Free and Premium Fortinet NSE7_SSE_AD-25 Dumps Questions Answers

The reason for the ping failures is due to the quick mode selectors restricting the subnet. Quick mode selectors define the IP ranges and protocols that are allowed through the VPN tunnel, and if they are not configured correctly, traffic to certain subnets can be blocked.

Quick Mode Selectors:

Quick mode selectors specify the source and destination subnets that are allowed to communicate through the VPN tunnel.

If the selectors do not include the subnet of the webserver (192.168.10.0/24), then the traffic will be restricted, and the ping will fail.

Diagnostic Output:

The diagnostic output shows the VPN configuration details, but it is important to check the quick mode selectors to ensure that the necessary subnets are included.

If the quick mode selectors are too restrictive, they will prevent traffic to and from the specified subnets.

Configuration Check:

Verify the quick mode selectors on both the FortiSASE and FortiGate hub to ensure they match and include the subnet of the webserver.

Adjust the selectors to allow the necessary subnets for successful communication.

The correct answers are A and B . In the FortiGate ZTNA access proxy workflow, FortiSASE and FortiClient first exchange endpoint information, user login details, security posture, and certificate information. FortiSASE then synchronizes the FortiClient certificate and security posture tags with FortiGate. The study guide states that FortiGate verifies the certificate, performs a user check, and performs a posture check based on the security posture tags before allowing encrypted access to the protected applications. This directly supports option A.

Option B is also correct because the ZTNA access proxy provides a direct path to private resources. The guide describes the ZTNA access proxy use case as a direct connection to applications hosted behind FortiGate, with a TLS-encrypted tunnel automatically created from the endpoint to the access proxy. It further states that this use case offers the direct shortest path to private resources, improving performance and security. That makes it suitable for latency-sensitive applications. Option C is incorrect because this specific FortiGate ZTNA access proxy deployment requires FortiClient on endpoints; agentless ZTNA is handled separately through the FortiSASE agentless ZTNA portal. Option D is not stated as a benefit of this deployment model.

The correct answers are C and D . FortiSASE branch on-ramp is designed for site-based or branch users by creating IPsec connectivity from a branch location to FortiSASE. The study guide states that branches can use on-premises FortiGate or third-party routers, and that supported devices include FortiGate and third-party VPN-capable devices , so option B is false because support is not limited to FortiExtender and FortiAP. The guide further explains that the branch device is configured as the dial-up client and the branch on-ramp location acts as the server; the branch device uses the on-ramp location FQDN as the remote gateway. It also states that FortiSASE supports only IKEv2 for IPsec dial-up tunnels and that IKEv2 supports the network ID feature for establishing multiple tunnels.

Option D is also correct. Fortinet documentation states directly that BGP configuration is shared between Branch On-ramp and Secure Private Access (SPA) and that SPA network configuration must be configured before deploying a Branch On-ramp location. Option A is false because when deep inspection is enabled, FortiSASE requires the FortiSASE CA certificate to be manually installed on endpoints for Branch On-Ramp/site-based users to avoid certificate errors and allow encrypted traffic inspection.

To implement Zero Trust Network Access (ZTNA) where a FortiGate hub enforces device posture and processes traffic directly, specific architectural and configuration steps are required on the FortiGate appliance.

ZTNA Access Proxy (B): The FortiGate must be configured as a ZTNA access proxy . In this role, the FortiGate acts as a secure gateway that mediates connections between remote users and internal applications. This setup ensures that all TCP traffic is intercepted and processed by the FortiGate, providing a direct, shortest-path connection that bypasses the FortiSASE cloud PoPs for the data plane.

ZTNA Servers and Policies (C): Within the FortiGate configuration, administrators must define ZTNA servers (which identify the protected applications or resources) and ZTNA policies . ZTNA policies are the enforcement rules that check for valid client certificates and specific ZTNA tags (synchronized from FortiSASE) before allowing access to a resource. This configuration allows the FortiGate to perform continuous posture checks on every session.

Posture Check Mechanism: While ZTNA tags are used, they are generally synchronized from the FortiSASE Endpoint Management Service (EMS) rather than manually configured on the FortiGate itself. This synchronization ensures the FortiGate has real-time visibility into the security posture (e.g., AV compliance, OS version) of the endpoints as reported by FortiClient.

