I85PREP
⌘ K
FCSS FortiSASE 25 Administrator study materials
FCSS FortiSASE 25 Administrator study resources

FCSS FortiSASE 25 Administrator practice questions

One question at a time. Build your FCSS FortiSASE 25 Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiSASE Deployment and Initial Configuration

A FortiSASE administrator needs to connect an on-premises FortiGate to the FortiSASE cloud so that branch clients can reach the internet through the cloud security stack. Which component is deployed on the FortiGate to build this overlay connection?

  1. A FortiSASE secure private access connector
  2. A FortiSASE agent installed on each endpoint
  3. A FortiSASE IPsec tunnel configured as a SIMA (secure internet access) connection
  4. A FortiSASE Secure SD-WAN overlay tunnel using the FortiGate as a secure private access node Correct answer.

Explanation

FortiSASE integrates an on-premises FortiGate as a secure private access node by forming an overlay tunnel from the FortiGate to the FortiSASE cloud, so branch traffic can be steered to cloud security services. This is the standard way to extend FortiSASE protection to traffic originating behind an existing FortiGate.

Question 2FortiSASE Deployment and Initial Configuration

Which portal does an administrator use to activate FortiSASE and manage the tenant, including licensing, user groups, and configuration profiles?

  1. The FortiClient EMS console
  2. The FortiCloud support portal only
  3. The FortiGate local GUI on the branch device
  4. The FortiSASE management console accessed through the FortiCloud single sign-on Correct answer.

Explanation

FortiSASE is a cloud-delivered service managed from the FortiSASE console, which is reached through FortiCloud single sign-on. Licensing, user and group management, and configuration profiles are all administered there.

Question 3FortiSASE Deployment and Initial Configuration

When onboarding users to FortiSASE, which identity source is used to authenticate remote users and assign them to groups for policy?

  1. An external identity provider integrated through SAML or LDAP Correct answer.
  2. A certificate authority issuing device certificates only
  3. A RADIUS server configured on the branch FortiGate
  4. A local user database on each endpoint

Explanation

FortiSASE authenticates remote users against an external identity provider, typically integrated via SAML or LDAP, so that group membership can drive security profiles and access policy. This is the standard identity integration for the tenant.

Question 4FortiSASE Deployment and Initial Configuration

An administrator wants remote endpoints to automatically connect to FortiSASE without manual configuration. Which mechanism delivers the connection profile to the endpoint?

  1. A static IPsec configuration entered by the user
  2. A browser bookmark to the FortiSASE portal
  3. A FortiClient EMS provisioning profile pushed to FortiClient Correct answer.
  4. A DHCP option on the branch network

Explanation

FortiClient EMS provisions FortiClient with the FortiSASE connection profile, so endpoints connect automatically with the correct settings. This central provisioning avoids per-user manual configuration.

Question 5FortiSASE Deployment and Initial Configuration

Which FortiSASE capability inspects traffic from remote users to the internet for threats such as malware and intrusions?

  1. Endpoint patch management
  2. Secure internet access Correct answer.
  3. SD-WAN orchestration
  4. Secure private access

Explanation

Secure internet access applies cloud-delivered security services, including antivirus, IPS, and web filtering, to remote user internet traffic. Secure private access, by contrast, governs access to private applications.

Question 6FortiSASE Deployment and Initial Configuration

An administrator is planning the initial FortiSASE deployment and must decide how branch offices behind FortiGates will be protected. Which approach uses the existing FortiGate to forward traffic to FortiSASE?

  1. Configure the FortiGate as a secure private access node with an overlay tunnel Correct answer.
  2. Deploy FortiClient on every branch workstation
  3. Replace each FortiGate with a FortiSASE hardware appliance
  4. Enable only local FortiGate security profiles

Explanation

Configuring the FortiGate as a secure private access node with an overlay tunnel lets branch traffic be forwarded to FortiSASE for cloud security processing. This preserves the existing branch gateway while extending cloud protection.

