NSE5_SSE_AD-7.6 Fortinet NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator Questions and Answers

In the SD-WAN 7.6 Core Administrator curriculum, steering " local-out " traffic (traffic generated by the FortiGate itself, such as DNS queries, FortiGuard updates, or diagnostic pings) requires specific configuration because this traffic follows a different path than " forward " traffic.

Individual Configuration (Option A): By default, local-out traffic bypasses the SD-WAN engine and uses the standard system routing table (RIB/FIB). To use SD-WAN rules for specific features like DNS or RADIUS, you must individually enable the sdwan interface-select-method within that feature ' s configuration (e.g., config system dns or config user radius).

Default Steerable Traffic (Option B): In FortiOS 7.6, while most local-out traffic is excluded from SD-WAN by default, the system is designed so that when SD-WAN is active, it primarily considers SD-WAN rules for specific diagnostic local-out traffic—specifically ping and traceroute—to allow administrators to verify path quality using the same logic as user traffic.

Why other options are incorrect:

Option C: Local-out traffic can be steered using any SD-WAN strategy (Manual, Best Quality, etc.), provided the interface-selection-method is set to sdwan.

The priority/failover connection feature uses the remote user ' s geolocation to determine the preferred location where the VPN connection should terminate. Administrators can build country-based rules that prioritize either an on-premises FortiGate VPN gateway or a FortiSASE security POP. The FortiSASE study guide gives a specific example in which users connecting from Canada first attempt to establish the VPN with an on-premises FortiGate; if that device is unavailable, FortiClient fails over to the configured FortiSASE security POP. FortiSASE_25_Administrator_Stud… This is particularly useful for global organizations that want selected users to continue using regional on-premises infrastructure while retaining cloud-based resiliency. It is not load balancing across every POP, mandatory nearest-POP selection, or simple geolocation blocking. Therefore, option B precisely describes the feature ' s purpose.

" If a flow is identified as belonging to a defined application category (such as social media), FortiGate will match it to the corresponding service rule (rule 2) and route it through the specified interface, such as port2. However, if the application is not recognized during the session setup, the system defaults to load balancing the traffic using the available tunnels according to the policy for unclassified traffic, ensuring continuous connectivity while waiting for application classification. "

This guarantees both performance and resilience.

According to the FortiSASE 7.6 Administration Guide and the FCP - FortiSASE 24/25 Administrator training materials, the security dashboard is a centralized hub for monitoring and remediating security risks across the entire fleet of managed endpoints.

Vulnerability Summary: The dashboard includes a dedicated Vulnerability summary widget that categorizes risks by severity (Critical, High, Medium, Low) and by application type (OS, Web Client, etc.).

Identifying Affected Endpoints: The dashboard is fully interactive; an administrator can drill down into specific vulnerability categories to view a detailed list of CVE data and, most importantly, identify the specific affected endpoints that require attention.

Automatic Patching: FortiSASE supports automatic patching for eligible vulnerabilities (such as common third-party applications and supported OS updates). This feature is configured within the Endpoint Profile, allowing the FortiClient agent to remediate risks without requiring the user to manually run updates.

Why other options are incorrect:

Option A: While it supports automatic patching, it does not do so for all vulnerabilities (only eligible/supported ones), and it specifically does categorize them by severity.

Option B: The dashboard shows vulnerabilities for the Operating System as well as applications, and it allows the administrator to identify affected endpoints rather than requiring the end-user to check.

Option C: The dashboard displays all levels of severity (not just critical) and explicitly allows the viewing of affected endpoints.

According to the FortiSASE 7.6 Administration Guide and the FCP - FortiSASE 24/25 training materials, FortiSASE leverages a cloud-native FortiAnalyzer instance to provide specialized reports. These reports are designed to give administrators visibility into remote user behavior, endpoint health, and cloud application usage.

The three valid and standard report types available directly within the FortiSASE portal are:

Web Usage Summary Report (Option A): This report provides a high-level overview of web activity across the SASE deployment. It categorizes traffic by website categories (e.g., Social Media, Streaming, Malicious Sites), top users by bandwidth, and blocked requests, helping IT teams understand how internet resources are being consumed by remote workers.

Vulnerability Assessment Report (Option C): Since FortiSASE integrates with FortiClient and an embedded EMS, it can aggregate vulnerability scan data from managed endpoints. This report lists software vulnerabilities found on user devices (OS-level and application-level), providing a " Security Rating " or posture assessment that is critical for Zero Trust Network Access (ZTNA) enforcement.

Shadow IT Report (Option D): Leveraging the built-in CASB (Cloud Access Security Broker) capabilities, this report identifies " unsanctioned " or " risky " SaaS applications being used by employees. It helps organizations discover hidden security risks by cataloging cloud applications that have not been explicitly approved by the IT department.