Analysis of Incorrect Options:

Option A: Creating ZTNA tags manually on a FortiGate is technically possible but is not the recommended " setup " in a FortiSASE deployment, as tags are meant to be dynamically assigned by EMS and synced to the fabric.

Option D: " Private access policies on FortiSASE " refers to the SD-WAN Secure Private Access (SPA) use case. In the SD-WAN SPA model, traffic is steered through the FortiSASE PoP first, whereas the requirement specifically asks for TCP traffic to be processed by the FortiGate using ZTNA.

FortiSASE Geofencing and Regional Compliance allow administrators to control where remote users connect based on their physical location, which is determined by the endpoint ' s public IP address. 3

Default Connection Behavior: By default, FortiSASE uses a " best-effort " geolocation logic to ensure the lowest latency for the user. If an administrator has not configured a specific regional compliance rule for a user ' s country or region, FortiClient will automatically attempt to connect to the closest available FortiSASE security PoP (Point of Presence) based on proximity. 4

Regional Compliance Rules: When an organization must enforce data residency or specific security routing requirements, they create Regional Compliance rules. According to the FortiSASE 25 Feature Administration Guide , these rules allow the administrator to override the default " closest PoP " behavior for specific countries.

Connectivity Options: Within a regional compliance rule, the administrator must specify the destination for the traffic. The system provides a choice between two distinct connection types: a FortiSASE Security PoP or an On-premises device (such as a FortiGate acting as a gateway). 5 The documentation specifies that a rule is designed to point to one of these types at a time to satisfy the compliance requirement for that specific region.

Connection Priority: While multiple connections can be managed in a priority table, the logic for Regional Compliance is focused on directing the user to the designated compliant entry point. Option D is incorrect because the connection order is determined by the Priority and custom fail-over connections table ; an administrator can manually adjust the sequence, so it is not " always " the security PoP first.

The correct answers are C and D . FortiSASE SPA supports two private access models. The first model is ZTNA access proxy , where the endpoint connects directly to the FortiGate ZTNA access proxy. The study guide states that ZTNA provides a direct connection to protected resources without establishing a persistent VPN tunnel and that the ZTNA access proxy use case offers the direct shortest path to private resources. This validates option C and invalidates option B, because ZTNA access proxy traffic does not first traverse a FortiSASE POP.

The second model is SD-WAN private access, where FortiSASE acts as a spoke. The guide explains that FortiSASE SPA enables a FortiSASE POP to connect to a FortiGate hub or an existing Fortinet SD-WAN deployment using IPsec and BGP. In that design, endpoint traffic is steered to the FortiSASE POP, and the POP forwards traffic through the SPA tunnel to the FortiGate hub. That validates option D and makes option A incorrect.

Based on the provided exhibits, the reason why the Win7-Pro endpoint can no longer access the internet through FortiSASE is due to exceeding the total vulnerability detected threshold. This threshold is used to determine if a device is compliant with the security requirements to access the network.

Endpoint Compliance:

FortiSASE monitors endpoint compliance by assessing various security parameters, including the number of vulnerabilities detected on the device.

The compliance status is indicated by the ZTNA tags and the vulnerabilities detected.

Vulnerability Threshold:

The exhibit shows that Win7-Pro has 176 vulnerabilities detected, whereas Win10-Pro has 140 vulnerabilities.

If the endpoint exceeds a predefined vulnerability threshold, it may be restricted from accessing the network to ensure overall network security.

Impact on Network Access:

Since Win7-Pro has exceeded the vulnerability threshold, it is marked as non-compliant and subsequently loses internet access through FortiSASE.

The FortiSASE endpoint profile enforces this compliance check to prevent potentially vulnerable devices from accessing the internet.

The unified FortiClient component of FortiSASE facilitates the always-on security measure required for ensuring that all remote user endpoints are always connected and protected.

Unified FortiClient:

FortiClient is a comprehensive endpoint security solution that integrates with FortiSASE to provide continuous protection for remote user endpoints.

It ensures that endpoints are always connected to the FortiSASE infrastructure, even when users are off the corporate network.

Always-On Security:

The unified FortiClient maintains a persistent connection to FortiSASE, enforcing security policies and protecting endpoints against threats at all times.

