How does FortiSASE Secure Private Access (SPA) facilitate connectivity to private resources in a hub-and-spoke network? (Choose one answer)
A.
SPA applies source network address translation (SNAT) for remote user traffic and uses IKEv1 for IPsec tunnels to connect to standalone hubs without BGP support.
B.
SPA connects to private resources using HTTP and HTTPS protocols and relies on FortiClient for agentless access to SD-WAN deployments.
C.
SPA establishes direct links to spokes without IPsec or BGP and uses an easy configuration key to secure web traffic for remote users.
D.
SPA connects a FortiSASE POP to a FortiGate hub or SD-WAN deployment using IPsec and BGP for dynamic route exchange, with an easy configuration key for simplified setup on FortiOS.
The correct answer is D . The FortiSASE study guide explains that SPA allows a FortiSASE POP to act as a spoke and connect to a FortiGate hub. It states that you can use FortiSASE SPA so that a POP connects to either a standalone hub using IPsec or to an existing Fortinet SD-WAN deployment . It also states that the BGP protocol is established through IPsec links for dynamic route exchange, which gives FortiSASE remote users access to private resources. For hub deployments running FortiOS 7.4.5 or later, the guide explains that an easy configuration key can simplify SPA setup on FortiSASE by automatically populating key fields in the FortiGate hub configuration.
The wrong options contradict the guide. Option A is false because FortiSASE does not apply SNAT for remote VPN user and edge device traffic destined for SPA hubs, and FortiSASE spokes support IKEv2, not IKEv1. Option B confuses agentless ZTNA with SD-WAN private access. Option C is wrong because SPA uses IPsec and BGP, and the easy configuration key is for SPA hub setup, not for securing general web traffic.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit