I85PREP
⌘ K
Fortinet FCSS SOC study materials
Fortinet FCSS SOC study resources

Fortinet FCSS SOC: Unified SASE: Cloud-Delivered Secure Internet and Private Access

Fortinet FCSS SOC · Work through your exam, one topic at a time.

All guide sections

Unified SASE: Cloud-Delivered Secure Internet and Private Access

What this domain tests

Unified SASE tests how FortiSASE delivers cloud-delivered security using FortiOS-based points of presence: secure internet access, secure private access, ZTNA, CASB, DLP, and firewall-as-a-service. Expect identity-based policy questions that separate internet-bound traffic from private application access and require the FortiClient or SASE agent, endpoint posture, and SAML authentication.

Core rules and concepts

  • FortiSASE combines FWaaS, secure web gateway, ZTNA, CASB, and DLP. Internet-bound traffic is inspected at the nearest point of presence; private applications are reached through a ZTNA application gateway or connector rather than a full-tunnel VPN.
  • Secure Internet Access policies use user or group identity, source, destination, application, and web-filter or CASB profiles. Secure Private Access policies publish internal applications and enforce identity plus device posture.
  • Identity comes from SAML or an identity provider; posture can come from FortiClient EMS tags. A missing or non-compliant endpoint can be denied or limited by policy.
  • The FortiClient or SASE agent steers traffic to FortiSASE. Without the agent and the correct endpoint profile, the user is not on the SASE path.
  • CASB provides SaaS visibility and control through API or inline inspection; DLP inspects content leaving the organization. Neither replaces private-application ZTNA policy.

Worked example

A remote user needs Salesforce and an internal HR portal. Salesforce traffic should use secure internet access with CASB and DLP; the HR portal should use ZTNA. Reasoning: configure a Secure Internet Access policy matching the user group and SaaS application, attach web-filter, CASB, and DLP profiles, and allow the destination. Configure a Secure Private Access or ZTNA policy for the HR application, authenticate the user by SAML, require a compliant posture tag from FortiClient EMS, and route through the application gateway. Do not send HR traffic through the internet-access policy; do not use a full-tunnel VPN when ZTNA satisfies the requirement. The exam distinguishes internet access from private access and tests the identity and posture conditions.

Traps that cost marks

  • Treating SASE as only a remote-access VPN; ZTNA is application-level and policy-driven.
  • Sending private application traffic through the secure internet access path instead of the private access path.
  • Forgetting the FortiClient or SASE agent and EMS posture dependency.
  • Overlapping internet and private policies that match the same application and user group.