FORTINET-NSE56 Exam Simulation 1 — 100 Questions

Question 1

Which TWO of the following are valid methods to back up a FortiManager configuration?

Accepted Answer

Manual backup via the System Settings GUI.. Option B is correct because FortiManager's System Settings GUI includes a Backup/Restore page where an administrator can manually export the full configuration (including ADOMs and device databases) to a local file. Option D is correct because FortiManager supports scheduled backups that push configuration backups to an FTP, SFTP, or SCP server via the 'set backup-mode' and related CLI/GUI scheduling settings. Option A is not a native FortiManager backup method, as USB copy is not a supported configuration backup mechanism on FortiManager. Option C is wrong because the Backup button belongs to FortiGate, not FortiManager. Option E is wrong because FortiManager does not perform automatic cloud sync of its configuration to FortiCloud.

Answer

Copying files via USB drive.

Answer

Using the 'Backup' button on the FortiGate.

Answer

Automatic cloud sync to FortiCloud.

Question 2

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

Accepted Answer

FortiAuthenticator Authentication Logs. When a user is denied access through a FortiAuthenticator-backed portal, the FortiAuthenticator Authentication Logs are the authoritative source because they record the full RADIUS/LDAP exchange, including whether the user was found, whether group membership was evaluated, and the exact rejection reason. Since the user exists in the mapped AD group, the failure is likely in the authentication flow itself (bind failure, group filter mismatch, or policy mapping), all of which are visible in these logs. Checking logs first follows the standard troubleshooting methodology of gathering evidence before changing configuration.

Answer

The AD domain controller's disk space

Answer

The FortiGate session table

Answer

The WAF policy on FortiWeb

Question 3

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Accepted Answer

The number of matches. In a FortiAnalyzer Event Handler, the Threshold defines the trigger condition and the Count field specifies how many matching log entries must occur within the configured time window before the handler fires. In other words, Count is the number of matches, not the total logs received or a priority value. This lets administrators say 'alert me when 10 failed logins occur in 5 minutes' by setting Count=10 and the time window accordingly.

Answer

The total number of logs

Answer

The priority of the alert

Answer

The time window in seconds

Question 4

Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?

Accepted Answer

telnet 25. The telnet command (D) allows you to test TCP connectivity to a specific port, such as port 25 for SMTP. By running 'telnet 25', you can verify if the remote mail server is reachable and accepting connections on that port. This is a standard network troubleshooting step.

Answer

ping <IP>

Answer

arp -a

Answer

traceroute <IP>

Question 5

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

Accepted Answer

The ADOM contains devices. An ADOM cannot be deleted while it still contains devices; the delete option is greyed out until all devices (and their associated objects) are removed or moved to another ADOM. This is a built-in safeguard to prevent accidental loss of device configurations and log data. Read-only mode, log data, and admin rights do not cause the delete option to be greyed out in the same way.

Answer

The ADOM is set to 'Read-Only'

Answer

The ADOM has log data

Answer

The administrator lacks super_admin rights

Question 6

What is the purpose of the 'Add Device' wizard?

Accepted Answer

To register a new device to be managed by FortiManager.. The 'Add Device' wizard in FortiManager is specifically designed to add and register a new FortiGate or other supported device so that it can be centrally managed by FortiManager. This process involves specifying the device's serial number, IP address, and credentials, after which FortiManager can push configuration, policies, and firmware updates to the device. It is the initial step to bring a device under FortiManager's management umbrella.

Answer

To update the FortiGate firmware.

Answer

To migrate policies.

Answer

To configure VPN tunnels.

Question 7

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

Accepted Answer

The Shared Secret. The Shared Secret is the pre-shared key used to secure RADIUS communication between the FortiAuthenticator (RADIUS server) and the third-party VPN gateway (RADIUS client). Both devices must be configured with the identical shared secret; otherwise, RADIUS authentication requests will be rejected due to message integrity check failures. The other settings are either optional or not required to match for basic authentication.

Answer

The RADIUS accounting port

Answer

The NAS-IP-Address

Answer

The VSA Vendor ID

Question 8

Which menu path is used to create a new Administrator account?

Accepted Answer

System Settings > Admin. In the FortiGate GUI, administrator accounts are created under System Settings > Admin, where you define the username, password, admin profile, and trusted hosts. This is the standard location for local admin management on FortiOS.

Answer

Device Manager

Answer

Report Settings

Answer

FortiSoC

Question 9

Which configuration is required to allow external users to access the Webmail portal?

Accepted Answer

An Access Control rule.. Access Control rules in FortiMail define which source IP addresses or networks are permitted to reach specific services, including the Webmail portal. To allow external users to access Webmail, an administrator must create an access control rule that permits the relevant source addresses to connect to the Webmail service on the appropriate interface. Without this rule, connections are denied by default.

Answer

An AntiSpam profile.

Answer

A relay host.

Answer

A static route.

Question 10

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

Accepted Answer

You must configure a bridge pair of interfaces to pass traffic transparently.. FortiMail Transparent Mode requires a bridge pair — two interfaces bridged together so FortiMail sits inline between the mail server and the network without changing IP addressing. Traffic passes through the bridge, and FortiMail inspects SMTP transparently. This bridge pair is the mandatory network configuration for transparent deployment.

Answer

The mail server must point to the FortiMail IP as its default gateway.

Answer

The FortiMail must be configured with a unique IP address for each physical port for routing.

Answer

The FortiMail must be configured as a mail relay agent.

