View Full Fortinet NSE5_SSE_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 81

Which FortiSASE capability provides security controls for users accessing private applications?

1. DNS Security
2. Secure Web Gateway
3. Cloud Access Security Broker
4. Zero Trust Network Access

Correct Answer: 4

Explanation

Zero Trust Network Access provides controlled access to private applications based on identity and security context. Instead of giving users unrestricted access to an internal network, ZTNA can authorize access to specific applications according to policy. Access decisions can consider factors such as user identity, authentication status, device posture, and other contextual information. DNS Security focuses on domain requests, Secure Web Gateway protects web traffic, and CASB focuses on cloud applications. ZTNA is therefore the FortiSASE capability designed specifically for secure and controlled access to private applications.

Question 82

Which security service is primarily responsible for controlling access to websites according to URL categories?

1. CASB
2. Secure Web Gateway
3. ZTNA
4. DLP

Correct Answer: 2

Explanation

Secure Web Gateway provides security inspection and policy enforcement for web traffic. It can use URL categories to allow or block websites according to organizational security requirements. Administrators can create policies for categories such as malware, phishing, social media, gambling, or other types of content. CASB focuses on cloud application security, ZTNA controls access to private applications, and DLP protects sensitive information. SWG is therefore the service most directly associated with controlling users’ access to websites through URL and web-category policies.

Question 83

Which SSE capability is designed to identify and protect sensitive information from unauthorized disclosure?

1. Data Loss Prevention
2. Application Control
3. DNS Security
4. SD-WAN

Correct Answer: 1

Explanation

Data Loss Prevention is designed to identify sensitive information and enforce policies that help prevent unauthorized disclosure. DLP can inspect supported traffic and look for configured data patterns, classifications, or other indicators of sensitive information. When a match is detected, policies can allow, block, log, or generate an alert depending on the configuration. Application Control manages application traffic, DNS Security focuses on domain requests, and SD-WAN manages connectivity. DLP is therefore the SSE capability specifically intended to protect sensitive information from unauthorized transmission.

Question 84

Which capability provides visibility and control over cloud-based SaaS applications?

1. DNS Security
2. ZTNA
3. CASB
4. DHCP

Correct Answer: 3

Explanation

Cloud Access Security Broker provides visibility and control over cloud applications, including SaaS services. CASB can help organizations identify cloud applications being used, monitor usage, and enforce security policies according to organizational requirements. This capability is particularly useful when employees use numerous cloud services from different locations and devices. DNS Security protects domain requests, ZTNA controls access to private applications, and DHCP provides network configuration. CASB is therefore the appropriate capability when an organization needs security visibility and policy enforcement for cloud-based applications.

Question 85

Which factor represents something a user possesses during authentication?

1. Password
2. PIN
3. Fingerprint
4. Hardware security token

Correct Answer: 4

Explanation

A hardware security token is an example of a possession factor because it is something the user has. Authentication factors are commonly categorized as something the user knows, something the user possesses, or something the user is. Passwords and PINs are knowledge factors, while fingerprints are biometric factors representing something the user is. A hardware token can be combined with a password or biometric factor to provide multifactor authentication. Using multiple factor types can provide stronger protection against credential compromise than relying on a single authentication factor.

Question 86

Which FortiSASE function can identify applications in network traffic and apply application-specific policies?

1. Application Control
2. DNS Filtering
3. DHCP
4. NAT

Correct Answer: 1

Explanation

Application Control identifies applications in network traffic and enables administrators to apply policies according to the detected application. This provides more granular visibility than relying only on IP addresses or ports. Organizations can use Application Control to monitor, allow, or restrict applications based on their security requirements. DNS Filtering focuses on domain requests, DHCP provides network configuration, and NAT performs address translation. Application Control is therefore the appropriate FortiSASE function when administrators need application-aware traffic identification and policy enforcement.

Question 87

What can device posture information be used for in a Zero Trust environment?