Question 7FortiSASE Deployment and Initial Configuration

What is required before a FortiSASE tenant can be activated and configured?

  1. A valid FortiSASE license entitlement associated with the FortiCloud account Correct answer.
  2. A dedicated MPLS circuit to the cloud
  3. A physical FortiGate in the same data center
  4. A FortiAnalyzer appliance on premises

Explanation

Activation requires a FortiSASE license entitlement tied to the FortiCloud account, which unlocks the tenant and its features. No on-premises appliance or dedicated circuit is a prerequisite for activation.

Question 8FortiSASE Deployment and Initial Configuration

Which FortiSASE feature allows administrators to define acceptable use and block categories of websites for remote users?

  1. IPsec phase 1 proposal settings
  2. DHCP lease time
  3. Web filter profile applied in the secure internet access policy Correct answer.
  4. SD-WAN health check interval

Explanation

A web filter profile, applied through the secure internet access policy, controls which website categories users may reach. The other options are networking parameters unrelated to content control.

Question 9FortiSASE Deployment and Initial Configuration

A remote user reports that FortiClient connects but cannot reach internal applications published through FortiSASE. Which configuration should the administrator review first?

  1. The endpoint's local firewall rules only
  2. The FortiSASE web filter category list
  3. The secure private access policy and published application definitions Correct answer.
  4. The FortiGate DHCP reservation table

Explanation

Reachability to published private applications depends on the secure private access policy and the application definitions that map destinations to the tunnel. If the connection succeeds but applications are unreachable, those definitions are the first thing to verify.

Question 10FortiSASE Deployment and Initial Configuration

An administrator wants to steer only specific SaaS application traffic through FortiSASE while allowing other traffic direct. Which FortiSASE capability should be configured on the endpoint profile?

  1. A static route on the branch FortiGate
  2. A DNS forwarder on the endpoint
  3. Split tunneling rules in the FortiClient connection profile Correct answer.
  4. An IPsec phase 2 selector on the branch FortiGate

Explanation

Split tunneling rules in the FortiClient connection profile determine which destinations are sent through FortiSASE and which bypass it. This gives granular control over what traffic is inspected in the cloud.

Question 11FortiSASE Deployment and Initial Configuration

During onboarding, an administrator maps an identity provider group to a FortiSASE configuration profile. What is the primary purpose of this mapping?

  1. To register the tenant with FortiCloud
  2. To assign the correct security and connection settings to users in that group Correct answer.
  3. To establish the IPsec tunnel to the branch
  4. To assign IP addresses to endpoints

Explanation

Mapping an identity provider group to a configuration profile ensures users in that group receive the appropriate security and connection settings automatically. Group-to-profile mapping is the core of identity-driven policy in FortiSASE.

Question 12FortiSASE Deployment and Initial Configuration

Which step must be completed on a FortiGate before it can be registered as a secure private access node in FortiSASE?

  1. The FortiGate must be registered to the same FortiCloud account and authorized in the FortiSASE console Correct answer.
  2. The FortiGate must have a public static IP only
  3. The FortiGate must run in transparent mode
  4. The FortiGate must disable all local security profiles

Explanation

The FortiGate must be registered to the FortiCloud account and then authorized from the FortiSASE console so the tenant can manage the overlay. This ties the device into the correct tenant.

Question 13FortiSASE Deployment and Initial Configuration

An administrator needs to verify that a newly provisioned endpoint is receiving the FortiSASE configuration profile. Where should they check the endpoint status?

  1. In the FortiGate routing table
  2. In the FortiClient EMS managed endpoint list and FortiSASE endpoint inventory Correct answer.
  3. In the branch switch MAC address table
  4. In the identity provider audit log only

Explanation

FortiClient EMS shows whether the endpoint received its profile, and the FortiSASE console shows the endpoint inventory and connection status. Together they confirm successful provisioning.

Question 14FortiSASE Deployment and Initial Configuration

Which FortiSASE component enforces data loss prevention and file filtering on traffic inspected in the cloud?

