NSE5_SSE_AD-7.6 Exam dumps PDF | Exam-Dumps.net (Page: 2)

QUESTION: 9

Which statement about security posture tags in FortiSASE is correct?

Multiple tags can be assigned to an endpoint, but only one is used for evaluation.
Multiple tags can be assigned to an endpoint and used for evaluation.
Tags are static and do not change with endpoint status.
Only one tag can be assigned to an endpoint.

Answer(s): B

Explanation:

According to the FortiSASE 7.6 Administration Guide and FCP - FortiSASE 24/25 Administrator curriculum, security posture tags (often referred to as ZTNA tags) are the fundamental building blocks for identity-based and posture-based access control.

Multiple Tag Assignment: A single endpoint can be assigned multiple tags at the same time. For example, an endpoint might simultaneously have the tags "OS-Windows-11", "AV-Running", and "Corporate-Domain-Joined".

Evaluation Logic: During the policy evaluation process (for both SIA and SPA), FortiSASE or the FortiGate hub considers all tags assigned to the endpoint. Security policies can be configured to use these tags as source criteria. If an administrator defines a policy that requires both "AV-Running" and "Corporate-Domain-Joined," the system evaluates both tags to decide whether to permit the traffic.

Dynamic Nature: Contrary to Option C, these tags are highly dynamic. They are automatically applied or removed in real-time based on the telemetry data sent by the FortiClient to the SASE cloud. If a user disables their antivirus, the "AV-Running" tag is removed immediately, and the endpoint's access is revoked by the next policy evaluation.

Scalability: While the system supports many tags, documentation recommends a baseline of custom tags for optimal performance, though it confirms that multiple tags are standard for reflecting a comprehensive security posture.

Why other options are incorrect:

Option A: This is incorrect because the system does not pick just one tag; it evaluates the collection of tags against the policy's requirements (e.g., matching any or matching all).

Option C: This is incorrect because tags are dynamic and change as soon as the endpoint's status (like vulnerability count or software presence) changes.

Option D: This is incorrect because the architectural advantage of ZTNA is the ability to layer multiple security "checks" (tags) for a single user.

Reveal Solution Next Question

QUESTION: 10

What is the purpose of the on/off-net rule setting in FortiSASE?

To enable or disable user authentication for external network access.
To define different traffic routing rules for on-premises and cloud-based resources.
To determine if an endpoint is connecting from a trusted network or untrusted location.
To configure different access policies for users based on their geographical location.

Answer(s): C

Explanation:

According to the FortiSASE 24.4 Administration Guide and the FortiSASE Core Administrator training materials, the On-net detection rule setting is a critical component for determining the "trust status" of an endpoint's physical location.

Endpoint Location Verification: On-net rule sets are used to determine if FortiSASE considers an endpoint to be on-net (trusted) or off-net (untrusted). An endpoint is considered on-net when it is physically located within the corporate network, which is assumed to already have on-premises security measures (like a FortiGate NGFW).

Operational Impact: When an endpoint is detected as on-net, FortiSASE can be configured to exempt the endpoint from automatically establishing a VPN tunnel to the SASE cloud. This optimization prevents redundant security inspection and conserves SASE bandwidth since the user is already protected by the local corporate firewall.

Detection Methods: To classify an endpoint as on-net, administrators configure rule sets that look for specific environmental markers, such as:

Known Public (WAN) IP: If the endpoint's public IP matches the corporate headquarters' egress IP.

DHCP Server: If the endpoint receives an IP from a specific corporate DHCP server.

DNS Server/Subnet: Matching internal DNS infrastructure or specific internal IP ranges.

Dynamic Policy Application: By accurately determining if an endpoint is on or off-net, FortiSASE ensures that the FortiClient agent only initiates its secure internet access (SIA) tunnel when the user is in an untrusted location (e.g., a home network or public Wi-Fi).

