According to the FortiSASE 7.6 Feature Administration Guide and the latest updates to the NSE 5 SASE curriculum, FortiSASE has introduced native lifecycle management for FortiClient agents to reduce the operational burden on IT teams who previously relied solely on third-party MDM (Mobile Device Management) or GPO (Group Policy Objects) for every update.

The Endpoint Upgrade feature, found under System > Endpoint Upgrade in the FortiSASE portal, allows administrators to perform the following:

Centralized Version Control: Administrators can see which versions are currently deployed and which " Recommended " versions are available from FortiGuard.

Scheduled Rollouts: You can choose to upgrade all endpoints or specific endpoint groups at a designated time, ensuring that upgrades do not disrupt business operations.

Status Monitoring: The portal provides a real-time dashboard showing the progress of the upgrade (e.g., Downloading, Installing, Reboot Pending, or Success).

Manual vs. Managed: While MDM is still highly recommended for the initial onboarding (the first time FortiClient is installed and connected to the SASE cloud), all subsequent upgrades can be handled natively by the FortiSASE portal.

Why other options are incorrect:

Option B: Manual upgrades are inefficient for large-scale deployments (~400 users in this scenario) and are not the intended " feature-rich " solution provided by FortiSASE.

Option C: " Onboarding " refers to the initial setup. Re-onboarding every time a version changes would be redundant and counterproductive.

Option D: While the system can manage the upgrade, it is not " auto-upgraded on demand " by the client itself without administrative configuration in the portal. The administrator must still define the target version and schedule.

The correct answer is B. SSO. The FortiSASE Administrator Study Guide explicitly states that enabling SSO authentication overrides any other previously created authentication methods, including the local user database, LDAP, and RADIUS.

FortiSASE implements SSO for endpoint users through SAML. In this design, FortiSASE functions as the service provider (SP), while authentication is performed by an external identity provider (IdP), such as Okta, FortiAuthenticator, or another supported IdP. The user database therefore does not need to be hosted directly on FortiSASE. Instead, FortiSASE redirects the user to the IdP and uses the resulting SAML assertion to establish the authenticated SSO session. The study guide confirms that SSO can be configured for both VPN users and Secure Web Gateway (SWG) users.

A. Local and C. RADIUS are authentication sources that SSO supersedes when SSO is enabled. D. MFA is an additional authentication-strength mechanism rather than the FortiSASE authentication mode described as overriding previously configured methods.

Study Guide Reference: User Onboarding and Additional Features > Configuring SSO > VPN User SSO / SWG User SSO, FortiSASE Administrator Study Guide, page 56.

Questions no: 9 Verified Answer: B

Comprehensive and Detailed Explanation with all FortiSASE and SD-WAN 7.6 Core Administrator curriculum documents: According to the SD-WAN 7.6 Core Administrator study guide and FortiOS 7.6 Administration Guide, the behavior for deleting an SD-WAN member from the GUI when it is the only member in its zone is governed by the following operational logic:

Reference Checks: Before allowing the deletion of any SD-WAN member, FortiOS performs a " check for dependencies. " If an interface is being used in an active Performance SLA or an SD-WAN Rule, the GUI will typically prevent the deletion or gray out the option until those references are removed. However, the question specifies that this member is no longer used in health-checks or rules.

Zone Integrity: Unlike some other network objects, an SD-WAN zone is permitted to exist without any members. When you delete the final member of a user-defined zone through the GUI, the zone itself remains in the configuration as an empty container.

Route Management: When an SD-WAN member is deleted, any static routes that were specifically tied to that interface ' s membership in the SD-WAN bundle are automatically updated or removed by the FortiGate to prevent routing loops or " black-holing " traffic. This is part of the automated cleanup process handled by the FortiOS management plane.

GUI vs. CLI: In the GUI, the process is streamlined to allow the removal of the member interface. Once the member is deleted, the interface returns to being a " regular " system interface and can be used for standard firewall policies or other functions.

Why other options are incorrect:

Option A: There is no requirement that a zone must contain at least one member; " empty " zones are valid configuration objects in FortiOS 7.6.

Option C: While the deletion is accepted, it is not with " no further action " —the system must still reconcile the routing table and interface status.

Option D: FortiGate does not automatically move deleted members into the default zone (virtual-wan-link). Once deleted, the interface is simply no longer an SD-WAN member.

According to the FortiSASE 7.6 Architecture Guide and the FCP - FortiSASE 24/25 Administrator study materials, the FortiSASE solution is structured around three primary pillars or " use cases " that address the security requirements of a modern distributed workforce.

