Fortinet · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which THREE components are required to create a functional FortiSoC Playbook?
Workflow Actions
Workflow Actions supply the executable steps the playbook performs, such as enrichment, notification or remediation tasks. Without at least one action, the playbook has no operational behaviour, so it cannot satisfy the requirement for a functional FortiSoC Playbook alongside a trigger and a target connector.
Report Template
Log retention policy
Target Connector/Device
The Target Connector/Device defines where the playbook's actions execute, binding workflow steps to a specific FortiGate, endpoint or integrated fabric device. It satisfies the functional playbook requirement by giving actions a concrete destination, without which execution has no defined endpoint.
Playbook Trigger
The Playbook Trigger specifies the event or condition that initiates execution, such as an incident creation or alert match. It satisfies the functional requirement by providing the entry point, since actions and connectors alone never run without a defined trigger.
You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?
Log aggregation
Event rate limiting
Event rate limiting suppresses duplicate alerts triggered by the same event within a defined window, so repeated failed logins from one source IP generate a single notification. This satisfies the stem's requirement to avoid alert flooding during a short duration.
Database auto-delete
Log forwarding filter
You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?
Run a manual report
Use the 'Test' button in the Event Handler definition
The Test button evaluates the handler's filter against existing logs and reports matches immediately, confirming whether criteria align with real log entries. This satisfies the troubleshooting need by isolating filter mismatch from trigger or delivery faults without waiting for live events.
Rebuild the SQL database
Check the FortiAnalyzer system logs
When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?
Remote server IP address
The remote Syslog server IP address is the destination FortiAnalyzer forwards logs to; without it, packets cannot be addressed and the server never receives them. This satisfies the requirement that the remote server accepts forwarded logs.
Log filter criteria
Enable compression for all logs
Syslog server port
The Syslog server port must match the listener on the remote host; FortiAnalyzer defaults to UDP 514, so a mismatched port causes silent drops. Specifying the correct port satisfies the stem's requirement that the remote server actually accepts forwarded logs, since the receiving daemon only binds one port.
Include device hostname in logs
An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?
FortiView Applications
FortiView Applications aggregates traffic by application identity, ranking each by total bandwidth consumed. This directly satisfies the administrator's need to identify the top bandwidth consumer, presenting ranked results rather than raw per-session data. The visual ranking makes the heaviest application immediately apparent without manual correlation.
Log View
FortiView Sources
FortiView Destinations
Reports
A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?
FortiGate log-server configuration
With connectivity and registration confirmed, the FortiGate's log-server configuration determines whether logs are actually directed to FortiAnalyzer. Checking the server address, port and enabled log types satisfies the stem's next-step constraint after transport and registration are verified.
Report scheduling
FortiView update interval
FortiAnalyzer Device registration status
Want more Nse5 Fortianalyzer Operations practice?
Practice this domainAn administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?
SPF validation
SPF validation queries the sending domain's DNS TXT record and checks whether the connecting mail server's IP is authorised to send for that domain, satisfying the stem's spoofing-prevention requirement by rejecting messages whose envelope sender fails the published SPF policy.
DKIM verification
DMARC policy
Sender Reputation
You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?
On the SMTP server of the recipient's domain.
In the FortiMail's relay host configuration.
On the FortiMail server's local certificate store.
In the public DNS records for the domain.
DKIM verification requires the public key in a DNS TXT record under the signing domain's selector, letting the receiving MTA retrieve it and validate the signature. Publishing it anywhere else, such as on the FortiMail itself, gives receivers no lookup path.
You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?
Configure the Bridge pair and disable IP forwarding.
Configure the Bridge pair under Network > Interface.
Transparent mode requires a bridge pair binding two interfaces, so FortiMail forwards frames at layer 2 without rewriting source or destination IP addresses. This satisfies the constraint that email packets are inspected while their IP headers remain unmodified.
Configure static IP routing on the management interface.
Assign a virtual IP to the WAN interface.
Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?
Modify the sender's IP address.
Re-encrypt the message body.
Delete the message.
Deleting a message directly from the FortiMail global quarantine satisfies the requirement to action quarantined items without releasing them to recipients. Administrators can permanently remove selected messages, eliminating any delivery risk, which is a core quarantine management capability alongside releasing, previewing and reclassifying stored items.
Change the recipient's email address.
Release the message to the intended recipient.
Releasing delivers the quarantined message onward to the original envelope recipient, clearing it from the global quarantine. This satisfies the stem's requirement for a valid quarantine action, since release restores normal delivery rather than deleting or re-scanning the item.
You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?
The mail server must point to the FortiMail IP as its default gateway.
The FortiMail must be configured with a unique IP address for each physical port for routing.
The FortiMail must be configured as a mail relay agent.
You must configure a bridge pair of interfaces to pass traffic transparently.
Transparent mode requires a bridge pair: two interfaces bound together so FortiMail forwards traffic without altering IP addressing or routing. This bridge pair is mandatory, as it lets FortiMail inspect mail transparently while remaining invisible to the surrounding network.
When using FortiMail in Server Mode, how does the appliance handle incoming mail?
It accepts mail directly for local mailboxes and provides access via POP3/IMAP.
Server Mode makes FortiMail the destination mail server itself: it accepts SMTP connections for locally hosted mailboxes and serves them to clients through POP3 and IMAP, rather than relaying to a separate backend server as Gateway mode does.