1. Assigning DNS records
2. Determining whether an endpoint meets access requirements
3. Increasing internet bandwidth
4. Configuring VLAN trunking

Correct Answer: 2

Explanation

Device posture information can help determine whether an endpoint meets the security requirements defined by an organization’s Zero Trust policy. Depending on the available endpoint integration, posture information may include security software status, operating system conditions, compliance state, or other security attributes. If a device does not meet the required conditions, access to protected applications can be restricted or denied. DNS records, bandwidth, and VLAN trunking are networking considerations and do not directly represent endpoint security posture. Device posture is therefore useful for contextual access decisions.

Question 88

Which security function can block a DNS request when the destination domain is identified as malicious?

1. DLP
2. CASB
3. Application Control
4. DNS Security

Correct Answer: 4

Explanation

DNS Security can inspect DNS requests and use security intelligence or configured policies to determine whether a requested domain should be allowed. If a domain is associated with malware, phishing, command-and-control infrastructure, or another prohibited category, the request can be blocked. This can prevent users from reaching malicious destinations before a full connection is established. DLP focuses on sensitive information, CASB protects cloud applications, and Application Control identifies applications. DNS Security is therefore the appropriate function for blocking malicious domain requests.

Question 89

Which principle restricts users to only the applications and resources necessary for their work?

1. Least privilege
2. Open access
3. Implicit trust
4. Full network access

Correct Answer: 1

Explanation

Least privilege restricts users to the minimum access necessary to perform their authorized responsibilities. In a Zero Trust architecture, this principle helps reduce unnecessary exposure of applications and resources. If an account is compromised, limiting its permissions can also reduce the number of resources that may be accessible to an attacker. Open access and full network access provide broader permissions, while implicit trust does not represent the restrictive approach used by Zero Trust. Least privilege is therefore an important principle for controlling access to applications and resources.

Question 90

Which FortiSASE component can inspect web traffic and enforce policies for internet access?

1. CASB
2. ZTNA
3. Secure Web Gateway
4. DLP

Correct Answer: 3

Explanation

Secure Web Gateway provides inspection and policy enforcement for users’ internet-bound web traffic. It can apply controls such as URL filtering, category filtering, malware protection, application control, and other web security policies. SWG helps organizations maintain consistent web security regardless of where users connect from. CASB is focused on cloud applications, ZTNA provides controlled private application access, and DLP focuses on sensitive information. Therefore, Secure Web Gateway is the FortiSASE component most directly responsible for inspecting and securing general web traffic.

Question 91

Which authentication factor is an example of something the user is?

1. Password
2. Fingerprint
3. Security token
4. PIN

Correct Answer: 2

Explanation

A fingerprint is a biometric authentication factor and represents something the user is. Authentication factors are generally grouped into knowledge, possession, and inherence categories. Passwords and PINs are knowledge factors because they are information known by the user. A security token is a possession factor because it is something the user has. A fingerprint is based on a physical characteristic of the individual and therefore represents an inherence factor. Combining biometric authentication with another factor can provide multifactor authentication.

Question 92

Which capability can help an organization discover unauthorized cloud services being used by employees?

1. NTP
2. CASB
3. DHCP
4. NAT

Correct Answer: 2

Explanation

CASB can provide visibility into cloud application usage and help organizations identify cloud services that employees access without formal approval. This can help security teams identify shadow IT and evaluate associated security and compliance risks. After identifying applications, administrators can create appropriate policies to monitor, permit, restrict, or block them according to organizational requirements. NTP synchronizes system time, DHCP provides network configuration, and NAT performs address translation. CASB is therefore the appropriate capability for discovering and managing unauthorized cloud application usage.

Question 93

Which capability can enforce policies based on the identity of an authenticated user?

1. NAT
2. DHCP
3. Identity-based policy
4. Static routing

Correct Answer: 3

Explanation

Identity-based policies allow administrators to associate security rules with authenticated users, groups, or other identity attributes. This enables more granular policy enforcement than relying only on IP addresses or network locations. For example, different groups can receive different web access or application access permissions. NAT translates network addresses, DHCP provides network configuration, and static routing defines fixed network paths. Identity-based policy is therefore the capability that allows security decisions to be directly associated with authenticated user identities.

Question 94

Which SSE capability can inspect traffic for sensitive data patterns and take a configured action?

