FCSS_SASE_AD-25 FCSS - FortiSASE 25 Administrator Questions and Answers

The FortiSASE BGP learned routes do not include the 10.160.160.0/24 subnet (server network). Although the FortiGate hub is advertising this route (10.160.160.0/24) to FortiSASE, it is not visible in the FortiSASE BGP route table - indicating a routing issue. Without this route, FortiSASE cannot forward traffic from FortiClient to the server.

Deploying FortiSASE with FortiGate ZTNA access proxy enables efficient access to private applications with reduced latency and supports both agentless and agent-based ZTNA methods for flexible access control.

FortiSASE inline-CASB operates in the traffic path to provide real-time visibility and control over data in motion as it is transmitted to and from cloud applications.

FortiSASE uses ZTNA tags to assess the endpoint’s security posture. If the posture is non-compliant based on predefined rules, FortiSASE enforces network lockdown to restrict access accordingly.

Although the antivirus is installed, it is not running due to the Windows application firewall blocking it. According to the FortiSASE-Non-Compliant rule, antivirus software must be both installed and running. Since this condition fails, FortiClient assigns the FortiSASE-Non-Compliant tag to the endpoint.

FortiSASE hides user information in logs by using hashing, which anonymizes sensitive data such as usernames or IP addresses while still allowing for consistent tracking and analysis.

The “Automatically patch vulnerabilities” option is disabled in the endpoint profile. Additionally, the Vulnerability Dashboard shows the patching status as “Manual patching required.” This means an administrator must manually initiate the patching process remotely using FortiSASE.

Single Sign-On (SSO) overrides any other previously configured user authentication method on FortiSASE, taking precedence for user authentication.

SD-WAN on-ramp with FortiSASE directs branch user internet traffic to the FortiSASE cloud for consistent security enforcement and protection, regardless of the branch location.

Deploying FortiAP enables secure internet access for unmanaged personal devices in small branch offices with minimal configuration by automatically directing traffic through FortiSASE, eliminating the need for endpoint installation or complex setup.

Deploying secure private access with SD-WAN enables the hub FortiGate to perform ZTNA posture checks, and supports both TCP and UDP applications over the tunnel, allowing for flexible and secure access to internal resources.

Application control with inline-CASB allows FortiSASE to inspect and control application behavior at a granular level. This enables the organization to block login attempts to personal or non-corporate Microsoft Office 365 accounts, ensuring that only approved cloud resources are accessed.