  1. A security profile attached to the secure internet access policy Correct answer.
  2. The identity provider assertion
  3. The FortiClient installer package
  4. The FortiGate SD-WAN rule

Explanation

DLP and file filtering are security profiles attached to the secure internet access policy so they are applied to inspected traffic. The other items are installation, routing, or authentication elements.

Question 15FortiSASE Deployment and Initial Configuration

An administrator wants branch traffic from a FortiGate to use FortiSASE for internet security while keeping local SD-WAN failover. What should be configured on the FortiGate?

  1. A local-only web filter profile
  2. A single static default route to the FortiSASE cloud
  3. A FortiClient profile on the FortiGate
  4. An overlay tunnel to FortiSASE combined with SD-WAN rules that steer traffic to the tunnel Correct answer.

Explanation

Combining the FortiSASE overlay tunnel with SD-WAN rules lets the FortiGate steer selected traffic to the cloud while retaining local path selection and failover. This preserves resilience while gaining cloud inspection.

Question 16FortiSASE Deployment and Initial Configuration

Which FortiSASE setting determines whether endpoints must authenticate with multi-factor authentication before being granted access?

  1. The endpoint's DNS suffix
  2. The FortiGate interface MTU
  3. The identity provider authentication policy referenced by the tenant Correct answer.
  4. The FortiSASE data center region

Explanation

Multi-factor authentication is enforced by the identity provider authentication policy that FortiSASE references during sign-in. FortiSASE delegates the MFA challenge to that identity source.

Question 17FortiSASE Deployment and Initial Configuration

A FortiSASE tenant is being prepared for production. Which task ensures that only approved endpoint devices can connect?

  1. Enforce device compliance and certificate checks in the endpoint profile and policy Correct answer.
  2. Increase the tunnel MTU
  3. Remove all web filter profiles
  4. Disable the identity provider integration

Explanation

Device compliance checks and certificate validation in the endpoint profile and access policy restrict connections to approved devices. This is the standard posture control for endpoint admission.

Question 18FortiSASE Deployment and Initial Configuration

What distinguishes secure private access from secure internet access in a FortiSASE deployment?

  1. Secure private access applies only to branch FortiGates
  2. Secure private access governs reachability to internal applications, while secure internet access inspects traffic to external destinations Correct answer.
  3. Both refer to the same policy and differ only in licensing
  4. Secure private access inspects internet traffic, while secure internet access governs internal applications

Explanation

Secure private access controls which internal applications users may reach, whereas secure internet access applies security inspection to external internet traffic. The two are complementary but address different traffic paths.

Question 19FortiSASE Deployment and Initial Configuration

An administrator notices that remote users can reach the internet but not published internal applications after a policy change. Which troubleshooting sequence is most efficient?

  1. Reboot the identity provider, then rebuild the branch tunnel
  2. Confirm the endpoint tunnel is up, then verify the secure private access policy and application definitions Correct answer.
  3. Disable SD-WAN, then reissue the tenant license
  4. Change the web filter categories, then reinstall FortiClient

Explanation

Because internet access works, the tunnel and authentication are likely intact; the fault is most likely in the secure private access policy or the published application definitions. Checking those in order isolates the cause quickly.

Question 20FortiSASE Deployment and Initial Configuration

A branch FortiGate is registered as a secure private access node, but traffic is not reaching FortiSASE. Which factor is most likely to prevent the overlay from coming up?

  1. The FortiGate has too many local security profiles enabled
  2. The identity provider group name contains spaces
  3. Outbound connectivity to the FortiSASE service endpoints is blocked by an upstream firewall Correct answer.
  4. The endpoint DNS suffix is misconfigured

Explanation

The overlay requires outbound connectivity to the FortiSASE service endpoints; an upstream firewall blocking that traffic prevents the tunnel from establishing. Local profile count, DNS suffix, and group naming do not block tunnel establishment.

