Pass Fortinet FCSS_SASE_AD-25 With VCEPrep Exam Dumps – Updated on Jan-2026 [Q28-Q49]

January 13, 2026 admin 0

Categories : FCSS_SASE_AD-25 , Fortinet

Rate this post

Pass Fortinet FCSS_SASE_AD-25 With VCEPrep Exam Dumps – Updated on Jan-2026

Fully Updated FCSS_SASE_AD-25 Dumps – 100% Same Q&A In Your Real Exam

Q28. An organization must block user attempts to log in to non-company resources while using Microsoft Office
365 to prevent users from accessing unapproved cloud resources.
Which FortiSASE feature can you implement to meet this requirement?

application control with inline-CASB

data loss prevention (DLP) with Microsoft Purview Information Protection (MPIP)

web filter with inline-CASB

DNS filter with domain filter

Application control with inline-CASB allows FortiSASE to inspect and control application behavior at a granular level. This enables the organization to block login attempts to personal or non-corporate Microsoft Office 365 accounts, ensuring that only approved cloud resources are accessed.

Q29. When accessing the FortiSASE portal for the first time, an administrator must select data center locations for which three FortiSASE components? (Choose three.)

Identity & access management (IAM)

Points of presence

Endpoint management

Logging

Sandbox

When first accessing the FortiSASE portal, the administrator must select data center locations for endpoint management, logging, and sandbox services to ensure optimized performance and compliance with data residency requirements.

Q30. When you configure FortiSASE Secure Private Access (SPA) with SD-WAN integration, you must establish a routing adjacency between FortiSASE and the FortiGate SD-WAN hub. Which routing protocol must you use?

BGP

IS-IS

OSPF

EIGRP

When configuring FortiSASE Secure Private Access (SPA) with SD-WAN integration, establishing a routing adjacency between FortiSASE and the FortiGate SD-WAN hub requires the use of the Border Gateway Protocol (BGP).
BGP (Border Gateway Protocol):
BGP is widely used for establishing routing adjacencies between different networks, particularly in SD-WAN environments.
It provides scalability and flexibility in managing dynamic routing between FortiSASE and the FortiGate SD-WAN hub.
Routing Adjacency:
BGP enables the exchange of routing information between FortiSASE and the FortiGate SD-WAN hub.
This ensures optimal routing paths and efficient traffic management across the hybrid network.
FortiOS 7.2 Administration Guide: Provides information on configuring BGP for SD-WAN integration.
FortiSASE 23.2 Documentation: Details on setting up routing adjacencies using BGP for Secure Private Access with SD-WAN.

Q31. An organization must block user attempts to log in to non-company resources while using Microsoft Office 365 to prevent users from accessing unapproved cloud resources.
Which FortiSASE feature can you implement to achieve this requirement?

Web Filter with Inline-CASB

SSL deep inspection

Data loss prevention (DLP)

Application Control with Inline-CASB

To block user attempts to log in to non-company resources while using Microsoft Office 365, the Web Filter with Inline-CASB feature in FortiSASE is the most appropriate solution. Inline-CASB (Cloud Access Security Broker) provides real-time visibility and control over cloud application usage. When combined with Web Filtering, it can enforce policies to restrict access to unauthorized or non-company resources within sanctioned applications like Microsoft Office 365. This ensures that users cannot access unapproved cloud resources while still allowing legitimate use of Office 365.
Here’s why the other options are incorrect:
B . SSL deep inspection: While SSL deep inspection is useful for decrypting and inspecting encrypted traffic, it does not specifically address the need to block access to non-company resources within Office 365. It focuses on securing traffic rather than enforcing application-specific policies.
C . Data loss prevention (DLP): DLP is designed to prevent sensitive data from being leaked or exfiltrated. While it is a valuable security feature, it does not directly block access to non-company resources within Office 365.
D . Application Control with Inline-CASB: Application Control focuses on managing access to specific applications rather than enforcing granular policies within an application like Office 365. Web Filter with Inline-CASB is better suited for this use case.
Fortinet FCSS FortiSASE Documentation – Inline-CASB and Web Filtering
FortiSASE Administration Guide – Securing Cloud Applications

Q32. Which FortiOS command is used to verify the health of Zero Trust Network Access (ZTNA) policies in FortiSASE?

diagnose ztna status

get system ztna status

diagnose debug application ztna

get ztna policy-status

Q33. To complete their day-to-day operations, remote users require access to a TCP-based application that is hosted on a private web server. Which FortiSASE deployment use case provides the most efficient and secure method for meeting the remote users’ requirements?

SD-WAN private access

inline-CASB

zero trust network access (ZTNA) private access

next generation firewall (NGFW)

Zero Trust Network Access (ZTNA) private access provides the most efficient and secure method for remote users to access a TCP-based application hosted on a private web server. ZTNA ensures that only authenticated and authorized users can access specific applications based on predefined policies, enhancing security and access control.
Zero Trust Network Access (ZTNA):
ZTNA operates on the principle of “never trust, always verify,” continuously verifying user identity and device security posture before granting access.
It provides secure and granular access to specific applications, ensuring that remote users can securely access the TCP-based application hosted on the private web server.
Secure and Efficient Access:
ZTNA private access allows remote users to connect directly to the application without needing a full VPN tunnel, reducing latency and improving performance.
It ensures that only authorized users can access the application, providing robust security controls.
FortiOS 7.2 Administration Guide: Provides detailed information on ZTNA and its deployment use cases.
FortiSASE 23.2 Documentation: Explains how ZTNA can be used to provide secure access to private applications for remote users.

