NSE7_SSE_AD-25 Fortinet NSE 7 - FortiSASE 25 Enterprise Administrator Question and Answers

The core of the issue shown in the exhibits is the lack of visibility into encrypted traffic.

HTTPS Encryption: The eicar.org website uses the HTTPS protocol for its downloads. This means the data payload, including the test malware file, is encrypted as it traverses the network.

SSL Inspection Modes: As seen in the Security profile group exhibit (image_5705fc.jpg), the SSL inspection mode is explicitly set to Certificate inspection mode .

Visibility Gap: Certificate inspection only analyzes the initial SSL handshake, such as the server certificate and SNI (Server Name Indication). It does not decrypt the traffic payload. Consequently, the antivirus engine in FortiSASE cannot " see " or scan the eicar.com-zip file hidden within the encrypted session.

Resolution Requirement: To detect and block malicious files over HTTPS, SSL Deep Inspection must be enabled. Deep inspection allows FortiSASE to act as a proxy, decrypting the traffic for full content scanning by the antivirus and IPS engines before re-encrypting it for the endpoint.

Log Analysis: While the web filtering logs (image_5704e5.jpg) show the traffic is " Allowed " because the URL is not blocked by a web filter category, this is only the first step of inspection. The antivirus engine is present but ineffective because it is blind to the encrypted content due to the lack of deep inspection.

In the context of Zero Trust Network Access (ZTNA) , security posture tagging is the fundamental mechanism used to enforce compliance and security standards before granting access to protected resources.

Granular Access Control: The primary purpose of tagging is to provide granular access control . 3 Instead of relying solely on static credentials, ZTNA uses these dynamic tags to determine if a device or user meets specific security requirements at the moment of the connection request.

Compliance-Based Enforcement: Tags are assigned based on the compliance status of the endpoint. For example, the FortiSASE Endpoint Management Service (EMS) can verify if a device has an active antivirus, is running a specific OS version, or is joined to the corporate domain. 5 If the device fails any of these checks, the " Compliant " tag is removed, and access is automatically revoked.

Dynamic and Continuous Assessment: Unlike traditional VPNs that check posture only at login, ZTNA posture tagging allows for continuous assessment . If a device ' s security posture changes—for instance, if the user disables their firewall—the tag is updated in real-time across the Security Fabric, and the ZTNA policy will immediately deny further access. 8

Integration with Policies: On the FortiGate (acting as a ZTNA proxy) or within FortiSASE, these tags are used as source criteria in ZTNA policies . 9 Only traffic originating from endpoints with the required tags (e.g., " EMS-Tag: Corporate-Managed " ) is permitted to reach the protected application.

FortiSASE is designed as a unified, single-vendor solution that specifically targets the convergence of networking and security to address the modern challenges of a distributed enterprise. 2

Multicloud and SaaS Adoption: FortiSASE addresses the surge in cloud-first strategies by providing Next-Generation Dual-Mode CASB (Cloud Access Security Broker). 3 This feature uses both inline and API-based inspection to provide comprehensive visibility into sanctioned and unsanctioned SaaS applications (Shadow IT), ensuring that data is protected regardless of whether it resides in AWS, Azure, Google Cloud, or SaaS platforms like Microsoft 365.

Hybrid Workforce: To support a workforce that moves between the home, the office, and public spaces, FortiSASE delivers consistent security posture . 5 It replaces the inconsistent experience of legacy VPNs with a geographically dispersed network of over 150 Points of Presence (PoPs), ensuring low-latency access to applications while maintaining high-performance SSL inspection and threat detection for all remote users.

Zero Trust Integration: Central to the FortiSASE architecture is Universal ZTNA (Zero Trust Network Access). 7 Unlike traditional VPNs that grant broad network access, ZTNA applies the principle of " never trust, always verify " . It grants access on a per-session, per-application basis, continuously verifying the device posture and user identity before and during application access. 9 This shift from implicit to explicit trust significantly reduces the internal attack surface and mitigates the risk of lateral movement by attackers.