Why other options are incorrect:

Endpoint Compliance Deviation Report (Option B): While FortiSASE performs compliance checks via ZTNA tags, this specific name is not a standard " Report Type " template in the portal; compliance is typically monitored via the Endpoint Management or ZTNA Dashboards.

Cyber Threat Assessment (Option E): The Cyber Threat Assessment Program (CTAP) is a specific Fortinet sales and auditing tool used to generate a one-time report on a network ' s security posture (often used for FortiGate evaluations). It is not a native, recurring report type within the day-to-day FortiSASE administration interface.

According to the FortiSASE 7.6 Feature Administration Guide and the latest updates to the NSE 5 SASE curriculum, FortiSASE has introduced native lifecycle management for FortiClient agents to reduce the operational burden on IT teams who previously relied solely on third-party MDM (Mobile Device Management) or GPO (Group Policy Objects) for every update.

The Endpoint Upgrade feature, found under System > Endpoint Upgrade in the FortiSASE portal, allows administrators to perform the following:

Centralized Version Control: Administrators can see which versions are currently deployed and which " Recommended " versions are available from FortiGuard.

Scheduled Rollouts: You can choose to upgrade all endpoints or specific endpoint groups at a designated time, ensuring that upgrades do not disrupt business operations.

Status Monitoring: The portal provides a real-time dashboard showing the progress of the upgrade (e.g., Downloading, Installing, Reboot Pending, or Success).

Manual vs. Managed: While MDM is still highly recommended for the initial onboarding (the first time FortiClient is installed and connected to the SASE cloud), all subsequent upgrades can be handled natively by the FortiSASE portal.

Why other options are incorrect:

Option B: Manual upgrades are inefficient for large-scale deployments (~400 users in this scenario) and are not the intended " feature-rich " solution provided by FortiSASE.

Option C: " Onboarding " refers to the initial setup. Re-onboarding every time a version changes would be redundant and counterproductive.

Option D: While the system can manage the upgrade, it is not " auto-upgraded on demand " by the client itself without administrative configuration in the portal. The administrator must still define the target version and schedule.

The correct answer is A. Drug Abuse. In the exhibit, the Drug Abuse FortiGuard web-filter category is configured with the Block action. FortiSASE applies the configured action according to the FortiGuard category assigned to the requested website. The FortiSASE Administrator Study Guide explicitly defines Block as an action that denies access to URLs belonging to the configured category and displays a replacement message.

The other displayed categories use different behaviors. Hacking is set to Monitor, which processes traffic similarly to Allow but generates a log entry whenever matching traffic is detected; therefore, the user is not denied access. Illegal or Unethical is configured as Warning, which displays a warning page but permits the user to continue if they choose. Discrimination is configured as Allow, so traffic continues through the remaining inspection engines and is not blocked.

The exhibit therefore directly maps the requested behavior—deny access and display a replacement message—to the Block action, and Drug Abuse is the only listed category configured that way.

Study Guide Reference: Security and Endpoint Profiles > Web Filter With Inline-CASB > FortiGuard Category Filter, page 118.

The correct external server types are Syslog and FortiAnalyzer . FortiSASE retains traffic, security, and event logs for a configurable period, but organizations may require longer retention or centralized analysis. For this reason, FortiSASE supports forwarding logs to external logging infrastructure. The study guide explicitly identifies FortiAnalyzer, Syslog, and CEF servers as supported external log-forwarding destinations and notes that these servers can be reached either through the internet or through a Secure Private Access tunnel. FortiSASE_25_Administrator_Stud… FortiAnalyzer provides Fortinet-native centralized storage, analytics, reporting, and correlation, while a Syslog server provides standards-based external collection. API is not identified here as an external log server type, and SNMP is principally used for monitoring and management telemetry rather than as a FortiSASE log-forwarding repository. Therefore, the required choices are A and C.

================

According to the SD-WAN 7.6 Core Administrator study guide and the FortiOS 7.6 Administration Guide, the selection of a preferred member in a Best Quality (priority) rule is determined by the measured quality metric (latency, in this case) and the link-cost-threshold.

Rule Logic (Best Quality): In the exhibit, the SD-WAN rule is configured with set mode priority, which corresponds to the Best Quality strategy. This strategy ranks members based on the link-cost-factor, which is set to latency.

The Link-Cost-Threshold: The exhibit shows link-cost-threshold(10), which is the default 10% value. This threshold is designed to prevent " link flapping " . To replace the current preferred member, a new member must not only have a better latency but must be better by more than 10%.

The Calculation:

The current preferred member is HUB1-VPN1 with a real latency of 96.349 ms.

To calculate the " target " latency a lower-priority member must achieve to take over, we use the formula: $Target = \frac{Current\_Latency}{(1 + \frac{Threshold}{100})}$.

$\frac{96.349}{1.1} = \mathbf{87.59\text{ ms}}$.

