The network topology explicitly shows an ADVPN (Auto-Discovery VPN) setup where FortiSASE functions as a spoke. When a remote user accesses a resource on Branch-2 (another spoke), the initial traffic is routed to HUB-2 based on the configured static route. Upon receiving this spoke-to-spoke traffic, HUB-2, as the ADVPN hub, facilitates the creation of a dynamic, on-demand "shortcut" tunnel directly between the FortiSASE security PoP and the Branch-2 FortiGate. A new, more specific route for this path is dynamically installed in the routing tables of both spokes. All subsequent traffic then flows directly over this shortcut, bypassing the hub. Therefore, the ultimate routing mechanism uses a dynamic route for a direct path, as enabled by the ADVPN protocol.

A: This describes only the initial traffic path before the ADVPN shortcut is established. It fails to account for the primary, optimized routing function of ADVPN.

B: The static route shown in the exhibit directs traffic to the hub (HUB-2), not directly to the branch. The direct path is established dynamically, not statically.

C: The static route in the exhibit clearly specifies the gateway for the Branch-2 network is HUB-2 (10.2.0.1), not HUB-1.

1. FortiSASE Administration Guide: In the section on Secure Private Access

the guide details integration with FortiGate secure SD-WAN. It states

"When a spoke (including FortiSASE) needs to send traffic to another spoke

it initially sends the traffic to the hub. The hub forwards the traffic...and also facilitates the two spokes to establish a dynamic IPsec tunnel

called a shortcut tunnel

between them. Subsequent traffic between the spokes flows through the shortcut tunnel

bypassing the hub." This confirms the process of initial routing via the hub

followed by the creation of a direct

dynamic path. (Search for "ADVPN" and "shortcut tunnel" in the FortiSASE Administration Guide for the relevant version).

2. FortiOS Administration Guide (SD-WAN Section): The ADVPN chapter explains that shortcut tunnels are created on-demand and that routes for these shortcuts are dynamically added to the routing table. This confirms that the route for the direct path described in the correct answer is dynamic. (Refer to the "ADVPN" section in the FortiOS Handbook).

During the initial provisioning of the FortiSASE service, the setup wizard requires the administrator to make foundational decisions about data residency and service availability. The administrator must select the geographic data center locations for three core components:

1. Points of Presence (PoPs): To determine which global gateways users will connect to for security inspection and network access.

2. Logging: To comply with data sovereignty regulations by specifying where security and traffic logs will be stored.

3. Endpoint Management: To define the region where FortiClient endpoint policies, profiles, and telemetry data will be stored and managed.

C. SD-WAN hub: Configuration of SD-WAN hubs is a subsequent step for site-to-cloud connectivity and is not part of the initial service-wide provisioning wizard.

E. Authentication: While authentication is a core service, its specific data center location is not a primary selection in the initial wizard, as it's often a globally distributed function or tied to the management plane.

1. FortiSASE Administration Guide (Version 24.1): In the "Provisioning" chapter

the "Initial setup wizard" section explicitly states: "When you first access FortiSASE

you must complete the initial setup wizard. The wizard guides you through selecting data center locations for the following FortiSASE components: Points of Presence

Logging

and Endpoint Management." This directly confirms the three correct choices.

A zero trust network access (ZTNA) private access use case is fundamentally defined by its core principles and scope. A primary tenet of ZTNA is "never trust, always verify," which mandates the continuous assessment of the connecting device's security posture before granting access. This makes statement A a core descriptor.

Furthermore, FortiSASE's ZTNA for private access functions as an application-level proxy. It is specifically designed to provide granular, secure access to private applications that use the TCP protocol. This defines the technical scope and capability of the use case, making statement C a correct description. Together, these two statements accurately outline the "what" and "how" of the ZTNA private access use case.

B. All FortiSASE user-based deployments are supported. This describes implementation compatibility rather than being a defining characteristic of the ZTNA use case itself. The use case is about the access model, not deployment methods.

D. Data center redundancy is offered. This is an infrastructure high-availability feature. While beneficial, it is not a fundamental component or descriptor of the ZTNA access control model or its use case.

