Fortinet FCSS_SASE_AD-25 Exam Questions Instant Access

Question 1

What happens to the logs on FortiSASE that are older than the configured log retention period?

AThe logs are deleted from FortiSASE.

BThe logs are indexed and can be stored in a SQL database.

CThe logs are backed up on FortiCloud.

DThe logs are compressed and archived.

Answer : A

Once the configured log retention period expires, FortiSASE automatically deletes the older logs to free up storage and maintain compliance with retention policies.

Question 2

Which two settings are automatically pushed from FortiSASE to FortiClient in a new FortiSASE deployment with default settings? (Choose two.)

Azero trust network access (ZTNA) tags

Btunnel profile

CFortiSASE certificate authority (CA) certificate

Dreal-time protection

Answer : B, C

In a default FortiSASE deployment, the tunnel profile (for secure connectivity) and the FortiSASE CA certificate (for SSL inspection and trusted communication) are automatically pushed to FortiClient endpoints.

Question 3

When accessing the FortiSASE portal for the first time, an administrator must select data center locations for which three FortiSASE components? (Choose three.)

AIdentity & access management (IAM)

BPoints of presence

CEndpoint management

DLogging

ESandbox

Answer : B, C, D

Question 4

Refer to the exhibits.

A FortiSASE administrator has configured an antivirus profile in the security profile group and applied it to the internet access policy. Remote users are still able to download the eicar.com-zip file from https://eicar.org.

Which configuration on FortiSASE is allowing users to perform the download?

AWeb filter is allowing the URL.

BDeep inspection is not enabled.

CApplication control is exempting all the browser traffic.

DIntrusion prevention is disabled.

Answer : B

The SSL inspection mode is set to certificate inspection, which only inspects SSL/TLS headers and does not allow full scanning of encrypted content. Without full (deep) inspection, the antivirus profile cannot scan or block malicious files (like eicar.com-zip) delivered over HTTPS, allowing the download to proceed.

Question 5

Which two are required to enable central management on FortiSASE? (Choose two.)

AFortiSASE connector configured on FortiManager.

BFortiSASE central management entitlement applied to FortiManager.

CThe FortiManager IP address in the FortiSASE central management configuration.

DFortiManager and FortiSASE registered under the same FortiCloud account.

Answer : B, D

According to the FortiOS Administration Guide, when configuring central management, a FortiManager Cloud entitlement must be present and the devices must share the same FortiCloud account for registration. Specifically:

''The FortiManager Cloud button can only be selected if you have a FortiManager Cloud product entitlement.''

''The FortiGate and FortiCloud license are registered to the same account.''

Thus, the two verified requirements are: B (entitlement) and D (same FortiCloud account).

Question 6

How can digital experience monitoring (DEM) on an endpoint assist in diagnosing connectivity and network issues?

AFortiSASE runs a ping from the endpoint to calculate the TTL to the SaaS application.

BFortiSASE runs SNMP traps to the endpoint using the DEM agent to verify the SaaS application health status.

CFortiSASE runs a netstat from the endpoint to the SaaS application to see if ports are open.

DFortiSASE runs a trace job on the endpoint using the DEM agent to the Software-as-a-Service (SaaS) application.

Answer : D

The Digital Experience Monitoring (DEM) agent on the endpoint performs a trace route to the SaaS application to measure latency, packet loss, and hop-by-hop performance. This helps diagnose where in the path connectivity or performance issues are occurring.

Question 7

A company must provide access to a web server through FortiSASE secure private access for contractors.

What is the recommended method to provide access?

AConfigure a TCP access proxy forwarding rule and push it to the contractor FortiClient endpoint.

BUpdate the DNS records on the endpoint to access private applications.

CPublish the web server URL on a bookmark portal and share it with contractors.

DUpdate the PAC file with the web server URL and share it with contractors.

Answer : C

The bookmark portal is the recommended method for providing contractors access to private web applications through FortiSASE Secure Private Access, as it offers a user-friendly, secure, and controlled access mechanism without requiring full network connectivity.

Fortinet FCSS - FortiSASE 25 Administrator FCSS_SASE_AD-25 Exam Questions