Secure Internet Access (SIA) (Option A): This use case focus on protecting remote users as they browse the public internet. It utilizes a full cloud-delivered security stack including Web Filtering, DNS Filtering, Anti-Malware, and Intrusion Prevention (IPS) to ensure that users are protected from web-based threats regardless of their physical location.

Secure SaaS Access (SSA) (Option B): This use case addresses the security of cloud-based applications (like Microsoft 365, Salesforce, and Dropbox). It leverages Inline-CASB (Cloud Access Security Broker) to identify and control " Shadow IT " —unauthorized cloud applications used by employees—and applies Data Loss Prevention (DLP) to prevent sensitive information from being leaked into unsanctioned SaaS platforms.

Secure Private Access (SPA) (Option C): This use case provides secure, granular access to private applications hosted in on-premises data centers or private clouds. It can be achieved through two main methods: ZTNA (Zero Trust Network Access), which provides session-specific access based on identity and device posture, or through SD-WAN integration, where the FortiSASE cloud acts as a spoke connecting to a corporate SD-WAN Hub.

Why other options are incorrect:

Secure VPN Access (SVA) (Option D): While SASE uses VPN technology (SSL or IPsec) as a transport for the Endpoint mode, " SVA " is not a formal curriculum-defined use case. The SASE framework is intended to evolve beyond traditional " Secure VPN Access " into the SIA and SPA models.

Secure Browser Access (SBA) (Option E): Although FortiSASE offers Remote Browser Isolation (RBI), it is considered a feature or a component of the broader Secure Internet Access (SIA) use case rather than a separate, standalone use case in the core administrator curriculum.

Based on the FortiSASE 7.6 (and later 2025 versions) curriculum and administration guides, the Vulnerability summary dashboard is a key component of the endpoint security posture management.

Drill Down Capability (Option C): According to the FortiSASE Administration Guide, the Vulnerability summary widget on the Security dashboard is interactive. An administrator can click on specific risk categories (e.g., Critical, High) or application types (e.g., Operating System, Web Client) to drill down. This action opens a detailed pane showing the specific affected endpoints, associated CVE identifiers, and severity classifications based on the CVSS standard.

Automatic Vulnerability Patching (Option D): In the FortiSASE 7.6/2025 feature sets, the endpoint profile configuration (under Endpoint > Configuration > Profiles) includes an " Automatic Patching " section. This feature allows the system to automatically install security updates for supported third-party applications and the underlying operating system (Windows/macOS) when vulnerabilities are detected. Furthermore, administrators can schedule these patches directly from the Vulnerability Summary widget by selecting specific vulnerabilities.

Why other options are incorrect:

Option A: The dashboard categories (Operating System, Web Client, Microsoft Office, etc.) are based on known software signatures. While there is an " Other " category, the dashboard primarily provides scores for recognized applications where CVE data is available.

Option B: The exhibit shows active data (157 total vulnerabilities), which indicates that the vulnerability scan is enabled and currently reporting data from the endpoints. If it were disabled, the widget would be empty or show zeros.

According to the SD-WAN 7.6 Core Administrator study guide and the FortiOS 7.6 Administration Guide, configuring load balancing within SD-WAN rules requires an understanding of how the engine selects and distributes sessions across multiple links.

SLA Target Logic (Option A): In FortiOS 7.6, the Lowest Cost (SLA) strategy has been enhanced. When the load-balance option is enabled for this strategy, the FortiGate does not just pick a single " best " link; it identifies all member interfaces that currently meet the configured SLA target (e.g., latency < 100ms). It then load balances the traffic across all those healthy links to maximize resource utilization.

Hash Modes (Option D): When an SD-WAN rule is configured for load balancing (valid for Manual and Lowest Cost (SLA) strategies in 7.6), the administrator must define a hash mode to determine how sessions are distributed. While " outsessions " in the question is a common exam-variant typo for outbandwidth (or sessions-based hashing), the core principle remains: you can select the specific load-balancing algorithm (e.g., source-ip, round-robin, or bandwidth-based) for all strategies where load-balancing is enabled.

Why other options are incorrect:

Option B and C: These options are too restrictive. In FortiOS 7.6, load balancing is not limited to only " manual and best quality " or " manual and lowest cost " in a singular way. The documentation highlights that Manual and Lowest Cost (SLA) are the primary strategies that support the explicit load-balance toggle to steer traffic through multiple healthy members simultaneously.

