View Full Fortinet NSE5_SSE_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 181

Which SSE component is designed to provide controlled access to private applications based on user identity?

1. CASB
2. ZTNA
3. SWG
4. DLP

Correct Answer: 2

Explanation

Zero Trust Network Access provides controlled, application-specific access to private resources. ZTNA evaluates the user’s identity and other contextual factors before granting access. Depending on the configured policy, the decision can also consider authentication status, device posture, and resource requirements. This approach differs from traditional remote access methods that may place a user broadly on an internal network. CASB focuses on cloud applications, SWG protects web traffic, and DLP protects sensitive information. ZTNA is therefore the appropriate SSE component when users need secure access to specific private applications based on identity and policy.

Question 182

Which service primarily protects users by inspecting and controlling internet web traffic?

1. DLP
2. CASB
3. ZTNA
4. Secure Web Gateway

Correct Answer: 4

Explanation

Secure Web Gateway provides centralized inspection and security policy enforcement for internet-bound web traffic. It can apply controls such as URL filtering, web categorization, malware protection, and application control. SWG is particularly useful for organizations that need consistent web security for users working from different locations. DLP focuses on sensitive information, CASB focuses on cloud applications, and ZTNA controls access to private applications. Secure Web Gateway is therefore the service most directly responsible for inspecting and securing users’ web traffic.

Question 183

Which SSE capability is used to identify sensitive information and help prevent unauthorized data transfer?

1. DLP
2. DNS Security
3. Application Control
4. ZTNA

Correct Answer: 1

Explanation

Data Loss Prevention is designed to identify and protect sensitive information in monitored traffic. Administrators can configure DLP rules to detect specific patterns, classifications, or types of protected content. When sensitive information is identified, the system can take actions such as blocking the transfer, generating an alert, or recording the event. DNS Security protects domain requests, Application Control identifies applications, and ZTNA manages private application access. DLP is therefore the SSE capability most directly associated with preventing unauthorized transmission of confidential or regulated information.

Question 184

Which technology provides visibility and policy controls for cloud applications such as SaaS services?

1. ZTNA
2. DLP
3. Secure Web Gateway
4. CASB

Correct Answer: 4

Explanation

Cloud Access Security Broker provides security visibility and policy controls for cloud applications. CASB can help organizations discover cloud services, monitor usage, and enforce policies related to users, applications, and activities. This is useful for managing SaaS environments and identifying applications that may not have been officially approved. ZTNA controls private application access, DLP protects sensitive information, and SWG secures web traffic. CASB is therefore the appropriate technology for improving visibility and governance over cloud application usage.

Question 185

Which principle limits access so that users receive only the permissions necessary for their assigned responsibilities?

1. Least privilege
2. Full trust
3. Open access
4. Implicit trust

Correct Answer: 4

Explanation

Least privilege means giving users only the permissions required to perform their authorized tasks. This principle is an important part of Zero Trust security because it minimizes unnecessary access to applications and data. If a user’s account is compromised, restricted permissions can reduce the number of resources that can be reached. Full trust, open access, and implicit trust provide broader access models and do not support the same restrictive approach. Least privilege therefore helps organizations reduce attack exposure while still allowing users to perform legitimate business activities.

Question 186

Which authentication factor represents something the user possesses?

1. Password
2. PIN
3. Hardware token
4. Fingerprint

Correct Answer: 3

Explanation

A hardware token is an example of a possession factor because it is something the user has. Authentication factors are commonly grouped into knowledge, possession, and inherence categories. Passwords and PINs are knowledge factors, while a fingerprint is a biometric factor representing something the user is. A hardware token can be combined with a password to provide multifactor authentication. Using more than one factor can improve security by making it harder for an attacker to gain access with a compromised password alone.

Question 187

Which capability can enforce policies according to the actual application identified in network traffic?

1. DNS Security
2. DLP
3. Application Control
4. DHCP

Correct Answer: 3

Explanation

Application Control identifies applications within network traffic and allows administrators to enforce application-specific policies. This can provide more granular control than relying solely on IP addresses or port numbers. Organizations can use Application Control to allow, block, monitor, or otherwise manage applications according to security and acceptable-use requirements. DNS Security focuses on domain requests, DLP protects sensitive information, and DHCP provides network configuration. Application Control is therefore the appropriate capability when security policies need to be based on the actual application generating the traffic.