Evaluating Options:

Option A (80 ms): Since 80 ms is lower than the required 87.59 ms target, HUB1-VPN3 successfully overcomes the 10% advantage of HUB1-VPN1 and becomes the new preferred member.

Option D (90 ms): While 90 ms is lower than 96.349 ms, it is not lower than 87.59 ms. Therefore, the 10% threshold prevents a member switch, and HUB1-VPN1 remains preferred.

Option B: Incorrect because having a " lower " latency is not enough due to the 10% threshold.

Option C: If HUB1-VPN1 moved to 200 ms, HUB1-VPN2 (at 141.278 ms) would likely become the new preferred member before HUB1-VPN3 (at 190.984 ms).

The correct answer is D. To implement geolocation rules and source IP address anchoring. The FortiSASE Administrator Study Guide identifies traffic identification and isolation and source IP anchoring as the two principal use cases for dedicated public IP addresses at FortiSASE security POPs. Without dedicated addresses, customers can share the same public egress IP at a POP, which prevents clear isolation of customer traffic.

For source IP anchoring, FortiSASE can ensure that traffic from a particular user, user group, or source country appears to originate from a consistent designated public IP address, independent of the endpoint ' s actual physical location. The study material further explains that source IP anchoring can be combined with geolocation rules to provide more granular assignment of public addresses. Additional dedicated public IP addresses are required for this use case.

A is unrelated because dedicated IPs are not a website acceleration mechanism. B incorrectly characterizes them primarily as logging identifiers. C describes a possible operational benefit of stable addressing but does not identify the FortiSASE feature being tested. D directly corresponds to the documented dedicated-IP/source-IP-anchoring architecture.

Study Guide Reference: User Onboarding and Additional Features > Dedicated IP Address > Source IP Anchoring, pages 65–67.

===============

According to the SD-WAN 7.6 Core Administrator study guide and FortiOS 7.6 Administration Guide, the " implicit rule " is the default rule at the bottom of the SD-WAN rule list (ID 0). It is only evaluated if traffic does not match any manually configured SD-WAN rules.

Policy Route Table Context (Option B): SD-WAN rules are technically a specialized form of policy-based routing. For a packet to match the implicit rule, it must first pass through the routing hierarchy. If traffic matches the implicit rule, it indicates that it did not match any higher-priority user-defined SD-WAN rules or any specific entries in the manual policy route table that would have intercepted the traffic earlier.

Session Information (Option E): When you use the CLI to inspect an active session (e.g., diagnose sys session list), the output contains a field for the SD-WAN Service ID. If traffic is steered by a user-defined rule, it displays the ID of that rule (e.g., service_id=1). However, when traffic falls through to the implicit rule, the session information displays no SD-WAN service ID (it often shows as 0 or is omitted), because the implicit rule does not function as a " service " in the same way user-defined rules do.

Routing Behavior: The implicit rule follows the standard routing table (RIB/FIB) logic. It uses the priority and distance of the static routes to determine the path. If multiple paths have the same distance and priority, it uses the algorithm set by v4-ecmp-mode, but this is a function of the routing engine, not the SD-WAN engine itself.

Why other options are incorrect:

Option A: While v4-ecmp-mode (e.g., source-ip-based) is used for ECMP routing, this is part of the general FortiOS routing behavior for equal-cost paths in the FIB, whereas the implicit rule simply " hands over " the decision to that routing table.

Option C: When traffic matches the implicit rule, the session is actually flagged with vwl_id=0 and potentially dirty if a route change occurs, but vwl_default is not the standard flag name used in this specific context in the curriculum.

Option D: This is incorrect because the implicit rule does respect weight, distance, and priority as defined in the static routes within the routing table; it does not distribute traffic " regardless " of these values.

A and D are correct. Fortinet ' s FortiSASE material identifies two fundamental prerequisites for agentless ZTNA/private application access: an SSO configuration for proxy users and an existing Secure Private Access (SPA) configuration. The Administrator Study Guide states explicitly that agentless support for private applications requires both an SPA configuration and a Secure Web Gateway SSO configuration.

Proxy user SSO (A) provides the identity-verification component. When an agentless user accesses the FortiSASE bookmark portal through a browser, the user must authenticate using SSO. The Enterprise Administrator workflow confirms that authentication occurs through FortiSASE proxy SSO user authentication before authorized application bookmarks are displayed.

SPA (D) provides connectivity from FortiSASE to the protected private applications. After authentication and policy evaluation, the application session is routed through FortiSASE SPA, which functions as the gateway for agentless ZTNA access.

B is incorrect because a FortiGate ZTNA access proxy is not itself a mandatory prerequisite for agentless ZTNA; SPA can be implemented through the supported private-access architecture. C is incorrect by definition: agentless ZTNA is designed for endpoints, including BYOD devices, that do not require FortiClient.

Study Guide Reference: SPA > Agentless ZTNA; Secure Private Access > Private Access for Agentless Users.