I85PREP
⌘ K
FCSS FortiSASE 25 Administrator study materials
FCSS FortiSASE 25 Administrator study resources

FCSS FortiSASE 25 Administrator: Client and Endpoint Management (FortiClient, FortiSASE Client, ZTNA)

FCSS FortiSASE 25 Administrator · Work through your exam, one topic at a time.

All guide sections

Client and Endpoint Management (FortiClient, FortiSASE Client, ZTNA)

Domain 5: Client and Endpoint Management (FortiClient, FortiSASE Client, ZTNA)

This domain tests endpoint onboarding and identity-aware access. You need to know how the FortiSASE client registers, how profiles control connection behavior, how posture becomes a ZTNA tag, and how that tag is used in access rules.

Core rules

  • The FortiSASE client is installed on the endpoint and registered with an activation code or invitation. Registration binds the device to the tenant; a stale or duplicate registration consumes license and confuses troubleshooting.
  • A client profile controls auto-connect, always-on behavior, PoP selection (automatic nearest or manual), split tunneling, and update settings. The profile must be assigned to the right user/group or device.
  • Posture checks evaluate endpoint state such as antivirus, firewall, disk encryption, and OS version. Compliance results can generate ZTNA tags. A tag only matters if an access rule references it.
  • ZTNA combines user identity and device identity. A rule can require group membership plus a compliant tag before allowing a private application. On-net versus off-net conditions can change which rule applies.
  • EMS integration can manage profiles, deploy the client, and collect telemetry; FortiSASE remains the policy enforcement point for SASE access.
  • Keep client versions within the supported matrix. A client that is too old may connect but fail posture or miss features.

Worked example

Sales laptops must reach a private order-entry app only if the device is encrypted and antivirus is running. The administrator creates a posture check for disk encryption and antivirus, assigns the client profile to SASE-Sales, and creates a ZTNA rule requiring group SASE-Sales plus tag compliant-sales for the app. A compliant laptop registers, receives the tag, and connects. A laptop with antivirus disabled registers but does not receive the tag, so the ZTNA rule denies it.

Reasoning: registration gets the device into the tenant; the profile controls behavior; posture produces the tag; the rule enforces both identities.

Traps

  • Assuming a posture check blocks traffic by itself; it only matters when a rule uses the resulting tag.
  • Letting activation codes expire or reusing them across many devices.
  • Forgetting split-tunnel settings that send private traffic outside the tunnel.
  • Not accounting for captive portals when always-on is enabled.
  • Leaving duplicate or stale device registrations that consume licenses.

Key points

  • Client registration binds a device to FortiSASE; stale or duplicate devices consume licenses.
  • The client profile controls auto-connect, always-on, PoP selection, and split tunneling.
  • Posture checks produce ZTNA tags, but tags only matter if an access rule references them.
  • ZTNA rules can require both user group membership and device compliance.
  • Keep client versions supported and clean up old registrations.