Refer to the exhibits.A FortiSASE administrator has configured an antivirus profile in the security profile group and applied it to the internet access policy. Remote users are still able to download the eicar.com-zip file from https://eicar.org. Traffic logs show traffic is allowed by the policy. Which configuration on FortiSASE is allowing users to perform the download?
Answer(s): A
Based on the provided exhibits and the configuration details, the reason why users are still able to download the eicar.com-zip file despite having an antivirus profile applied is due to the Web Filter allowing the traffic. Here is the step-by-step detailed explanation:Web Filtering Logs Analysis:The logs show that the traffic to the destination port 443 (which is HTTPS) is allowed and the security event triggered is Web Filter.The log details indicate that the URL belongs to an allowed category in the policy and thus, the traffic is permitted by the Web Filter.Security Profile Group Configuration:The Web Filter with Inline-CASB section indicates that the site www.eicar.org is being monitored (93 occurrences) and not blocked.Since the Web Filter is set to allow traffic from this site, the antivirus profile will not block it because the Web Filter decision takes precedence.Antivirus Profile Configuration:Although the antivirus profile is configured, the logs do not show any antivirus actions being triggered. This indicates that the web filter is overriding the antivirus action.Policy Configuration:The policy named "Web Traffic" shows that it has logging enabled and is set to accept traffic. The profile group "SIA" applied to this policy includes both Web Filter and Antivirus settings. However, since the Web Filter is allowing the traffic, the antivirus profile does not get the chance to inspect it.
FortiGate Security 7.2 Study Guide: Provides details on the precedence of web filtering over antivirus in security profiles.Fortinet Knowledge Base: Detailed explanation of web filtering and antivirus profiles interaction.
An organization wants to block all video and audio application traffic but grant access to videos from CNN Which application override action must you configure in the Application Control with Inline- CASB?
Answer(s): D
To block all video and audio application traffic while granting access to videos from CNN, you need to configure an application override action in the Application Control with Inline-CASB. Here is the step- by-step detailed explanation:Application Control Configuration:Application Control is used to identify and manage application traffic based on predefined or custom application signatures.Inline-CASB (Cloud Access Security Broker) extends these capabilities by allowing more granular control over cloud applications.Blocking Video and Audio Applications:To block all video and audio application traffic, you can create a policy within Application Control to deny all categories related to video and audio streaming.Granting Access to Specific Videos (CNN):To allow access to videos from CNN specifically, you must create an override rule within the same Application Control profile.The override action "Exempt" ensures that traffic to specified URLs (such as those from CNN) is not subjected to the blocking rules set for other video and audio traffic.Configuration Steps:Navigate to the Application Control profile in the FortiSASE interface. Set the application categories related to video and audio streaming to "Block." Add a new override entry for CNN video traffic and set the action to "Exempt."
FortiOS 7.2 Administration Guide: Detailed steps on configuring Application Control and Inline-CASB. Fortinet Training Institute: Provides scenarios and examples of using Application Control with Inline- CASB for specific use cases.
Refer to the exhibits.When remote users connected to FortiSASE require access to internal resources on Branch-2. how will traffic be routed?
Answer(s): C
When remote users connected to FortiSASE require access to internal resources on Branch-2, the following process occurs:SD-WAN Capability:FortiSASE leverages SD-WAN to optimize traffic routing based on performance metrics and priorities. In the priority settings, HUB-1 is configured with the highest priority (P1), whereas HUB-2 has a lower priority (P2).Traffic Routing Decision:FortiSASE evaluates the available hubs (HUB-1 and HUB-2) and selects HUB-1 due to its highest priority setting.Once the traffic reaches HUB-1, it is then routed to the appropriate branch based on internal routing policies.Branch-2 Access:Since HUB-1 has the highest priority, FortiSASE directs the traffic to HUB-1. HUB-1 then routes the traffic to Branch-2, providing the remote users access to the internal resources.
FortiOS 7.2 Administration Guide: Details on SD-WAN configurations and priority settings. FortiSASE 23.2 Documentation: Explains how FortiSASE integrates with SD-WAN to route traffic based on defined priorities and performance metrics.
What are two advantages of using zero-trust tags? (Choose two.)
Answer(s): A,B
Zero-trust tags are critical in implementing zero-trust network access (ZTNA) policies. Here are the two key advantages of using zero-trust tags:Access Control (Allow or Deny):Zero-trust tags can be used to define policies that either allow or deny access to specific network resources based on the tag associated with the user or device. This granular control ensures that only authorized users or devices with the appropriate tags can access sensitive resources, thereby enhancing security.Determining Security Posture:Zero-trust tags can be utilized to assess and determine the security posture of an endpoint. Based on the assigned tags, FortiSASE can evaluate the device's compliance with security policies, such as antivirus status, patch levels, and configuration settings. Devices that do not meet the required security posture can be restricted from accessing the network or given limited access.
FortiOS 7.2 Administration Guide: Provides detailed information on configuring and using zero-trust tags for access control and security posture assessment. FortiSASE 23.2 Documentation: Explains how zero-trust tags are implemented and used within the FortiSASE environment for enhancing security and compliance.
Refer to the exhibit.In the user connection monitor, the FortiSASE administrator notices the user name is showing random characters. Which configuration change must the administrator make to get proper user information?
In the user connection monitor, the random characters shown for the username indicate that log anonymization is enabled. Log anonymization is a feature that hides the actual user information in the logs for privacy and security reasons. To display proper user information, you need to disable log anonymization.Log Anonymization:When log anonymization is turned on, the actual usernames are replaced with random characters to protect user privacy.This feature can be beneficial in certain environments but can cause issues when detailed user monitoring is required.Disabling Log Anonymization:Navigate to the FortiSASE settings.Locate the log settings section.Disable the log anonymization feature to ensure that actual usernames are displayed in the logs and user connection monitors.
FortiSASE 23.2 Documentation: Provides detailed steps on enabling and disabling log anonymization. Fortinet Knowledge Base: Explains the impact of log anonymization on user monitoring and logging.
Share your comments for Fortinet FCSS_SASE_AD-23 exam with other users:
good to prepare in this site
very helpful to crack first attempt
please upload this exam
please upload the c_activate22 dump questions with answer
q10 - the answer should be a. if its c, the criteria will meet if either the prospect is not part of the suppression lists or if the job title contains vice president
this was on the exam as of 1211/2023
great for prep
i think in question 7 the first answer should be power bi portal (not power bi)
on question 10 and so far 2 wrong answers as evident in the included reference link.
wonderful material
i passed!! ...but barely! got 728, but needed 720 to pass. the exam hit me with labs right out of the gate! then it went to multiple choice. protip: study the labs!
correct answer for question 92 is c -aws shield
great !! it is really good
explanations for the answers are to the point.
how can rea next
question: 128 d is the wrong answer...should be c
thanks for az 700 dumps
thank you for this tableau dumps . it will helpfull for tableau certification
good content
just testing if the comments are real
very helpful for exam preparation
question 11: https://help.salesforce.com/s/articleview?id=sf.admin_lead_to_patient_setup_overview.htm&type=5
i think the answer to question 42 is b not c
thanks for the dump
fantastic assessments
i find the xengine test engine simulator to be more fun than reading from pdf.
nice document
thank you for making the questions and answers intractive and selectable.
answers are correct?
can i belive this dump
great site to practice for sitecore exam
good for students
nice practice dumps
nokia 4a0-114 dumps