Why other options are incorrect:

Option A: User authentication is a separate process and is not controlled by the on/off-net detection rules, which focus on the network environment rather than user credentials.

Option B: While on-net status affects how traffic is routed (VPN vs. local), these rules specifically determine the status itself rather than defining the routing tables for private vs. cloud resources.

Option D: Geographical location (Geo-location) is a different filtering criterion often used in firewall policies; on-net detection is specifically about the proximity to the trusted corporate perimeter.

Reveal Solution Next Question

QUESTION: 11

Which FortiSASE feature monitors SaaS application performance and connectivity to points of presence (POPs)?

Operations widgets
FortiView dashboards
Event logs
Digital experience monitoring

Answer(s): D

Explanation:

According to the FortiSASE 7.6 Administration Guide and Digital Experience Monitoring (DEM) documentation, the feature specifically designed to monitor SaaS application performance and connectivity to PoPs is Digital Experience Monitoring (DEM).

SaaS and Path Visibility: DEM assists administrators in troubleshooting remote user connectivity issues by providing enhanced health check visibility for SaaS applications, endpoint devices, and the network path. It provides real-time insights into application performance and latency issues.

PoP Connectivity: It monitors the digital journey from the end-user device through the Security Points of Presence (POPs) to the final application, identifying hops where degraded service (packet loss, delay, or jitter) is detected.

Proactive Management: By establishing thresholds and simulating user activities through Synthetic Transaction Monitoring (STM), DEM allows IT teams to identify performance problems before they impact the business.

Why other options are incorrect:

Option A: Operations widgets provide general status overviews but do not offer the granular per-hop path analysis or specific SaaS transaction monitoring found in DEM.

Option B: FortiView dashboards provide traffic visibility and session data but are not dedicated performance monitoring tools for end-to-end digital experience.

Option C: Event logs record system occurrences and security events but do not provide real-time performance metrics or health check probes for SaaS applications.

Reveal Solution Next Question

QUESTION: 12

For a small site, an administrator plans to implement SD-WAN and ensure high network availability for business-critical applications while limiting the overall cost and the cost of pay-per-use backup connections.

Which action must the administrator take to accomplish this plan?

Use a mid-range FortiGate device to implement standalone SD-WAN.
Implement dynamic routing.
Set up a high availability (HA) cluster to implement standalone SD-WAN.
Configure at least two WAN links.

Answer(s): D

Explanation:

According to the SD-WAN 7.6 Core Administrator curriculum, to implement an SD-WAN solution that ensures high network availability for business-critical applications while managing costs, the administrator must configure at least two WAN links.

SD-WAN Fundamentals: SD-WAN operates by creating a virtual overlay across multiple physical or logical transport links (e.g., broadband, LTE, MPLS). Without at least two links, the SD-WAN engine has no alternative path to steer traffic toward if the primary link fails or degrades.

Cost Management: By using multiple links, administrators can implement the Lowest Cost (SLA) or Maximize Bandwidth strategies. This allows the site to use a low-cost broadband connection for primary traffic and only failover to a "pay-per-use" backup (like LTE) when the primary link's quality falls below the defined SLA target.

High Availability (Link Level): While a "High Availability (HA) cluster" (Option C) provides device redundancy (protecting against a hardware failure of the FortiGate itself), it does not address link redundancy or steering, which are the core functions of SD-WAN for application uptime.

Why other options are incorrect:

Option A: Using a mid-range device refers to hardware capacity but does not solve the requirement for link-level redundancy and cost-steering logic.

Option B: Dynamic routing (like BGP or OSPF) is often used with SD-WAN in large topologies, but for a small site, the primary mechanism for meeting availability and cost goals is the configuration of the SD-WAN member links and rules themselves.

Option C: HA clusters protect against hardware failure, but the question specifically asks about ensuring availability for applications while limiting backup link costs, which is a traffic-steering (SD- WAN) requirement rather than a hardware-redundancy requirement.

