Describe FortiSASE Integration with SD-WAN NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company with 30 branch offices is deploying FortiSASE. The company wants to ensure that all internet traffic is inspected, but also wants to reduce the amount of traffic sent to FortiSASE to lower bandwidth costs. What should the administrator configure?

   • AUse SD-WAN policies to send only traffic that requires security inspection (e.g., unknown or high-risk traffic) to FortiSASE, while allowing trusted traffic to go directly to the internet.
   • BDisable FortiSASE for all traffic and use local FortiGate security profiles.
   • CUse FortiSASE only for remote users and keep branch traffic on local FortiGates.
   • DSend all traffic to FortiSASE to ensure maximum security, regardless of bandwidth costs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A global company has 5,000 remote employees who connect from home. The company also operates 50 branch offices with FortiGate SD-WAN appliances. The security team wants a single, unified security policy for both remote users and branch internet traffic, managed from one cloud console. Which FortiSASE deployment model best satisfies this requirement?

   • ADeploy FortiSASE with a secure access service edge (SASE) POP and connect both remote users and branch FortiGates to it.
   • BDeploy a separate FortiSASE instance for each branch office and one for remote users.
   • CReplace all branch FortiGates with FortiSASE and use only cloud-based routing.
   • DUse FortiSASE only for remote users and keep branch security on local FortiGates with separate policies.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A healthcare provider has 50 clinics with FortiGate SD-WAN. The provider is subject to strict data-privacy regulations. The provider wants to use FortiSASE for internet security, but the nearest FortiSASE POP is in a different country. The provider's legal team has determined that patient data cannot leave the country. Which action should the administrator take to use FortiSASE while remaining compliant?

   • ADeploy a FortiSASE POP in the provider's country at their own data center.
   • BConfigure SD-WAN policies to send only non-patient internet traffic to FortiSASE, and keep patient-related traffic on the local FortiGate with on-premises inspection.
   • CSend all traffic to the FortiSASE POP and rely on encryption to protect patient data during transit.
   • DUse FortiSASE only for remote users and keep all clinic traffic on local FortiGates.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail chain with 200 stores plans to replace legacy MPLS links with broadband internet connections. Each store has a FortiGate SD-WAN appliance. The company wants to enforce consistent web-filtering and anti-malware policies for all store traffic without deploying additional hardware at each location. Which FortiSASE integration approach should the architect recommend?

   • AConfigure the FortiGates to send all internet-bound traffic to FortiSASE via an IPsec tunnel for cloud-based security inspection.
   • BRoute all store traffic through the corporate headquarters FortiGate over the existing MPLS links for centralized inspection.
   • CDeploy a FortiGate VM in each store's local server room to run the same security profiles locally.
   • DUse FortiSASE only for remote users and keep all store traffic on the local FortiGate with default security profiles.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company with 20 branch offices is deploying FortiSASE to replace its legacy web-filtering proxy. The branches use FortiGate SD-WAN. The company wants to ensure that all internet traffic from branches is inspected by FortiSASE, but also wants to maintain high availability. What should the administrator configure on the FortiGates?

   • AConfigure the FortiGates to send traffic to FortiSASE only during peak hours.
   • BConfigure a single IPsec tunnel to the nearest FortiSASE POP and rely on the FortiGate's local failover.
   • CConfigure multiple IPsec tunnels to different FortiSASE POPs and use SD-WAN health-check to failover between them.
   • DUse FortiSASE only for remote users and keep branch internet traffic on the local FortiGate.
   Reveal Solution Discussion Select an answer first