FCSS_SASE_AD-24 Practice Questions

To meet the requirements of implementing device posture checks for remote endpoints and ensuring

that TCP traffic between the endpoints and protected servers is processed by FortiGate, the following

three setups are necessary:

Configure ZTNA tags on FortiGate (Option A):

ZTNA (Zero Trust Network Access) tags are used to define access control policies based on the

security posture of devices. By configuring ZTNA tags on FortiGate, administrators can enforce

granular access controls, ensuring that only compliant devices can access protected resources.

Configure FortiGate as a zero trust network access (ZTNA) access proxy (Option B):

FortiGate can act as a ZTNA access proxy, which allows it to mediate and secure connections

between remote endpoints and protected servers. This setup ensures that all TCP traffic passes

through FortiGate, enabling inspection and enforcement of security policies.

Configure ZTNA servers and ZTNA policies on FortiGate (Option C):

To enable ZTNA functionality, administrators must define ZTNA servers (the protected resources) and

create ZTNA policies on FortiGate. These policies determine how traffic is routed, inspected, and

controlled based on device posture and user identity.

Here’s why the other options are incorrect:

D . Configure private access policies on FortiSASE with ZTNA: While FortiSASE supports ZTNA, the

requirement specifies that TCP traffic must be processed by FortiGate. Configuring private access

policies on FortiSASE would route traffic through FortiSASE instead of FortiGate, which does not meet

the stated requirements.

E . Sync ZTNA tags from FortiSASE to FortiGate: Synchronizing ZTNA tags is unnecessary in this

scenario because the focus is on FortiGate processing the traffic. The tags can be directly configured

on FortiGate without involving FortiSASE.

Reference:

Fortinet FCSS FortiSASE Documentation - Zero Trust Network Access (ZTNA) Deployment

FortiGate Administration Guide - ZTNA Configuration

================

When accessing the FortiSASE portal for the first time, an administrator must select data center

locations for the following FortiSASE components:

Endpoint Management:

The data center location for endpoint management ensures that endpoint data and policies are

managed and stored within the chosen geographical region.

Points of Presence (PoPs):

Points of Presence (PoPs) are the locations where FortiSASE services are delivered to users. Selecting

PoP locations ensures optimal performance and connectivity for users based on their geographical

distribution.

Logging:

The data center location for logging determines where log data is stored and managed. This is crucial

for compliance and regulatory requirements, as well as for efficient log analysis and reporting.

Reference:

FortiOS 7.2 Administration Guide: Details on initial setup and configuration steps for FortiSASE.

FortiSASE 23.2 Documentation: Explains the importance of selecting data center locations for various

FortiSASE components.

In the user connection monitor, the random characters shown for the username indicate that log

anonymization is enabled. Log anonymization is a feature that hides the actual user information in

the logs for privacy and security reasons. To display proper user information, you need to disable log

anonymization.

Log Anonymization:

When log anonymization is turned on, the actual usernames are replaced with random characters to

protect user privacy.

This feature can be beneficial in certain environments but can cause issues when detailed user

monitoring is required.

Disabling Log Anonymization:

Navigate to the FortiSASE settings.

Locate the log settings section.

Disable the log anonymization feature to ensure that actual usernames are displayed in the logs and

user connection monitors.

Reference:

FortiSASE 23.2 Documentation: Provides detailed steps on enabling and disabling log anonymization.

Fortinet Knowledge Base: Explains the impact of log anonymization on user monitoring and logging.

FortiSASE provides several features to ensure secure access for remote workers. The following three

ways are particularly relevant:

It secures traffic from endpoints to cloud applications (Option B):

FortiSASE secures all traffic between remote endpoints and cloud applications by inspecting it in real

time. This includes applying security policies, threat detection, and data protection measures to

ensure that traffic is safe and compliant.

It offers zero trust network access (ZTNA) capabilities (Option D):

ZTNA ensures that remote workers are granted access to resources based on strict verification of

their identity and device posture. By treating all users and devices as untrusted by default, ZTNA

minimizes the risk of unauthorized access and lateral movement within the network.

It enforces granular access policies based on user identities (Option E):

FortiSASE allows administrators to define and enforce fine-grained access policies based on user

identities, roles, and other attributes. This ensures that remote workers only have access to the

resources they need, reducing the attack surface.

Here’s why the other options are incorrect:

A . It enforces multi-factor authentication (MFA) to validate remote users: While MFA is a critical

security measure, it is typically implemented through identity providers (e.g., FortiAuthenticator or

third-party solutions) rather than directly through FortiSASE.