Reveal Solution Next Question

QUESTION: 13

An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1-VPN1. However, the traffic is routed over HUB1-VPN3.

Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two.)

HUB1-VPN1 does not have a valid route to the destination.
HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device.

Answer(s): A,C

Explanation:

According to the SD-WAN 7.6 Core Administrator curriculum and the diagnostic outputs shown in the exhibit, the reason traffic is steered to HUB1-VPN3 instead of the expected HUB1-VPN1 (defined in SD-WAN rule ID 1) can be explained by two core routing principles in FortiOS:

Valid Route Requirement (Option A): In the diagnose sys sdwan service 4 output (which corresponds to Rule ID 1), it shows the rule has members HUB1-VPN1, HUB1-VPN2, and HUB1-VPN3. A key principle of SD-WAN steering is that for a member to be "selectable" by a rule, it must have a valid route to the destination in the routing table (RIB/FIB). If the routing table output (the third section of the exhibit) shows a route to 10.0.0.0/8 via HUB1-VPN3 but not through HUB1-VPN1, the SD-WAN engine will skip HUB1-VPN1 entirely because it is considered a "non-reachable" path for that specific destination.

Policy Route Precedence (Option D): In the FortiOS route lookup hierarchy, Regular Policy Routes (PBR) are evaluated before SD-WAN rules. If an administrator has configured a traditional Policy Route (found under Network > Policy Routes) that matches traffic destined for 10.0.0.0/8 and specifies HUB1-VPN3 as the outgoing interface, the FortiGate will forward the packet based on that policy route and will never evaluate the SD-WAN rules for that session. This "bypass" occurs regardless of whether the SD-WAN rule would have chosen a "better" link.

Why other options are incorrect:

Option B: While member configuration priority (cfg_order) is a tie-breaker in some strategies, the SD-

WAN rule logic is only applied if the routing table allows it or if a higher-priority policy route doesn't intercept the traffic first.

Option C: Lower route priority (which means higher preference in the RIB) affects the Implicit Rule (standard routing). However, SD-WAN rules are designed to override RIB priority for matching traffic. If HUB1-VPN1 was a valid candidate and no Policy Route existed, the SD-WAN rule would typically ignore RIB priority to enforce its own steering strategy.

Reveal Solution Next Question

QUESTION: 14

Which configuration is a valid use case for FortiSASE features in supporting remote users?

Enabling secure SaaS access through SD-WAN integration, protecting against web-based threats with data loss prevention, and monitoring user connectivity with shadow IT visibility.
Monitoring SaaS application performance, isolating browser sessions for all websites, and integrating with SD-WAN for data loss prevention.
Enabling secure web browsing to protect against threats, providing explicit application access with zero-trust or SD-WAN integration, and addressing shadow IT visibility with data loss prevention.
Providing secure web browsing through remote browser isolation, addressing shadow IT with zero-trust access, and protecting data at rest only.

Answer(s): C

Explanation:

According to the FortiSASE 7.6 Architecture Guide and FCP - FortiSASE 24/25 Administrator materials, the solution is built around three primary use cases that support a hybrid workforce:

Secure Internet Access (SIA): This enables secure web browsing by applying security profiles such as Web Filter, Anti-Malware, and SSL Inspection in the SASE cloud. It protects remote users from internet-based threats regardless of their location.

Secure Private Access (SPA): This provides granular, explicit access to private applications hosted in data centers or the cloud. It is achieved through ZTNA (Zero Trust Network Access) for session-based security or through SD-WAN integration where FortiSASE acts as a spoke to an existing corporate SD- WAN hub.

SaaS Security: FortiSASE utilizes Inline-CASB and Shadow IT visibility to monitor and control the use of cloud applications. Data Loss Prevention (DLP) is integrated into these workflows to prevent sensitive corporate data from being uploaded to unauthorized SaaS platforms.

