Fortinet FCSS_SASE_AD-24 Practice Exams
Last updated on Oct 21,2026- Exam Code: FCSS_SASE_AD-24
- Exam Name: FCSS - FortiSASE 24 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 21,2026
Which scenario best demonstrates the use of FortiSASE for compliance in a hybrid network?
- A . Isolating network segments
- B . Implementing geo-restrictions on data access
- C . Encrypting all inbound and outbound traffic
- D . Regularly updating firewall rules
Which FortiSASE component can be utilized for endpoint compliance?
- A . Firewall-as-a-Service (FWaaS)
- B . zero trust network access (ZTNA)
- C . cloud access security broker (CASB)
- D . secure web gateway (SWG)
When you configure FortiSASE Secure Private Access (SPA) with SD-WAN integration, you must establish a routing adjacency between FortiSASE and the FortiGate SD-WAN hub.
Which routing protocol must you use?
- A . BGP
- B . IS-IS
- C . OSPF
- D . EIGRP
A
Explanation:
When configuring FortiSASE Secure Private Access (SPA) with SD-WAN integration, establishing a routing adjacency between FortiSASE and the FortiGate SD-WAN hub requires the use of the Border Gateway Protocol (BGP).
BGP (Border Gateway Protocol):
BGP is widely used for establishing routing adjacencies between different networks, particularly in SD-WAN environments.
It provides scalability and flexibility in managing dynamic routing between FortiSASE and the FortiGate SD-WAN hub.
Routing Adjacency:
BGP enables the exchange of routing information between FortiSASE and the FortiGate SD-WAN hub. This ensures optimal routing paths and efficient traffic management across the hybrid network.
Reference: FortiOS 7.2 Administration Guide: Provides information on configuring BGP for SD-WAN integration. FortiSASE 23.2 Documentation: Details on setting up routing adjacencies using BGP for Secure Private Access with SD-WAN.
What role does automation play in the configuration of SASE administration settings?
- A . It eliminates the need for IT personnel
- B . It ensures settings are dynamically adjusted based on network traffic
- C . It reduces the flexibility in applying user policies
- D . It only applies to initial setup procedures
What information can be gleaned from a detailed analysis of login attempts logged by FortiSASE to detect potential security threats?
- A . Patterns indicating brute force attacks
- B . Employee login schedules
- C . Frequency of password resets
- D . Duration of user sessions
Which policy type is used to control traffic between the FortiClient endpoint to FortiSASE for secure internet access?
- A . VPN policy
- B . thin edge policy
- C . private access policy
- D . secure web gateway (SWG) policy
FortiSASE automatically updates compliance rules to adhere to the latest regulations without manual intervention.
- A . True
- B . False
What benefit does FortiSASE’s Secure Internet Access (SIA) offer for compliance with security policies?
- A . Automated updates of all network devices
- B . Centralized management of user sessions
- C . Consistent enforcement of security policies across all users
- D . Increased network speed for remote users
Which FortiSASE component primarily provides secure access to cloud applications?
- A . Secure Web Gateway (SWG)
- B . Cloud Access Security Broker (CASB)
- C . Cloud Access Security Broker (CASB)
- D . Secure SD-WAN
A customer needs to implement device posture checks for their remote endpoints while accessing the protected server. They also want the TCP traffic between the remote endpoints and the protected servers to be processed by FortiGate.
In this scenario, which three setups will achieve the above requirements? (Choose three.)
- A . Configure ZTNA tags on FortiGate.
- B . Configure FortiGate as a zero trust network access (ZTNA) access proxy.
- C . Configure ZTNA servers and ZTNA policies on FortiGate.
- D . Configure private access policies on FortiSASE with ZTNA.
- E . Sync ZTNA tags from FortiSASE to FortiGate.
A, B, C
Explanation:
To meet the requirements of implementing device posture checks for remote endpoints and ensuring that TCP traffic between the endpoints and protected servers is processed by FortiGate, the following three setups are necessary:
Configure ZTNA tags on FortiGate (Option A):
ZTNA (Zero Trust Network Access) tags are used to define access control policies based on the security posture of devices. By configuring ZTNA tags on FortiGate, administrators can enforce granular access controls, ensuring that only compliant devices can access protected resources. Configure FortiGate as a zero trust network access (ZTNA) access proxy (Option B):
FortiGate can act as a ZTNA access proxy, which allows it to mediate and secure connections between remote endpoints and protected servers. This setup ensures that all TCP traffic passes through FortiGate, enabling inspection and enforcement of security policies. Configure ZTNA servers and ZTNA policies on FortiGate (Option C):
To enable ZTNA functionality, administrators must define ZTNA servers (the protected resources) and create ZTNA policies on FortiGate. These policies determine how traffic is routed, inspected, and controlled based on device posture and user identity. Here’s why the other options are incorrect:
D. Configure private access policies on FortiSASE with ZTNA: While FortiSASE supports ZTNA, the requirement specifies that TCP traffic must be processed by FortiGate. Configuring private access policies on FortiSASE would route traffic through FortiSASE instead of FortiGate, which does not meet the stated requirements.
E. Sync ZTNA tags from FortiSASE to FortiGate: Synchronizing ZTNA tags is unnecessary in this scenario because the focus is on FortiGate processing the traffic. The tags can be directly configured on FortiGate without involving FortiSASE.
Reference: Fortinet FCSS FortiSASE Documentation – Zero Trust Network Access (ZTNA) Deployment FortiGate Administration Guide – ZTNA Configuration