Field technicians connecting to the utility's dispatch application over SSL VPN report that the tunnel mode client works fine, but their laptops sometimes need to reach dispatch through a plain web browser from a shared kiosk in a truck depot where no client software can be installed. Which SSL VPN access mode fits the kiosk scenario?

The clientless answer here is SSL VPN web mode, which presents a browser-based portal giving access to specific published web applications — exactly suited to a shared depot kiosk where installing FortiClient isn't practical or permitted. Tunnel mode, by contrast, establishes a full network-layer connection using a virtual adapter and does require the FortiClient application (or a compatible client) to be installed, so describing it as browser-launchable without a client install misstates how tunnel mode works. Dialup IPsec refers to how a phase 1 gateway identifies a peer with a dynamic address in a site-to-site or FortiClient IPsec context; it is not the SSL VPN feature that provides clientless, browser-only access to a specific web application, so labeling it the only browser-only option is inaccurate. Split tunneling is a routing decision about which traffic is sent through an already-established tunnel versus the local network, and it has no bearing on whether a client installation is required in the first place, so it cannot be the answer to a question about clientless access from a shared kiosk — this option intentionally tests whether a candidate can spot a mismatched concept being substituted for the real feature. Because Fortinet's exact SSL VPN mode positioning has evolved across FortiOS releases, the safest operational check for the utility is to review the currently available VPN portal types and confirm which modes and applications are configured under the SSL VPN settings relevant to the deployed FortiOS 7.6 build, rather than assuming feature availability from an older release.