Fortinet FCSS_SASE_AD-24 Practice Exams
Last updated on Oct 21,2026- Exam Code: FCSS_SASE_AD-24
- Exam Name: FCSS - FortiSASE 24 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 21,2026
Question #41
Which two additional components does FortiSASE use for application control to act as an inline-CASB? (Choose two.)
- A . intrusion prevention system (IPS)
- B . SSL deep inspection
- C . DNS filter
- D . Web filter with inline-CASB
Correct Answer: AB
Question #42
Refer to the exhibit.
A company has a requirement to inspect all the endpoint internet traffic on FortiSASE, and exclude Google Maps traffic from the FortiSASE VPN tunnel and redirect it to the endpoint physical Interface.
Which configuration must you apply to achieve this requirement?
- A . Exempt the Google Maps FQDN from the endpoint system proxy settings.
- B . Configure a static route with the Google Maps FQDN on the endpoint to redirect traffic
- C . Configure the Google Maps FQDN as a split tunneling destination on the FortiSASE endpoint profile.
- D . Change the default DNS server configuration on FortiSASE to use the endpoint system DNS.
Correct Answer: C
C
Explanation:
To meet the requirement of inspecting all endpoint internet traffic on FortiSASE while excluding Google Maps traffic from the FortiSASE VPN tunnel and redirecting it to the endpoint’s physical interface, you should configure split tunneling. Split tunneling allows specific traffic to bypass the VPN tunnel and be routed directly through the endpoint’s local interface.
Split Tunneling Configuration:
Split tunneling enables selective traffic to be routed outside the VPN tunnel.
By configuring the Google Maps Fully Qualified Domain Name (FQDN) as a split tunneling
destination, you ensure that traffic to Google Maps bypasses the VPN tunnel and uses the endpoint’s
local interface instead.
Implementation Steps:
Access the FortiSASE endpoint profile configuration.
Add the Google Maps FQDN to the split tunneling destinations list.
This configuration directs traffic intended for Google Maps to bypass the VPN tunnel and be routed directly through the endpoint’s physical network interface.
Reference: FortiOS 7.2 Administration Guide: Provides details on split tunneling configuration.
FortiSASE 23.2 Documentation: Explains how to set up and manage split tunneling for specific destinations.
C
Explanation:
To meet the requirement of inspecting all endpoint internet traffic on FortiSASE while excluding Google Maps traffic from the FortiSASE VPN tunnel and redirecting it to the endpoint’s physical interface, you should configure split tunneling. Split tunneling allows specific traffic to bypass the VPN tunnel and be routed directly through the endpoint’s local interface.
Split Tunneling Configuration:
Split tunneling enables selective traffic to be routed outside the VPN tunnel.
By configuring the Google Maps Fully Qualified Domain Name (FQDN) as a split tunneling
destination, you ensure that traffic to Google Maps bypasses the VPN tunnel and uses the endpoint’s
local interface instead.
Implementation Steps:
Access the FortiSASE endpoint profile configuration.
Add the Google Maps FQDN to the split tunneling destinations list.
This configuration directs traffic intended for Google Maps to bypass the VPN tunnel and be routed directly through the endpoint’s physical network interface.
Reference: FortiOS 7.2 Administration Guide: Provides details on split tunneling configuration.
FortiSASE 23.2 Documentation: Explains how to set up and manage split tunneling for specific destinations.
Question #43
What is the primary purpose of configuring SASE administration settings for geographic restrictions?
- A . To enhance data localization compliance
- B . To increase the bandwidth available to local users
- C . To increase the bandwidth available to local users
- D . To promote faster local network setup
Correct Answer: A
Question #44
What is the primary function of FortiSASE when deployed in a hybrid network?
- A . To provide VPN services only
- B . To enforce consistent security policies across network environments
- C . To manage internal databases
- D . To boost network speed
Correct Answer: B
Question #45
What are the key benefits of deploying FortiSASE in a hybrid network? (Select all that apply)
- A . Consistent security policy enforcement
- B . Simplified network management
- C . Enhanced physical security of network devices
- D . Reduced need for VPN connections
Correct Answer: ABD
Question #46
How does integrating endpoint detection and response (EDR) systems into SASE contribute to security posture?