By integrating these components into a single operating system ( FortiOS ) and managed via a single console, FortiSASE simplifies IT operations while delivering the visibility and control required for today ' s multicloud and hybrid environments.

Based on the detailed analysis of the provided exhibits ( image_65feb6.jpg ), the connectivity failure is caused by a mismatch in the Hub firewall policy configuration.

Endpoint Analysis: The Network Diagram shows the FortiClient endpoint has an IP address of 100.65.80.2/20 and currently carries the FortiSASE-Compliant ZTNA tag.

FortiSASE Policy Validation: The Private access policy on FortiSASE shows an " Accept " rule for traffic originating from " FortiSASE-Compliant " sources destined for " All Private Access Traffic " . This confirms the traffic is successfully leaving the FortiSASE PoP.

Routing Validation: The Learned BGP Routes on FortiSASE table shows the prefix 10.160.160.0/24 (the Server subnet) is correctly received via Next Hop 10.11.11.1 . Routing is correctly established.

Hub Firewall Policy Error: Examining the Hub firewall policy (edit 7), the srcaddr is set to " SASE_Remote_Access " . Looking at the address object definition for " SASE_Remote_Access, " it is configured with the subnet 10.11.11.0 255.255.255.0 .

The Conflict: The FortiClient ' s actual IP address ( 100.65.80.2 ) does not fall within the 10.11.11.0/24 range defined in the policy ' s source address. On a FortiGate hub, for traffic to be permitted through the tunnel to the internal server, the firewall policy must include the specific subnet assigned to the remote clients, not just the tunnel interface subnet. Because the FortiClient address range is missing from the hub ' s policy, the traffic is dropped at the hub.

In FortiSASE, Zero Trust Network Access (ZTNA) tags—also known as security posture tags—are used to dynamically grant or deny access based on the real-time security state of an endpoint. This mechanism ensures that only devices meeting specific compliance requirements can access protected resources or the internet.

Endpoint Analysis: The Managed Endpoints exhibit shows that while Jumpbox only has the FortiSASE-Compliant tag, the Windows-AD endpoint has been assigned both FortiSASE-Compliant and FortiSASE-Non-Compliant tags. This indicates that a security posture check on the Windows-AD device has failed, triggering a rule that applies the non-compliant tag.

Policy Evaluation: The Secure Internet Access Policy table shows two custom policies. The first policy, named Non-compliant , uses the FortiSASE-Non-Compliant tag as its source and has the action set to Deny . The second policy, Web Traffic , allows access for FortiSASE-Compliant users.

Root Cause of Outage: Because FortiSASE (powered by FortiOS) processes security policies in a top-down sequence, the " Non-compliant " policy is evaluated first. Since Windows-AD matches the source criteria for this " Deny " policy, its traffic is blocked before it can reach the " Accept " policy.

Although the exhibit shows a warning icon for the FortiClient version on Windows-AD, the direct cause of the internet outage is the explicit Deny policy triggered by the change in the device ' s security posture (the application of the Non-Compliant tag).

When accessing the FortiSASE portal for the first time, an administrator must select data center locations for the following FortiSASE components:

Endpoint Management:

The data center location for endpoint management ensures that endpoint data and policies are managed and stored within the chosen geographical region.

Points of Presence (PoPs):

Points of Presence (PoPs) are the locations where FortiSASE services are delivered to users. Selecting PoP locations ensures optimal performance and connectivity for users based on their geographical distribution.

Logging:

The data center location for logging determines where log data is stored and managed. This is crucial for compliance and regulatory requirements, as well as for efficient log analysis and reporting.

FortiSASE Secure Private Access (SPA) provides flexible connectivity to internal corporate resources using a hub-and-spoke architecture where FortiSASE PoPs act as spokes to an organization ' s FortiGate hub.

