grants reachability only to published applications rather than the whole network. Each app requires a client destination, user identity, and an access policy.
- ZTNA posture tag
- A dynamic tag derived from endpoint compliance checks such as antivirus status. If the check fails, the tag is removed and policy stops matching, revoking access.
- FortiClient EMS telemetry
- EMS or FortiClient Cloud reports endpoint compliance to FortiSASE. Tags from that telemetry can gate access on posture, adding a device-trust condition to policy.
- Client version compatibility
- The endpoint client version must be supported by the tenant. A mismatched version can fail to establish the tunnel even when credentials and policy are correct.
- Full tunnel mode
- A client setting that routes all endpoint traffic to the PoP. It maximizes inspection coverage but increases latency and PoP bandwidth consumption for every flow.
- Cloud log types
- FortiSASE portal logs include traffic, web filter, security (antivirus and IPS), and event logs. Each type answers a different question during troubleshooting.
- Log retention window
- Portal log retention is limited by the license or plan. Forwarding to syslog preserves records beyond that window for compliance or long-term investigation.
- Matched policy rule ID
- Traffic logs record the rule that matched a flow. Reading that rule and its attached profiles explains why traffic was allowed, blocked, or inspected.
- Policy order precedence
- Rules are evaluated top-down and the first match applies. An early allow rule can bypass a later block, so rule order is checked before blaming a profile.
- Certificate error diagnosis
- Browser certificate warnings while the tunnel is up usually mean the endpoint does not trust the inspection CA, or the site is certificate-pinned and needs an exemption.
- DNS resolution failure
- If the tunnel is connected but names fail to resolve, check the DNS servers pushed by the client profile and confirm DNS-over-HTTPS is not bypassing FortiGuard DNS.
- Routing loop avoidance
- The branch must not route the FortiSASE PoP public IPs back into the tunnel. Those addresses stay on the underlay so the tunnel itself remains reachable.