It only filters outgoing mail.
It relays all mail to an internal backend mail server.
It inspects traffic in-line without terminating the connection.
Want more Nse6 Fortimail Secure Email Gateway practice?
Practice this domainWhich object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?
Provisioning templates.
Local ADOM objects.
CLI templates.
Global objects.
Global objects reside above ADOMs, so a single definition propagates to every ADOM, enforcing one naming convention across all managed domains. Per-ADOM objects would need duplicating and could drift, breaking the consistency the stem demands.
You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?
Upgrade the firmware.
Re-install the device settings.
Perform an Import Policy operation.
Import Policy retrieves the policy package already running on the newly added FortiGate and installs it into FortiManager, aligning the manager's database with the device. This satisfies the stem's requirement to synchronise the existing policy package with the imported device.
Run a script to update the policy database.
You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?
Install Wizard
Revision History
Policy Check
Policy Check validates policy packages for syntax, conflicts and errors before installation, satisfying the requirement to verify correctness prior to pushing to production. It performs static analysis without deploying, unlike Install Wizard, which pushes configurations to managed FortiGates.
Device Manager
You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?
Policy & Objects > Installation Preview.
Installation Preview compares the FortiManager policy database against the FortiGate's running configuration, displaying the exact configuration diff before installation. This satisfies the troubleshooting requirement by exposing precisely which policy objects differ, without committing changes to the managed device.
Object Usage.
FortiView.
Device Manager > Revision History.
System Settings > Task Monitor.
Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?
Configure global policies
Schedule backups
Assign a name to the ADOM
Assigning a name is mandatory because FortiManager cannot create an ADOM without a unique identifier. This satisfies the question's requirement for a compulsory configuration step, as the name field must be populated before the ADOM can be saved.
Enable ADOMs in System Settings
Enabling ADOMs in System Settings is mandatory because the ADOM feature is disabled by default in FortiManager. Without this global toggle, no ADOM can be created, directly satisfying the question's requirement for a compulsory configuration step.
Assign a firewall to the ADOM
An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?
Global Policy Packages
Policy Packages
Policy packages group policies for assignment to specific managed devices or groups, giving granular control over which FortiGates receive changes. This satisfies the requirement to push ADOM policy changes only to selected firewalls, rather than the entire ADOM.
Provisioning Templates
Device Groups
Want more Nse5 Fortimanager Operations practice?
Practice this domainWhat is the primary function of the Security Fabric's 'Automation Stitch' feature?
To synchronize user databases
To trigger actions based on system events
Automation Stitch responds to Security Fabric events by executing configured actions, such as quarantining a compromised endpoint or blocking an IP, without manual intervention. This directly satisfies the stem's requirement for event-driven automation, distinguishing it from static policy enforcement or logging, which merely record activity rather than trigger remediation workflows.
To scan for vulnerabilities
To load balance traffic
A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?
Content Routing Policy
Client SSL Profile
The Client SSL Profile holds the certificate and key used to terminate TLS on the virtual server, so the FortiADC decrypts incoming HTTPS connections and forwards plaintext to backend servers. This offloads the CPU-intensive handshake and encryption work the scenario demands.
Server SSL Profile
Layer 7 Persistence Rule
You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?
Prevention mode
Prevention mode actively inspects requests and drops those matching SQL injection signatures, satisfying the requirement to block attacks rather than merely log them. Unlike detection or monitor modes, which only alert, prevention enforces the WAF policy inline, allowing legitimate traffic through while terminating malicious requests before they reach the backend application.
Transparent mode
Learning mode
Detection mode
Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?
Install a web certificate on the FortiGate
Enable LDAP on the FortiAuthenticator
Configure FortiAuthenticator as a RADIUS Server on FortiGate
FortiGate must define FortiAuthenticator as a RADIUS server object, supplying its IP and shared secret, so the firewall can forward authentication requests to it. Without this server entry, FortiGate has no target for RADIUS traffic, so the integration cannot function.
Configure SAML on the FortiGate
Add the FortiGate IP as a RADIUS Client on FortiAuthenticator
FortiAuthenticator only answers RADIUS requests from registered clients, so the FortiGate's IP must be added as a RADIUS client with a matching shared secret. This authorises the firewall's queries and satisfies the mutual-credential requirement of the integration.
You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?
Enable Auto Learning
Disable the SQL Injection scanner entirely
Switch to Transparent mode
Create a WAF Exception for the specific signature ID
A WAF Exception targets the specific signature ID that triggered the false positive, disabling only that signature for the affected URL or parameter. This clears the 403 Forbidden response for legitimate traffic while every other SQL injection signature remains enforced.
You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?
Enable SQL Injection in the WAF profile
SQL Injection signatures in the WAF profile inspect request parameters and payloads for malicious SQL syntax, blocking injection attempts before they reach the application. Enabling this signature set directly satisfies the requirement to block requests containing SQL injection patterns.
Enable Buffer Overflow protection
Enable HTTP Protocol Validation
Enable Cross-site Scripting protection
Want more Nse6 Security Fabric Specialist Topics practice?
Practice this domainThe vendor does not publish an exact question count for the FORTINET-NSE56. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Nse5 Fortianalyzer Operations, Nse6 Fortimail Secure Email Gateway, Nse5 Fortimanager Operations, Nse6 Security Fabric Specialist Topics. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Fortinet FORTINET-NSE56 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.