Fortinet NSE7_SSE_AD-25 Practice Exam Questions & Answers

Question 6 of 36

Refer to the exhibits.
Exam NSE7_SSE_AD-25: Image 1

A FortiSASE administrator has configured an antivirus profile in the security profile group and applied it to the internet access policy. Remote users are still able to download the eicar.com-zip file from https: //eicar.org.
Which configuration on FortiSASE is allowing users to perform the download?

Deep inspection is not enabled.

Application control is exempting all the browser traffic.

Web filter is allowing the URL.

Intrusion prevention is disabled.

Question 7 of 36

Refer to the exhibit.
Exam NSE7_SSE_AD-25: Image 1

Which two prerequisites must be met to use the feature shown in the exhibit? (Choose two.)

The secure private access (SPA) feature must be configured in FortiSASE.

The relevant FortiGate ZTNA application gateway must be configured.

FortiClient must be installed on the user’s device to access the private application.

The proxy and proxy user single sign-on (SSO) features must be configured in FortiSASE.

Question 8 of 36

Refer to the exhibit.
Exam NSE7_SSE_AD-25: Image 1

A customer configured the On/off-net detection rule to disable FortiSASE VPN auto-connect when users are inside the corporate network. The rule is set to Connects with a known public IP using the company’s public IP address. However, when the users are on the corporate network, the FortiSASE VPN still auto-connects. The customer has confirmed that traffic is going to the internet with the correct IP address.
Which configuration is causing the issue?

The On-net rule set configuration is incorrect.

Allow local LAN access when endpoint is on-net is disabled when it should be enabled.

Exempt endpoint from FortiSASE auto-connect is disabled when it should be enabled.

Is connected to a known DNS server should be enabled and configured.

Question 9 of 36

How does FortiSASE Secure Private Access (SPA) facilitate connectivity to private resources in a hub-and-spoke network?

SPA establishes direct links to spokes without IPsec or BGP and uses an easy configuration key to secure web traffic for remote users.

SPA applies source network address translation (SNAT) for remote user traffic and uses IKEv1 for IPsec tunnels to connect to standalone hubs without BGP support.

SPA connects to private resources using HTTP and HTTPS protocols and relies on FortiClient for agentless access to SD-WAN deployments.

SPA connects a FortiSASE POP to a FortiGate hub or SD-WAN deployment using IPsec and BGP for dynamic route exchange with an easy configuration key for simplified setup on FortiOS.

Question 10 of 36

For monitoring potentially unwanted applications on endpoints, which information is available on the FortiSASE software installations page? (Choose two.)

The endpoint the software is installed on

The license status of the software

The vendor of the software

The usage frequency of the software