FORTINET-NSE56 Practice Test 12 — 15 Questions

Question 1

In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?

Accepted Answer

SSL Offloading. SSL Offloading in FortiADC is the feature that terminates client SSL connections at the load balancer and establishes a separate connection to the backend server. This allows the ADC to decrypt, inspect, and optionally re-encrypt traffic, and it offloads CPU-intensive TLS handshakes from backend servers. The question explicitly describes termination at the ADC and a new connection to the backend, which is the definition of SSL offloading (specifically SSL bridging/termination).

Answer

Server Persistence

Answer

HTTP Header Insertion

Answer

Layer 4 Load Balancing

Question 2

In the context of FortiAuthenticator, what does 'SSO' stand for?

Accepted Answer

Single Sign-On. In FortiAuthenticator, SSO stands for Single Sign-On, a feature that allows users to authenticate once and gain access to multiple systems without re-entering credentials. FortiAuthenticator supports SSO through protocols like SAML, Kerberos, and RADIUS, integrating with FortiGate and third-party applications.

Answer

Standard Security Option

Answer

Service Security Object

Answer

Secure System Operation

Question 3

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

Accepted Answer

Use a Header Rewrite script. FortiADC provides Header Rewrite scripts specifically for manipulating HTTP request and response headers at Layer 7. To insert or rewrite X-Forwarded-For with the client IP, you create a Header Rewrite policy/script and bind it to the virtual server or content rule. This is the intended tool for header manipulation in FortiADC's L7 processing pipeline.

Answer

Configure a SNAT pool

Answer

Apply a WAF profile

Answer

Modify the Virtual Server interface

Question 4

How can you ensure that only encrypted traffic is allowed for webmail access?

Accepted Answer

Enable HTTPS and redirect HTTP to HTTPS.. Enabling HTTPS and redirecting HTTP to HTTPS (A) ensures that all webmail sessions are encrypted in transit using TLS, and that users who type 'http://' are automatically upgraded to the secure channel. This is the standard method to enforce encrypted webmail access without disabling the service. It satisfies both confidentiality and availability requirements.

Answer

Use a VPN for all traffic.

Answer

Set the port to 25.

Answer

Disable the Webmail service.

Question 5

What does the 'Auto-Link' feature in the 'Policy & Objects' tab do?

Accepted Answer

It maps matching objects between the managed device and the FortiManager database.. The Auto-Link feature in FortiManager's Policy & Objects tab automatically maps objects (addresses, services, etc.) that exist on the managed FortiGate with those in the FortiManager database, ensuring consistency when policies are installed. This prevents duplicate objects and simplifies policy management by aligning the device's configuration with the central database. It does not create rules, link ADOMs, or enable VPNs.

Answer

It automatically creates rules.

Answer

It links two separate ADOMs.

Answer

It enables VPN tunnels.

Question 6

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

Accepted Answer

The FortiManager database is updated with the device configuration.. 'Retrieve Config' pulls the running configuration from the managed FortiGate and imports it into the FortiManager database, overwriting the FortiManager copy. If the FortiGate has local changes not yet reflected in FortiManager, those changes are captured and the FortiManager database is updated to match the device. This makes the device the source of truth for that operation.

Answer

All policies are deleted.

Answer

The FortiGate resets to factory settings.

Answer

The FortiGate goes offline.

Question 7

Which TWO actions can be triggered by a FortiSoC Playbook?

Accepted Answer

Sending an email notification. Option B is correct because FortiSoC playbooks can include notification actions that send email alerts to administrators or stakeholders when a trigger condition is met, using configured SMTP/mail server settings. Option E is correct because playbooks can execute remediation actions against integrated devices, including updating firewall address objects (for example, adding a malicious IP to a blocklist address object) via the FortiGate/FortiManager connector. Option A is not a valid playbook action because deleting an ADOM is an administrative configuration task performed in FortiManager/FortiAnalyzer, not an automated response action. Option C is incorrect because changing system time is an administrative system setting, not a playbook-triggered response. Option D is incorrect because rebooting the FortiAnalyzer is a maintenance operation, not a typical automated playbook action.