Flow from Agent-based users to Private Resources (C): This is the core functionality of SPA. Remote users running FortiClient (agent-based) connect to the nearest FortiSASE PoP. The PoP, integrated into the corporate SD-WAN fabric, uses IPsec and BGP to route traffic to the private applications located behind the FortiGate hub or associated spokes.

Flow from Thin Branches/Branch On-ramp to Private Resources (E): FortiSASE extends its security and connectivity to physical locations through " Thin Edge " (e.g., FortiExtender, FortiAP) or " Branch On-ramp " (e.g., branch FortiGates). These sites form tunnels to the FortiSASE PoP, which then provides them with access to the same private resources in the SD-WAN network as the remote agent-based users.

Flow from Private Resources to Agent-based users (A): The SPA architecture is designed for bidirectional communication. Documentation confirms that traffic can be initiated from the FortiGate hub (or local networks behind it) to the remote VPN agents. This " Server-to-Client " flow is essential for administrative tasks, log forwarding, or real-time communication applications like VoIP.

Incorrect Options:

Option B: Traffic from private resources to the internet is handled via Secure Internet Access (SIA) or local gateway policies, not the SPA use case, which is dedicated to internal private application access.

Option D: While FortiSASE can facilitate branch-to-branch communication via ADVPN shortcuts, the term " SPA " specifically refers to the access layer for users and is not used to describe resource-to-resource or hub-to-hub traffic.

Based on the settings shown in the provided exhibits, the vulnerability remediation workflow is determined by the Endpoint Profile and the Vulnerability Dashboard .

Endpoint Profile Evaluation: The top exhibit displays the Scan for Vulnerabilities settings. The toggle for Automatically patch vulnerabilities is explicitly set to Disabled . Consequently, the system will not perform automated remediation when a scan completes.

Manual Patching Requirement: The Vulnerability Dashboard (bottom exhibit) lists several application vulnerabilities with a Patching status of Manual patching required . In a FortiSASE environment, " Manual " indicates that the vulnerability cannot be handled by the client ' s autonomous update process and requires a direct instruction from the management plane.

Administrative Intervention: The dashboard includes a Patch endpoints action button. Since auto-patching is disabled in the profile, an administrator must manually select the vulnerabilities and click the " Patch endpoints " button to remotely trigger the patching sequence on the managed endpoints via the FortiSASE cloud service.

Workflow Logic: While FortiClient acts as the " conductor " on the local machine to facilitate the download and installation, the trigger for this specific scenario is the administrator ' s remote action within the portal. This differentiates it from Option D (which is disabled) and Option C (which would involve a user manually browsing a website outside the managed SASE workflow).

Zero Trust Network Access (ZTNA) is the FortiSASE feature that ensures least-privileged user access to all applications. ZTNA operates on the principle of " never trust, always verify, " providing secure access based on the identity of users and devices, regardless of their location.

Zero Trust Network Access (ZTNA):

ZTNA ensures that only authenticated and authorized users and devices can access applications.

It applies the principle of least privilege by granting access only to the resources required by the user, minimizing the potential for unauthorized access.

Implementation:

ZTNA continuously verifies user and device trustworthiness and enforces granular access control policies.

This approach enhances security by reducing the attack surface and limiting lateral movement within the network.

In a FortiSASE environment, log management is governed by a cloud-native storage policy that prioritizes performance and resource availability.

Retention Policy Framework: All FortiSASE instances come with log retention enabled by default. The standard log retention period is 30 days , though administrators can customize this policy to any duration between 2 and 30 days . This policy applies across all log types, including traffic, security, and event logs.

Automatic Deletion (A): When logs exceed the configured retention threshold, FortiSASE automatically deletes the older logs from the platform. 2 This automatic purging is necessary to free up storage space on the cloud infrastructure and maintain compliance with the organization ' s data lifecycle settings.

Persistence and Recovery: Once logs are deleted due to the expiration of the retention period, they are generally unrecoverable from the FortiSASE platform.

