FCSS_SASE_AD-23 Practice Test

FCSS_SASE_AD-23 Practice Test practice questions, page 2 of 2, with answer review and explanations.

Question 6

Refer to the exhibit. A company has a requirement to inspect all the endpoint internet traffic on FortiSASE, and exclude Google Maps traffic from the FortiSASE VPN tunnel and redirect it to the endpoint physical interface. Which configuration must you apply to achieve this requirement?

  1. Exempt the Google Maps FQDN from the endpoint system proxy settings.
  2. Configure a static route with the Google Maps FQDN on the endpoint to redirect traffic
  3. Configure the Google Maps FQDN as a split tunneling destination on the FortiSASE endpoint profile.
  4. Change the default DNS server configuration on FortiSASE to use the endpoint system DNS.

Question 7

Refer to the exhibit. To allow access, which web filter configuration must you change on FortiSASE?

  1. FortiGuard category-based filter
  2. content filter
  3. URL Filter
  4. inline cloud access security broker (CASB) headers

Question 8

Refer to the exhibits. Win10-Pro and Win7-Pro are endpoints from the same remote location. Win10-Pro can access the internet though FortiSASE, while Win7-Pro can no longer access the internet. Given the exhibits, which reason explains the outage on Win7-Pro?

  1. The Win7-Pro device posture has changed.
  2. Win7-Pro cannot reach the FortiSASE SSL VPN gateway
  3. The Win7-Pro FortiClient version does not match the FortiSASE endpoint requirement.
  4. Win-7 Pro has exceeded the total vulnerability detected threshold.

Question 9

Refer to the exhibits. A FortiSASE administrator is trying to configure FortiSASE as a spoke to a FortiGate hub. The tunnel is up to the FortiGate hub. However, the administrator is not able to ping the Webserver hosted behind the FortiGate hub. Based on the output, what is the reason for the ping failures?

  1. The Secure Private Access (SPA) policy needs to allow PING service.
  2. Quick mode selectors are restricting the subnet.
  3. The BGP route is not received.
  4. Network address translation (NAT) is not enabled on the spoke-to-hub policy.

Question 10

An organization wants to block all video and audio application traffic but grant access to videos from CNN. Which application override action must you configure in the Application Control with Inline-CASB?

  1. Allow
  2. Pass
  3. Permit
  4. Exempt