Question 21FortiSASE Deployment and Initial Configuration

An administrator must choose between endpoint-based and branch-based onboarding for a hybrid workforce. Which consideration most strongly favors the endpoint-based approach?

  1. Users work from varied locations and need consistent protection regardless of network Correct answer.
  2. The organization has no remote users
  3. The organization wants to avoid identity provider integration
  4. The organization wants to protect all devices behind a single FortiGate

Explanation

Endpoint-based onboarding follows the user and applies protection regardless of the network they connect from, which suits a distributed workforce. Branch-based onboarding protects traffic behind a FortiGate but does not cover users off that network.

Question 22FortiSASE Deployment and Initial Configuration

Which outcome indicates that split tunneling is configured too broadly in a FortiSASE endpoint profile?

  1. The tenant license fails to activate
  2. The endpoint cannot authenticate to the identity provider
  3. The branch FortiGate loses its overlay tunnel
  4. Security inspection is bypassed for traffic that should have been inspected in the cloud Correct answer.

Explanation

Overly broad split tunneling exemptions cause traffic that should be inspected to bypass FortiSASE, weakening protection. Authentication, branch tunnel state, and licensing are unaffected by split tunneling scope.

Question 23FortiSASE Deployment and Initial Configuration

An administrator is validating a new FortiSASE deployment before go-live. Which check best confirms that secure internet access inspection is functioning?

  1. Ping the FortiSASE data center from the branch FortiGate
  2. Confirm the DHCP lease duration on the branch
  3. Verify the endpoint's local antivirus version
  4. Generate test traffic to a known malicious or blocked category and confirm the cloud policy blocks it Correct answer.

Explanation

Sending test traffic to a known blocked destination and observing the block confirms that the cloud inspection path and policy are active. Reachability pings and local endpoint details do not validate cloud inspection.

Question 24FortiSASE Deployment and Initial Configuration

Which FortiSASE console area would an administrator use to view which users are currently connected through the cloud service?

  1. The license activation page
  2. The dashboard and user/endpoint monitoring views Correct answer.
  3. The DNS zone editor
  4. The FortiGate interface configuration page

Explanation

Dashboard and monitoring views in the FortiSASE console show connected users and endpoints in near real time. License, FortiGate interface, and DNS pages do not provide user connection visibility.

Question 25FortiSASE Deployment and Initial Configuration

When configuring the FortiGate as a secure private access node, which interface role is typically used to source the overlay tunnel to FortiSASE?

  1. An internal LAN interface only
  2. A loopback interface with no route
  3. The WAN interface with internet reachability Correct answer.
  4. A dedicated management interface without routing

Explanation

The overlay tunnel is sourced from the WAN interface that has internet reachability to the FortiSASE service. Interfaces without routing or internet access cannot carry the tunnel.

Question 26FortiSASE Deployment and Initial Configuration

An administrator is preparing the first FortiSASE deployment and needs to confirm which identity sources the tenant can use for user authentication. Which identity integration does FortiSASE support natively for single sign-on with remote endpoints?

  1. RADIUS proxy chaining only
  2. NTLM pass-through authentication
  3. SAML 2.0 identity provider integration Correct answer.
  4. Kerberos constrained delegation

Explanation

FortiSASE integrates with external identity providers through SAML 2.0 so that endpoint users authenticate against the corporate IdP and group membership is passed to FortiSASE for policy matching. RADIUS, Kerberos, and NTLM are not the native SSO mechanism used for endpoint onboarding in FortiSASE.

Question 27FortiSASE Deployment and Initial Configuration

During initial FortiSASE provisioning, an administrator must decide how endpoints will be associated with the tenant. Which artifact is used to enroll a FortiClient endpoint into a specific FortiSASE tenant?

  1. A FortiAnalyzer log forwarding certificate
  2. A FortiGate configuration backup file
  3. A FortiManager provisioning template
  4. An invitation code generated in the FortiSASE portal Correct answer.

