FCSS_SASE_AD-24 FCSS - FortiSASE 24 Administrator Questions and Answers

TheFortiSASE inline-CASB (Cloud Access Security Broker)component is designed to provide real-time security and visibility by beingplaced directly in the traffic path between the endpoint and cloud applications. Inline-CASB inspects traffic as it flows to and from cloud applications, enablingenforcement of security policies, detection of threats, and prevention of unauthorized access. This approach ensures that all interactions with cloud applications are monitored and controlled in real time.

Here’s why the other options are incorrect:

A. It provides visibility for unmanaged locations and devices:While inline-CASB enhances visibility, its primary function is to inspect and secure traffic in real time. Visibility for unmanaged locations and devices is typically achieved through other components like endpoint agents or API-based CASB.

C. It uses API to connect to the cloud applications:API-based CASB is a different approach that relies on APIs provided by cloud applications to monitor and manage data. Inline-CASB operates directly in the traffic flow rather than using APIs.

D. It detects data at rest:Detecting data at rest is typically handled by Data Loss Prevention (DLP) tools or API-based CASB solutions. Inline-CASB focuses on inspecting traffic in motion, not data stored in cloud applications.

References:

Fortinet FCSS FortiSASE Documentation - Inline-CASB Overview

FortiSASE Administration Guide - Cloud Application Security

Zero-trust tags are critical in implementing zero-trust network access (ZTNA) policies. Here are the two key advantages of using zero-trust tags:

Access Control (Allow or Deny):

Zero-trust tags can be used to define policies that either allow or deny access to specific network resources based on the tag associated with the user or device.

This granular control ensures that only authorized users or devices with the appropriate tags can access sensitive resources, thereby enhancing security.

Determining Security Posture:

Zero-trust tags can be utilized to assess and determine the security posture of an endpoint.

Based on the assigned tags, FortiSASE can evaluate the device's compliance with security policies, such as antivirus status, patch levels, and configuration settings.

Devices that do not meet the required security posture can be restricted from accessing the network or given limited access.

References:

FortiOS 7.2 Administration Guide: Provides detailed information on configuring and using zero-trust tags for access control and security posture assessment.

FortiSASE 23.2 Documentation: Explains how zero-trust tags are implemented and used within the FortiSASE environment for enhancing security and compliance.

In aSingle Sign-On (SSO)deployment on FortiSASE,SSO users can be imported into FortiSASE and added to user groups. This allows administrators to manage SSO users within FortiSASE, enabling them to apply policies, permissions, and group-based access controls. By integrating SSO with FortiSASE, organizations can streamline user authentication and simplify access management while maintaining security.

Here’s why the other options are incorrect:

A. SSO overrides any other previously configured user authentication:This is incorrect because SSO does not automatically override other authentication methods. FortiSASE supports multiple authentication mechanisms, and SSO is just one of them. Administrators can configure fallback authentication methods if needed.

B. SSO identity providers can be integrated using public and private access types:While FortiSASE supports integration with various identity providers (e.g., SAML, LDAP, OAuth), the concept of "public and private access types" is not applicable to SSO configurations.

C. SSO is recommended only for agent-based deployments:This is incorrect because SSO can be used in both agent-based and agentless deployments. It is not limited to environments where agents are installed.

References:

Fortinet FCSS FortiSASE Documentation - Single Sign-On (SSO) Integration

FortiSASE Administration Guide - User Authentication and SSO

================

Zero Trust Network Access (ZTNA) private access use cases focus on providing secure and controlled access to private applications without exposing them to the public internet. The following two statements accurately describe ZTNA private access use cases:

The security posture of the device is secure (Option A):ZTNA enforces strict access controls based on the principle of least privilege. Before granting access to private applications, ZTNA evaluates the security posture of the device (e.g., whether it is patched, compliant, and free of malware). Only devices that meet the required security standards are granted access, ensuring that the device is secure before allowing private access.

All TCP-based applications are supported (Option C):ZTNA supports all TCP-based applications, enabling secure access to a wide range of private applications, including legacy systems and custom-built applications. This flexibility makes ZTNA suitable for organizations with diverse application environments.

Here’s why the other options are incorrect:

B. All FortiSASE user-based deployments are supported:While FortiSASE supports various deployment scenarios, not all user-based deployments are automatically compatible with ZTNA. Specific configurations and requirements must be met to enable ZTNA functionality.

D. Data center redundancy is offered:Data center redundancy is unrelated to ZTNA private access use cases. Redundancy typically pertains to infrastructure design and failover mechanisms, not access control methodologies like ZTNA.

References:

Fortinet FCSS FortiSASE Documentation - ZTNA Private Access Overview

FortiSASE Administration Guide - ZTNA Deployment Best Practices

The issue of an almost empty daily summary report in FortiSASE can often be traced back to how logging is configured within the system. Specifically, if "Log Allowed Traffic" is set to "Security Events" for all policies, it means that only security-related events (such as threats or anomalies) are being logged, while normal, allowed traffic is not being recorded. Since most traffic in a typical network environment is allowed, this configuration would result in very little data being captured and subsequently reported in the daily summary.