Long-Term Storage Solutions: Because FortiSASE is not designed as a long-term archival solution, customers who need to store logs for months or years for regulatory compliance should configure log forwarding to an external server , such as a FortiAnalyzer or a remote Syslog server.

Analysis of Incorrect Options: * Option B and D: While traditional FortiAnalyzer deployments use SQL indexing and separate " Archive " (raw/compressed) vs. " Analytics " (SQL) tiers, FortiSASE uses a simplified cloud storage model where data is purged rather than archived or tier-shifted upon expiry.

Option C: While FortiSASE is part of the FortiCloud ecosystem, it does not automatically " back up " expired logs to another FortiCloud service; the deletion is final unless external forwarding is active.

The correct answer is D. Web filter with inline-CASB . The FortiSASE study guide states that FortiCASB provides cloud-based and API-based capabilities for deep inspection of SaaS applications, enabling monitoring, analysis, and reporting. It also states that FortiSASE provides inline CASB functionality with a web filter and application control security features , while DLP protects data at rest and in motion.

This question specifically describes restricting Microsoft Office 365 access by tenant, meaning users should be allowed to access company-approved Microsoft 365 resources but blocked from logging in to non-company or personal resources. Fortinet’s FortiSASE documentation describes this exact use case as “restricted SaaS access,” where organizations restrict access to Microsoft Office 365, Google Workspace, and similar SaaS services by tenant to block non-company login attempts and prevent access to non-approved cloud resources. Fortinet’s Office 365 example confirms this is implemented through FortiSASE Web Filter with Inline-CASB, using inline-CASB headers to allow corporate domains and deny personal accounts.

In the Fortinet SASE architecture, Zero Trust Network Access (ZTNA) tags (which have been renamed to Security Posture Tags starting with FortiClient/EMS 7.4.0) play a critical role in continuous posture assessment. These tags are dynamic metadata assign 8 ed to an endpoint based on specific conditions or " tagging rules " defined in the FortiSASE Endpoint Management Service (EMS).

Posture Determination: The FortiClient agent, installed on the endpoint, monitors the device for various security attributes—such as whether an antivirus is running, the presence of specific registry keys, OS version, or the absence of critical vulnerabilities.

SIA (Secure Internet Access) Use Case: In SIA scenarios, FortiSASE uses these tags within security policies to control internet access. For example, a policy may allow full internet access only to endpoints tagged as " Compliant " while redirecting " Non-Compliant " devices to a restricted remediation portal.

SPA (Secure Private Access) Use Case: In SPA (specifically ZTNA Proxy mode), the tags are synchronized from FortiSASE to the corporate FortiGate (acting as the ZTNA Access Proxy). 12 When a user attempts to access a private application, the FortiGate checks the endpoint ' s client certificate and its synchronized ZTNA tags. 13 If the endpoint does not meet the required posture (e.g., it is missing a required " Domain-Joined " tag), access is denied at the session level.

According to the FortiSASE 25 Enterprise Administrator Study Guide , ZTNA tags are fundamental to the " Zero Trust " principle because they move beyond static identity (username/password) to verify the real-time security state of the device before granting access to either the internet or internal private resources.

When deploying FortiSASE agent-based clients, several features are available that are not typically available with an agentless solution. These features enhance the security and management capabilities for endpoints.

Vulnerability Scan:

Agent-based clients can perform vulnerability scans on endpoints to identify and remediate security weaknesses.

This proactive approach helps to ensure that endpoints are secure and compliant with security policies.

SSL Inspection:

Agent-based clients can perform SSL inspection to decrypt and inspect encrypted traffic for threats.

This feature is critical for detecting malicious activities hidden within SSL/TLS encrypted traffic.

Web Filter:

Web filtering is a key feature available with agent-based clients, allowing administrators to control and monitor web access.

This feature helps enforce acceptable use policies and protect users from web-based threats.

To enable remote users to access internal applications located behind an existing FortiGate SD-WAN hub, the customer must license the FortiSASE Secure Private Access (SPA) add-on .