Explanation

FortiSASE enrollment relies on an invitation code (also called an activation or enrollment code) generated in the portal that ties a FortiClient installation to the correct tenant and configuration profile. FortiGate backups, FortiAnalyzer certificates, and FortiManager templates are not endpoint enrollment artifacts.

Question 28FortiSASE Deployment and Initial Configuration

An administrator is validating the FortiSASE tenant after the first configuration sync. Which statement describes the relationship between configuration profiles and endpoint groups in FortiSASE?

  1. Profiles are bound to FortiGate serial numbers rather than to users or groups
  2. A configuration profile is assigned to an endpoint group so all members inherit the same settings Correct answer.
  3. Each endpoint must be individually assigned to a profile without using groups
  4. Groups are created only after endpoints authenticate through a FortiGate tunnel

Explanation

In FortiSASE, configuration profiles define settings such as web filtering, SSL inspection, and tunneling behavior, and they are applied to endpoint groups so members receive consistent policy. Individual assignment or binding profiles to FortiGate serial numbers is not the model used for endpoint policy.

Question 29FortiSASE Deployment and Initial Configuration

A new FortiSASE tenant has been activated but no endpoints are connecting. Which licensing element must be in place for endpoint-based secure internet access to function?

  1. A FortiSwitch management license per access point
  2. A FortiClient EMS perpetual license per endpoint
  3. A FortiGate hardware appliance license for each branch
  4. A FortiSASE user license assigned to each connecting user Correct answer.

Explanation

FortiSASE endpoint-based deployments consume user licenses, so each connecting user must be covered by an assigned FortiSASE user license for secure internet access to be enforced. FortiGate, FortiClient EMS, and FortiSwitch licenses are separate products and do not activate FortiSASE endpoint protection.

Question 30FortiSASE Deployment and Initial Configuration

An administrator is configuring the FortiSASE portal for the first time and wants to restrict which public-facing applications remote users can reach through secure private access. Which object must exist before an access policy can reference the internal application?

  1. A static route on the endpoint pointing to the FortiSASE cloud
  2. A DNS forwarder zone hosted on the FortiGate
  3. A virtual IP mapped to the endpoint public address
  4. A published application entry defining the internal host and port Correct answer.

Explanation

Secure private access policies reference published application objects that describe the internal destination host, protocol, and port. Static routes on endpoints, DNS forwarder zones, and virtual IPs are not the objects that define reachable internal applications in FortiSASE.

Question 31FortiSASE Deployment and Initial Configuration

An administrator is deploying FortiSASE for a branch office whose FortiGate will act as a secure private access node. Which FortiGate configuration step establishes the tunnel to FortiSASE?

  1. Configuring a site-to-site IPsec tunnel to the tenant public IP
  2. Installing FortiClient on the FortiGate management interface
  3. Enabling the FortiSASE cloud connection and registering the FortiGate serial number in the portal Correct answer.
  4. Adding the tenant as an LDAP server on the FortiGate

Explanation

A FortiGate joins FortiSASE as a secure private access node by enabling the cloud connection and registering the device serial number with the tenant. A manual IPsec tunnel, LDAP server entry, or FortiClient on the FortiGate is not how the node establishes its FortiSASE connectivity.

Question 32FortiSASE Deployment and Initial Configuration

During initial FortiSASE configuration, an administrator wants branch FortiGate traffic to use secure internet access while local traffic stays local. Which FortiSASE setting controls which traffic is redirected to the cloud?

  1. The FortiAnalyzer log retention period
  2. The traffic steering or tunnel mode setting in the branch configuration Correct answer.
  3. The SSL certificate inspection depth on the endpoint
  4. The FortiGate administrative timeout value

Explanation

FortiSASE branch deployments use traffic steering and tunnel mode settings to determine which traffic is redirected to the cloud for inspection and which remains local. Administrative timeouts, certificate inspection depth, and log retention do not define traffic redirection scope.

