Fortinet FCSS_SASE_AD-24 Practice Exams
Last updated on Oct 22,2026- Exam Code: FCSS_SASE_AD-24
- Exam Name: FCSS - FortiSASE 24 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 22,2026
Your organization is currently using FortiSASE for its cybersecurity. They have recently hired a contractor who will work from the HQ office and who needs temporary internet access in order to set up a web-based point of sale (POS) system.
What is the recommended way to provide internet access to the contractor?
- A . Use FortiClient on the endpoint to manage internet access.
- B . Use a proxy auto-configuration (PAC) file and provide secure web gateway (SWG) service as an explicit web proxy.
- C . Use zero trust network access (ZTNA) and tag the client as an unmanaged endpoint.
- D . Configure a VPN policy on FortiSASE to provide access to the internet.
C
Explanation:
The recommended way to provide temporary internet access to the contractor is to use Zero Trust Network Access (ZTNA) and tag the client as an unmanaged endpoint. ZTNA ensures that only authorized users and devices can access specific resources, while treating all endpoints as untrusted by default. By tagging the contractor’s device as an unmanaged endpoint, you can apply strict access controls and ensure that the contractor has limited access to only the necessary resources (e.g., the web-based POS system) without exposing the internal network to unnecessary risks.
Here’s why the other options are less suitable:
What are the benefits of implementing Multi-Factor Authentication (MFA) in FortiSASE deployments? (Select all that apply)
- A . Enhances security by requiring multiple forms of verification
- B . Simplifies the user login process
- C . Reduces the risk of unauthorized access
- D . Allows anonymous access to the network
When deploying FortiSASE agent-based clients, which three features are available compared to an agentless solution? (Choose three.)
- A . Vulnerability scan
- B . SSL inspection
- C . Anti-ransomware protection
- D . Web filter
- E . ZTNA tags
Which command is used to verify the status of compliance checks for user devices in FortiSASE?
- A . diagnose compliance check
- B . get system compliance status
- C . execute compliance verify
- D . diagnose debug compliance
Which settings are essential for securing device compliance in FortiSASE? (Select all that apply)
- A . Enforcing regular software updates
- B . Configuring firewall rules on endpoints
- C . Limiting access based on device type
- D . Allowing guest access to secure resources
Which onboarding methods should be used in FortiSASE for securing user access? (Select all that apply)
- A . Bulk user registration with secure credentials
- B . Individual user invitations
- C . Multi-Factor Authentication (MFA)
- D . Publicly available registration forms
Which VDOM type needs to be configured on the FortiGate Secure Edge to establish a layer 2 network between itself and FortiSASE?
- A . Transparent
- B . Traffic
- C . Admin
- D . LAN-Extension
Refer to the exhibits.
WiMO-Pro and Win7-Pro are endpoints from the same remote location. WiMO-Pro can access the internet though FortiSASE, while Wm7-Pro can no longer access the internet.
Given the exhibits, which reason explains the outage on Wm7-Pro?
- A . The Win7-Pro device posture has changed.
- B . Win7-Pro cannot reach the FortiSASE SSL VPN gateway
- C . The Win7-Pro FortiClient version does not match the FortiSASE endpoint requirement.
- D . Win-7 Pro has exceeded the total vulnerability detected threshold.
D
Explanation:
Based on the provided exhibits, the reason why the Win7-Pro endpoint can no longer access the internet through FortiSASE is due to exceeding the total vulnerability detected threshold. This threshold is used to determine if a device is compliant with the security requirements to access the network.
Endpoint Compliance:
FortiSASE monitors endpoint compliance by assessing various security parameters, including the number of vulnerabilities detected on the device.
The compliance status is indicated by the ZTNA tags and the vulnerabilities detected.
Vulnerability Threshold:
The exhibit shows that Win7-Pro has 176 vulnerabilities detected, whereas Win10-Pro has 140 vulnerabilities.
If the endpoint exceeds a predefined vulnerability threshold, it may be restricted from accessing the network to ensure overall network security.
Impact on Network Access:
Since Win7-Pro has exceeded the vulnerability threshold, it is marked as non-compliant and subsequently loses internet access through FortiSASE.
The FortiSASE endpoint profile enforces this compliance check to prevent potentially vulnerable devices from accessing the internet.
Reference: FortiOS 7.2 Administration Guide: Provides information on endpoint compliance and vulnerability management.
FortiSASE 23.2 Documentation: Explains how vulnerability thresholds are used to determine endpoint compliance and access control.
Which logs are critical for identifying security incidents in FortiSASE?
- A . Debug level logs
- B . Error and event logs
- C . User activity logs
- D . Server room temperature logs
Which feature of Secure Internet Access (SIA) within FortiSASE is critical for protecting users from malicious web content?
- A . Content filtering
- B . Load balancing
- C . Network segmentation
- D . Bandwidth throttling