1. FortiSASE Administration Guide: In the "ZTNA for private access" chapter

the guide details the workflow where FortiClient assesses the endpoint's security posture and applies ZTNA tags. This verification is a prerequisite for access. This supports option A.

2. FortiSASE Administration Guide: The "ZTNA for private access" section explicitly states

"FortiSASE ZTNA provides remote users with secure access to private applications. ZTNA provides better security than a traditional VPN solution by providing per-application access for TCP-based applications..." This directly supports option C.

3. FortiSASE Administration Guide: The "ZTNA rules" configuration section shows that rules are created for specific TCP ports and services

reinforcing that the use case is centered on TCP-based applications. This further supports option C.

FortiExtender can be connected as a FortiSASE LAN extension using two primary methods. The first is an automated, zero-touch provisioning (ZTP) process. In this method, the FortiExtender is registered in FortiCare and, upon its first internet connection, it contacts the FortiZTP service, which directs it to the appropriate FortiSASE instance for configuration. The second method is manual deployment, where an administrator directly accesses the FortiExtender's interface (GUI or CLI) and statically configures the FortiSASE domain name as its management discovery server. Both methods establish the initial control plane connection for provisioning.

B. Enable Control and Provisioning Wireless Access Points (CAPWAP) access on the FortiSASE portal.

CAPWAP is a protocol used for managing wireless access points (FortiAPs), not for deploying a FortiExtender device as a LAN extension.

D. Configure an IPsec tunnel on FortiSASE to connect to FortiExtender.

The IPsec tunnel is the secure data plane that is automatically established after the FortiExtender is successfully deployed and provisioned by FortiSASE, not the initial deployment method itself.

1. Fortinet Docs | FortiSASE 23.3 Administration Guide

LAN Extension > Deployment workflow.

This section explicitly outlines the two deployment methods: "You can deploy a FortiExtender as a FortiSASE LAN extension using one of the following methods: Zero-touch provisioning (ZTP) deployment... Manual deployment..." This directly supports options A and C.

2. Fortinet Docs | FortiSASE 23.3 Administration Guide

LAN Extension > Manual deployment.

This section details the manual process: "In the FortiExtender GUI

go to Settings > Management. For Discovery Type

select Static. For Static Server Address

enter the FortiSASE domain name..." This provides the specific steps for option C.

3. Fortinet Docs | FortiSASE 23.3 Administration Guide

LAN Extension > Deployment workflow > Step 4.

This step clarifies the role of the IPsec tunnel: "FortiSASE pushes the configuration to the FortiExtender

which includes creating an IPsec VPN tunnel between the FortiExtender and FortiSASE." This confirms that the tunnel is a result of deployment

making option D incorrect.

To resolve internal hostnames for remote endpoints, FortiSASE requires two key configurations. First, Split DNS rules are configured to specify which domain queries should be forwarded to internal DNS servers instead of public ones. Second, for the endpoint to communicate with the internal DNS server, the server's IP address must be reachable through the secure tunnel. This is achieved by configuring Split tunnelling destinations to include the subnet or IP address of the internal DNS server, ensuring traffic to it is routed through the FortiSASE tunnel to the private network.

A. SSL deep inspection: This is a security feature for inspecting encrypted traffic content; it does not influence DNS query routing or network path selection.

D. DNS filter: This security feature blocks or allows DNS queries based on domain categories or lists, but it does not direct queries to specific DNS servers.

1. FortiSASE 24.1 Administration Guide

Configuring split DNS

Page 101: "You can configure split DNS to resolve internal hostnames using your internal DNS servers instead of public DNS servers." This directly supports the need for Split DNS rules.

2. FortiSASE 24.1 Administration Guide

Configuring split DNS

Page 101

"Prerequisites": "You must have configured split tunneling to allow access to the internal DNS server." This explicitly states that split tunneling is a prerequisite

supporting the need to configure split tunneling destinations.