Question 11

Which TWO of the following are true about 'Scripts' in FortiManager?

Accepted Answer

They can be scheduled to run at specific times.. Option B is correct because FortiManager scripts support scheduling, allowing an administrator to define when a script executes (for example, a one-time run at a future date/time or a recurring schedule) rather than only running it manually on demand. Option E is correct because FortiManager scripts can be executed against multiple managed FortiGate devices at once, either by selecting several devices or by targeting a device group, which is a core benefit of centralized script management. Option A is wrong because scripts are not limited to a single execution; they can be run repeatedly and can also be scheduled. Option C is wrong because scripts execute CLI commands or configuration snippets on devices and do not automatically transform into policy objects or policy packages. Option D is wrong because scripting is a built-in FortiManager feature and does not require a separate add-on license.

Answer

They can only be run once.

Answer

They automatically convert to policies.

Answer

They require a separate license.

Question 12

When should you use 'Log Archive' instead of 'Log Database'?

Accepted Answer

For long-term storage. Log Archive is designed for long-term storage and compliance retention, storing logs in a compressed format that is not indexed for fast querying. Log Database, by contrast, is optimized for real-time analysis and fast searches. Therefore, Log Archive should be used when the primary requirement is long-term retention rather than immediate analytics.

Answer

For real-time traffic analysis

Answer

For triggering alerts

Answer

For generating daily reports

Question 13

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

Accepted Answer

Policy & Objects > Task Monitor. FortiManager logs all policy installation tasks in the Task Monitor, accessible under Policy & Objects > Task Monitor. When an installation fails due to an object conflict or any other reason, the Task Monitor shows the task status, the affected device, and a detailed log with the specific error message (e.g., which object conflicted and why). This is the primary place to diagnose installation failures.

Answer

Device Manager > Revision History

Answer

System Settings > Event Log

Answer

Policy & Objects > Installation Targets

Question 14

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

Automating incident response actions. Automation Stitches in the Security Fabric let you define trigger-action workflows that automatically respond to security events, such as quarantining a compromised endpoint or blocking an IP. The primary benefit is automating incident response actions across Fabric-connected devices. This reduces response time and manual effort.

Answer

Improving log compression

Answer

Increasing bandwidth

Answer

Updating firmware

Question 15

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Accepted Answer

Playbook Execution logs. FortiSOAR (and FortiGate's automation stitches) maintain dedicated Playbook Execution logs that record each playbook run, the actions executed, their results, and any errors. When a playbook fails to execute an action, the Playbook Execution logs are the correct place to inspect the execution history and diagnose the failure.

Answer

Device manager logs

Answer

System logs

Answer

FortiView

Question 16

Which TWO factors impact the performance of report generation?

Accepted Answer

Whether report caching is enabled. Option C is correct because enabling report caching allows previously generated report results to be reused instead of recomputed, directly reducing the time and resource load required for each report generation. Option D is correct because the size of the log data determines how much data must be queried, aggregated, and rendered, so larger log volumes increase processing time and can slow report generation. The number of registered devices (A) and firmware version (B) may affect the environment but are not direct determinants of report-generation performance, and CPU temperature (E) is a hardware/environmental symptom rather than a defined performance factor for report generation.

Answer

The number of registered devices

Answer

The firmware version of the devices

Answer

The CPU temperature

Question 17

When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?

Accepted Answer

It indicates if the package is in sync with the device.. In the Install Wizard, the Policy Package Status column shows whether the policy package currently installed on the target device matches the version in FortiManager — i.e., whether the device is in sync or out of sync. This lets the administrator see at a glance which devices need a policy install. A green/consistent status means no changes are pending; a modified status means the FortiManager copy differs from the device.

Answer

It displays the device firmware version.

Answer

It shows the last modified date.

Answer

It shows the number of policies in the package.

Question 18

Which TWO of the following protocols does FortiMail support for mail retrieval?

Accepted Answer

POP3. FortiMail supports POP3 (option A) for mail retrieval, allowing clients to download messages from the FortiMail mail store to their local mail client, which is a standard retrieval protocol for receiving email. FortiMail also supports IMAP (option C), which enables clients to access and manage mail on the server without downloading everything locally, and is commonly used for webmail and mobile synchronization. FTP (option B) is a file transfer protocol and is not used for retrieving email messages. HTTP (option D) is used for web browsing and webmail interfaces, not as a mail retrieval protocol in this context. DNS (option E) resolves domain names to IP addresses and does not retrieve mail.

Answer

FTP

Answer

HTTP

Answer

DNS

Question 19

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Accepted Answer

Traffic Monitor / SSL Dashboard. The Traffic Monitor / SSL Dashboard in FortiADC provides real-time visibility into SSL handshake times, including metrics like SSL negotiation duration. This tool is specifically designed to monitor SSL/TLS performance and identify bottlenecks in the handshake process.

Answer

Packet Capture (sniffer)

Answer

Log Access

Answer

System Health Monitor

Question 20

What is the function of the FortiGate's 'Security Fabric' connector?

Accepted Answer

To integrate with external platforms like AWS or Azure. The Security Fabric connector on FortiGate enables integration with external platforms and services — including public cloud providers like AWS and Azure, as well as other Fortinet and third-party security products — to share threat intelligence and automate responses. It extends the Fabric beyond Fortinet devices to external ecosystems. This is distinct from internal Fabric devices, which are Fortinet products joined via Fabric root.

Answer

To connect to physical power outlets

Answer

To reset the firewall

Answer

To bypass the firewall