Pass the Fortinet Fortinet Network Security Expert NSE5_SSE_AD-7.6 Questions and answers with CertsForce

A and D are correct. Fortinet ' s FortiSASE material identifies two fundamental prerequisites for agentless ZTNA/private application access: an SSO configuration for proxy users and an existing Secure Private Access (SPA) configuration. The Administrator Study Guide states explicitly that agentless support for private applications requires both an SPA configuration and a Secure Web Gateway SSO configuration.

Proxy user SSO (A) provides the identity-verification component. When an agentless user accesses the FortiSASE bookmark portal through a browser, the user must authenticate using SSO. The Enterprise Administrator workflow confirms that authentication occurs through FortiSASE proxy SSO user authentication before authorized application bookmarks are displayed.

SPA (D) provides connectivity from FortiSASE to the protected private applications. After authentication and policy evaluation, the application session is routed through FortiSASE SPA, which functions as the gateway for agentless ZTNA access.

B is incorrect because a FortiGate ZTNA access proxy is not itself a mandatory prerequisite for agentless ZTNA; SPA can be implemented through the supported private-access architecture. C is incorrect by definition: agentless ZTNA is designed for endpoints, including BYOD devices, that do not require FortiClient.

Study Guide Reference: SPA > Agentless ZTNA; Secure Private Access > Private Access for Agentless Users.

According to the FortiSASE 7.6 Architecture Guide and the FCP - FortiSASE 24/25 Administrator study materials, the FortiSASE solution is structured around three primary pillars or " use cases " that address the security requirements of a modern distributed workforce.

Secure Internet Access (SIA) (Option A): This use case focus on protecting remote users as they browse the public internet. It utilizes a full cloud-delivered security stack including Web Filtering, DNS Filtering, Anti-Malware, and Intrusion Prevention (IPS) to ensure that users are protected from web-based threats regardless of their physical location.

Secure SaaS Access (SSA) (Option B): This use case addresses the security of cloud-based applications (like Microsoft 365, Salesforce, and Dropbox). It leverages Inline-CASB (Cloud Access Security Broker) to identify and control " Shadow IT " —unauthorized cloud applications used by employees—and applies Data Loss Prevention (DLP) to prevent sensitive information from being leaked into unsanctioned SaaS platforms.

Secure Private Access (SPA) (Option C): This use case provides secure, granular access to private applications hosted in on-premises data centers or private clouds. It can be achieved through two main methods: ZTNA (Zero Trust Network Access), which provides session-specific access based on identity and device posture, or through SD-WAN integration, where the FortiSASE cloud acts as a spoke connecting to a corporate SD-WAN Hub.

Why other options are incorrect:

Secure VPN Access (SVA) (Option D): While SASE uses VPN technology (SSL or IPsec) as a transport for the Endpoint mode, " SVA " is not a formal curriculum-defined use case. The SASE framework is intended to evolve beyond traditional " Secure VPN Access " into the SIA and SPA models.

Secure Browser Access (SBA) (Option E): Although FortiSASE offers Remote Browser Isolation (RBI), it is considered a feature or a component of the broader Secure Internet Access (SIA) use case rather than a separate, standalone use case in the core administrator curriculum.

According to the FortiSASE 24.4 Administration Guide and the FortiSASE Core Administrator training materials, the On-net detection rule setting is a critical component for determining the " trust status " of an endpoint ' s physical location.

Endpoint Location Verification: On-net rule sets are used to determine if FortiSASE considers an endpoint to be on-net (trusted) or off-net (untrusted). An endpoint is considered on-net when it is physically located within the corporate network, which is assumed to already have on-premises security measures (like a FortiGate NGFW).

Operational Impact: When an endpoint is detected as on-net, FortiSASE can be configured to exempt the endpoint from automatically establishing a VPN tunnel to the SASE cloud. This optimization prevents redundant security inspection and conserves SASE bandwidth since the user is already protected by the local corporate firewall.

Detection Methods: To classify an endpoint as on-net, administrators configure rule sets that look for specific environmental markers, such as:

Known Public (WAN) IP: If the endpoint ' s public IP matches the corporate headquarters ' egress IP.

DHCP Server: If the endpoint receives an IP from a specific corporate DHCP server.

DNS Server/Subnet: Matching internal DNS infrastructure or specific internal IP ranges.

Dynamic Policy Application: By accurately determining if an endpoint is on or off-net, FortiSASE ensures that the FortiClient agent only initiates its secure internet access (SIA) tunnel when the user is in an untrusted location (e.g., a home network or public Wi-Fi).

Why other options are incorrect:

Option A: User authentication is a separate process and is not controlled by the on/off-net detection rules, which focus on the network environment rather than user credentials.

Option B: While on-net status affects how traffic is routed (VPN vs. local), these rules specifically determine the status itself rather than defining the routing tables for private vs. cloud resources.

Option D: Geographical location (Geo-location) is a different filtering criterion often used in firewall policies; on-net detection is specifically about the proximity to the trusted corporate perimeter.

The selected performance SLA in the exhibit is Corp_HC , and the Latency view shows two configured latency criteria as horizontal threshold lines. Throughout the displayed 60-second interval, the green port1 latency remains below both thresholds, so port1 remains healthy against both Corp_HC latency criteria. Fortinet explains that the FortiGate GUI displays measured member performance and highlights when a member fails a configured SLA target; configured latency values can therefore be compared directly with measured latency. SD-WAN_7.6_Enterprise_Administr… Option A incorrectly associates the graph with HUB1_HC when Corp_HC is selected. Option B cannot be inferred merely because packet loss, latency, and jitter metrics are displayed; those metrics can be measured without all three being configured as SLA targets. Option D confuses the displayed failure/recovery threshold values of 5 with a 5% packet-loss SLA threshold .

================

According to the SD-WAN 7.6 Core Administrator curriculum and the provided exhibits, the traffic steering decision is determined by the interaction between the Lowest Cost (SLA) strategy and the link health status reported in the event logs.

Rule Strategy (Lowest Cost SLA): The SD-WAN rule configuration for ID 1 (named Critical-DIA) is set to mode sla. In this mode, the FortiGate will only steer traffic through member interfaces that satisfy the assigned Performance SLA targets.

Member Preference: The rule defines priority-members 1 2. This means that under normal conditions (where both links are healthy), Member 1 (port1) is the preferred interface because it is listed first.

Event Log Analysis:

The first log message explicitly states: " Member status changed. Member out-of-sla. " for Member 1. This indicates that port1 has exceeded one of the thresholds (latency, jitter, or packet loss) defined in the Corp_HC health check.

The second log confirms: " Number of pass member changed. New Value: 1, Old Value: 2 " . This verifies that while there were previously two links passing the SLA, now only one link (Member 2/port2) remains in a passing state.

Steering Decision: Because the rule strategy is mode sla and the primary preferred member (port1) is now out-of-sla, the FortiGate immediately disqualifies Member 1 from the selection pool for this specific rule. It then moves to the next available member in the priority list that does satisfy the SLA, which is Member 2 (port2).

Why other options are incorrect:

Option A: FortiGate will not load balance or choose between both links because port1 is currently ineligible due to the SLA failure.

Option B: Steering to port1 would violate the " Lowest Cost (SLA) " rule logic, as that link is no longer meeting the required health standards.

Option D: FortiGate does not " skip " the rule unless no members meet the SLA and there is no fallback configured; in this scenario, port2 is still passing and available.