NSE7_SSE_AD-25 Exam Questions & Answers

To block all video and audio application traffic while granting access to videos from CNN, you need to configure an application override action in the Application Control with Inline-CASB. Here is the step-by-step detailed explanation:

Application Control Configuration:

Application Control is used to identify and manage application traffic based on predefined or custom application signatures.

Inline-CASB (Cloud Access Security Broker) extends these capabilities by allowing more granular control over cloud applications.

Blocking Video and Audio Applications:

To block all video and audio application traffic, you can create a policy within Application Control to deny all categories related to video and audio streaming.

Granting Access to Specific Videos (CNN):

To allow access to videos from CNN specifically, you must create an override rule within the same Application Control profile.

The override action 'Exempt' ensures that traffic to specified URLs (such as those from CNN) is not subjected to the blocking rules set for other video and audio traffic.

Configuration Steps:

Navigate to the Application Control profile in the FortiSASE interface.

Set the application categories related to video and audio streaming to 'Block.'

Add a new override entry for CNN video traffic and set the action to 'Exempt.'

FortiOS 7.6 Administration Guide: Detailed steps on configuring Application Control and Inline-CASB.

Fortinet Training Institute: Provides scenarios and examples of using Application Control with Inline-CASB for specific use cases.

Onboarding a Secure Web Gateway (SWG) endpoint involves several components to ensure secure and effective integration with FortiSASE. Two key components are the FortiSASE CA certificate and the proxy auto-configuration (PAC) file.

FortiSASE CA Certificate:

The FortiSASE CA certificate is essential for establishing trust between the endpoint and the FortiSASE infrastructure.

It ensures that the endpoint can securely communicate with FortiSASE services and inspect SSL/TLS traffic.

Proxy Auto-Configuration (PAC) File:

The PAC file is used to configure the endpoint to direct web traffic through the FortiSASE proxy.

It provides instructions on how to route traffic, ensuring that all web requests are properly inspected and filtered by FortiSASE.

FortiOS 7.6 Administration Guide: Details on onboarding endpoints and configuring SWG.

FortiSASE 23.2 Documentation: Explains the components required for integrating endpoints with FortiSASE and the process for deploying the CA certificate and PAC file.

Based on the provided exhibits, the reason why the Win7-Pro endpoint can no longer access the internet through FortiSASE is due to exceeding the total vulnerability detected threshold. This threshold is used to determine if a device is compliant with the security requirements to access the network.

Endpoint Compliance:

FortiSASE monitors endpoint compliance by assessing various security parameters, including the number of vulnerabilities detected on the device.

The compliance status is indicated by the ZTNA tags and the vulnerabilities detected.

Vulnerability Threshold:

The exhibit shows that Win7-Pro has 176 vulnerabilities detected, whereas Win10-Pro has 140 vulnerabilities.

If the endpoint exceeds a predefined vulnerability threshold, it may be restricted from accessing the network to ensure overall network security.

Impact on Network Access:

Since Win7-Pro has exceeded the vulnerability threshold, it is marked as non-compliant and subsequently loses internet access through FortiSASE.

The FortiSASE endpoint profile enforces this compliance check to prevent potentially vulnerable devices from accessing the internet.

FortiOS 7.6 Administration Guide: Provides information on endpoint compliance and vulnerability management.

FortiSASE 23.2 Documentation: Explains how vulnerability thresholds are used to determine endpoint compliance and access control.

FortiSASE supports zero trust network access (ZTNA) principles by identifying attributes on the endpoint for security posture checks. ZTNA principles require continuous verification of user and device credentials, as well as their security posture, before granting access to network resources.

Security Posture Check:

FortiSASE can evaluate the security posture of endpoints by checking for compliance with security policies, such as antivirus status, patch levels, and configuration settings.

This ensures that only compliant and secure devices are granted access to the network.

Zero Trust Network Access (ZTNA):

ZTNA is based on the principle of 'never trust, always verify,' which requires continuous assessment of user and device trustworthiness.

FortiSASE plays a crucial role in implementing ZTNA by performing these security posture checks and enforcing access control policies.

FortiOS 7.6 Administration Guide: Provides information on ZTNA and endpoint security posture checks.

FortiSASE 23.2 Documentation: Details on how FortiSASE implements ZTNA principles.

In the FortiSASE architecture, Network Lockdown is a security feature designed to prevent off-net (off-fabric) endpoints from accessing the internet or local network without the protection of the SASE security stack.

Triggering Lockdown: When an endpoint is determined to be 'off-net'---meaning it does not satisfy the on-net rule sets defined in its endpoint profile---a timer starts for a configurable grace period.

Function of the Grace Period: During this period, the endpoint maintains full access to the LAN and the internet.4 The specific purpose of this grace period is to provide the user with a window of time to attempt a connection to the FortiSASE VPN tunnel or an alternate corporate tunnel.5 This ensures that users can authenticate and regain a secure 'on-net' status before any connectivity restrictions are enforced.

Enforcement: If the grace period expires and the endpoint has failed to establish a VPN connection, FortiClient enforces a strict lockdown.7 In this state, the device cannot reach the LAN or the internet, except for specifically defined 'Exempt Destinations' (such as captive portal login pages or the FortiSASE portal itself).

Resetting the Timer: Any attempt to connect to the tunnel during the grace period resets the timer, providing additional opportunities for the user to remediate their connection status.8

According to the FortiSASE 25 Administrator Study Guide, the grace period is an essential user-experience setting that balances strict 'zero-trust' security with the practical need for users to access the network briefly to establish their secure tunnel.