Question 33FortiSASE Deployment and Initial Configuration

An administrator is onboarding a new identity provider and needs FortiSASE to place users into the correct endpoint group automatically. Which attribute mapping should be configured?

  1. Mapping the IdP session timeout to a FortiSASE license tier
  2. Mapping the IdP group claim to a FortiSASE endpoint group Correct answer.
  3. Mapping the IdP user password to a FortiSASE local account
  4. Mapping the IdP certificate to a FortiSASE SSL inspection profile

Explanation

FortiSASE uses SAML group claims from the identity provider to place authenticated users into the corresponding endpoint groups, which then receive the assigned configuration profile. Passwords, session timeouts, and certificates are not mapped to endpoint group membership.

Question 34FortiSASE Deployment and Initial Configuration

An administrator is reviewing the FortiSASE dashboard after initial deployment and wants to confirm that endpoints are checking in with the cloud service. Which indicator best shows active endpoint connectivity?

  1. The count of connected endpoints and their last-seen timestamps Correct answer.
  2. The DNS query volume reported by the branch resolver
  3. The number of configured firewall addresses
  4. The FortiGate CPU utilization graph

Explanation

The FortiSASE dashboard reports connected endpoints and last-seen timestamps, which directly indicate whether enrolled endpoints are communicating with the cloud service. Firewall address counts, FortiGate CPU graphs, and DNS query volume do not confirm endpoint check-in.

Question 35FortiSASE Deployment and Initial Configuration

An administrator must ensure that endpoints cannot disable the FortiSASE protection profile locally. Which FortiClient setting in the FortiSASE configuration profile enforces this?

  1. Configuring a custom FortiClient skin
  2. Locking the profile so users cannot modify protected settings Correct answer.
  3. Setting the update interval to daily
  4. Enabling the FortiClient diagnostic log level

Explanation

FortiSASE configuration profiles can lock settings so endpoint users cannot change or disable protections such as web filtering and tunneling. Log level, skin customization, and update interval affect usability or maintenance, not tamper resistance.

Question 36FortiSASE Deployment and Initial Configuration

An administrator is planning the initial FortiSASE rollout and needs to decide where SSL inspection will occur for branch traffic. Which deployment choice determines whether SSL inspection is performed in the FortiSASE cloud or on the FortiGate?

  1. Whether the tenant uses a shared or dedicated public IP
  2. Whether the branch FortiGate uses DHCP or static addressing
  3. Whether the branch uses FortiSASE cloud-based inspection or FortiGate local inspection in the steering configuration Correct answer.
  4. Whether the endpoint uses IPv4 or IPv6

Explanation

The traffic steering configuration determines whether SSL inspection is offloaded to the FortiSASE cloud or performed locally on the FortiGate before traffic leaves the branch. Addressing method, IP version, and public IP sharing do not select the inspection location.

Question 37FortiSASE Deployment and Initial Configuration

An administrator is troubleshooting a newly registered secure private access node that shows as offline in the FortiSASE portal. Which condition is the most likely cause?

  1. The FortiGate is running a FortiOS version with IPv6 enabled
  2. The FortiGate uses a hostname longer than 32 characters
  3. The FortiGate cannot reach the FortiSASE service over the required outbound ports Correct answer.
  4. The FortiGate has too many firewall policies configured

Explanation

A secure private access node must be able to reach the FortiSASE service on the required outbound ports; blocked egress is the most common reason a registered node appears offline. Policy count, IPv6 enablement, and hostname length do not prevent the node tunnel from coming up.

Question 38FortiSASE Deployment and Initial Configuration

An administrator is comparing endpoint-based and branch-based onboarding for a hybrid workforce during initial FortiSASE design. Which factor most strongly favors endpoint-based onboarding?

  1. The organization wants to avoid installing software on user devices
  2. Users work from unmanaged networks where no branch FortiGate is present Correct answer.
  3. The organization requires all traffic to traverse a single egress point
  4. All users are permanently located behind one data center FortiGate

Explanation

Endpoint-based onboarding installs FortiClient and tunnels traffic from the device, so it works regardless of the network the user is on, including home and public networks without a branch FortiGate. A single data center FortiGate, avoiding endpoint software, and forcing one egress point favor branch-based designs instead.

