Fortinet NSE5_SSE_AD-7.6 - Fortinet NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator

The correct answer is A. Drug Abuse. In the exhibit, the Drug Abuse FortiGuard web-filter category is configured with the Block action. FortiSASE applies the configured action according to the FortiGuard category assigned to the requested website. The FortiSASE Administrator Study Guide explicitly defines Block as an action that denies access to URLs belonging to the configured category and displays a replacement message.

The other displayed categories use different behaviors. Hacking is set to Monitor, which processes traffic similarly to Allow but generates a log entry whenever matching traffic is detected; therefore, the user is not denied access. Illegal or Unethical is configured as Warning, which displays a warning page but permits the user to continue if they choose. Discrimination is configured as Allow, so traffic continues through the remaining inspection engines and is not blocked.

The exhibit therefore directly maps the requested behavior—deny access and display a replacement message—to the Block action, and Drug Abuse is the only listed category configured that way.

Study Guide Reference: Security and Endpoint Profiles > Web Filter With Inline-CASB > FortiGuard Category Filter, page 118.

Based on the FortiSASE 7.6 (and later 2025 versions) curriculum and administration guides, the Vulnerability summary dashboard is a key component of the endpoint security posture management.

Drill Down Capability (Option C): According to the FortiSASE Administration Guide, the Vulnerability summary widget on the Security dashboard is interactive. An administrator can click on specific risk categories (e.g., Critical, High) or application types (e.g., Operating System, Web Client) to drill down. This action opens a detailed pane showing the specific affected endpoints, associated CVE identifiers, and severity classifications based on the CVSS standard.

Automatic Vulnerability Patching (Option D): In the FortiSASE 7.6/2025 feature sets, the endpoint profile configuration (under Endpoint > Configuration > Profiles) includes an " Automatic Patching " section. This feature allows the system to automatically install security updates for supported third-party applications and the underlying operating system (Windows/macOS) when vulnerabilities are detected. Furthermore, administrators can schedule these patches directly from the Vulnerability Summary widget by selecting specific vulnerabilities.

Why other options are incorrect:

Option A: The dashboard categories (Operating System, Web Client, Microsoft Office, etc.) are based on known software signatures. While there is an " Other " category, the dashboard primarily provides scores for recognized applications where CVE data is available.

Option B: The exhibit shows active data (157 total vulnerabilities), which indicates that the vulnerability scan is enabled and currently reporting data from the endpoints. If it were disabled, the widget would be empty or show zeros.

According to the FortiSASE 7.6 Administration Guide and the FCP - FortiSASE 24/25 Administrator curriculum, the Agentless deployment mode—commonly referred to as Secure Web Gateway (SWG) mode—is a vital component of the Secure Internet Access (SIA) framework.

Deployment Mechanism: In an agentless deployment, FortiSASE functions as an explicit web proxy. This is achieved by distributing a PAC (Proxy Auto-Configuration) file to the user ' s browser, which instructs the device to send its web traffic to the nearest FortiSASE Point of Presence (PoP).

Target Use Case: This mode is specifically designed for unmanaged endpoints, such as those used by contractors, partners, or temporary workers, where the organization does not have the authority or capability to install the FortiClient agent.

Security Capabilities: Even without an agent, FortiSASE applies a full security stack to the redirected traffic. This includes Web Filtering, Anti-Malware, SSL Inspection, and Inline-CASB to secure HTTP and HTTPS sessions.

Protocol Limitations: Because it relies on proxy settings, this mode is limited to web protocols (HTTP/HTTPS) and does not inherently secure non-web traffic like ICMP, DNS, or custom TCP/UDP applications unless they are specifically proxied.

Why other options are incorrect:

Option A: While it provides secure browsing, session isolation (RBI) is a specific feature that can be used in either mode; the defining characteristic of the agentless use case is the proxy-based redirection for unmanaged devices.

Option C: A PAC file can only secure web traffic (protocols that support proxying), not non-web traffic protocols.

Option D: Agentless mode is the opposite of requiring FortiClient; ZTNA tags generally require the FortiClient agent to provide the necessary telemetry for tag evaluation.

B and C are correct. The FortiSASE Administrator Study Guide explicitly states that FortiClient can be provisioned using installers embedded with an invitation code obtained from the FortiSASE portal. Administrators can then deploy the installer through enterprise software-distribution mechanisms such as Microsoft System Center Configuration Manager (SCCM) or Group Policy Object (GPO). The same installer can also be distributed through mobile device management (MDM) software.

The study guide also explicitly identifies manual installation as a supported deployment method: administrators can distribute the FortiClient installer directly to end users and have them install it on their endpoints. Consequently, C is also correct.

Invitation codes are important because they allow FortiClient to register with and become managed by the appropriate FortiSASE instance. The Enterprise Administrator material further explains that the default invitation code is embedded in preconfigured Windows and macOS installers, while custom invitation codes can place newly onboarded endpoints into specified endpoint groups and associated profiles.

A, D, and E are incorrect because they unnecessarily restrict supported deployment methods or incorrectly claim that an invitation code is not required.

Study Guide Reference: User Onboarding and Additional Features > FortiClient Deployment; Endpoint Management > Invitation Codes.

The correct answer is B. SSO. The FortiSASE Administrator Study Guide explicitly states that enabling SSO authentication overrides any other previously created authentication methods, including the local user database, LDAP, and RADIUS.

FortiSASE implements SSO for endpoint users through SAML. In this design, FortiSASE functions as the service provider (SP), while authentication is performed by an external identity provider (IdP), such as Okta, FortiAuthenticator, or another supported IdP. The user database therefore does not need to be hosted directly on FortiSASE. Instead, FortiSASE redirects the user to the IdP and uses the resulting SAML assertion to establish the authenticated SSO session. The study guide confirms that SSO can be configured for both VPN users and Secure Web Gateway (SWG) users.

A. Local and C. RADIUS are authentication sources that SSO supersedes when SSO is enabled. D. MFA is an additional authentication-strength mechanism rather than the FortiSASE authentication mode described as overriding previously configured methods.

Study Guide Reference: User Onboarding and Additional Features > Configuring SSO > VPN User SSO / SWG User SSO, FortiSASE Administrator Study Guide, page 56.