This ensures compliance with the cybersecurity policy requiring constant connectivity and protection for remote users.

Zero Trust Network Access (ZTNA) is the FortiSASE feature that ensures least-privileged user access to all applications. ZTNA operates on the principle of " never trust, always verify, " providing secure access based on the identity of users and devices, regardless of their location.

Zero Trust Network Access (ZTNA):

ZTNA ensures that only authenticated and authorized users and devices can access applications.

It applies the principle of least privilege by granting access only to the resources required by the user, minimizing the potential for unauthorized access.

Implementation:

ZTNA continuously verifies user and device trustworthiness and enforces granular access control policies.

This approach enhances security by reducing the attack surface and limiting lateral movement within the network.

The correct answer is B. By hashing log data . This question belongs to Analytics because it deals with FortiSASE log visibility, reporting, and log analysis. The FortiSASE study guide explains that FortiSASE has built-in local logging for monitoring network activity in the portal. It creates traffic logs with user sessions, destinations, protocols, and actions; security logs for detected threats; event logs for system activity; and endpoint management logs for FortiClient events. The guide also explains that FortiSASE can forward logs to FortiAnalyzer, syslog, or CEF servers for longer retention and centralized analytics.

For hiding personally identifiable user information, Fortinet’s FortiSASE documentation calls the feature log anonymization . It states that log anonymization hides user information, such as usernames, in dashboard widgets, logs, and other FortiSASE areas. When anonymization is enabled, FortiSASE uses a username anonymization hash salt ; FortiSASE then generates a hash based on the username and salt value and uses that hash to anonymize log information.

So the mechanism is hashing, not compression, deletion, or tokenization.

To enable remote users to access internal applications located behind an existing FortiGate SD-WAN hub, the customer must license the FortiSASE Secure Private Access (SPA) add-on .

Secure Private Access (SPA) Use Case: This specific add-on is designed to extend the Fortinet Security Fabric into the SASE cloud, allowing for a hub-and-spoke architecture where the FortiSASE PoPs act as spokes and the customer ' s on-premises FortiGate acts as the hub.

Licensing Requirements: The SPA add-on is a per-hub (per service connection) license. It provides the necessary entitlements to establish IPsec tunnels and BGP peering between the SASE infrastructure and the corporate FortiGate.

Feature Enablement: Once the SPA license is applied, the Configuration > Private Access menu becomes available in the FortiSASE portal. This allows administrators to define " Service Connections " to their private data centers or cloud VPCs.

Analysis of Other Options:

Option A: The Global add-on is typically related to expanding the geographic reach or performance of the SASE PoPs, not specifically for private resource routing.

Option B: The Branch On-Ramp refers to connecting physical office locations (Thin Edge) to SASE, rather than the specific licensing for private application access for remote users.

Option D: Dedicated Public IP Address is used for source IP anchoring (SIA) to ensure remote users egress with a consistent IP for third-party SaaS IP-whitelisting.

In recent versions of FortiSASE (starting from version 24.4 and later), the platform has increased its scalability to support larger enterprise environments.

Maximum Hub Support : According to the FortiSASE Mature Administration Guide and the FortiSASE 25.3.148 Feature Release Notes , administrators can now configure a maximum of 12 SPA Service Connections (SPA hubs) . Previously, this limit was restricted to 4 hubs.

Scalability for Large Enterprises : This enhancement allows organizations with complex, geographically dispersed networks—such as those with multiple regional datacenters or cloud hubs—to integrate up to 12 distinct FortiGate SD-WAN hubs into their SASE infrastructure.

Service Connection Licensing : Each SPA hub requires a dedicated FortiGate SPA Service Connection license . In MSSP environments using FortiCloud Organizations, a single FortiSASE instance can inherit these licenses from a root OU, supporting up to the same cumulative maximum of 12 service connections.

Routing and Performance : These 12 hubs form the " Private Access " backbone, where FortiSASE security PoPs act as spokes. The use of BGP (either per-overlay or on loopback) ensures that traffic is dynamically routed to the optimal hub based on the destination network and defined SLA priorities.

In a standard FortiSASE agent-based deployment, the FortiSASE Endpoint Management Service (EMS) acts as the central control plane for all managed FortiClient instances. When an endpoint is onboarded, the system is designed to provide " zero-touch " configuration for the core connectivity and security components.