Question 188

Which feature can block access to websites categorized as malicious or inappropriate?

1. URL filtering
2. NAT
3. DHCP
4. NTP

Correct Answer: 1

Explanation

URL filtering allows administrators to control access to websites according to categories, reputation, or configured destinations. Organizations can use it to block websites associated with malware, phishing, inappropriate content, or other restricted categories. URL filtering is commonly provided as part of Secure Web Gateway functionality and can be applied consistently to users through centralized policies. NAT performs address translation, DHCP provides network configuration, and NTP synchronizes system time. URL filtering is therefore the appropriate feature for restricting access to specific website categories.

Question 189

Which security control can evaluate whether an endpoint meets organizational requirements before granting access?

1. URL filtering
2. Application Control
3. Device posture
4. DNS caching

Correct Answer: 3

Explanation

Device posture represents the security and compliance state of an endpoint and can be used by Zero Trust policies during access decisions. Depending on the configured integration, posture information may include endpoint protection status, operating system conditions, compliance state, and other security attributes. If the device fails required checks, access can be restricted or denied. URL filtering controls websites, Application Control identifies applications, and DNS caching stores domain-resolution information. Device posture is therefore the relevant mechanism for evaluating endpoint security before granting access to protected applications.

Question 190

Which SSE service can block a request to a domain that is known to host phishing content?

1. CASB
2. ZTNA
3. DLP
4. DNS Security

Correct Answer: 4

Explanation

DNS Security can inspect domain requests and compare destinations against threat intelligence and security policies. Domains associated with phishing, malware, command-and-control infrastructure, or other threats can be blocked or redirected. This can stop users from reaching malicious destinations before a complete connection is established. CASB focuses on cloud application security, ZTNA controls private application access, and DLP protects sensitive information. DNS Security is therefore the SSE capability best suited to preventing access to malicious domains through DNS-level enforcement.

Question 191

Which capability allows security policies to be associated with authenticated users and groups?

1. Identity-based policy
2. NAT
3. Static routing
4. DHCP

Correct Answer: 1

Explanation

Identity-based policy allows administrators to create security rules based on authenticated users, groups, roles, or other identity attributes. This provides more granular policy control than relying only on IP addresses or network location. For example, different groups can receive different web access or application access policies. NAT translates network addresses, static routing defines fixed traffic paths, and DHCP provides network configuration. Identity-based policy is therefore the appropriate capability when security decisions need to reflect the authenticated identity or group membership of the user.

Question 192

Which service can identify unsanctioned cloud applications being used by employees?

1. DLP
2. CASB
3. DNS Security
4. ZTNA

Correct Answer: 2

Explanation

CASB provides visibility into cloud application usage and can help organizations discover unsanctioned services. Identifying these applications allows administrators to assess their security and compliance risks and determine whether they should be allowed, monitored, restricted, or blocked. This is especially useful in organizations where employees use many SaaS applications from different locations. DLP focuses on sensitive data, DNS Security protects domain requests, and ZTNA controls access to private applications. CASB is therefore the appropriate capability for identifying and managing unsanctioned cloud application usage.

Question 193

Which authentication method requires two or more independent authentication factors?

1. Password authentication
2. Multifactor authentication
3. Anonymous authentication
4. Guest authentication

Correct Answer: 4

Explanation

Multifactor authentication requires two or more authentication factors, generally from different categories such as knowledge, possession, and inherence. A password combined with a security token or biometric factor is a common example. MFA improves identity security because possession of only one credential is usually insufficient to gain access. Password-only authentication uses a single factor, while anonymous and guest access do not provide the same level of identity verification. Multifactor authentication is therefore the method specifically designed to combine multiple independent factors.

Question 194

Which feature can inspect web traffic for unsafe content and malicious downloads?

