Examen de FortiSASE 23

A FortiSASE administrator is configuring a Secure Private Access (SPA) solution to share endpoint information with a corporate FortiGate. What three configuration actions will achieve this solution? (Choose three.)

• Add the FortiGate IP address in the secure private access configuration in FortiSASE.

• Use the FortiClient EMS cloud connector on the corporate FortiGate to connect to FortiSASE.

• Register FortiGate and FortiSASE under the same FortiCloud account.

• Authorize the corporate FortiGate in FortiSASE as a ZTNA access proxy.

• Apply the FortiSASE zero trust network access (ZTNA) license on the corporate FortiGate.

A FortiSASE administrator is trying to configure FortiSASE as a spoke to a FortiGate hub. The VPN tunnel is not establishing. Based on the provided configuration, what setting needs to be modified for the tunnel to activate?

• NAT needs to be enabled on the Spoke-to-Hub firewall policy.

• The BGP router ID needs to match on the hub and FortiSASE.

• FortiSASE spoke devices do not support mode configuration.

• The hub needs IKEv2 enabled in the IPsec phase 1 configuration.

A FortiSASE administrator is trying to configure FortiSASE as a spoke to a FortiGate hub. The tunnel is active to the FortiGate hub. However, the administrator cannot ping the web server hosted behind the FortiGate hub. Based on the output, what is the reason for the ping failures?

• The Secure Private Access (SPA) policy needs to allow the PING service.

• The fast mode selectors are restricting the subnet.

• The BGP route is not being received.

• Network Address Translation (NAT) is not enabled in the spoke-to-hub policy.

WiMO-Pro and Win7-Pro are endpoints from the same remote location. WiMO-Pro can access the internet though FortiSASE, while Wm7-Pro can no longer access the internet Given the exhibits, which reason explains the outage on Wm7-Pro?

• The posture of the Win7-Pro device has changed.

• Win7-Pro cannot reach the FortiSASE SSL VPN gateway.

• The version of FortiClient on Win7-Pro does not match the FortiSASE endpoint requirement.

• Win-7 Pro has exceeded the total threshold of detected vulnerabilities.

An organization needs to resolve internal hostnames using its internal DNS servers instead of public DNS servers for remote-connected endpoints. What two components must be configured in FortiSASE to achieve this? (Choose two.)

• Deep SSL Inspection

• Split DNS Rules

• Split Tunnel Destinations

• DNS Filter

When accessing the FortiSASE portal for the first time, an administrator must select data center locations for which three components of FortiSASE? (Choose three).

• Endpoint management

• Points of presence

• SD-WAN Hub

• Logging

• Authentication

During the provision of FortiSASE, how many security points of presence (PoPs) must be configured by the FortiSASE administrator?

• 3

• 4

• 2

• 1

NO.8 When you configure FortiSASE Secure Private Access (SPA) with SD-WAN integration, you must establish a routing adjacency between FortiSASE and the FortiGate SD-WAN hub. Which routing protocol must you use?

• BGP

• IS-IS

• OSPF

• EIGRP

What type of policy is used to control traffic between the FortiClient endpoint and FortiSASE for secure Internet access?

• VPN Policy

• Thin Edge Policy

• Private Access Policy

• Secure Web Gateway (SWG) Policy

What are two advantages of using zero trust labels? (Choose two.)

• Zero trust labels can be used to allow or deny access to network resources

• Zero trust labels can determine the security posture of an endpoint.

• Zero trust labels can be used to create multiple endpoint profiles that can be applied to different endpoints

• Zero trust labels can be used to allow access to the secure web gateway (SWG)