CA Certificate (A): For SSL deep inspection to function without triggering browser certificate warnings, the endpoint must trust the FortiSASE CA. FortiSASE supports automatically installing the FortiSASE CA certificate for managed agent-based users. Once the endpoint connects to the FortiSASE EMS, the service automatically deploys the CA certificate to the trusted certificate store of the client machine.

Tunnel Profile (B): To enable Secure Internet Access (SIA), FortiClient requires a pre-configured VPN or tunnel profile that points to the FortiSASE cloud infrastructure. In a new deployment with default settings, FortiSASE automatically pushes the tunnel profile (including gateway information and auto-connect settings) to the FortiClient endpoint. This allows the user to establish a full-tunnel connection to the nearest Security PoP immediately after onboarding.

Analysis of Incorrect Options:

Real-time protection (C): While FortiSASE can manage Malware Protection and Sandbox settings, specific " Real-time protection " features often require manual activation or specific configuration within the Malware Protection profile before being pushed; they are not necessarily " automatically " active in the absolute default state without a profile assignment.

ZTNA tags (D): ZTNA tags are dynamic security posture attributes. While FortiSASE evaluates the endpoint to determine which tags apply, the tags themselves are not " pushed " to the client as a setting; rather, the ZTNA connection rules are pushed, and the tags are synchronized back to the security fabric for posture enforcement.

In a FortiSASE environment, the ability of a remote user to establish a VPN tunnel is governed not only by their credentials and firewall policies but also by geographic access controls .

Geofencing Mechanism: FortiSASE includes a Geofencing feature (found under Configuration > Restrictions or Configuration > Geofencing in newer versions) that allows administrators to restrict or allow access to SASE services based on the geographic location of the endpoint ' s public IP address.

Connection Failure vs. SSO Success: The scenario describes a situation where users can successfully authenticate via SSO to reach third-party SaaS apps like Office 365 (O365) or Salesforce (SFDC) but cannot connect to the SASE VPN. This occurs because the SSO authentication is handled directly by the Identity Provider (IdP) (e.g., Microsoft Entra ID), which may not have the same geographic restrictions. However, when the FortiClient attempts to establish the tunnel to the FortiSASE Point of Presence (PoP), the SASE gateway checks the Geofencing list . If the country the user is visiting is on the Deny list (or not on the Allow list), the connection is dropped at the " local-in " policy level on the SASE backend, preventing the tunnel from forming.

Verification and Resolution: To resolve this, the administrator must verify the Geofencing settings and ensure that the countries where the traveling users are located are permitted to connect. If the feature is enabled with a " Deny " list, the specific country must be removed from that list; if it uses an " Allow " list, the country must be added.

Analysis of Other Options:

Option A: Firewall policies govern traffic after the tunnel is established; they cannot resolve a failure to connect the tunnel itself.

Option B: Restarting the device is a general troubleshooting step but will not bypass a server-side geographic block.

Option D: While keeping clients updated is a best practice, the issue described (specific to overseas travel while other functions work) points to a configuration restriction rather than a software bug.

Based on the detailed analysis of the provided exhibits ( image_65feb6.jpg ), the connectivity failure is caused by a mismatch in the Hub firewall policy configuration.

Endpoint Analysis: The Network Diagram shows the FortiClient endpoint has an IP address of 100.65.80.2/20 and currently carries the FortiSASE-Compliant ZTNA tag.

FortiSASE Policy Validation: The Private access policy on FortiSASE shows an " Accept " rule for traffic originating from " FortiSASE-Compliant " sources destined for " All Private Access Traffic " . This confirms the traffic is successfully leaving the FortiSASE PoP.

Routing Validation: The Learned BGP Routes on FortiSASE table shows the prefix 10.160.160.0/24 (the Server subnet) is correctly received via Next Hop 10.11.11.1 . Routing is correctly established.

Hub Firewall Policy Error: Examining the Hub firewall policy (edit 7), the srcaddr is set to " SASE_Remote_Access " . Looking at the address object definition for " SASE_Remote_Access, " it is configured with the subnet 10.11.11.0 255.255.255.0 .