Here’s a breakdown of why the other options are less likely to be the cause:

B. There are no security profile groups applied to all policies:While applying security profiles is important for comprehensive protection, their absence does not directly affect the volume of data in reports unless specific logging settings are also misconfigured.

C. The web filter security profile is not set to Monitor:This option pertains specifically to web filtering activities. Even if web filtering is not set to monitor mode, other types of traffic and logs should still populate the report.

D. Digital experience monitoring is not configured:Digital Experience Monitoring (DEM) focuses on user experience metrics rather than general traffic logging. Its absence would not lead to an almost empty report.

To resolve this issue, administrators should review the logging settings across all policies and ensure that "Log Allowed Traffic" is appropriately configured to capture the necessary data for reporting purposes.

References:

Fortinet FCSS FortiSASE Documentation - Reporting and Logging Best Practices

FortiSASE Administration Guide - Configuring Logging Settings

There are two deployment methods used to connect a FortiExtender as a FortiSASE LAN extension:

Connect FortiExtender to FortiSASE using FortiZTP:

FortiZero Touch Provisioning (FortiZTP) simplifies the deployment process by allowing FortiExtender to automatically connect and configure itself with FortiSASE.

This method requires minimal manual configuration, making it efficient for large-scale deployments.

Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server:

Manually configuring the FortiSASE domain name in the FortiExtender GUI allows the extender to discover and connect to the FortiSASE infrastructure.

This static discovery method ensures that FortiExtender can establish a connection with FortiSASE using the provided domain name.

References:

FortiOS 7.2 Administration Guide: Details on FortiExtender deployment methods and configurations.

FortiSASE 23.2 Documentation: Explains how to connect and configure FortiExtender with FortiSASE using FortiZTP and static discovery.

The recommended way to provide temporary internet access to the contractor is to useZero Trust Network Access (ZTNA)and tag the client as anunmanaged endpoint. ZTNA ensures that only authorized users and devices can access specific resources, while treating all endpoints as untrusted by default. By tagging the contractor's device as an unmanaged endpoint, you can apply strict access controls and ensure that the contractor has limited access to only the necessary resources (e.g., the web-based POS system) without exposing the internal network to unnecessary risks.

Here’s why the other options are less suitable:

A. Use FortiClient on the endpoint to manage internet access:While FortiClient provides endpoint security and management, it requires installation and configuration on the contractor's device. This may not be feasible for temporary contractors or unmanaged devices.

B. Use a proxy auto-configuration (PAC) file and provide secure web gateway (SWG) service as an explicit web proxy:While this approach can control web traffic, it does not provide thegranular access control and security posture validation offered by ZTNA. Additionally, managing PAC files can be cumbersome and less secure compared to ZTNA.

D. Configure a VPN policy on FortiSASE to provide access to the internet:Using a VPN policy would grant broader access to the network, which is not ideal for a temporary contractor. It increases the risk of unauthorized access to internal resources and does not align with the principle of least privilege.

References:

Fortinet FCSS FortiSASE Documentation - Zero Trust Network Access (ZTNA) Use Cases

FortiSASE Administration Guide - Managing Unmanaged Endpoints

================

FortiSASE provides several features to ensure secure access for remote workers. The following three ways are particularly relevant:

It secures traffic from endpoints to cloud applications (Option B):FortiSASE secures all traffic between remote endpoints and cloud applications by inspecting it in real time. This includes applying security policies, threat detection, and data protection measures to ensure that traffic is safe and compliant.

It offers zero trust network access (ZTNA) capabilities (Option D):ZTNA ensures that remote workers are granted access to resources based on strict verification of their identity and device posture. By treating all users and devices as untrusted by default, ZTNA minimizes the risk of unauthorized access and lateral movement within the network.

It enforces granular access policies based on user identities (Option E):FortiSASE allows administrators to define and enforce fine-grained access policies based on user identities, roles, and other attributes. This ensures that remote workers only have access to the resources they need, reducing the attack surface.

Here’s why the other options are incorrect:

A. It enforces multi-factor authentication (MFA) to validate remote users:While MFA is a critical security measure, it is typically implemented through identity providers (e.g., FortiAuthenticator or third-party solutions) rather than directly through FortiSASE.

C. It uses the identity & access management (IAM) portal to validate the identities of remote workers:FortiSASE integrates with IAM systems but does not use the IAM portal itself to validate identities. Identity validation is handled through authentication mechanisms like SAML, LDAP, or OAuth.

References:

Fortinet FCSS FortiSASE Documentation - Secure Remote Access

FortiSASE Administration Guide - ZTNA and Access Policies