Q34. Refer to the exhibit.

In the user connection monitor, the FortiSASE administrator notices the user name is showing random characters. Which configuration change must the administrator make to get proper user information?

Turn off log anonymization on FortiSASE.

Add more endpoint licenses on FortiSASE.

Configure the username using FortiSASE naming convention.

Change the deployment type from SWG to VPN.

In the user connection monitor, the random characters shown for the username indicate that log anonymization is enabled. Log anonymization is a feature that hides the actual user information in the logs for privacy and security reasons. To display proper user information, you need to disable log anonymization.
Log Anonymization:
When log anonymization is turned on, the actual usernames are replaced with random characters to protect user privacy.
This feature can be beneficial in certain environments but can cause issues when detailed user monitoring is required.
Disabling Log Anonymization:
Navigate to the FortiSASE settings.
Locate the log settings section.
Disable the log anonymization feature to ensure that actual usernames are displayed in the logs and user connection monitors.
FortiSASE 23.2 Documentation: Provides detailed steps on enabling and disabling log anonymization.
Fortinet Knowledge Base: Explains the impact of log anonymization on user monitoring and logging.

Q35. Which two settings are automatically pushed from FortiSASE to FortiClient in a new FortiSASE deployment with default settings? (Choose two.)

zero trust network access (ZTNA) tags

tunnel profile

FortiSASE certificate authority (CA) certificate

real-time protection

In a default FortiSASE deployment, the tunnel profile (for secure connectivity) and the FortiSASE CA certificate (for SSL inspection and trusted communication) are automatically pushed to FortiClient endpoints.

Q36. Refer to the exhibits.

How will the application vulnerabilities be patched, based on the exhibits provided?

The vulnerability will be patched automatically based on the endpoint profile configuration.

The vulnerability will be patched by installing the patch from the vendor’s website.

The end user will patch the vulnerabilities using the FortiClient software.

An administrator will patch the vulnerability remotely using FortiSASE.

The “Automatically patch vulnerabilities” option is disabled in the endpoint profile. Additionally, the Vulnerability Dashboard shows the patching status as “Manual patching required.” This means an administrator must manually initiate the patching process remotely using FortiSASE.

Q37. Which policy type is used to control traffic between the FortiClient endpoint to FortiSASE for secure internet access?

VPN policy

thin edge policy

private access policy

secure web gateway (SWG) policy

Q38. A customer wants to upgrade their legacy on-premises proxy to a cloud-based proxy for a hybrid network.
Which two FortiSASE features would help the customer achieve this outcome? (Choose two.)

secure web gateway (SWG)

zero trust network access (ZTNA)

sandbox cloud

inline-CASB

The secure web gateway (SWG) serves as the cloud-based proxy that inspects and controls web traffic, replacing the on-premises proxy. The inline-CASB provides additional visibility and control over cloud application usage, enhancing security in hybrid environments.

Q39. Refer to the exhibit.

The daily report for application usage for internet traffic shows an unusually high number of unknown applications by category.
What are two possible explanations for this? (Choose two.)

Certificate inspection is not being used to scan application traffic.

Deep inspection is not being used to scan traffic.

The private access policy must be to set to log Security Events.

The inline-CASB application control profile does not have application categories set to Monitor.

Q40. When viewing the daily summary report generated by FortiSASE, the administrator notices that the report contains very little data.
What is a possible explanation for this almost empty report?

Log allowed traffic is set to Security Events for all policies.

There are no security profile groups applied to all policies.

The web filter security profile is not set to Monitor.

Digital experience monitoring is not configured.

The issue of an almost empty daily summary report in FortiSASE can often be traced back to how logging is configured within the system. Specifically, if “Log Allowed Traffic” is set to “Security Events” for all policies, it means that only security-related events (such as threats or anomalies) are being logged, while normal, allowed traffic is not being recorded. Since most traffic in a typical network environment is allowed, this configuration would result in very little data being captured and subsequently reported in the daily summary.
Here’s a breakdown of why the other options are less likely to be the cause:
B . There are no security profile groups applied to all policies: While applying security profiles is important for comprehensive protection, their absence does not directly affect the volume of data in reports unless specific logging settings are also misconfigured.
C . The web filter security profile is not set to Monitor: This option pertains specifically to web filtering activities. Even if web filtering is not set to monitor mode, other types of traffic and logs should still populate the report.
D . Digital experience monitoring is not configured: Digital Experience Monitoring (DEM) focuses on user experience metrics rather than general traffic logging. Its absence would not lead to an almost empty report.
To resolve this issue, administrators should review the logging settings across all policies and ensure that “Log Allowed Traffic” is appropriately configured to capture the necessary data for reporting purposes.
Fortinet FCSS FortiSASE Documentation – Reporting and Logging Best Practices FortiSASE Administration Guide – Configuring Logging Settings

Q41. Refer to the exhibit.