The Conflict: The FortiClient ' s actual IP address ( 100.65.80.2 ) does not fall within the 10.11.11.0/24 range defined in the policy ' s source address. On a FortiGate hub, for traffic to be permitted through the tunnel to the internal server, the firewall policy must include the specific subnet assigned to the remote clients, not just the tunnel interface subnet. Because the FortiClient address range is missing from the hub ' s policy, the traffic is dropped at the hub.

If the daily summary report generated by FortiSASE contains very little data, one possible explanation is that the " Log allowed traffic " setting is configured to log only " Security Events " for all policies. This configuration limits the amount of data logged, as it only includes security events and excludes normal allowed traffic.

Log Allowed Traffic Setting:

The " Log allowed traffic " setting determines which types of traffic are logged.

When set to " Security Events, " only traffic that triggers a security event (such as a threat detection or policy violation) is logged.

Impact on Report Data:

If the log setting excludes regular allowed traffic, the amount of data captured and reported is significantly reduced.

This results in reports with minimal data, as only security-related events are included.

The Digital Experience Monitor (DEM) feature in FortiSASE is a specialized monitoring tool integrated into the SASE cloud to ensure optimal application performance and user satisfaction. 2

Purpose and Visibility : DEM is designed to provide end-to-end network visibility by monitoring the health and performance of the connections between the global FortiSASE security Points of Presence (PoPs) and specific SaaS applications (such as Microsoft 365, WebEx, or Dropbox).

Performance Metrics : It identifies and helps troubleshoot issues related to latency, jitter, and packet loss . By leveraging vantage points within the SASE infrastructure, administrators can determine if a performance bottleneck resides within the local network, the SASE backbone, or the SaaS provider ' s environment.

Integration : This feature is often powered by FortiMonitor , allowing for synthetic transaction monitoring (STM) to simulate user interactions and proactively spot performance issues before they impact the hybrid workforce.

Operational Efficiency : By providing comprehensive insights across users and PoPs, DEM reduces the time required to resolve " slowness " complaints, which are common in remote work scenarios.

Comparison of Other Features:

Option A : While FortiSASE monitors PoP health, DEM ' s primary value is the end-to-end path to the application.

Option B : Compliance checks are a function of Endpoint Profiles and ZTNA tagging rules, not the monitoring dashboard.

Option D : Vulnerability management is handled by the Vulnerability Scan feature within the managed FortiClient settings.

In a FortiSASE deployment, the Secure Private Access (SPA) use case is specifically designed to provide remote users with secure, high-performance connectivity to internal corporate applications hosted in private data centers or public clouds. 5 This is achieved through two primary architectural methods:

SD-WAN Integration (A): FortiSASE integrates natively with existing Fortinet Secure SD-WAN networks. 6 In this architecture, the FortiSASE global PoPs act as spokes that establish automated IPsec tunnels to the organization’s FortiGate SD-WAN hubs. This allows the platform to use intelligent application steering and dynamic routing to find the shortest, most efficient path to private resources, ensuring a superior user experience.

Zero Trust Network Access (ZTNA) (B): FortiSASE provides Universal ZTNA to enforce granular, per-session access control. 7 Unlike traditional VPNs that grant broad network access, ZTNA verifies the user ' s identity and the endpoint ' s security posture (via ZTNA tags) before every application session. This ensures that users only have access to the specific corporate applications they are authorized to use, significantly reducing the attack surface.

Analysis of Other Options: * Thin Edge (C) is a connectivity method used to secure branch offices and micro-branches (typically using FortiExtender), rather than a specific feature for facilitating private corporate application access for individual remote users.

CASB (D) is used for Secure SaaS Access (SSA) to provide visibility and control over third-party cloud applications like Office 365, rather than private applications hosted on-premises.

When providing Secure Private Access (SPA) to external contractors who may not be using managed corporate devices, FortiSASE offers specific methods to ensure security while maintaining ease of use.

Bookmark Portal (Clientless Access): For web-based resources like a web server, the recommended and most efficient method for contractors is to use the ZTNA portal (bookmark portal) . This allows for clientless access , meaning the contractor does not need to install the FortiClient agent or any specific software on their personal machine.

Workflow: The administrator publishes the web server URL as a bookmark within the FortiSASE portal. Contractors simply log into the secure SASE web portal via their browser, authenticate, and click the bookmark to access the internal server.

