FORTINET-NSE56 Practice Test 13 — 15 Questions

Question 1

How does FortiMail identify the policy to apply to an incoming email?

Accepted Answer

By the sender IP and recipient domain.. FortiMail evaluates incoming email against access control rules (recipient policies) that match on criteria including sender IP/domain and recipient domain. These are the primary matching attributes used to determine which policy — and thus which antivirus, antispam, and content actions — apply to the message. The policy lookup happens early in the inbound flow, before content inspection.

Answer

By the size of the email.

Answer

By the file type.

Answer

By the subject line.

Question 2

Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?

Accepted Answer

Rate Limiting / Thresholds. Brute force attacks are characterized by a high volume of repeated login attempts from one or more sources within a short window. FortiWeb's Rate Limiting / Thresholds feature (often configured as a brute-force login protection policy) counts failed login attempts per source IP or user and triggers blocking or challenge actions once a threshold is exceeded. This directly detects and mitigates credential-guessing behavior.

Answer

IP Reputation

Answer

Cookie signing

Answer

SQL Injection protection

Question 3

In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?

Accepted Answer

Automation Stitch. Automation Stitch in the Security Fabric lets you define trigger-action workflows across Fabric devices. When one device (e.g., FortiSandbox or FortiAnalyzer) detects a compromised host, it can send a trigger that the FortiGate consumes to automatically quarantine that host (e.g., via a quarantine action or address group update). This is the automation mechanism for cross-device response.

Answer

Security Rating

Answer

Fabric Connector

Answer

Log Correlation

Question 4

Which of the following is a symptom of a full quarantine storage?

Accepted Answer

Inability to save new emails to the quarantine.. When quarantine storage is full, the system cannot write new messages to the quarantine database or disk, resulting in the inability to save new emails to quarantine. This is the direct and immediate symptom because the storage medium has reached capacity and rejects further writes. Other symptoms like slow delivery or increased spam are indirect and not definitive indicators of a full quarantine.

Answer

Slow email delivery.

Answer

Loss of admin access.

Answer

Increased spam.

Question 5

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

Accepted Answer

It provides centralized logging and advanced analytics. Integrating FortiWeb with FortiAnalyzer in the Security Fabric provides centralized logging and advanced analytics — FortiWeb forwards its WAF logs (attacks, violations, traffic) to FortiAnalyzer, where they are correlated with logs from FortiGate, FortiSandbox, and other Fabric devices. This enables unified dashboards, compliance reports, and threat correlation that would be impossible with FortiWeb's local logs alone.

Answer

It enables hardware acceleration on FortiWeb

Answer

It bypasses the need for WAF policies

Answer

It allows FortiWeb to perform SSL offloading

Question 6

A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?

Accepted Answer

The server has reached its max connection limit. In FortiADC, a 'Server Busy' status for a pool member indicates that the server has reached its configured maximum connection limit. FortiADC tracks concurrent connections per real server, and when the limit is hit, it marks the server as busy and stops sending new connections to it until existing ones close. This is a load-balancing health/status indicator, not a health check failure or a device-down state.

Answer

The server is rejected by the health check

Answer

The server is down

Answer

The ADC is experiencing high CPU

Question 7

Which type of scan should be enabled to detect known malware in email attachments?

Accepted Answer

Antivirus scanning.. Antivirus scanning is the scan type that inspects email attachments for known malware by matching file content against virus signatures and heuristic patterns. It is specifically designed to detect and block malicious payloads in attachments.

Answer

Spam scanning.

Answer

Reputation scanning.

Answer

Content scanning.

Question 8

When scheduling a report, what is the purpose of the 'Output Profile'?

Accepted Answer

Defining report formats and destinations. In FortiAnalyzer/FortiManager report scheduling, the Output Profile defines how the finished report is rendered and where it is delivered — for example PDF, CSV, or XML format, and whether it is emailed, saved to a share, or uploaded to a remote server. It is the delivery/formatting layer of the report job, separate from the data selection and time window.

Answer

Configuring data retention

Answer

Setting the report time range

Answer

Adding user permissions

Question 9

In the context of the Security Fabric, what is a 'root' FortiGate?

Accepted Answer

The device that controls the Fabric and collects telemetry. In the Security Fabric, the 'root' FortiGate is the device that controls the Fabric topology and collects telemetry from all downstream (downstream/child) devices. It is the central management and visibility point — the Fabric root — from which the administrator sees the entire security posture.

Answer

The firewall with the most ports

Answer

The oldest firewall in the office

Answer

A virtual appliance

Question 10

If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?

Accepted Answer

Trusted hosts. Trusted hosts is a FortiAnalyzer (and FortiGate) feature that restricts GUI and administrative access to a specified list of source IP addresses or subnets. By configuring trusted hosts on administrator accounts, only connections originating from those authorized addresses can reach the GUI, effectively ensuring that only authorized administrators can access it. The other options do not provide this access restriction.

Answer

Log encryption

Answer

ADOM mode switching

Answer

Report scheduling

Question 11

When using FortiSoC playbooks, what is the 'Connector' used for?

Accepted Answer

Integrating with external systems. In FortiSOC playbooks, a Connector is a configuration object that defines how the playbook integrates with external systems — such as firewalls, ticketing systems, email servers, or threat intelligence platforms. Connectors provide the credentials, endpoints, and protocol details needed for the playbook to execute actions like blocking an IP on a firewall or creating a ServiceNow ticket.

Answer

Filtering log traffic

Answer

Managing device firmware

Answer

Linking logs to reports

Question 12

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Accepted Answer

Use the 'Test' button in the Event Handler definition. The 'Test' button in the Event Handler definition allows the administrator to run the handler's filter against existing logs and see which entries match, without waiting for a real-time trigger. This directly validates whether the filter criteria (log type, severity, field conditions) are correctly defined and whether any logs in the current dataset satisfy them. It is the fastest and most precise troubleshooting step.

Answer

Run a manual report

Answer

Rebuild the SQL database

Answer

Check the FortiAnalyzer system logs

Question 13

A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?

Accepted Answer

FortiGate log-server configuration. After confirming IP connectivity and that the FortiGate is registered on the FortiAnalyzer, the next logical step is to verify the FortiGate's log-server configuration. This setting defines the FortiAnalyzer's IP address, port, and which log types (traffic, event, etc.) are sent. If the log-server is misconfigured or disabled, logs will not be transmitted even if the device is registered. Therefore, checking the log-server configuration is the correct next step.

Answer

Report scheduling

Answer

FortiView update interval

Answer

FortiAnalyzer Device registration status

Question 14

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Accepted Answer

Prevention mode. Prevention mode in a FortiWeb server policy actively blocks detected attacks such as SQL injection while allowing legitimate traffic to pass. This is the operational mode that enforces the WAF's security rules and takes action against malicious requests. Detection mode only logs, and learning mode builds a baseline without blocking.

Answer

Transparent mode

Answer

Learning mode

Answer

Detection mode

Question 15

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

Accepted Answer

Enable the Security Fabric connector on the FortiGate. To add a FortiWeb appliance to the Security Fabric, the FortiGate must have the Security Fabric connector enabled. This connector is the mechanism that allows the FortiGate to discover, authorize, and manage Fabric devices including FortiWeb. Without it enabled, the FortiGate will not recognize or accept the FortiWeb as a Fabric member, regardless of network connectivity.

Answer

Configure static routing between the devices

Answer

Disable all firewall policies

Answer

Manually create an IPsec tunnel between devices