I85PREP
⌘ K
FCSS FortiSASE 25 Administrator study materials
FCSS FortiSASE 25 Administrator study resources

FCSS FortiSASE 25 Administrator: Secure Internet Access and Web Filtering

FCSS FortiSASE 25 Administrator · Work through your exam, one topic at a time.

All guide sections

Secure Internet Access and Web Filtering

Domain 3: Secure Internet Access and Web Filtering

This domain tests how client internet traffic is matched to policy at the FortiSASE PoP and how web filtering decisions are made. Expect questions on category actions, URL filters, HTTPS visibility, policy order, and why a block happened in DNS rather than the web filter.

Core rules

  • Internet traffic from the FortiSASE client reaches a PoP and is evaluated top-down by security policy. The first matching policy applies; its web filter profile then makes the URL decision. An implicit deny catches unmatched traffic.
  • A web filter profile combines FortiGuard category actions, URL filter entries, safe-search enforcement, YouTube restrictions, rating overrides, and quotas. Actions include allow, block, monitor, warning, and authenticate.
  • Category and URL filter entries can conflict. Know the profile's evaluation behavior: an explicit URL entry can override a category, and a block in DNS filter can prevent the web filter from ever seeing the request.
  • HTTPS visibility is limited without SSL inspection. Certificate inspection usually exposes the host/SNI; path-level URL filtering and many category decisions need deep inspection.
  • Policy scope matters: source user/group, device, source network, destination, and time. A correct web filter attached to the wrong policy changes nothing.

Worked example

A company wants to block gambling for everyone, allow streaming only for Marketing, and block uncategorized sites. The administrator creates a web filter with gambling=block, streaming=block, uncategorized=block, and a URL filter exception for media.example.com allow. A separate policy for group Marketing uses a profile with streaming=monitor, placed above the general policy. A Finance user tries a gambling site and gets blocked; a Marketing user reaches the streaming site, and the event is logged as monitored.

Reasoning: policy order sends Marketing to the permissive profile first; the general policy blocks the rest. The URL exception is explicit and overrides the category. Monitoring still logs.

Traps

  • Attaching the profile to one policy but not the policy that actually matches.
  • Expecting path filtering when SSL inspection is certificate-only.
  • Forgetting that DNS filtering can block first and produce a different block page.
  • Placing a broad allow policy above a specific block policy.
  • Assuming a browser cache or a previously rated URL reflects the current category.

Key points

  • Security policy is evaluated top-down; the first matching policy and its web filter profile apply.
  • URL filter entries can override FortiGuard category actions in the same profile.
  • Deep SSL inspection is needed for path-level URL filtering and full category visibility.
  • DNS filtering can block before the web filter is consulted.
  • Policy order and correct user/group scope determine whether a web filter is effective.