Which two components are part of onboarding a secure web gateway (SWG) endpoint? (Choose two)

Onboarding a Secure Web Gateway (SWG) endpoint without an agent involves configuring the device's browser to proxy web traffic through FortiSASE. This requires two key components. First, a proxy auto-configuration (PAC) file is used to direct the browser to the appropriate FortiSASE security point of presence (PoP). Second, the FortiSASE CA certificate must be installed on the endpoint so that the browser trusts the certificate used by FortiSASE for SSL inspection, preventing security warnings for HTTPS sites.

C. FortiSASE invitation code: This code is used exclusively for onboarding agent-based deployments by registering the FortiClient software with the correct FortiSASE instance.

D. FortiClient installer: The FortiClient installer is used for agent-based deployments. The agentless SWG method, by definition, does not involve installing this software.

1. FortiSASE Administration Guide, Version 23.3, "Secure Web Gateway > SWG for remote users > Onboarding SWG users". The procedure for agentless users explicitly lists downloading the PAC file and downloading/installing the FortiSASE root CA certificate as the required steps.

2. FortiSASE Datasheet. The document differentiates between agent-based protection via FortiClient and agentless protection for web traffic, which relies on browser proxy settings (PAC files).