The three documented work-from-anywhere challenges are inconsistent security, lack of visibility and control, and performance issues . Fortinet explains that users can receive different levels of protection depending on location and trust context, creating inconsistent security enforcement. The traditional architecture also produces limited visibility into remotely accessed SaaS traffic and corporate data, creating security blind spots. FortiSASE_25_Administrator_Stud… Performance is another challenge because traditional remote-access designs commonly backhaul internet and SaaS traffic through corporate VPN infrastructure, which can introduce latency and degrade the user experience. FortiSASE_25_Administrator_Stud… FortiSASE addresses these problems by delivering consistent cloud-based security inspection, centralized visibility and policy enforcement, and optimized access from distributed locations. Lack of raw bandwidth and remote internet connectivity themselves are not the three architectural challenges identified by the FortiSASE course material.

================

FortiSASE endpoint upgrade rules provide controlled deployment of the latest supported FortiClient version. The FortiSASE study material specifies that administrators can either perform an upgrade immediately or configure a scheduled start time, with the scheduled deployment based on the endpoint ' s local time. It also identifies endpoint groups as the targeting mechanism and explains that automatic reboot behavior is configurable rather than unconditional.

Therefore, A is correct. Fortinet ' s Endpoint Upgrade documentation provides the exact scheduling behavior: when Scheduled (endpoint local time) is configured and the endpoint ' s clock has already passed the selected time, FortiClient installation is deferred until the next day at that selected time.

B is incorrect because upgrade rules cannot be assigned to a user group or user object; they apply to computer/device groups or computer/device objects. C is incorrect because only the Immediate option begins installation immediately; a scheduled deployment follows its configured local schedule. D is incorrect because the automatic reboot setting applies to Windows endpoints. Fortinet specifically states that macOS endpoints do not require a reboot to complete the FortiClient installation.

Study Guide Reference: Endpoint Management > Endpoint Upgrade; FortiSASE Enterprise Administrator Study Guide, Endpoint Management.

===============

According to the FortiSASE 24.4 Administration Guide and the FortiSASE Core Administrator training materials, the On-net detection rule setting is a critical component for determining the " trust status " of an endpoint ' s physical location.

Endpoint Location Verification: On-net rule sets are used to determine if FortiSASE considers an endpoint to be on-net (trusted) or off-net (untrusted). An endpoint is considered on-net when it is physically located within the corporate network, which is assumed to already have on-premises security measures (like a FortiGate NGFW).

Operational Impact: When an endpoint is detected as on-net, FortiSASE can be configured to exempt the endpoint from automatically establishing a VPN tunnel to the SASE cloud. This optimization prevents redundant security inspection and conserves SASE bandwidth since the user is already protected by the local corporate firewall.

Detection Methods: To classify an endpoint as on-net, administrators configure rule sets that look for specific environmental markers, such as:

Known Public (WAN) IP: If the endpoint ' s public IP matches the corporate headquarters ' egress IP.

DHCP Server: If the endpoint receives an IP from a specific corporate DHCP server.

DNS Server/Subnet: Matching internal DNS infrastructure or specific internal IP ranges.

Dynamic Policy Application: By accurately determining if an endpoint is on or off-net, FortiSASE ensures that the FortiClient agent only initiates its secure internet access (SIA) tunnel when the user is in an untrusted location (e.g., a home network or public Wi-Fi).

Why other options are incorrect:

Option A: User authentication is a separate process and is not controlled by the on/off-net detection rules, which focus on the network environment rather than user credentials.

Option B: While on-net status affects how traffic is routed (VPN vs. local), these rules specifically determine the status itself rather than defining the routing tables for private vs. cloud resources.

Option D: Geographical location (Geo-location) is a different filtering criterion often used in firewall policies; on-net detection is specifically about the proximity to the trusted corporate perimeter.

FortiView is designed to transform FortiSASE log information into aggregated, consolidated views that make operational and security analysis easier than reviewing individual raw log entries. The study guide describes FortiView as a consolidated series of consoles that enables administrators to analyze security events over a selected time period and according to different sorting criteria. It can display the resulting information through both graphical and text-based consoles and presents metadata derived from available logs rather than simply listing every log individually. FortiSASE_25_Administrator_Stud… Therefore, option D accurately describes FortiView. Options A and C incorrectly remove aggregation and flexible sorting, while B incorrectly characterizes FortiView primarily as an alert-generation mechanism and limits its presentation to a single text console. FortiView ' s core purpose is consolidated visibility and analysis.

================