C . It uses the identity & access management (IAM) portal to validate the identities of remote

workers: FortiSASE integrates with IAM systems but does not use the IAM portal itself to validate

identities. Identity validation is handled through authentication mechanisms like SAML, LDAP, or

OAuth.

Reference:

Fortinet FCSS FortiSASE Documentation - Secure Remote Access

FortiSASE Administration Guide - ZTNA and Access Policies

Zero-trust tags are critical in implementing zero-trust network access (ZTNA) policies. Here are the

two key advantages of using zero-trust tags:

Access Control (Allow or Deny):

Zero-trust tags can be used to define policies that either allow or deny access to specific network

resources based on the tag associated with the user or device.

This granular control ensures that only authorized users or devices with the appropriate tags can

access sensitive resources, thereby enhancing security.

Determining Security Posture:

Zero-trust tags can be utilized to assess and determine the security posture of an endpoint.

Based on the assigned tags, FortiSASE can evaluate the device's compliance with security policies,

such as antivirus status, patch levels, and configuration settings.

Devices that do not meet the required security posture can be restricted from accessing the network

or given limited access.

Reference:

FortiOS 7.2 Administration Guide: Provides detailed information on configuring and using zero-trust

tags for access control and security posture assessment.

FortiSASE 23.2 Documentation: Explains how zero-trust tags are implemented and used within the

FortiSASE environment for enhancing security and compliance.

The agentless remote user internet access use case is designed to minimize individual endpoint

configuration. In this scenario, FortiSASE provides secure internet access without requiring the

installation of an agent on the endpoint device. This approach is particularly useful for environments

with unmanaged devices or temporary users, as it eliminates the need for complex configurations on

each endpoint. Instead, security policies are enforced at the network level, ensuring consistent

protection without relying on endpoint-specific software.

Here’s why the other options are incorrect:

A . Site-based remote user internet access: This use case involves securing internet access for users

at a specific site or location, typically through a gateway or firewall. While it simplifies configuration

for all users at that site, it does not specifically minimize individual endpoint configuration for remote

users.

C . SIA for SSL VPN remote users: SSL VPN requires users to connect to the corporate network via a

client or browser-based interface. This approach often involves additional configuration on the

endpoint, such as installing and configuring the SSL VPN client.

D. SIA using ZTNA: Zero Trust Network Access (ZTNA) focuses on verifying the identity and posture of

devices before granting access to resources. While ZTNA enhances security, it may require endpoint

agents or posture checks, which involve some level of endpoint configuration.

Reference:

Fortinet FCSS FortiSASE Documentation - Secure Internet Access (SIA) Use Cases

FortiSASE Administration Guide - Agentless Remote User Access

:

:

Zero Trust Network Access (ZTNA) is the FortiSASE feature that ensures least-privileged user access

to all applications. ZTNA operates on the principle of "never trust, always verify," providing secure

access based on the identity of users and devices, regardless of their location.

Zero Trust Network Access (ZTNA):

ZTNA ensures that only authenticated and authorized users and devices can access applications.

It applies the principle of least privilege by granting access only to the resources required by the user,

minimizing the potential for unauthorized access.

Implementation:

ZTNA continuously verifies user and device trustworthiness and enforces granular access control

policies.

This approach enhances security by reducing the attack surface and limiting lateral movement within

the network.

Reference:

FortiOS 7.2 Administration Guide: Provides detailed information on ZTNA and its role in ensuring

least-privileged access.

FortiSASE 23.2 Documentation: Explains the implementation and benefits of ZTNA within the

FortiSASE environment.

To meet the requirement of inspecting all endpoint internet traffic on FortiSASE while excluding

Google Maps traffic from the FortiSASE VPN tunnel and redirecting it to the endpoint's physical

interface, you should configure split tunneling. Split tunneling allows specific traffic to bypass the

VPN tunnel and be routed directly through the endpoint's local interface.

Split Tunneling Configuration:

Split tunneling enables selective traffic to be routed outside the VPN tunnel.

By configuring the Google Maps Fully Qualified Domain Name (FQDN) as a split tunneling

destination, you ensure that traffic to Google Maps bypasses the VPN tunnel and uses the endpoint's

local interface instead.

Implementation Steps:

Access the FortiSASE endpoint profile configuration.

Add the Google Maps FQDN to the split tunneling destinations list.

This configuration directs traffic intended for Google Maps to bypass the VPN tunnel and be routed

directly through the endpoint's physical network interface.

Reference:

FortiOS 7.2 Administration Guide: Provides details on split tunneling configuration.

FortiSASE 23.2 Documentation: Explains how to set up and manage split tunneling for specific

destinations.