View all questions & answers for the NSE 7 - FortiSASE 25 Enterprise Administrator Exam Materials exam

NSE 7 - FortiSASE 25 Enterprise Administrator Exam Materials - Question #35 Discussion

Comment Image Comment Image Comment Image

You have configured FortiSASE Secure Private Access (SPA) deployment. Which statement is true about traffic flows? (Choose two answers)

  • A. When using SD-WAN private access, traffic goes from an endpoint directly to an SPA hub.
  • B. When using zero trust network access, traffic goes from an endpoint to a FortiSASE POP, and then to a ZTNA access proxy.
  • C. When using zero trust network access (ZTNA) traffic goes from an endpoint directly to a ZTNA access proxy.
  • D. When using SD-WAN private access, traffic goes from an endpoint to a FortiSASE POP, and then to an SPA hub.
Correct Answer: C,D

Brave-Dump Community Votes

Answer: C, D (4 votes) 66.67%
Answer: B, D (2 votes) 33.33%

Community Explanations & Comments (6)

Brave-Dumps.com Admin 11 months ago
Selected: B, D
It needs additional check.
javaughn Bryan 11 months ago
Selected: B, D
PAGE 55 & 61. SASE NSE7 ENTERPRISE GUIDE (THE DIAGRAMS)

ZTNA traffic is brokered by the FortiSASE POP first, which then forwards to the ZTNA access proxy — so traffic goes endpoint → FortiSASE POP → ZTNA access proxy (B).

For SD-WAN private access, the endpoint’s traffic is also sent to the FortiSASE POP and then forwarded to the SPA hub (the hub is where the SD-WAN/SPA hub terminates), so it’s endpoint → FortiSASE POP → SPA hub (D).
mahmoud mostafa 6 months ago
You have correctly discribed that: in case of SPA with ZTNA, FortiSASE is the Trust Borcker just trust the client for the ZTNA Access Proxy and forward the ZTNA Tags to it to allow client toaccess their ZTNA Dst. SO I think, the answe is C,D
Anonymous User 7 months ago
Selected: C, D
Page 55 again, The data traffic arrow completely bypasses the FortiSASE. This perfectly illustrates ZTNA traffic goes from the endpoint directly to the access proxy.
Anonymous User 7 months ago
Selected: C, D
C;D
I Am Weird 6 months ago
Selected: C, D
CD
mahmoud mostafa 6 months ago
Selected: C, D
All Agrees on <<<<< D >>>>>>> and this is correct.
Also C is correct not B
in case of SPA with ZTNA, FortiSASE is the Trust Borcker just trust the client for the ZTNA Access Proxy and forward the ZTNA Tags to ZTNA Access Proxy(Mostly the onprime firewall ) So to allow client toaccess their ZTNA Dst.