FCSS_SASE_AD-23 Exam Dumps : FCSS FortiSASE 23 Administrator

The unusually high number of unknown applications by category in the daily report for application usage can be attributed to the following reasons:

Certificate Inspection is not being used to scan application traffic:

Without certificate inspection, encrypted traffic cannot be adequately analyzed, leading to a higher number of unknown applications.

Certificate inspection allows the FortiSASE to decrypt and inspect HTTPS traffic, identifying applications correctly.

Deep Inspection is not being used to scan traffic:

Deep inspection goes beyond basic traffic analysis, performing thorough examination of packet contents to identify applications accurately.

If deep inspection is not enabled, many applications may go unrecognized and categorized as unknown.

References:

FortiOS 7.2 Administration Guide: Details on certificate inspection and deep inspection configurations.

FortiSASE 23.2 Documentation: Explains the importance of deep inspection and certificate inspection in accurate application identification.

FortiSASE hides user information when viewing and analyzing logs by hashing data using salt. This approach ensures that sensitive user information is obfuscated, enhancing privacy and security.

Hashing Data with Salt:

Hashing data involves converting it into a fixed-size string of characters, which is typically a hash value.

Salting adds random data to the input of the hash function, ensuring that even identical inputs produce different hash values.

This method provides enhanced security by making it more difficult to reverse-engineer the original data from the hash value.

Security and Privacy:

Using salted hashes ensures that user information remains secure and private when stored or analyzed in logs.

This technique is widely used in security systems to protect sensitive data from unauthorized access.

References:

FortiOS 7.2 Administration Guide: Provides information on log management and data protection techniques.

FortiSASE 23.2 Documentation: Details on how FortiSASE implements data hashing and salting to secure user information in logs.

To resolve internal hostnames using internal DNS servers for remotely connected endpoints, the following two components must be configured on FortiSASE:

Split DNS Rules:

Split DNS allows the configuration of specific DNS queries to be directed to internal DNS servers instead of public DNS servers.

This ensures that internal hostnames are resolved using the organization's internal DNS infrastructure, maintaining privacy and accuracy for internal network resources.

Split Tunneling Destinations:

Split tunneling allows specific traffic (such as DNS queries for internal domains) to be routed through the VPN tunnel while other traffic is sent directly to the internet.

By configuring split tunneling destinations, you can ensure that DNS queries for internal hostnames are directed through the VPN to the internal DNS servers.

References:

FortiOS 7.2 Administration Guide: Provides details on configuring split DNS and split tunneling for VPN clients.

FortiSASE 23.2 Documentation: Explains the implementation and configuration of split DNS and split tunneling for securely resolving internal hostnames.