Free FCSS_SASE_AD-23: FCSS FortiSASE 23 Administrator Exam Questions and Answers

A company onboards 800 laptops with the agent-based method. The administrator must see which laptops are registered and assign zero trust tagging rules to them, without deploying any server in the corporate network. Which FortiSASE component provides this capability?

• AA. FortiClient EMS service integrated in the FortiSASE portal
• BB. FortiAuthenticator appliance in the corporate data center
• CC. FortiManager Cloud instance managed by the administrator
• DD. FortiAnalyzer Cloud instance linked to the FortiSASE tenant

A company wants FortiSASE to block uploads of files that contain credit card numbers. Which security profile should the administrator configure?

• AA. Data loss prevention
• BB. File filter
• CC. Antivirus
• DD. Application control

An administrator wants to identify which users downloaded files that FortiSASE detected as malware. Which log type should the administrator review?

• AA. Web filter logs
• BB. DNS logs
• CC. Application control logs
• DD. Antivirus logs

A FortiSASE tenant is deployed as a spoke to a corporate FortiGate hub for secure private access. The IPsec overlay is up and the BGP session is established. Remote users can reach servers in 10.10.0.0/16 at the data center behind the hub, but connections to 10.20.0.0/16, which sits behind a router attached to the same hub, time out. The FortiSASE routing table lists only 10.10.0.0/16 through the overlay. What is the cause?

• AA. The security profile group on FortiSASE blocks traffic destined to 10.20.0.0/16
• BB. The endpoints lack the zero trust tag required to reach 10.20.0.0/16 servers
• CC. The hub FortiGate does not advertise 10.20.0.0/16 to FortiSASE over BGP
• DD. The IPsec phase 2 selector on FortiSASE excludes the 10.20.0.0/16 subnet

A FortiSASE administrator sets SSL inspection in the security profile group to deep inspection so the antivirus and web filter profiles can scan HTTPS traffic. Managed endpoints running FortiClient now show certificate warnings in the browser on every HTTPS website. The administrator must keep deep inspection enabled. What should the administrator do?

• AA. Install the FortiSASE CA certificate in the trusted root store of the endpoints
• BB. Remove the web filter profile from the security profile group
• CC. Add the endpoint subnets to the SSL inspection exemption list
• DD. Change the inspection mode in the profile group to certificate inspection

An administrator configures a FortiGate as the hub for FortiSASE secure private access. The public IP addresses of the FortiSASE security PoPs are not fixed and cannot be entered in advance. Which hub configuration allows the PoPs to establish the overlay?

• AA. A GRE tunnel over the WAN interface with a static route to each PoP overlay address
• BB. A static IPsec tunnel with the public IP address of each security PoP as remote gateway
• CC. A dialup IPsec tunnel with a BGP neighbor range covering the overlay addresses
• DD. An SSL VPN portal in tunnel mode with a BGP neighbor entry for each security PoP

A FortiSASE administrator must prevent remote users from downloading files with the .exe and .msi extensions from any website, whether or not the files contain malware. Deep inspection is already enabled in the security profile group. Which security profile should the administrator configure?

• AA. An IPS profile with a signature set for executable file transfers
• BB. A web filter profile with a static URL filter entry for each download site
• CC. An antivirus profile with the grayware and heuristic detection options enabled
• DD. A file filter profile with rules that block the executable file types

A company connects FortiSASE to two FortiGate hubs, Hub-A and Hub-B, in different data centers. Both hubs use AS 65000, FortiSASE uses AS 65060, and each hub establishes an IPsec tunnel and an eBGP session with FortiSASE. Both hubs advertise 172.16.0.0/16. Refer to the exhibit. Exhibit: BGP routes learned by FortiSASE Prefix Next Hop AS Path Status 172.16.0.0/16 10.255.1.1 65000 Active (ECMP) 172.16.0.0/16 10.255.2.1 65000 Active (ECMP) The administrator wants Hub-A to be the preferred path and Hub-B to be used only if Hub-A becomes unavailable. Which two statements are true? (Choose two.)

Select 2 answers.

• AA. If Hub-B prepends its AS number to the routes it advertises to FortiSASE, the Hub-A route becomes preferred.
• BB. If the tunnel and BGP session to Hub-A go down, the Hub-A routes are withdrawn and FortiSASE uses the Hub-B routes.
• CC. FortiSASE selects between the hubs using SD-WAN rules with performance SLAs that are defined for each user group.
• DD. Setting a lower local preference in the outbound route map on Hub-B makes FortiSASE prefer the Hub-A route.

A FortiSASE administrator created the compliance rule set Corp-Managed, which assigns the ZTNA tag Compliant only when all criteria in the rule match. A user's laptop is tagged Non-Compliant. Refer to the exhibit. Exhibit: Rule Corp-Managed (Windows) OS: Windows 11 Antivirus: FortiClient real-time protection enabled Registry: HKLM\SOFTWARE\Contoso\Agent, Installed = 1 Running process: edr.exe Endpoint LT-3108 (reported by FortiClient) OS: Windows 11 Pro 23H2 FortiClient real-time protection: enabled Registry HKLM\SOFTWARE\Contoso\Agent, Installed = 1 Running processes: svchost.exe, forticlient.exe, chrome.exe Which criterion causes the endpoint to fail the rule?

• AA. The OS version of the endpoint is not covered by the rule
• BB. The process edr.exe is not running on the endpoint
• CC. FortiClient real-time protection is disabled on the endpoint
• DD. The registry value on the endpoint differs from the value in the rule

A FortiSASE administrator is building zero trust tagging rules to classify endpoints as compliant or noncompliant. Which two endpoint attributes can a tagging rule check? (Choose two.)

Select 2 answers.

• AA. Windows registry key value
• BB. BIOS firmware version of the endpoint
• CC. List of installed browser extensions
• DD. Operating system version