Secure Private Access (SPA) Use Case: This specific add-on is designed to extend the Fortinet Security Fabric into the SASE cloud, allowing for a hub-and-spoke architecture where the FortiSASE PoPs act as spokes and the customer ' s on-premises FortiGate acts as the hub.

Licensing Requirements: The SPA add-on is a per-hub (per service connection) license. It provides the necessary entitlements to establish IPsec tunnels and BGP peering between the SASE infrastructure and the corporate FortiGate.

Feature Enablement: Once the SPA license is applied, the Configuration > Private Access menu becomes available in the FortiSASE portal. This allows administrators to define " Service Connections " to their private data centers or cloud VPCs.

Analysis of Other Options:

Option A: The Global add-on is typically related to expanding the geographic reach or performance of the SASE PoPs, not specifically for private resource routing.

Option B: The Branch On-Ramp refers to connecting physical office locations (Thin Edge) to SASE, rather than the specific licensing for private application access for remote users.

Option D: Dedicated Public IP Address is used for source IP anchoring (SIA) to ensure remote users egress with a consistent IP for third-party SaaS IP-whitelisting.

Integrating FortiManager with FortiSASE allows for central management of configuration objects like addresses and 5 security 6 profiles. For this integration to function correctly, the following key prerequisites must be met:

Same FortiCloud Account: A fundamental requirement for the integration is that both 10 the FortiSASE instance and the FortiManager (whether physical, VM, or Cloud) must be registered under the same FortiCloud (FortiCare) account . This common identity allows the platforms to securely discover and authorize each other for synchronization.

Supported Firmware Version: The FortiManager must run a firmware version that is compatible with the FortiSASE release. According to the FortiSASE 25 Enterprise Administrator Study Guide , FortiManager version 7.4.4 or later is generally required to support the specific API connectors and object synchronization logic used by current FortiSASE environments. Using an unsupported version may result in synchronization failures or missing configuration features.

Management Logic: Once these prerequisites are met, the administrator can enable " Central Management " in the FortiSASE portal. This creates a one-way synchronization where FortiManager acts as the source of truth for objects like Security Profile Groups, ensuring consistent security posture across both the SASE cloud and on-premises FortiGates.

Zero-trust tags are critical in implementing zero-trust network access (ZTNA) policies. Here are the two key advantages of using zero-trust tags:

Access Control (Allow or Deny):

Zero-trust tags can be used to define policies that either allow or deny access to specific network resources based on the tag associated with the user or device.

This granular control ensures that only authorized users or devices with the appropriate tags can access sensitive resources, thereby enhancing security.

Determining Security Posture:

Zero-trust tags can be utilized to assess and determine the security posture of an endpoint.

Based on the assigned tags, FortiSASE can evaluate the device ' s compliance with security policies, such as antivirus status, patch levels, and configuration settings.

Devices that do not meet the required security posture can be restricted from accessing the network or given limited access.

In the FortiSASE architecture, there are two primary methods for delivering Secure Internet Access (SIA) : Agent-based (using FortiClient) and Agentless (using Secure Web Gateway/SWG).

Use Case Analysis: The scenario describes a contractor—an unmanaged user—who requires temporary access for a web-based application (the POS system). For contractors or guests using personal/non-corporate devices where installing the FortiClient agent is either not feasible or not desired, FortiSASE provides the SIA Agentless deployment model.

Mechanism (SWG & PAC): In this mode, FortiSASE functions as an explicit web proxy . To steer the contractor ' s web traffic (HTTP/HTTPS) to the SASE cloud for inspection, the administrator provides the user with a proxy auto-configuration (PAC) file . The contractor simply configures their browser or operating system to point to the URL of this PAC file.

Security Enforcement: Once the PAC file is applied, all web traffic from the contractor ' s device is redirected to the FortiSASE SWG PoP. Here, the traffic is subject to the organization’s full security stack, including SSL deep inspection, Antivirus, Web Filtering, and Application Control , ensuring that even temporary contractor access is fully secured and logged.

