FCSS_SASE_AD-24 Free Practice Test

Which of the following describes the FortiSASE inline-CASB component?

1. A. It provides visibility for unmanaged locations and devices.
2. B. It is placed directly in the traffic path between the endpoint and cloud applications.
3. C. It uses API to connect to the cloud applications.
4. D. It detects data at rest.

Correct Answer: B
TheFortiSASE inline-CASB (Cloud Access Security Broker)component is designed to provide real-time security and visibility by beingplaced directly in the traffic path between the endpoint and cloud applications. Inline-CASB inspects traffic as it flows to and from cloud applications, enablingenforcement of security policies, detection of threats, and prevention of unauthorized access. This approach ensures that all interactions with cloud applications are monitored and controlled in real time.
Here??s why the other options are incorrect:
✑ A. It provides visibility for unmanaged locations and devices:While inline-CASB enhances visibility, its primary function is to inspect and secure traffic in real time. Visibility for unmanaged locations and devices is typically achieved through other components like endpoint agents or API-based CASB.
✑ C. It uses API to connect to the cloud applications:API-based CASB is a different approach that relies on APIs provided by cloud applications to monitor and manage data. Inline-CASB operates directly in the traffic flow rather than using APIs.
✑ D. It detects data at rest:Detecting data at rest is typically handled by Data Loss Prevention (DLP) tools or API-based CASB solutions. Inline-CASB focuses on
inspecting traffic in motion, not data stored in cloud applications.
References:
✑ Fortinet FCSS FortiSASE Documentation - Inline-CASB Overview
✑ FortiSASE Administration Guide - Cloud Application Security

Which policy type is used to control traffic between the FortiClient endpoint to FortiSASE for secure internet access?

1. A. VPN policy
2. B. thin edge policy
3. C. private access policy
4. D. secure web gateway (SWG) policy

Correct Answer: A

Your organization is currently using FortiSASE for its cybersecurity. They have recently hired a contractor who will work from the HQ office and who needs temporary internet access in order to set up a web-based point of sale (POS) system.
What is the recommended way to provide internet access to the contractor?

1. A. Use FortiClient on the endpoint to manage internet access.
2. B. Use a proxy auto-configuration (PAC) file and provide secure web gateway (SWG) service as an explicit web proxy.
3. C. Use zero trust network access (ZTNA) and tag the client as an unmanaged endpoint.
4. D. Configure a VPN policy on FortiSASE to provide access to the internet.

Correct Answer: C
The recommended way to provide temporary internet access to the contractor is to useZero Trust Network Access (ZTNA)and tag the client as an unmanaged endpoint. ZTNA ensures that only authorized users and devices can access specific resources, while treating all endpoints as untrusted by default. By tagging the contractor's device as an unmanaged endpoint, you can apply strict access controls and ensure that the contractor has limited access to only the necessary resources (e.g., the web-based POS system) without exposing the internal network to unnecessary risks. Here??s why the other options are less suitable:
✑ A. Use FortiClient on the endpoint to manage internet access:While FortiClient
provides endpoint security and management, it requires installation and configuration on the contractor's device. This may not be feasible for temporary contractors or unmanaged devices.
✑ B. Use a proxy auto-configuration (PAC) file and provide secure web gateway
(SWG) service as an explicit web proxy:While this approach can control web traffic, it does not provide thegranular access control and security posture validation offered by ZTNA. Additionally, managing PAC files can be cumbersome and less secure compared to ZTNA.
✑ D. Configure a VPN policy on FortiSASE to provide access to the internet:Using a
VPN policy would grant broader access to the network, which is not ideal for a temporary contractor. It increases the risk of unauthorized access to internal resources and does not align with the principle of least privilege.
References:
✑ Fortinet FCSS FortiSASE Documentation - Zero Trust Network Access (ZTNA) Use Cases
✑ FortiSASE Administration Guide - Managing Unmanaged Endpoints
================