3. FortiSASE 24.1 Administration Guide

Configuring split tunneling

Page 99: "Split tunneling allows you to configure which subnets are accessible through the VPN tunnel. Traffic to other destinations goes directly to the Internet." This confirms the role of split tunneling in providing access to internal resources like DNS servers.

To grant access to a specific application while blocking its parent category, you must create an application override. The Allow action is used within an Application Control profile to explicitly permit traffic for a specified application (CNN) that would otherwise be blocked by a more general category rule (blocking all Video/Audio). This creates a specific exception to the general policy. The traffic allowed by this rule will still be processed by other security profiles, ensuring comprehensive security.

B. Pass: This is not a valid action in Fortinet's Application Control override settings. The term typically implies passing traffic to another inspection engine without a verdict.

C. Permit: While synonymous with "allow," Allow is the specific term used in the FortiSASE and FortiOS configuration interfaces for this action.

D. Exempt: This action not only allows the traffic but also bypasses further inspection by other security profiles (like Web Filter, Antivirus). This is not required by the scenario, making Allow the more precise choice.

1. FortiSASE Administration Guide: In the section describing Application Control

the configuration of overrides is detailed. It specifies the available actions for an override rule.

Reference: FortiSASE Administration Guide

"Security > Application Control" section. The guide states that when creating an "Application and Filter Override

" the available actions are Allow

Monitor

Block

and Quarantine. The Allow action is used to permit a specific application.

2. FortiOS Administration Guide: FortiSASE is built upon FortiOS

and the Application Control functionality is fundamentally the same.

Reference: FortiOS 7.4 Administration Guide

"Security Profiles > Application Control" chapter

"Application and filter overrides" section. It documents: "You can override the Application Control category settings for an application by setting the Action to Allow

Monitor

Block

or Quarantine." This confirms Allow is the correct action to create an exception to a blocked category.

Agentless remote user internet access is the use case that minimizes individual endpoint configuration. This model leverages a Secure Web Gateway (SWG) to which endpoint web traffic is directed, typically via a proxy auto-config (PAC) file or explicit proxy settings in the browser. This method secures web access without requiring the installation or management of a dedicated software agent (like FortiClient) on each user's device, thereby significantly reducing the configuration overhead on individual endpoints.

A. Site-based remote user internet access: This model involves configuring a network gateway (like a FortiGate) at a physical site, not individual remote user endpoints. It is not designed for individual, off-site users.

C. SIA for SSL VPN remote users: This approach requires the installation and configuration of an SSL VPN client on each endpoint, which is a significant configuration step, contradicting the goal of minimization.

D. SIA using ZTNA: A comprehensive ZTNA solution typically requires an agent (like FortiClient) on the endpoint to perform device posture checks and provide secure access to applications, which involves endpoint configuration.

1. Fortinet FortiSASE Administration Guide: In the "Secure Web Gateway" section

the documentation states

"FortiSASE secure web gateway (SWG) for remote users allows you to apply security inspections to user's web traffic without requiring them to install FortiClient." This explicitly confirms the agentless nature and minimal endpoint impact. (Reference: FortiSASE 23.3 Administration Guide

"Secure Web Gateway" chapter).

2. Fortinet FortiSASE Architecture Guide: This guide describes the various connectivity options. It contrasts agent-based access

which provides ZTNA and full SIA

with agentless access for SWG. The agentless model is presented as a "thin-client" approach that simplifies endpoint requirements by only needing browser configuration. (Reference: FortiSASE Architecture Guide

"Connectivity Options" section).

3. Fortinet FortiSASE Datasheet: The datasheet often outlines different modes of operation. It distinguishes between the full functionality provided by the FortiClient agent (ZTNA

VPN

SIA) and the agentless SWG option for securing web traffic for any user on any device without a client install. (Reference: FortiSASE Datasheet

"Use Cases" or "Features" section).

The unified FortiClient is the FortiSASE endpoint agent installed on remote user devices. It is designed to establish a persistent, "always-on" secure tunnel (VPN) to the nearest FortiSASE Point of Presence (PoP). This ensures that the endpoint is always connected and all its traffic is routed through the SASE security stack for inspection and policy enforcement, regardless of the user's physical location. This directly facilitates the requirement for endpoints to be always connected and protected.

