Security posture tagging in ZTNA is used to evaluate and classify endpoints based on their compliance and security status, enabling granular, dynamic access control decisions that determine whether a device is allowed to access specific resources.

The Digital Experience Monitoring (DEM) agent on the endpoint performs a trace route to the SaaS application to measure latency, packet loss, and hop-by-hop performance. This helps diagnose where in the path connectivity or performance issues are occurring.

FortiSASE hides user information in logs by using hashing, which anonymizes sensitive data such as usernames or IP addresses while still allowing for consistent tracking and analysis.

The correct answers are C and D . FortiSASE branch on-ramp is designed for site-based or branch users by creating IPsec connectivity from a branch location to FortiSASE. The study guide states that branches can use on-premises FortiGate or third-party routers, and that supported devices include FortiGate and third-party VPN-capable devices , so option B is false because support is not limited to FortiExtender and FortiAP. The guide further explains that the branch device is configured as the dial-up client and the branch on-ramp location acts as the server; the branch device uses the on-ramp location FQDN as the remote gateway. It also states that FortiSASE supports only IKEv2 for IPsec dial-up tunnels and that IKEv2 supports the network ID feature for establishing multiple tunnels.
Option D is also correct. Fortinet documentation states directly that BGP configuration is shared between Branch On-ramp and Secure Private Access (SPA) and that SPA network configuration must be configured before deploying a Branch On-ramp location. Option A is false because when deep inspection is enabled, FortiSASE requires the FortiSASE CA certificate to be manually installed on endpoints for Branch On-Ramp/site-based users to avoid certificate errors and allow encrypted traffic inspection.