Security Benefits: This method leverages the FortiSASE ZTNA access proxy to mediate the connection. It ensures that the contractor is authenticated and that the traffic is inspected without exposing the internal network directly to the contractor ' s device.

Analysis of Incorrect Options:

Option A: TCP forwarding rules require the FortiClient agent to be installed and managed on the endpoint. Contractors often use unmanaged devices where installing agents is restricted or undesirable.

Option C: Updating a PAC (Proxy Auto-Configuration) file is part of a Secure Web Gateway (SWG) deployment for internet access, not for routing traffic to private internal web servers via an SPA hub. 1

Option D: Manually updating DNS records on a contractor ' s endpoint is an unscalable, insecure, and administratively heavy task that does not provide the session-level security required by ZTNA.

The exhibit ( image_595357.jpg ) illustrates the Sandbox configuration tab within a FortiSASE Endpoint Profile . This profile dictates how the managed FortiClient agent handles suspicious files and interacts with the sandbox service.

Profile-Based Enforcement: In the FortiSASE architecture, security features are not applied globally by default; they are enabled through specific profiles assigned to endpoints. Therefore, the sandbox inspection and remediation logic will only be active for endpoints that have been assigned a profile where the Sandbox feature is enabled.

Removable Media Protection: Under the File Submission Options in the exhibit, the setting All Files Executed from Removable Media is toggled on. This ensures that any file executed from a USB drive or other external storage is sent to the FortiSandbox for analysis before being permitted to run on the endpoint.

Sandbox Mode: The Sandbox Mode is set to FortiSASE , indicating that files are sent to the integrated cloud-native sandbox rather than an on-premises appliance. This makes Option A incorrect.

Quarantine Threshold: The Remediation Actions show that the Action is set to Quarantine for files meeting the Sandbox Detection Verdict Level of Medium . This acts as a minimum threshold; FortiClient will quarantine files identified as Medium, High, or Malicious. Option B is incorrect because it implies only medium-level files are quarantined, whereas higher-risk levels would also be blocked.

In the context of Zero Trust Network Access (ZTNA) , security posture tagging is the fundamental mechanism used to enforce compliance and security standards before granting access to protected resources.

Granular Access Control: The primary purpose of tagging is to provide granular access control . 3 Instead of relying solely on static credentials, ZTNA uses these dynamic tags to determine if a device or user meets specific security requirements at the moment of the connection request.

Compliance-Based Enforcement: Tags are assigned based on the compliance status of the endpoint. For example, the FortiSASE Endpoint Management Service (EMS) can verify if a device has an active antivirus, is running a specific OS version, or is joined to the corporate domain. 5 If the device fails any of these checks, the " Compliant " tag is removed, and access is automatically revoked.

Dynamic and Continuous Assessment: Unlike traditional VPNs that check posture only at login, ZTNA posture tagging allows for continuous assessment . If a device ' s security posture changes—for instance, if the user disables their firewall—the tag is updated in real-time across the Security Fabric, and the ZTNA policy will immediately deny further access. 8

Integration with Policies: On the FortiGate (acting as a ZTNA proxy) or within FortiSASE, these tags are used as source criteria in ZTNA policies . 9 Only traffic originating from endpoints with the required tags (e.g., " EMS-Tag: Corporate-Managed " ) is permitted to reach the protected application.

When remote users connected to FortiSASE require access to internal resources on Branch-2, the following process occurs:

SD-WAN Capability:

FortiSASE leverages SD-WAN to optimize traffic routing based on performance metrics and priorities.

In the priority settings, HUB-1 is configured with the highest priority (P1), whereas HUB-2 has a lower priority (P2).

Traffic Routing Decision:

FortiSASE evaluates the available hubs (HUB-1 and HUB-2) and selects HUB-1 due to its highest priority setting.

Once the traffic reaches HUB-1, it is then routed to the appropriate branch based on internal routing policies.

Branch-2 Access:

Since HUB-1 has the highest priority, FortiSASE directs the traffic to HUB-1.

HUB-1 then routes the traffic to Branch-2, providing the remote users access to the internal resources.

Based on the settings shown in the provided exhibits, the vulnerability remediation workflow is determined by the Endpoint Profile and the Vulnerability Dashboard .

