Free FCSS_SASE_AD-24: FCSS - FortiSASE 24 Administrator Exam Questions and Answers

A company has a FortiGate SD-WAN hub at its headquarters that hosts private web applications. Remote employees run FortiClient connected to FortiSASE. Employees must reach the HQ applications, and internet traffic must be inspected in the cloud so that the HQ internet link is not saturated. Which design meets the requirements?

• AA. Apply secure internet access on FortiSASE for all endpoints and publish the HQ applications on public IP addresses with virtual IPs on the hub
• BB. Use ZTNA tagging on FortiClient only and connect the endpoints directly to the hub through SSL VPN for both traffic types
• CC. Connect FortiSASE to the hub over IPsec with BGP and send all endpoint traffic, including internet traffic, through the hub for inspection
• DD. Use secure internet access on FortiSASE for internet traffic and secure private access over IPsec to the hub, with BGP exchanging routes

A company requires that only Windows endpoints with its EDR agent actively running can reach private applications through FortiSASE. The agent is not registered as antivirus software. Which zero trust tagging rule should the administrator create?

• AA. A rule with the Logged in Domain type that matches the company domain name
• BB. A rule with the Registry Key type that matches the agent's service key
• CC. A rule with the File type that matches the agent's installation path
• DD. A rule with the Running Process type that matches the agent's executable name

A FortiSASE administrator created a FortiCloud IAM user for a security analyst who must review FortiSASE logs but must not change any policies. The analyst can sign in to FortiCloud, but FortiSASE does not appear among the portals available to the account. Which action resolves the issue?

• AA. Enable SAML single sign-on on the FortiSASE tenant and map the analyst's group to a read-only role
• BB. Add the analyst's source IP address to the trusted hosts list of the FortiSASE tenant
• CC. Add the analyst's email address as an authorized user in the FortiClient EMS Cloud instance
• DD. Assign the IAM user a permission profile that grants read-only access to the FortiSASE portal

In a FortiSASE deployment, which component receives telemetry from registered FortiClient endpoints and applies ZTNA tags to them based on tagging rules?

• AA. FortiGuard distribution service used by the security POP
• BB. Firewall engine of the nearest security POP
• CC. FortiAnalyzer instance that stores the tenant logs
• DD. FortiClient EMS integrated with the FortiSASE tenant

A company wants all internet traffic from its managed roaming laptops inspected by FortiSASE, whether the users are at home or in a hotel. Which two actions are required to deploy this secure internet access (SIA) use case? (Choose two.)

Select 2 answers.

• AA. Create an internet access policy on FortiSASE that applies security profiles to the laptops' traffic
• BB. Install an on-premises FortiClient EMS server and import its certificate into FortiSASE
• CC. Configure BGP peering between FortiSASE and the headquarters FortiGate
• DD. Install FortiClient on each laptop and register it to the FortiSASE tenant

Refer to the exhibit. A FortiSASE security POP is connected as a spoke to the headquarters FortiGate hub over an IPsec overlay. Remote users can send requests to the server at 10.10.20.15, but no replies return. The endpoint address range assigned by FortiSASE is 10.212.134.0/23. HQ-HUB # get router info routing-table bgp B 10.50.0.0/16 [200/0] via 172.16.1.2, branch1-ovl B 10.60.0.0/16 [200/0] via 172.16.1.3, branch2-ovl What should the administrator do to fix the problem?

• AA. Limit the phase 2 selectors on the hub overlay tunnel to the 10.10.20.0/24 server subnet
• BB. Configure a BGP neighbor on the hub for the FortiSASE overlay address so that the hub learns the endpoint range
• CC. Enable ADVPN on the hub so that the branch FortiGates forward the endpoint range to the server
• DD. Add a static route for 10.212.134.0/23 on the hub that uses the WAN interface as the outgoing interface

Which condition can a ZTNA tagging rule evaluate on a Windows endpoint registered to FortiSASE?

• AA. A specific process running on the endpoint
• BB. A specific USB device attached to the endpoint
• CC. A specific TCP port open on the endpoint
• DD. A specific browser extension installed on the endpoint

An administrator edits the VPN profile in the FortiSASE portal to add a split tunnel exclusion for a video conferencing service. Which FortiSASE component delivers this change to the FortiClient installed on the endpoints?

• AA. The cloud-hosted FortiClient EMS that FortiSASE uses to manage registered endpoints
• BB. The FortiAnalyzer instance that stores the logs and reports of the registered endpoint
• CC. The FortiGuard distribution network that supplies signature updates to the endpoint
• DD. The security POP FortiGate that inspects the internet traffic of the connected user

An administrator reviews the FortiSASE logs and finds entries only for blocked traffic and security events. There are no entries for allowed sessions that match the internet access policy named Allow-SaaS. What should the administrator change?

• AA. Enable log forwarding to a FortiAnalyzer in the logging settings
• BB. Set Log Allowed Traffic to All Sessions in the Allow-SaaS policy
• CC. Extend the log retention period in the FortiSASE logging settings
• DD. Add a Sessions widget to the FortiSASE dashboard

A retailer has 12 stores. Each store has a FortiGate and a LAN of point-of-sale terminals and printers that cannot be modified or enrolled in any endpoint management system. The security team wants all internet-bound store traffic inspected by FortiSASE without changing the terminals or the store LAN design. Which two actions meet these requirements? (Choose two.)

Select 2 answers.

• AA. Enroll every terminal in FortiClient EMS and assign ZTNA tags for store devices
• BB. Push a PAC file to the browser on every terminal by using a group policy
• CC. Configure an IPsec tunnel from each store FortiGate to a FortiSASE security POP
• DD. Add an SD-WAN rule or policy route on each store FortiGate that sends internet-bound traffic into the tunnel