Answer

Deleting the ADOM

Answer

Changing system time

Answer

Rebooting the FortiAnalyzer

Question 8

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

Accepted Answer

Policy & Objects > Installation Preview.. The Installation Preview in Policy & Objects shows a detailed diff between the FortiManager policy database and the FortiGate's running configuration before installation. This allows administrators to review exactly what changes will be pushed, making it the correct place to troubleshoot a failed policy installation.

Answer

Object Usage.

Answer

FortiView.

Answer

Device Manager > Revision History.

Answer

System Settings > Task Monitor.

Question 9

You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?

Accepted Answer

DLP dictionary. A DLP dictionary defines the patterns (such as regular expressions or predefined patterns for credit card numbers, SSNs, etc.) that the DLP engine uses to identify sensitive data. To block emails containing credit card numbers, you must configure a DLP dictionary with the appropriate pattern (e.g., a regex for 16-digit numbers with Luhn check) and then reference it in a DLP profile or content profile.

Answer

Access Control Rule

Answer

Content profile

Answer

Antivirus policy

Question 10

When utilizing the 'Install Preview' feature before pushing a policy package, what is the primary benefit to the administrator?

Accepted Answer

To view the CLI commands that will be pushed to the device.. The Install Preview feature in FortiManager shows the administrator the exact CLI commands that will be pushed to the managed device before committing the policy package. This allows verification of the configuration changes, detection of unintended modifications, and validation that the policy will apply as expected, reducing the risk of service disruption.

Answer

To update the FortiManager revision history database.

Answer

To automatically correct syntax errors in the policy.

Answer

To bypass the approval workflow.

Question 11

What is the primary function of the FortiMail 'Quarantine' feature?

Accepted Answer

To hold emails identified as spam or viruses for review.. FortiMail's Quarantine feature holds messages flagged as spam, virus-infected, or otherwise suspicious so they are not delivered to end users' inboxes but remain available for review, release, or deletion. It acts as a safety net that prevents false positives from being permanently lost while blocking threats.

Answer

To provide long-term email archiving.

Answer

To compress outgoing attachments.

Answer

To bypass SMTP authentication.

Question 12

Which THREE features are provided by the FortiADC when acting as an application delivery controller?

Accepted Answer

Layer 7 Load Balancing. FortiADC is an application delivery controller (ADC), and its core function is Layer 7 load balancing (option B), inspecting application-layer protocols such as HTTP/HTTPS to distribute requests across backend servers based on content, headers, or URLs. It also provides a Web Application Firewall (option C), which inspects and filters HTTP/HTTPS traffic to block attacks like SQL injection and cross-site scripting, a standard ADC security feature. Additionally, FortiADC supports Global Server Load Balancing (option D), directing clients to the best data center or site based on health, proximity, or performance across geographically distributed resources. Email routing (option A) is a mail-transfer function handled by mail servers or secure email gateways, not an ADC capability, and a DHCP server (option E) provides IP address leasing, which is unrelated to application delivery and load balancing.

Answer

Email routing

Answer

DHCP server

Question 13

What happens if a message matches multiple policies?

Accepted Answer

The first matching policy is applied.. FortiMail processes policies in a top-down, first-match order, similar to firewall policy evaluation. Once a message matches a policy, that policy's action is applied and evaluation stops — subsequent policies are not evaluated. This makes policy ordering critical, since a broad permissive policy placed above a specific restrictive one will shadow the latter.

Answer

The system throws an error.

Answer

All matching policies are applied.

Answer

The most restrictive action is taken.

Question 14

Which FortiWeb feature allows you to block traffic based on the geographic origin of the IP address?

Accepted Answer

Country Blocking. FortiWeb's Country Blocking feature allows administrators to block or allow traffic based on the geographic origin of the source IP address. It uses a geo-IP database to map IP addresses to countries, and policies can be configured to deny requests from specific countries outright. This is commonly used to reduce attack surface from regions where the organization does not do business.

Answer

Threshold rules

Answer

IP Reputation

Answer

Signature set

Question 15

Which GUI menu is primarily used for monitoring real-time activity?

Accepted Answer

Monitor.. The Monitor menu in FortiMail provides real-time visibility into system activity, including live mail logs, queue status, active sessions, and statistics dashboards. It is the designated GUI area for observing current operational state rather than configuring behavior.

Answer

Profile.

Answer

Policy.

Answer

System settings.