Question 39FortiSASE Deployment and Initial Configuration

An administrator has completed initial FortiSASE configuration and wants to verify that secure private access works end to end before go-live. Which test provides the strongest evidence?

  1. Pinging the FortiSASE public portal address from the branch FortiGate
  2. Reviewing the FortiGate routing table for a default route
  3. From an enrolled endpoint, resolving and connecting to a published internal application through the FortiSASE tunnel Correct answer.
  4. Confirming that the FortiGate has an active DHCP lease

Explanation

End-to-end validation of secure private access requires an enrolled endpoint to reach a published internal application through the FortiSASE tunnel, proving identity, policy, and application objects all work together. Pinging the portal, checking a DHCP lease, or reviewing the routing table only confirms basic connectivity.

Question 40FortiSASE Deployment and Initial Configuration

An administrator is finalizing the FortiSASE initial configuration and must decide how DNS resolution will work for endpoints using secure internet access. Which approach keeps DNS filtering consistent with FortiSASE web policy?

  1. Disabling DNS on the endpoint and relying on cached entries
  2. Hard-coding internal DNS servers on all remote endpoints
  3. Configuring endpoints to use any public DNS resolver directly
  4. Directing endpoint DNS queries to the FortiSASE DNS service so filtering follows the same policy Correct answer.

Explanation

Sending endpoint DNS queries to the FortiSASE DNS service keeps domain resolution subject to the same category and policy decisions as web traffic. Arbitrary public resolvers, hard-coded internal servers, or disabled DNS bypass tenant filtering and can cause policy mismatches.

Question 41Secure Private Access and SD-WAN Integration

In FortiSASE Secure Private Access, which component is deployed inside the private network to establish tunnels between the private network and the FortiSASE cloud?

  1. FortiGate SSL VPN portal
  2. FortiSASE wireless controller
  3. FortiSASE Secure Private Access Connector Correct answer.
  4. FortiClient EMS

Explanation

The Secure Private Access Connector is the on-premises virtual appliance that terminates IPsec tunnels to the FortiSASE point of presence and provides access to internal resources. FortiClient EMS manages endpoints, and a FortiGate SSL VPN portal is a separate remote-access feature not used for this purpose.

Question 42Secure Private Access and SD-WAN Integration

Which protocol does a Secure Private Access Connector use to build the tunnel toward the FortiSASE point of presence?

  1. BGP over GRE
  2. IPsec Correct answer.
  3. MPLS LDP
  4. VXLAN-GPE

Explanation

Connectors establish IPsec tunnels to FortiSASE, which are then used to carry private application traffic from the cloud to the private network. MPLS LDP, VXLAN-GPE, and BGP over GRE are transport or overlay technologies not used as the connector tunnel type here.

Question 43Secure Private Access and SD-WAN Integration

What is the primary purpose of configuring private application destinations on a Secure Private Access Connector?

  1. To define which internal subnets and hosts the connector is allowed to reach on behalf of remote users Correct answer.
  2. To define which public internet sites remote users may browse
  3. To set the DHCP scope used by the connector management interface
  4. To specify the FortiGuard category filters applied to guest Wi-Fi

Explanation

Private application destinations describe the internal IP subnets, ranges, or hosts that the connector can serve, so FortiSASE knows which traffic to forward through that tunnel. Public browsing policy and DHCP scoping are handled elsewhere and are unrelated to connector destination definitions.

Question 44Secure Private Access and SD-WAN Integration

In FortiSASE, which object binds a set of private application destinations to the connector that serves them?

