The correct answers are C and D . FortiSASE SPA supports two private access models. The first model is ZTNA access proxy , where the endpoint connects directly to the FortiGate ZTNA access proxy. The study guide states that ZTNA provides a direct connection to protected resources without establishing a persistent VPN tunnel and that the ZTNA access proxy use case offers the direct shortest path to private resources. This validates option C and invalidates option B, because ZTNA access proxy traffic does not first traverse a FortiSASE POP.

The second model is SD-WAN private access, where FortiSASE acts as a spoke. The guide explains that FortiSASE SPA enables a FortiSASE POP to connect to a FortiGate hub or an existing Fortinet SD-WAN deployment using IPsec and BGP. In that design, endpoint traffic is steered to the FortiSASE POP, and the POP forwards traffic through the SPA tunnel to the FortiGate hub. That validates option D and makes option A incorrect.

If the daily summary report generated by FortiSASE contains very little data, one possible explanation is that the " Log allowed traffic " setting is configured to log only " Security Events " for all policies. This configuration limits the amount of data logged, as it only includes security events and excludes normal allowed traffic.

Log Allowed Traffic Setting:

The " Log allowed traffic " setting determines which types of traffic are logged.

When set to " Security Events, " only traffic that triggers a security event (such as a threat detection or policy violation) is logged.

Impact on Report Data:

If the log setting excludes regular allowed traffic, the amount of data captured and reported is significantly reduced.

This results in reports with minimal data, as only security-related events are included.

Based on the provided exhibits, the reason why the Win7-Pro endpoint can no longer access the internet through FortiSASE is due to exceeding the total vulnerability detected threshold. This threshold is used to determine if a device is compliant with the security requirements to access the network.

Endpoint Compliance:

FortiSASE monitors endpoint compliance by assessing various security parameters, including the number of vulnerabilities detected on the device.

The compliance status is indicated by the ZTNA tags and the vulnerabilities detected.

Vulnerability Threshold:

The exhibit shows that Win7-Pro has 176 vulnerabilities detected, whereas Win10-Pro has 140 vulnerabilities.

If the endpoint exceeds a predefined vulnerability threshold, it may be restricted from accessing the network to ensure overall network security.

Impact on Network Access:

Since Win7-Pro has exceeded the vulnerability threshold, it is marked as non-compliant and subsequently loses internet access through FortiSASE.

The FortiSASE endpoint profile enforces this compliance check to prevent potentially vulnerable devices from accessing the internet.