1. CASB
2. ZTNA
3. DLP
4. Secure Web Gateway

Correct Answer: 4

Explanation

Secure Web Gateway can inspect web traffic and apply security policies to websites and downloaded content. Depending on the enabled security services, SWG can enforce URL filtering, malware protection, and other controls that help protect users from unsafe web resources. CASB provides cloud application controls, ZTNA manages private application access, and DLP focuses on sensitive information. Secure Web Gateway is therefore the most appropriate service for inspecting web traffic and helping prevent users from receiving malicious or unsafe content from internet resources.

Question 195

Which security principle is central to Zero Trust access control?

1. Least privilege
2. Full network trust
3. Automatic internal trust
4. Open access

Correct Answer: 2

Explanation

Least privilege is a central Zero Trust principle because it limits access to only the resources and permissions required by the user. Zero Trust does not automatically trust a user simply because authentication succeeded or the user is connected through an internal network. Instead, authorization is based on explicit policies and relevant context. Full network trust, automatic internal trust, and open access provide broader permissions and do not reflect the restrictive approach used by Zero Trust. Least privilege helps reduce unnecessary exposure and limits the potential impact of compromised accounts.

Question 196

Which SSE architecture provides cloud-based security services to distributed users without requiring all traffic to pass through a central corporate data center?

1. Local-only firewall
2. Cloud-delivered SSE
3. Standalone DHCP
4. Traditional LAN switching

Correct Answer: 1

Explanation

Cloud-delivered SSE provides security services through cloud infrastructure and allows users to receive protection regardless of their physical location. This can reduce dependence on sending all remote traffic through a central corporate data center. Security functions such as web security, Zero Trust access, cloud application protection, and data protection can be centrally managed and delivered through cloud points of presence. A local-only firewall and traditional LAN switching are more dependent on specific network locations, while DHCP provides addressing rather than comprehensive security. Cloud-delivered SSE therefore supports distributed users with centralized security policies.

Question 197

Which capability can help prevent sensitive data from being uploaded to an unauthorized cloud application?

1. DLP
2. Application Control
3. DNS Security
4. DHCP

Correct Answer: 1

Explanation

DLP can detect sensitive information in supported traffic and enforce policies that control how the information is transferred. If a user attempts to upload confidential information to an unauthorized cloud application, DLP rules may identify the sensitive content and perform an action such as blocking the transfer, logging it, or generating an alert. Application Control identifies applications, DNS Security protects domain requests, and DHCP provides network configuration. DLP is therefore the most appropriate capability for preventing sensitive information from being uploaded to unauthorized destinations.

Question 198

Which SSE component provides access to internal applications according to identity and device context?

1. ZTNA
2. CASB
3. SWG
4. DNS Security

Correct Answer: 2

Explanation

ZTNA provides application-level access to private resources according to identity and contextual security information. A ZTNA policy can consider the user’s identity, authentication status, device posture, and other conditions before allowing access. This supports least-privilege access without granting unrestricted internal network connectivity. CASB focuses on cloud applications, SWG secures internet web traffic, and DNS Security protects domain requests. ZTNA is therefore the SSE component designed for identity- and context-aware access to internal applications.

Question 199

Which feature allows administrators to control applications based on their identification in network traffic?

1. DLP
2. DNS Security
3. Application Control
4. NTP

Correct Answer: 3

Explanation

Application Control identifies applications in network traffic and provides the ability to enforce application-specific security policies. Administrators can use it to monitor, permit, restrict, or block applications according to organizational requirements. This provides more granular control than relying only on destination addresses or ports. DLP is designed for sensitive-data protection, DNS Security protects domain requests, and NTP synchronizes system clocks. Application Control is therefore the feature that allows administrators to make security decisions based on the actual application detected in traffic.

Question 200

Which SSE capability is responsible for providing centralized web security policies to users in remote locations?

1. CASB
2. Secure Web Gateway
3. DLP
4. ZTNA

Correct Answer: 1

Explanation

Secure Web Gateway provides centralized security controls for users accessing internet resources, including remote and mobile users. Through cloud-delivered SSE, administrators can enforce web filtering, URL policies, malware protection, and application controls regardless of where users connect. CASB focuses on cloud applications, DLP protects sensitive information, and ZTNA provides private application access. Secure Web Gateway is therefore the service most directly associated with centralized web security policies for distributed and remote users.