- A . It isolates the network from the internet
- B . It provides real-time threat detection and response at endpoints
- C . It serves as the primary firewall
- D . It enhances user interface designs
Correct Answer: B
Question #47
Refer to the exhibit.
The daily report for application usage shows an unusually high number of unknown applications by category.
What are two possible explanations for this? (Choose two.)
- A . Certificate inspection is not being used to scan application traffic.
- B . The inline-CASB application control profile does not have application categories set to Monitor
- C . Zero trust network access (ZTNA) tags are not being used to tag the correct users.
- D . Deep inspection is not being used to scan traffic.
Correct Answer: B, D
Question #48
Which two statements describe a zero trust network access (ZTNA) private access use case? (Choose two.)
- A . The security posture of the device is secure.
- B . All FortiSASE user-based deployments are supported.
- C . All TCP-based applications are supported.
- D . Data center redundancy is offered.
Correct Answer: A, C
A, C
Explanation:
Zero Trust Network Access (ZTNA) private access use cases focus on providing secure and controlled access to private applications without exposing them to the public internet. The following two statements accurately describe ZTNA private access use cases:
The security posture of the device is secure (Option A):
ZTNA enforces strict access controls based on the principle of least privilege. Before granting access to private applications, ZTNA evaluates the security posture of the device (e.g., whether it is patched, compliant, and free of malware). Only devices that meet the required security standards are granted access, ensuring that the device is secure before allowing private access.
All TCP-based applications are supported (Option C):
ZTNA supports all TCP-based applications, enabling secure access to a wide range of private applications, including legacy systems and custom-built applications. This flexibility makes ZTNA suitable for organizations with diverse application environments. Here’s why the other options are incorrect:
B. All FortiSASE user-based deployments are supported: While FortiSASE supports various deployment scenarios, not all user-based deployments are automatically compatible with ZTNA. Specific configurations and requirements must be met to enable ZTNA functionality.
D. Data center redundancy is offered: Data center redundancy is unrelated to ZTNA private access use cases. Redundancy typically pertains to infrastructure design and failover mechanisms, not access control methodologies like ZTNA.
Reference: Fortinet FCSS FortiSASE Documentation – ZTNA Private Access Overview FortiSASE Administration Guide – ZTNA Deployment Best Practices
A, C
Explanation:
Zero Trust Network Access (ZTNA) private access use cases focus on providing secure and controlled access to private applications without exposing them to the public internet. The following two statements accurately describe ZTNA private access use cases:
The security posture of the device is secure (Option A):
ZTNA enforces strict access controls based on the principle of least privilege. Before granting access to private applications, ZTNA evaluates the security posture of the device (e.g., whether it is patched, compliant, and free of malware). Only devices that meet the required security standards are granted access, ensuring that the device is secure before allowing private access.
All TCP-based applications are supported (Option C):
ZTNA supports all TCP-based applications, enabling secure access to a wide range of private applications, including legacy systems and custom-built applications. This flexibility makes ZTNA suitable for organizations with diverse application environments. Here’s why the other options are incorrect:
B. All FortiSASE user-based deployments are supported: While FortiSASE supports various deployment scenarios, not all user-based deployments are automatically compatible with ZTNA. Specific configurations and requirements must be met to enable ZTNA functionality.
D. Data center redundancy is offered: Data center redundancy is unrelated to ZTNA private access use cases. Redundancy typically pertains to infrastructure design and failover mechanisms, not access control methodologies like ZTNA.
Reference: Fortinet FCSS FortiSASE Documentation – ZTNA Private Access Overview FortiSASE Administration Guide – ZTNA Deployment Best Practices
Question #49
What is a common strategy for onboarding users in a SASE environment that ensures secure identity verification?
- A . Shared password systems
- B . Manual entry of user credentials by administrators
- C . Multi-factor authentication (MFA)
- D . Anonymous access
Correct Answer: C
Question #50
When configuring logging settings in FortiSASE, what is essential to capture for effective security analysis?
- A . Debug level logs for everyday operations
- B . Error and event logs related to security incidents
- C . Continuous video logs of server rooms
- D . Logs of all printed documents
Correct Answer: B