Why other options are incorrect:

Option B (Tunnel Policy): This refers to agent-based access where a VPN tunnel is established. This requires FortiClient, which is generally not used for temporary contractors on unmanaged devices.

Option C (ZTNA Unmanaged): While ZTNA supports agentless access to private applications (SPA), providing internet access (SIA) to an unmanaged endpoint is specifically the role of the SWG/Proxy service.

Option D (Self-registration): While FortiSASE has a User Portal for onboarding, it is a method for user registration/credential management, not the technical traffic-steering mechanism used to provide internet connectivity.

According to the FortiSASE 25 Secure Internet Access Architecture Guide , the SWG (Agentless) approach is the recommended best practice for securing web-only traffic from unmanaged endpoints and third-party contractors.

To enable the Managed Security Service Provider (MSSP) feature on FortiSASE, the administrative framework must be established outside of the local SASE instance within the broader FortiCloud ecosystem.

FortiCloud IAM Integration: The FortiSASE MSSP portal relies on FortiCloud Identity & Access Management (IAM) to define the scope of management for internal teams. Administrators do not create local " MSSP users " within the SASE portal itself; instead, they must use the FortiCloud IAM portal to assign specific Role-Based Access Control (RBAC) to IAM users.

Permissions and Scope: These RBAC settings determine which customer tenants (Organizational Units or OUs) an MSSP administrator can view, configure, or monitor. Without the proper role assignment in the IAM portal, the MSSP portal and its multi-tenant viewing capabilities will not be accessible to the user, even if the account has the necessary licenses.

Hierarchical Management: Once RBAC is correctly assigned, the MSSP administrator can leverage the FortiCloud Organizations service to manage multiple customer accounts from a single pane of glass. This centralized approach ensures that security policies and configurations can be standardized across the entire customer base while maintaining strict data isolation between tenants.

According to the FortiSASE 25 Multitenant Deployment Guide , configuring the IAM portal is the primary prerequisite that grants an MSSP internal team the permissions necessary to perform operations on customer FortiSASE tenants.

In a FortiSASE environment, the Unified FortiClient agent is the critical component that fulfills the requirement for " always-on " connectivity and security for remote users.

Persistent Encrypted Tunnels : The Unified FortiClient maintains a persistent, always-on connection to the FortiSASE infrastructure. 4 This is typically achieved through an auto-connect VPN tunnel (SSL or IPsec) that initiates as soon as the user logs into their device and has internet access.

Continuous Security Enforcement : By staying connected to a nearby FortiSASE Point of Presence (PoP), the endpoint ensures that all traffic is inspected. This allows the organization to enforce a consistent security posture—including Web Filtering, Antivirus, and Application Control—regardless of whether the user is at home, in a coffee shop, or traveling.

Zero-Trust Integration : Beyond simple connectivity, the unified agent supports Universal ZTNA . It continuously verifies the identity of the user and the security posture of the device before granting access to specific applications, thereby satisfying modern zero-trust security mandates.

Comparison of Other Components :

SD-WAN on-ramp (B) : Used primarily to integrate existing branch office SD-WAN networks with the SASE cloud for private application access.

Secure Web Gateway (C) : While a feature of the SASE PoP, the agentless SWG deployment (using PAC files) does not provide the same level of " always-on " persistent tunnel protection as the FortiClient agent.

Thin-branch SASE extension (D) : Focused on securing small branch locations (using FortiAP or FortiExtender) where individual client agents may not be deployed on every device.

To block all video and audio application traffic while granting access to videos from CNN, you need to configure an application override action in the Application Control with Inline-CASB. Here is the step-by-step detailed explanation:

Application Control Configuration:

Application Control is used to identify and manage application traffic based on predefined or custom application signatures.