Endpoint Profile Evaluation: The top exhibit displays the Scan for Vulnerabilities settings. The toggle for Automatically patch vulnerabilities is explicitly set to Disabled . Consequently, the system will not perform automated remediation when a scan completes.

Manual Patching Requirement: The Vulnerability Dashboard (bottom exhibit) lists several application vulnerabilities with a Patching status of Manual patching required . In a FortiSASE environment, " Manual " indicates that the vulnerability cannot be handled by the client ' s autonomous update process and requires a direct instruction from the management plane.

Administrative Intervention: The dashboard includes a Patch endpoints action button. Since auto-patching is disabled in the profile, an administrator must manually select the vulnerabilities and click the " Patch endpoints " button to remotely trigger the patching sequence on the managed endpoints via the FortiSASE cloud service.

Workflow Logic: While FortiClient acts as the " conductor " on the local machine to facilitate the download and installation, the trigger for this specific scenario is the administrator ' s remote action within the portal. This differentiates it from Option D (which is disabled) and Option C (which would involve a user manually browsing a website outside the managed SASE workflow).

In FortiSASE, the accuracy of application usage reports depends on two primary factors: the ability to identify the application (visibility) and the configuration to log that data (reporting).

Deep Inspection Requirement (D): Modern applications frequently use encryption (SSL/TLS) and dynamic ports. Without Deep Inspection (SSL decryption), the FortiSASE security engine cannot see the application payload and is limited to inspecting headers or SNI. This results in many applications being identified only by their generic protocol (e.g., " SSL " or " HTTPS " ) and subsequently appearing as Unknown in reports because the specific Layer 7 application signature cannot be matched.

Application Control Monitor Setting (B): Even when an application is correctly identified, it must be properly logged to appear accurately in the " Daily report for application usage " . In the inline-CASB (Application Control) profile, categories are assigned actions such as " Allow " , " Block " , or " Monitor " . If categories are set to " Allow " instead of Monitor , the traffic is permitted but granular session details—including the specific application category—may not be logged for reporting purposes, causing them to be grouped into an " Unknown " or " Uncategorized " bucket in high-level summaries.

Analysis of Incorrect Options:

Option A: While certificate inspection provides more visibility than no inspection, it is still insufficient for many applications that require deep packet inspection for identification. Therefore, the lack of Deep inspection (Option D) is the more accurate technical explanation for " Unknown " results.

Option C: ZTNA tags are used for access control and posture-based policy enforcement; they do not impact the application identification engine ' s ability to categorize traffic flows.

To resolve internal hostnames using internal DNS servers for remotely connected endpoints, the following two components must be configured on FortiSASE:

Split DNS Rules:

Split DNS allows the configuration of specific DNS queries to be directed to internal DNS servers instead of public DNS servers.

This ensures that internal hostnames are resolved using the organization ' s internal DNS infrastructure, maintaining privacy and accuracy for internal network resources.

Split Tunneling Destinations:

Split tunneling allows specific traffic (such as DNS queries for internal domains) to be routed through the VPN tunnel while other traffic is sent directly to the internet.

By configuring split tunneling destinations, you can ensure that DNS queries for internal hostnames are directed through the VPN to the internal DNS servers.

Based on the provided exhibits and the logic of FortiSASE On/off-net detection , the endpoint ' s behavior is determined by its network environment relative to the configured rules.

Subnet Matching and Detection: The On-net rule set (named " On-Premises " ) is configured to identify a trusted location when the endpoint " Connects from a known local subnet " . The administrator has defined the known subnet as $192.168.13.0/24$ . Since the endpoint ' s IP address is $192.168.13.101$ , it falls within this range. Consequently, FortiClient detects the endpoint as being on-net (on-fabric).

Action Logic (Exemption): In a FortiSASE Endpoint Profile , when On/off-net detection is enabled and an endpoint matches an " On-net " rule, the standard behavior is to exempt the endpoint from auto-connecting to the FortiSASE VPN tunnel. This design assumes the endpoint is already in a secured office environment where the corporate firewall (FortiGate) provides the necessary protection, making the SASE tunnel redundant.

Comparison of Other Options: * Option B: Incorrect, because the IP matches the defined " known local subnet " rule for on-net detection.

Option D: Incorrect, as auto-connect only triggers when the endpoint is detected as off-net to ensure remote security.