FCSS - FortiSASE 23 Administrator

Here you have the best Fortinet FCSS_SASE_AD-23 practice exam questions

You have 44 total questions to study from
Each page has 5 questions, making a total of 9 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on November 19, 2025
This site is not affiliated with or endorsed by Fortinet.

Question 1 of 44

Refer to the exhibit.
Exam FCSS_SASE_AD-23: Question 1 - Image 1

The daily report for application usage shows an unusually high number of unknown applications by category.
What are two possible explanations for this? (Choose two.)

Certificate inspection is not being used to scan application traffic.

The inline-CASB application control profile does not have application categories set to Monitor.

Zero trust network access (ZTNA) tags are not being used to tag the correct users.

Deep inspection is not being used to scan traffic.

Correct Answer: B, D

Question 2 of 44

What are two advantages of using zero-trust tags? (Choose two.)

Zero-trust tags can be used to allow or deny access to network resources.

Zero-trust tags can determine the security posture of an endpoint.

Zero-trust tags can be used to create multiple endpoint profiles which can be applied to different endpoints.

Zero-trust tags can be used to allow secure web gateway (SWG) access.

Correct Answer: A, B

Question 3 of 44

Refer to the exhibits.
Exam FCSS_SASE_AD-23: Question 3 - Image 1

Exam FCSS_SASE_AD-23: Question 3 - Image 2

Exam FCSS_SASE_AD-23: Question 3 - Image 3

Exam FCSS_SASE_AD-23: Question 3 - Image 4

Exam FCSS_SASE_AD-23: Question 3 - Image 5

A FortiSASE administrator is trying to configure FortiSASE as a spoke to a FortiGate hub. The VPN tunnel does not establish.
Based on the provided configuration, what configuration needs to be modified to bring the tunnel up?

NAT needs to be enabled in the Spoke-to-Hub firewall policy.

The BGP router ID needs to match on the hub and FortiSASE.

FortiSASE spoke devices do not support mode config.

The hub needs IKEv2 enabled in the IPsec phase 1 settings.

Correct Answer: D

Question 4 of 44

Refer to the exhibits.
Exam FCSS_SASE_AD-23: Question 4 - Image 1

Exam FCSS_SASE_AD-23: Question 4 - Image 2

When remote users connected to FortiSASE require access to internal resources on Branch-2, how will traffic be routed?

FortiSASE will use the SD-WAN capability and determine that traffic will be directed to HUB-2, which will then route traffic to Branch-2.

FortiSASE will use the AD VPN protocol and determine that traffic will be directed to Branch-2 directly, using a static route.

FortiSASE will use the SD-WAN capability and determine that traffic will be directed to HUB-1, which will then route traffic to Branch-2.

FortiSASE will use the AD VPN protocol and determine that traffic will be directed to Branch-2 directly, using a dynamic route.

Correct Answer: D

Question 5 of 44

Refer to the exhibits.
Exam FCSS_SASE_AD-23: Question 5 - Image 1

Exam FCSS_SASE_AD-23: Question 5 - Image 2

Exam FCSS_SASE_AD-23: Question 5 - Image 3

A FortiSASE administrator has configured an antivirus profile in the security profile group and applied it to the internet access policy. Remote users are still able to download the eicar.com-zip file from https://eicar.org. Traffic logs show traffic is allowed by the policy.
Which configuration on FortiSASE is allowing users to perform the download?

Web filter is allowing the traffic.

IPS is disabled in the security profile group.

The HTTPS protocol is not enabled in the antivirus profile.

Force certificate inspection is enabled in the policy.

Correct Answer: D