In a default FortiSASE deployment, endpoints are typically onboarded using a shared invitation code sent via email. While this code simplifies deployment, it can represent a security risk if the code is leaked or intercepted, as any device with the code could potentially register with the SASE management service.
* User Verification (SAML SSO): To mitigate this risk, administrators can enable user verification as an additional layer of security. 3 When this feature is enforced, entering the invitation code is no longer sufficient to complete registration.
* Authentication Workflow: After the end user enters the invitation code in FortiClient, they are prompted to provide their corporate credentials via a SAML SSO login. 5 FortiSASE acts as the Service Provider (SP), while an external identity provider (IdP) such as Microsoft Entra ID, Okta, or FortiAuthenticator verifies the user ' s identity.
* Security Benefit: This ensures that only authenticated users -not just anyone with a valid code-can successfully register an endpoint and receive the organization ' s security and VPN profiles. It prevents unauthorized " shadow " endpoints from joining the managed environment.
* Incorrect Options:
* Option A: Security posture tags are used after registration to determine if an endpoint is compliant (e.g., checking if an antivirus is active); they do not secure the registration process itself.
* Option C and D: Device identification and application inventory are monitoring and visibility features that occur once the endpoint is already managed.
Refer to the exhibit. Based on the configuration shown in image_595357.jpg , FortiSASE will process sessions requiring FortiSandbox inspection in the following two ways:
A). Only endpoints assigned a profile for sandbox detection will be processed by the sandbox feature.
C). All files executed on a USB drive will be sent to FortiSandbox for analysis.
The provided exhibit displays an Endpoint Profile configuration specifically for the Sandbox module. This profile controls how the FortiClient agent on remote endpoints interacts with the integrated FortiSASE cloud sandbox engine.
* Profile Assignment (A): In the FortiSASE architecture, security and endpoint settings are organized into profiles that must be explicitly assigned to users or user groups via endpoint policies.
Consequently, the sandbox detection and remediation features are active only on those endpoints that have been assigned this specific endpoint profile . If an endpoint is not assigned a profile with sandbox enabled, it will not submit files for analysis.
* Removable Media Analysis (C): Under the File Submission Options , the toggle for All Files Executed from Removable Media is enabled (shown in blue). Since USB drives are the most common form of removable media, this configuration ensures that any file executed from a USB drive is intercepted by FortiClient and submitted to the FortiSASE sandbox for behavioral analysis before being allowed to run, protecting the endpoint from offline-delivered threats.
* Understanding Verdict Levels (B): The exhibit shows the Action is set to Quarantine and the Sandbox Detection Verdict Level is set to Medium . This configuration functions as a threshold; FortiClient will quarantine any file that receives a verdict of Medium or higher (including High and Malicious). Option B is incorrect because it claims only medium-level files are quarantined, which ignores the high-risk and malicious files that would also be blocked.
* Sandbox Mode (D): The Sandbox Mode is clearly set to FortiSASE , which utilizes the built-in cloud- native sandbox. This contradicts Option D, which suggests the use of an on-premises or standalone sandbox appliance.

In the Fortinet SASE architecture, Zero Trust Network Access (ZTNA) tags (which have been renamed to Security Posture Tags starting with FortiClient/EMS 7.4.0) play a critical role in continuous posture assessment. These tags are dynamic metadata assign 8 ed to an endpoint based on specific conditions or " tagging rules " defined in the FortiSASE Endpoint Management Service (EMS).
* Posture Determination: The FortiClient agent, installed on the endpoint, monitors the device for various security attributes-such as whether an antivirus is running, the presence of specific registry keys, OS version, or the absence of critical vulnerabilities.
* SIA (Secure Internet Access) Use Case: In SIA scenarios, FortiSASE uses these tags within security policies to control internet access. For example, a policy may allow full internet access only to endpoints tagged as " Compliant " while redirecting " Non-Compliant " devices to a restricted remediation portal.
* SPA (Secure Private Access) Use Case: In SPA (specifically ZTNA Proxy mode), the tags are synchronized from FortiSASE to the corporate FortiGate (acting as the ZTNA Access Proxy). 12 When a user attempts to access a private application, the FortiGate checks the endpoint ' s client certificate and its synchronized ZTNA tags. 13 If the endpoint does not meet the required posture (e.g., it is missing a required " Domain-Joined " tag), access is denied at the session level.
According to the FortiSASE 25 Enterprise Administrator Study Guide , ZTNA tags are fundamental to the
" Zero Trust " principle because they move beyond static identity (username/password) to verify the real-time security state of the device before granting access to either the internet or internal private resources.

