In a FortiSASE environment, the Unified FortiClient agent is the critical component that fulfills the requirement for " always-on " connectivity and security for remote users.
* Persistent Encrypted Tunnels : The Unified FortiClient maintains a persistent, always-on connection to the FortiSASE infrastructure. 4 This is typically achieved through an auto-connect VPN tunnel (SSL or IPsec) that initiates as soon as the user logs into their device and has internet access.
* Continuous Security Enforcement : By staying connected to a nearby FortiSASE Point of Presence (PoP), the endpoint ensures that all traffic is inspected. This allows the organization to enforce a consistent security posture-including Web Filtering, Antivirus, and Application Control-regardless of whether the user is at home, in a coffee shop, or traveling.
* Zero-Trust Integration : Beyond simple connectivity, the unified agent supports Universal ZTNA . It continuously verifies the identity of the user and the security posture of the device before granting access to specific applications, thereby satisfying modern zero-trust security mandates.
* Comparison of Other Components :
* SD-WAN on-ramp (B) : Used primarily to integrate existing branch office SD-WAN networks with the SASE cloud for private application access.
* Secure Web Gateway (C) : While a feature of the SASE PoP, the agentless SWG deployment (using PAC files) does not provide the same level of " always-on " persistent tunnel protection as the FortiClient agent.
* Thin-branch SASE extension (D) : Focused on securing small branch locations (using FortiAP or FortiExtender) where individual client agents may not be deployed on every device.

The provided exhibit (image_57e69d.jpg) displays the Software Installations dashboard within the FortiSASE portal. This dashboard is a key component of the endpoint visibility and management features provided by the integrated FortiClient EMS functionality.
* Visible Metadata: The output provides a granular list of all software detected on managed endpoints, including the application Name , the Vendor (e.g., Igor Pavlov, Microsoft Corporation, Adobe), the specific Version currently installed, and critical timestamps such as First Detected and Last Installed .
* Administrative Utility: This information allows an administrator to audit the software environment effectively. By reviewing these details, they can identify unwanted software (PUA), shadow IT, or outdated software versions that may possess known vulnerabilities.
* Actions Available: While the primary view is informational, the presence of the View Endpoints button (visible in the top-left) allows administrators to pivot from a specific application to a list of all individual devices where that software is present, facilitating targeted remediation.
* Analysis of Incorrect Options:
* Option A: While FortiSASE manages profiles and tags, this specific " Software Installations " view is focused purely on software inventory.
* Option B: Although the " First Detected " date is visible, FortiSASE does not support " automatic patching " of third-party software directly from this inventory screen.
* Option C: The dashboard shows what is installed, not the " latest available " version in the market, nor does it provide a mechanism to " push updates " to these third-party applications.

The FortiSASE On/off-net detection feature is a two-part configuration designed to optimize bandwidth and user experience by determining when a device is in a trusted environment.
* Rule Set Definition: The first part involves defining what constitutes an " on-net " or " on-fabric " status. In this scenario, the customer successfully configured a rule set named CERT-PUBLIC-IP using the Connects with a known public IP detection type. This tells FortiSASE that if the endpoint's public WAN IP matches the corporate gateway, it is considered to be on the corporate network.
* Profile Exemption Logic: Defining the rule set is not enough to stop the VPN connection. Within the Endpoint Profile (under the Connection tab > On/off-net Settings), there is a specific toggle labeled Exempt endpoint from FortiSASE auto-connect when endpoint is on-net (or in some versions, Bypass FortiSASE when endpoint is on-net ).
* Exhibit Analysis: Looking at the provided exhibit (image_57097d.jpg), the " Exempt endpoint from FortiSASE auto-connect... " toggle is clearly disabled (switched to the left).
* Root Cause: Because this toggle is disabled, FortiClient identifies that it is " on-net " based on the IP rule, but it has no instruction to skip the VPN connection. Consequently, the " Automatically " initiate tunnel setting remains the dominant instruction, causing the VPN to connect regardless of the network location.
To resolve the issue, the administrator must enable the Exempt endpoint from FortiSASE auto-connect when endpoint is on-net option in the SASECert01 profile.

The correct answers are A and B . In the FortiGate ZTNA access proxy workflow, FortiSASE and FortiClient first exchange endpoint information, user login details, security posture, and certificate information.
FortiSASE then synchronizes the FortiClient certificate and security posture tags with FortiGate. The study guide states that FortiGate verifies the certificate, performs a user check, and performs a posture check based on the security posture tags before allowing encrypted access to the protected applications. This directly supports option A.
Option B is also correct because the ZTNA access proxy provides a direct path to private resources.
The guide describes the ZTNA access proxy use case as a direct connection to applications hosted behind FortiGate, with a TLS-encrypted tunnel automatically created from the endpoint to the access proxy. It further states that this use case offers the direct shortest path to private resources, improving performance and security. That makes it suitable for latency-sensitive applications. Option C is incorrect because this specific FortiGate ZTNA access proxy deployment requires FortiClient on endpoints; agentless ZTNA is handled separately through the FortiSASE agentless ZTNA portal.
Option D is not stated as a benefit of this deployment model.

To enable remote users to access internal applications located behind an existing FortiGate SD-WAN hub, the customer must license the FortiSASE Secure Private Access (SPA) add-on .
* Secure Private Access (SPA) Use Case: This specific add-on is designed to extend the Fortinet Security Fabric into the SASE cloud, allowing for a hub-and-spoke architecture where the FortiSASE PoPs act as spokes and the customer ' s on-premises FortiGate acts as the hub.
* Licensing Requirements: The SPA add-on is a per-hub (per service connection) license. It provides the necessary entitlements to establish IPsec tunnels and BGP peering between the SASE infrastructure and the corporate FortiGate.
* Feature Enablement: Once the SPA license is applied, the Configuration > Private Access menu becomes available in the FortiSASE portal. This allows administrators to define " Service Connections
" to their private data centers or cloud VPCs.
* Analysis of Other Options:
* Option A: The Global add-on is typically related to expanding the geographic reach or performance of the SASE PoPs, not specifically for private resource routing.
* Option B: The Branch On-Ramp refers to connecting physical office locations (Thin Edge) to SASE, rather than the specific licensing for private application access for remote users.
* Option D: Dedicated Public IP Address is used for source IP anchoring (SIA) to ensure remote users egress with a consistent IP for third-party SaaS IP-whitelisting.