A customer needs to implement device posture checks for their remote endpoints while accessing the protected server. They also want the TCP traffic between the remote endpoints and the protected servers to be processed by FortiGate.
In this scenario, which two setups will achieve these requirements? (Choose two.)

Configure ZTNA servers and ZTNA policies on FortiGate.

Configure FortiGate as a zero trust network access (ZTNA) access proxy.

Configure ZTNA tags on FortiGate.

Configure private access policies on FortiSASE with ZTNA.

To enforce device posture checks and ensure that TCP traffic flows through FortiGate, the FortiGate must act as a ZTNA access proxy and host the ZTNA servers and policies. This setup allows posture validation via FortiSASE while routing traffic securely to protected servers through FortiGate.

Q42. What information is crucial for generating security reports in FortiSASE?

User browsing history

Peak usage times and potential security breaches

Device serial numbers

Employee attendance records

Q43. Refer to the exhibit.

The daily report for application usage for internet traffic shows an unusually high number of unknown applications by category.
What are two possible explanations for this? (Choose two.)

Certificate inspection is not being used to scan application traffic.

Deep inspection is not being used to scan traffic.

The private access policy must be to set to log Security Events.

The inline-CASB application control profile does not have application categories set to Monitor.

Q44. What key components are involved in Secure Internet Access (SIA) within FortiSASE?
(Select all that apply)

Content filtering

Bandwidth throttling

Web application firewall (WAF)

Malware protection

Q45. What is the benefit of SD-WAN on-ramp deployment with FortiSASE?

To provide access to private applications using the bookmark portal

To provide device compliance checks using ZTNA tags

To secure internet traffic for branch users

To manage branch location endpoints

SD-WAN on-ramp with FortiSASE directs branch user internet traffic to the FortiSASE cloud for consistent security enforcement and protection, regardless of the branch location.

Q46. Which feature should be prioritized when configuring dashboards in FortiSASE for monitoring network traffic?

Real-time traffic flow

Historical bandwidth usage

Comparative analysis of past and present data

User access logs

Q47. An organization needs to resolve internal hostnames using its internal rather than public DNS servers for remotely connected endpoints. Which two components must be configured on FortiSASE to achieve this? (Choose two.)

SSL deep inspection

Split DNS rules

Split tunnelling destinations

DNS filter

To resolve internal hostnames using internal DNS servers for remotely connected endpoints, the following two components must be configured on FortiSASE:
Split DNS Rules:
Split DNS allows the configuration of specific DNS queries to be directed to internal DNS servers instead of public DNS servers.
This ensures that internal hostnames are resolved using the organization’s internal DNS infrastructure, maintaining privacy and accuracy for internal network resources.
Split Tunneling Destinations:
Split tunneling allows specific traffic (such as DNS queries for internal domains) to be routed through the VPN tunnel while other traffic is sent directly to the internet.
By configuring split tunneling destinations, you can ensure that DNS queries for internal hostnames are directed through the VPN to the internal DNS servers.
FortiOS 7.2 Administration Guide: Provides details on configuring split DNS and split tunneling for VPN clients.
FortiSASE 23.2 Documentation: Explains the implementation and configuration of split DNS and split tunneling for securely resolving internal hostnames.

Q48. What can be configured on FortiSASE as an additional layer of security for FortiClient registration?

user verification

application inventory

device identification

security posture tags

Q49. Which of the following describes the FortiSASE inline-CASB component?

It provides visibility for unmanaged locations and devices.

It is placed directly in the traffic path between the endpoint and cloud applications.

It uses API to connect to the cloud applications.

It detects data at rest.

The FortiSASE inline-CASB (Cloud Access Security Broker) component is designed to provide real-time security and visibility by being placed directly in the traffic path between the endpoint and cloud applications . Inline-CASB inspects traffic as it flows to and from cloud applications, enabling enforcement of security policies, detection of threats, and prevention of unauthorized access. This approach ensures that all interactions with cloud applications are monitored and controlled in real time.
Here’s why the other options are incorrect:
A . It provides visibility for unmanaged locations and devices: While inline-CASB enhances visibility, its primary function is to inspect and secure traffic in real time. Visibility for unmanaged locations and devices is typically achieved through other components like endpoint agents or API-based CASB.
C . It uses API to connect to the cloud applications: API-based CASB is a different approach that relies on APIs provided by cloud applications to monitor and manage data. Inline-CASB operates directly in the traffic flow rather than using APIs.
D . It detects data at rest: Detecting data at rest is typically handled by Data Loss Prevention (DLP) tools or API-based CASB solutions. Inline-CASB focuses on inspecting traffic in motion, not data stored in cloud applications.
Fortinet FCSS FortiSASE Documentation – Inline-CASB Overview
FortiSASE Administration Guide – Cloud Application Security

Loading …