Why other options are incorrect:

Option A: While it mentions SD-WAN and Shadow IT, it misses the core definition of SIA (secure web browsing) which is the primary driver for SASE deployments.

Option B: Remote Browser Isolation (RBI) is typically applied to risky or uncategorized websites, not "all websites," due to the high performance and resource overhead.

Option D: FortiSASE is designed to protect data in motion (via security profiles) as well as data stored in sanctioned cloud apps, not "at rest only".

Reveal Solution Next Question

QUESTION: 15

Which two delivery methods are used for installing FortiClient on a user's laptop? (Choose two.)

Use zero-touch installation through a third-party application store.
Download the installer directly from the FortiSASE portal.
Send an invitation email to selected users containing links to FortiClient installers.
Configure automatic installation through an API to the user's laptop.

Answer(s): B,C

Explanation:

The FortiSASE 7.6 Administration Guide outlines the standard onboarding procedures for deploying the FortiClient agent to remote endpoints. There are two primary user-facing delivery methods:

Download from the FortiSASE portal (Option B): Administrators can provide users with access to the FortiSASE portal where they can directly download a pre-configured installer. This installer is uniquely tied to the organization's SASE instance, ensuring the client automatically registers to the correct cloud EMS upon installation.

Invitation Email (Option C): This is the most common administrative method. The FortiSASE portal (via its integrated EMS) allows administrators to send an invitation email to specific users or groups. This email contains direct download links for various operating systems (Windows, macOS, Linux) and the necessary invitation code for zero-touch registration.

Why other options are incorrect:

Option A: While third-party stores (like the App Store or Google Play) are used for mobile devices, "zero-touch installation through a third-party store" is not the standard curriculum-defined method for laptops (Windows/macOS) in a SASE environment.

Option D: FortiSASE does not use a direct "API to the user's laptop" for automatic installation.
While MDM/GPO (centralized deployment) is supported, it is not described as an API-based auto-

installation in the core curriculum.

Reveal Solution Next Question

QUESTION: 16

An existing Fortinet SD-WAN customer who has recently deployed FortiSASE wants to have a comprehensive view of, and combined reports for, both SD-WAN branches and remote users. How can the customer achieve this?

Forward the logs from FortiSASE to Fortinet SOCaaS.
Forward the logs from FortiGate to FortiSASE.
Forward the logs from FortiSASE to the external FortiAnalyzer.
Forward the logs from the external SD-WAN FortiAnalyzer to FortiSASE.

Answer(s): C

Explanation:

For customers with hybrid environments (on-premises SD-WAN branches and remote FortiSASE users), the FortiOS 7.6 and FortiSASE curriculum recommends centralized log aggregation for unified visibility.

Centralized Reporting: The standard architectural best practice is to forward logs from FortiSASE to an external FortiAnalyzer (Option C).

Unified View: Since the customer's on-premises FortiGate SD-WAN branches are already sending logs to an existing FortiAnalyzer, adding the FortiSASE log stream to that same FortiAnalyzer allows for the creation of combined reports.

Fabric Integration: This setup leverages the Security Fabric, enabling the FortiAnalyzer to provide a single pane of glass for monitoring security events, application usage, and SD-WAN performance metrics across the entire distributed network.

Why other options are incorrect:

Option A: SOCaaS is a managed service for threat monitoring, not a primary tool for an administrator to generate combined SD-WAN/SASE operational reports.

Option B: FortiSASE is not designed to act as a log collector or reporting hub for external on-premises FortiGates.

Option D: Data flows from the source (FortiSASE) to the collector (FortiAnalyzer), not the other way around.

Reveal Solution Next Question

Fortinet NSE5_SSE_AD-7.6 Exam (page: 2) Fortinet NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator Updated on: 19-Feb-2026

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

QUESTION: 16

Explanation:

Fortinet NSE5_SSE_AD-7.6 Exam (page: 2)
Fortinet NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator
Updated on: 19-Feb-2026