FCSS-SASE-AD-25 Sample Questions & Answers

HealthForward, a large healthcare provider, is migrating its 10,000 remote clinicians and administrative staff to FortiSASE. Their primary goals are to enforce HIPAA compliance for all internet-bound traffic, prevent data exfiltration of Patient Health Information (PHI), and secure access to both modern SaaS applications (like Office 365) and legacy clinical applications hosted in their on-premises data center. The legacy applications are not web-based and require direct TCP/UDP connectivity.

The CISO has mandated a stringent security posture. All traffic, including to trusted SaaS vendors, must be inspected for threats and data loss. Clinicians often work from untrusted networks, so endpoint compliance is critical; devices must have active antivirus and full-disk encryption. Furthermore, to simplify auditing and interactions with external partners who have IP-based allow-lists, all traffic from the finance department must originate from a single, predictable public IP address, regardless of where the user is located.

The network team has been tasked with implementing a solution that meets all these requirements without significantly impacting user experience, especially for latency-sensitive clinical applications. They must use FortiSASE's native capabilities to achieve this.

Which combination of FortiSASE configurations best addresses all of HealthForward's security and compliance requirements?

An administrator needs to configure FortiSASE logging to meet strict data privacy regulations. The requirements are to retain security event logs for one year, traffic logs for 90 days, and to minimize the storage of personally identifiable information (PII) where possible. Which two actions should the administrator take in the logging settings? (Select TWO)

A FortiSASE administrator is troubleshooting a ZTNA connection issue for a remote user. The user can authenticate successfully, but cannot access the protected application. The administrator wants to view real-time debugging information for the ZTNA application gateway. Which FortiOS CLI command is used for this purpose?

What is the primary architectural benefit of integrating FortiSASE with an existing Fortinet SD-WAN deployment at branch offices?

A company has configured a dedicated IP address in FortiSASE for source IP anchoring. The goal is to ensure that traffic from their European sales team always exits to the internet from a specific IP address when accessing a partner's SaaS platform. After configuration, the sales team reports that their traffic is still egressing from the general shared IP pool. What is the most likely configuration error?

An administrator is creating a custom dashboard in FortiSASE to monitor endpoint compliance over time. Which widget would be most effective for visualizing the percentage of compliant versus non-compliant devices over the last 30 days?

When constructing a FortiSASE deployment for a company with a large number of small, autonomous branch offices that have no on-premises IT staff, which user onboarding method is most scalable and requires the least administrative overhead?

A FortiSASE administrator is designing a security profile to inspect traffic to SaaS applications. The primary goal is to prevent users from uploading sensitive documents containing project codenames to personal cloud storage accounts, while still allowing general use of approved corporate cloud storage. Which security feature is most critical for this policy?

True or False: In a FortiSASE deployment, the AI-driven analytics engine primarily relies on signatures and static rules to identify security threats.

A media company is adopting FortiSASE to provide secure access for its freelance journalists who work globally. The security team wants to define ZTNA access policies based on the journalist's role (e.g., 'Editor', 'Field Reporter') and the security posture of their device. The user role information is managed in their Azure Active Directory. What must the administrator configure to achieve this role-based access control?