  1. An SD-WAN service rule referencing a health check
  2. A FortiClient profile referencing a web filter
  3. A private application entry referencing a connector group Correct answer.
  4. A firewall address group referencing a virtual IP

Explanation

Private applications are defined in FortiSASE and associated with a connector or connector group, which determines the tunnel used to reach those destinations. Virtual IPs, FortiClient profiles, and SD-WAN service rules serve different functions and do not perform this binding.

Question 45Secure Private Access and SD-WAN Integration

A connector shows as down in FortiSASE after deployment. Which condition most directly prevents the connector from establishing its tunnel?

  1. The connector hostname contains a hyphen
  2. The connector management interface uses a /24 subnet mask
  3. The connector has two DNS servers configured
  4. Outbound IPsec and IKE traffic is blocked by an upstream firewall Correct answer.

Explanation

The connector must reach the FortiSASE point of presence over the internet using IKE and IPsec, so blocking those protocols upstream prevents tunnel establishment. Subnet mask size, multiple DNS servers, and hostname characters do not by themselves block the tunnel.

Question 46Secure Private Access and SD-WAN Integration

Which FortiSASE capability ensures that traffic to private applications is inspected by the same security profiles applied to internet-bound traffic?

  1. Assigning private destinations to the guest network segment
  2. Disabling TLS inspection for all private destinations
  3. Routing private application traffic through the FortiSASE security stack after tunnel decapsulation Correct answer.
  4. Splitting private traffic directly to the endpoint without inspection

Explanation

FortiSASE decapsulates connector traffic and subjects it to the security profiles in the policy path, giving consistent inspection for private and internet traffic. Bypassing inspection or disabling TLS inspection for all private destinations would remove that protection.

Question 47Secure Private Access and SD-WAN Integration

What role does SD-WAN play when integrated with FortiSASE for branch connectivity?

  1. It encrypts private application traffic using MPLS labels
  2. It replaces the need for any tunnel to FortiSASE
  3. It selects the best available WAN path for traffic destined to FortiSASE based on link health Correct answer.
  4. It assigns public IP addresses to remote endpoints

Explanation

SD-WAN steers traffic toward FortiSASE across the best-performing link using health checks and SLA targets, improving resilience and application experience. It does not eliminate the tunnel, encrypt with MPLS labels, or perform public address assignment.

Question 48Secure Private Access and SD-WAN Integration

Which SD-WAN element determines whether a WAN link meets the latency, jitter, and packet-loss thresholds used for FortiSASE path selection?

  1. DHCP lease timer
  2. SLA health check Correct answer.
  3. Static route priority
  4. Policy route counter

Explanation

SLA health checks probe the links and compare measured latency, jitter, and packet loss against configured thresholds, which SD-WAN rules then use to choose a path. Static route priority, policy route counters, and DHCP timers do not evaluate link quality.

Question 49Secure Private Access and SD-WAN Integration

An administrator wants branch traffic to prefer the broadband link to FortiSASE but fail over to LTE when broadband latency exceeds the SLA. Which configuration achieves this?

  1. An SD-WAN rule with a health-check SLA target and LTE configured as the backup member Correct answer.
  2. A static default route pointing only to the LTE interface
  3. A policy route that always sends FortiSASE traffic to broadband
  4. A DNS forwarder configured with two upstream servers

Explanation

An SD-WAN rule referencing an SLA health check evaluates link performance and moves traffic to the backup member when the primary fails the SLA. A static default route or unconditional policy route cannot react to latency changes, and DNS forwarding does not steer traffic.

Question 50Secure Private Access and SD-WAN Integration

Which statement accurately describes how FortiSASE handles traffic from an SD-WAN branch that is not destined for a private application?

  1. It is routed back to the branch over the same tunnel
  2. It bypasses FortiSASE and uses local breakout only
  3. It is sent to FortiSASE for secure internet access inspection Correct answer.
  4. It is dropped by default at the connector

Explanation

Internet-bound traffic from branch users is forwarded to FortiSASE and inspected by secure internet access controls, while private application traffic is steered through the connector tunnel. The connector does not drop such traffic by default, and the other options misstate the forwarding behavior.