1. DLP
2. ZTNA
3. CASB
4. DNS Security

Correct Answer: 1

Explanation

DLP can inspect supported traffic for sensitive information using configured rules, patterns, dictionaries, or classifications. When sensitive data is detected, the policy can specify actions such as allowing the transaction, blocking it, recording an event, or generating an alert. This helps organizations reduce the risk of accidental or unauthorized data disclosure. ZTNA focuses on private application access, CASB focuses on cloud application security, and DNS Security protects domain requests. DLP is therefore the SSE capability designed for sensitive-data inspection and policy enforcement.

Question 95

Which feature allows security policies to consider whether an endpoint is compliant before granting access?

1. URL filtering
2. Device posture
3. Application control
4. DNS filtering

Correct Answer: 2

Explanation

Device posture provides information about the security and compliance condition of an endpoint. Zero Trust policies can use this information when deciding whether the endpoint should receive access to a protected resource. For example, an organization may require specific endpoint security controls or compliance conditions before allowing application access. URL filtering controls website destinations, Application Control identifies applications, and DNS filtering manages domain requests. Device posture is therefore the feature most directly associated with evaluating endpoint compliance as part of an access decision.

Question 96

Which SSE service is most closely associated with controlling access to private applications based on identity and context?

1. SWG
2. CASB
3. ZTNA
4. DLP

Correct Answer: 3

Explanation

Zero Trust Network Access controls access to private applications based on identity and contextual security information. A ZTNA policy can evaluate factors such as authentication, user identity, device posture, and application requirements before allowing access. This reduces the need to provide broad network connectivity and supports least-privilege access. SWG protects internet web traffic, CASB manages cloud application security, and DLP protects sensitive information. ZTNA is therefore the SSE service most directly associated with identity- and context-based access to private applications.

Question 97

What is one purpose of Secure Web Gateway URL categorization?

1. Assign IP addresses
2. Synchronize clocks
3. Classify websites for policy enforcement
4. Manage storage devices

Correct Answer: 3

Explanation

URL categorization classifies websites into groups that can be used by security policies. Administrators can use these categories to allow or block websites according to organizational requirements. Categories may include security-related classifications such as malware or phishing as well as content categories such as social media or gambling. URL categorization is therefore useful for consistent web access control. Assigning IP addresses, synchronizing clocks, and managing storage devices are unrelated functions. SWG can use URL categorization as part of its web security policy enforcement.

Question 98

Which capability can provide security visibility into cloud applications and help enforce cloud usage policies?

1. DHCP
2. CASB
3. Routing
4. NTP

Correct Answer: 2

Explanation

CASB provides visibility and policy controls for cloud applications. It can help organizations understand which cloud services are being used and apply security policies based on application, user, activity, or other supported conditions. This is useful for improving governance and reducing risks associated with unmanaged or inappropriate cloud application usage. DHCP provides network configuration, routing determines packet paths, and NTP synchronizes system time. CASB is therefore the capability most directly associated with cloud application visibility and cloud usage policy enforcement.

Question 99

Which authentication method combines two different factor types to improve account security?

1. Multifactor authentication
2. Anonymous access
3. Open authentication
4. Single-factor authentication

Correct Answer: 1

Explanation

Multifactor authentication combines two or more authentication factors, typically from different categories such as knowledge, possession, and inherence. For example, a password can be combined with a security token or biometric factor. This makes it more difficult for an unauthorized person to gain access using a compromised password alone. Anonymous access does not provide identity verification, open authentication does not necessarily require multiple factors, and single-factor authentication relies on one factor. MFA is therefore the authentication method that combines multiple factor types for stronger identity verification.

Question 100

Which SSE capability can provide centralized security enforcement for users connecting from remote locations?

1. Cloud-delivered security services
2. Local DHCP
3. Standalone LAN switching
4. Physical storage management

Correct Answer: 1

Explanation

Cloud-delivered security services allow organizations to apply centralized security policies to users regardless of their physical location. Remote and mobile users can connect to cloud security infrastructure and receive controls such as web security, Zero Trust access, cloud application protection, and data protection. This model reduces dependence on sending all remote-user traffic through a traditional corporate data center. Local DHCP, LAN switching, and storage management provide infrastructure functions but do not deliver the complete SSE security architecture. Cloud-delivered security services therefore support centralized protection for distributed users.