Inline-CASB (Cloud Access Security Broker) extends these capabilities by allowing more granular control over cloud applications.

Blocking Video and Audio Applications:

To block all video and audio application traffic, you can create a policy within Application Control to deny all categories related to video and audio streaming.

Granting Access to Specific Videos (CNN):

To allow access to videos from CNN specifically, you must create an override rule within the same Application Control profile.

The override action " Exempt " ensures that traffic to specified URLs (such as those from CNN) is not subjected to the blocking rules set for other video and audio traffic.

Configuration Steps:

Navigate to the Application Control profile in the FortiSASE interface.

Set the application categories related to video and audio streaming to " Block. "

Add a new override entry for CNN video traffic and set the action to " Exempt. "

To configure a Secure Private Access (SPA) solution to share endpoint information between FortiSASE and a corporate FortiGate, you need to take the following steps:

Add the FortiGate IP address in the secure private access configuration on FortiSASE:

This step allows FortiSASE to recognize and establish a connection with the corporate FortiGate.

Use the FortiClient EMS cloud connector on the corporate FortiGate to connect to FortiSASE:

The EMS (Endpoint Management Server) cloud connector facilitates the integration between FortiClient endpoints and FortiSASE, enabling seamless sharing of endpoint information.

Register FortiGate and FortiSASE under the same FortiCloud account:

By registering both FortiGate and FortiSASE under the same FortiCloud account, you ensure centralized management and synchronization of configurations and policies.

FortiSASE utilizes Security Assertion Markup Language (SAML) to provide a seamless Single Sign-On (SSO) experience for remote users connecting to the cloud infrastructure.

Role Identification: In a SAML exchange, FortiSASE functions as the Service Provider (SP) . It relies on an external Identity Provider (IdP) —such as Microsoft Entra ID (formerly Azure AD), Okta, or FortiAuthenticator—to authenticate the user ' s identity and provide security assertions. 2

SAML Group Matching: One of the core features of the FortiSASE SAML implementation is the ability to perform group matching . During the authentication process, the IdP sends a SAML assertion that typically includes an " Attribute Statement " containing the user ' s group memberships. 3 FortiSASE captures this attribute and matches it against locally defined SAML user groups.

Policy Enforcement: This group matching capability is critical because it allows administrators to apply different Security Internet Access (SIA) or Secure Private Access (SPA) policies based on the user ' s role (e.g., " Marketing " vs. " Finance " ) rather than managing individual users manually.

Analysis of Incorrect Options: * Options C and D are incorrect because FortiSASE does not natively act as a SAML IdP; it is designed to consume assertions from professional identity management platforms.

Option B is incorrect because FortiSASE fully supports and relies upon group matching for enterprise-scale policy management.

The exhibit ( image_595357.jpg ) illustrates the Sandbox configuration tab within a FortiSASE Endpoint Profile . This profile dictates how the managed FortiClient agent handles suspicious files and interacts with the sandbox service.

Profile-Based Enforcement: In the FortiSASE architecture, security features are not applied globally by default; they are enabled through specific profiles assigned to endpoints. Therefore, the sandbox inspection and remediation logic will only be active for endpoints that have been assigned a profile where the Sandbox feature is enabled.

Removable Media Protection: Under the File Submission Options in the exhibit, the setting All Files Executed from Removable Media is toggled on. This ensures that any file executed from a USB drive or other external storage is sent to the FortiSandbox for analysis before being permitted to run on the endpoint.

Sandbox Mode: The Sandbox Mode is set to FortiSASE , indicating that files are sent to the integrated cloud-native sandbox rather than an on-premises appliance. This makes Option A incorrect.

Quarantine Threshold: The Remediation Actions show that the Action is set to Quarantine for files meeting the Sandbox Detection Verdict Level of Medium . This acts as a minimum threshold; FortiClient will quarantine files identified as Medium, High, or Malicious. Option B is incorrect because it implies only medium-level files are quarantined, whereas higher-risk levels would also be blocked.