FortiSASE proxy-based secure internet access allows managed and unmanaged endpoints to use cloud-delivered security controls without requiring the FortiClient endpoint agent.
Option A is correct because a proxy auto-configuration file can define how browsers and operating systems redirect eligible HTTP and HTTPS requests to the FortiSASE secure web gateway.
A PAC file allows automatic proxy selection based on destination URLs, hostnames, and other conditions. FortiSASE supports hosted and downloadable PAC file configurations, simplifying deployment across large endpoint populations.
Option B is correct because endpoints should install and trust the FortiSASE certificate authority certificate when SSL deep inspection is required. During TLS inspection, FortiSASE decrypts permitted traffic for security analysis and presents certificates that must be trusted by the endpoint.
Without the appropriate certificate, browsers and applications may reject inspected HTTPS connections because the signing authority is untrusted.
Option C is incorrect because FortiClient is associated with agent-based endpoint connectivity. Proxy-based deployment can operate without installing FortiClient.
Option D is incorrect because a tunnel policy applies to tunnel-based traffic handling rather than constituting an endpoint onboarding component for explicit proxy access.
PAC configuration provides traffic steering, while CA certificate installation establishes the certificate trust needed for SSL inspection.
[References: FortiSASE 25 Enterprise Administrator Study Guide — Fortinet SASE Solution and SWG; FortiSASE 25.3 Agentless Proxy Deployment Guide — Configuring Proxy Settings on Endpoints and Installing the FortiSASE CA Certificate., ==========, ]