To meet the requirement of inspecting all endpoint internet traffic on FortiSASE while excluding Google Maps traffic from the FortiSASE VPN tunnel and redirecting it to the endpoint's physical interface, you should configure split tunneling. Split tunneling allows specific traffic to bypass the VPN tunnel and be routed directly through the endpoint's local interface.
* Split Tunneling Configuration:
* Split tunneling enables selective traffic to be routed outside the VPN tunnel.
* By configuring the Google Maps Fully Qualified Domain Name (FQDN) as a split tunneling destination, you ensure that traffic to Google Maps bypasses the VPN tunnel and uses the endpoint's local interface instead.
* Implementation Steps:
* Access the FortiSASE endpoint profile configuration.
* Add the Google Maps FQDN to the split tunneling destinations list.
* This configuration directs traffic intended for Google Maps to bypass the VPN tunnel and be routed directly through the endpoint's physical network interface.
References:
FortiOS 7.6 Administration Guide: Provides details on split tunneling configuration.
FortiSASE 23.2 Documentation: Explains how to set up and manage split tunneling for specific destinations.

Based on the settings shown in the provided exhibits, the vulnerability remediation workflow is determined by the Endpoint Profile and the Vulnerability Dashboard .
* Endpoint Profile Evaluation: The top exhibit displays the Scan for Vulnerabilities settings. The toggle for Automatically patch vulnerabilities is explicitly set to Disabled . Consequently, the system will not perform automated remediation when a scan completes.
* Manual Patching Requirement: The Vulnerability Dashboard (bottom exhibit) lists several application vulnerabilities with a Patching status of Manual patching required . In a FortiSASE environment, " Manual " indicates that the vulnerability cannot be handled by the client ' s autonomous update process and requires a direct instruction from the management plane.
* Administrative Intervention: The dashboard includes a Patch endpoints action button. Since auto- patching is disabled in the profile, an administrator must manually select the vulnerabilities and click the " Patch endpoints " button to remotely trigger the patching sequence on the managed endpoints via the FortiSASE cloud service.
* Workflow Logic: While FortiClient acts as the " conductor " on the local machine to facilitate the download and installation, the trigger for this specific scenario is the administrator ' s remote action within the portal. This differentiates it from Option D (which is disabled) and Option C (which would involve a user manually browsing a website outside the managed SASE workflow).

In recent versions of FortiSASE (starting from version 24.4 and later), the platform has increased its scalability to support larger enterprise environments.
* Maximum Hub Support : According to the FortiSASE Mature Administration Guide and the FortiSASE 25.3.148 Feature Release Notes , administrators can now configure a maximum of 12 SPA Service Connections (SPA hubs) . Previously, this limit was restricted to 4 hubs.
* Scalability for Large Enterprises : This enhancement allows organizations with complex, geographically dispersed networks-such as those with multiple regional datacenters or cloud hubs-to integrate up to 12 distinct FortiGate SD-WAN hubs into their SASE infrastructure.
* Service Connection Licensing : Each SPA hub requires a dedicated FortiGate SPA Service Connection license . In MSSP environments using FortiCloud Organizations, a single FortiSASE instance can inherit these licenses from a root OU, supporting up to the same cumulative maximum of
12 service connections.
* Routing and Performance : These 12 hubs form the " Private Access " backbone, where FortiSASE security PoPs act as spokes. The use of BGP (either per-overlay or on loopback) ensures that traffic is dynamically routed to the optimal hub based on the destination network and defined SLA priorities.