A. site-based deployment: This method connects a fixed physical site, such as a branch office, to FortiSASE using a FortiGate appliance, not individual remote user endpoints.

B. thin-branch SASE extension: This is a specific type of site-based deployment for smaller branches, often using a FortiExtender. It does not apply to individual remote users.

D. inline-CASB: This is a security service for monitoring and controlling access to cloud applications. It is a function applied to traffic, not the component that establishes the endpoint's connection.

1. Fortinet FortiSASE Administration Guide: In the "Remote users" section

it states

"FortiSASE secures remote users using the FortiClient endpoint agent... FortiClient establishes a secure tunnel to the nearest FortiSASE PoP." The guide also details the configuration of "Always-on VPN" for FortiClient profiles. (Reference: FortiSASE Administration Guide > Remote users > FortiClient).

2. Fortinet FortiSASE Datasheet: The datasheet describes the two primary modes of connectivity: "securing remote users with a client" and "securing edges (sites)." It explicitly identifies FortiClient as the component for securing remote users. (Reference: FortiSASE Datasheet

"Comprehensive SASE Solution" section).

3. Fortinet Docs - FortiSASE Architecture Guide: This guide outlines the core components

showing FortiClient as the agent for endpoints connecting to the FortiSASE cloud-delivered security services. (Reference: FortiSASE Architecture Guide > Architecture > Components).

FortiSASE treats the external identity provider as the authoritative source once SSO is enabled. The portal automatically suppresses any previously-defined local or cloud-native user-password authentication methods; users can log in only through the configured IdP credentials. (FortiSASE Administration Guide v23.4, “Enable Single Sign-On”, p.103-104).

B. FortiSASE supports IdP integration through SAML/OIDC only; it has no “public/private access type” configuration.

C. FortiSASE SSO applies to both agent-based and agentless (browser) access; recommendation is not limited to agents.

D. Users and groups are not imported or manually edited in FortiSASE; group membership is asserted dynamically by the IdP at login.

1. Fortinet. “FortiSASE Administration Guide v23.4”

Section “Enable Single Sign-On”

pp. 103-104.

2. Fortinet. “FortiSASE SAML & OIDC IdP Integration”

TechDocs KB FD542473

para. 2 (“Local user logins are disabled once SSO is enabled”).

The exhibit displays a FortiSASE block page, which explicitly states the reason for denial: "You have tried to access a web page which is in a category that is blocked." It identifies the specific blocked category as "Potentially Liable." The FortiSASE feature that classifies websites into categories (such as "Potentially Liable") and enforces block/allow actions based on them is the FortiGuard category-based filter. To permit access, the administrator must modify this specific filter within the applied Web Filter security profile to change the action for this category from "Block" to "Allow" or "Monitor".

B. content filter: This is a generic industry term. The specific Fortinet feature is the "Web Filter" profile, and the precise component causing the block is the "FortiGuard category-based filter," making option A more accurate.

C. URL Filter: This feature blocks or allows specific, manually entered URLs. While it could create an override, it doesn't address the root cause of the block, which is the category-based policy.

D. inline cloud access security broker (CASB) headers: CASB is for controlling access to specific cloud applications (SaaS), not for general web category filtering as shown in the block page.

1. FortiSASE Administration Guide (23.3): In the section Security > Web Filter

the guide details the configuration of Web Filter profiles. It explicitly shows the "FortiGuard Category Based Filter" as the component where administrators set actions (Allow

Block

Monitor

etc.) for web categories. This directly corresponds to the reason for the block shown in the exhibit.

2. FortiSASE Administration Guide (23.3): The Security > Web Filter section also describes the "Static URL Filter

" confirming it is a separate function from category-based filtering

used for creating explicit allow/block lists for specific URLs. This differentiates option A from C.

3. FortiSASE Administration Guide (23.3): The Security > CASB section details the configuration for Cloud Access Security Broker functionality

which focuses on SaaS application control

demonstrating it is a distinct feature from the general Web Filter. This invalidates option D.