Question 4 (Topic 1)

Which two components are part of the secure internet access (SIA) agent-based mode on FortiSASE? (Choose two.)

Select an option, then click Submit answer.

○ FortiExtender
○ VPN policies
○ The proxy auto-configuration (PAC) file
○ FortiSASE Firewall-as-a-Service (FWaaS)

Reference / correct answer:

FortiSASE Firewall-as-a-Service (FWaaS)

Most accepted answer: D. FortiSASE Firewall-as-a-Service (FWaaS)

Community votes: B=5, C=1, D=6

Selected Answer: BD A is irrelevant here and C is for agentless proxy configs upvoted 2 times

Selected Answer: BD In FortiSASE Secure Internet Access (SIA) agent-based mode, traffic steering and security enforcement rely on components integrated with the FortiClient agent. Components used in SIA agent-based mode D . FortiSASE Firewall-as-a-Service (FWaaS) Correct. FWaaS is a core security component of FortiSASE. It enforces firewall policies, security inspection, and access control for agent-based users. All user traffic tunneled by the agent is inspected by FWaaS. B . VPN policies Correct. In agent-based mode, the FortiClient establishes a secure tunnel to FortiSASE. VPN policies define: Authentication Access control Traffic steering These policies are fundamental to agent-based connectivity. upvoted 2 times

Selected Answer: BD B and D Pac file is for Secure Web Gateway /SWG upvoted 2 times

Selected Answer: BD For agent-based mode in FortiSASE, the key concept is that traffic is steered and secured by the endpoint agent, not by PAC files or external devices. What agent-based mode includes Uses an endpoint agent (FortiClient) Traffic is tunneled securely to the cloud Security inspection is enforced in the cloud (FWaaS) Correct answers B. VPN policies Agent-based mode relies on secure tunnels (VPN-like behavior) VPN policies define how traffic is routed to FortiSASE D. FortiSASE Firewall-as-a-Service (FWaaS) Core component of SIA Provides: Application control Web filtering IPS All enforced in the cloud upvoted 3 times

Selected Answer: BD For SIA agent based B and D upvoted 2 times

Question 5 (Topic 1)

A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode. Which step is not part of the expected process?

Select an option, then click Submit answer.

○ The user logs into the windows domain.
○ FortiGate determines user identity based on the IP address in the FSSO list.
○ The DC agent sends login event data directly to FortiGate.
○ The collector agent forwards login event data to FortiGate.

Reference / correct answer:

The DC agent sends login event data directly to FortiGate.

Most accepted answer: C. The DC agent sends login event data directly to FortiGate.

Community votes: C=5, D=3

Selected Answer: C Correct answer: C DC Agent Mode flow (how it really works) User logs into Windows domain DC Agent (on Domain Controller) detects logon event DC Agent → Collector Agent Collector Agent → FortiGate FortiGate maps IP → user upvoted 2 times

Selected Answer: C In DC Agent Mode, the communication path is a three-tier architecture. The Domain Controller (DC) does not have the "intelligence" to communicate with the FortiGate directly; it relies on a middleman. upvoted 2 times

Selected Answer: D The correct answer is: D. The collector agent forwards login event data to FortiGate. Explanation In DC Agent Mode on FortiGate, the expected process is: User logs into the Windows domain DC Agent captures the login event DC Agent sends the login event data directly to FortiGate FortiGate maps the user identity based on the IP address Why option D ? D introduces the Collector Agent, which is not used in DC Agent Mode The Collector Agent is only part of Collector Agent Mode, not DC Agent Mode upvoted 1 times NasimDonya 2 months, 3 weeks ago It is C.IT is collector agent sending login events to fortigate and not DC agent upvoted 1 times ...

It is C.IT is collector agent sending login events to fortigate and not DC agent upvoted 1 times

Selected Answer: C FortiOS_7.6_Administrator_Study_Guide p180 upvoted 1 times

Question 6 (Topic 1)

An administrator wanted to configure an IPS sensor to block traffic that triggers the signature set number of times during a specific time period. How can the administrator achieve the objective?

Select an option, then click Submit answer.

○ Use IPS packet logging option with periodical filter option.
○ Use IPS group signatures, set rate-mode 60.
○ Use IPS filter, rate-mode periodical option.
○ Use IPS signatures, rate-mode periodical option.

Reference / correct answer:

Use IPS signatures, rate-mode periodical option.

Most accepted answer: D. Use IPS signatures, rate-mode periodical option.

Community votes: C=1, D=3

Selected Answer: D You configure IPS signature settings like: rate-mode = periodical Define: number of hits (count) time window (seconds) upvoted 2 times

Selected Answer: D Correct answer: D. Use IPS signatures, rate-mode periodical option. Explanation The requirement is: Block traffic when a signature is triggered a certain number of times within a specific time period This is exactly what rate-based blocking does in FortiGate IPS. You must configure it at the signature level Use: rate-mode: periodical Define: number of hits (threshold) time period When the threshold is exceeded → traffic is blocked Why the other options are incorrect A. Packet logging does not enforce blocking behavior B. “rate-mode 60” is not a valid configuration and not tied to time logic properly C. Filters are used to select signatures, not to apply rate-based behavior upvoted 2 times

Selected Answer: D Option D (Signatures): When you apply a rate-limit to a specific signature ID, the counter tracks only that one specific threat. • Option C (Filters): An IPS Filter is a dynamic bucket (e.g., "all High Severity signatures for Windows"). If you apply a rate-mode to a Filter, the rate-count becomes cumulative across every single signature inside that filter. upvoted 2 times

Selected Answer: C C. Use IPS filter, rate-mode periodical option. Under Security Profiles > Intrusion Prevention > IPS Sensor (or via CLI: config ips sensor): Create or edit an entry (filter) with criteria such as severity, protocol, CVE, signature ID, etc. Then configure the rate-based parameters: set rate-count <number> → e.g., 100 (how many times the signature must trigger) set rate-duration <seconds> → e.g., 60 (the time period) set rate-mode periodical → This is the key setting. upvoted 1 times

Free NSE4-FGT-AD-7-6 – Fortinet NSE4-FGT-AD-7-6 Practice Test Question