FORTINET-NSE56 Practice Test 14 — 15 Questions

Question 1

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the public DNS records for the domain.. The public key for DKIM must be published in the public DNS records for the sending domain, typically as a TXT record at a selector-based name like selector._domainkey.example.com. Receiving MTAs query DNS to retrieve the public key and validate the DKIM signature. Without DNS publication, validation fails.

Answer

On the SMTP server of the recipient's domain.

Answer

In the FortiMail's relay host configuration.

Answer

On the FortiMail server's local certificate store.

Question 2

When using FortiMail in Server Mode, how does the appliance handle incoming mail?

Accepted Answer

It accepts mail directly for local mailboxes and provides access via POP3/IMAP.. In Server Mode, FortiMail acts as the final destination mail server (MTA/MDA) for one or more protected domains, accepting inbound SMTP connections directly and delivering messages into local mailboxes. Users then retrieve their mail using POP3, IMAP, or webmail (FortiMail's built-in web interface). This contrasts with Gateway Mode, where FortiMail sits in front of an existing backend mail server and relays filtered mail to it.

Answer

It only filters outgoing mail.

Answer

It relays all mail to an internal backend mail server.

Answer

It inspects traffic in-line without terminating the connection.

Question 3

If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?

Accepted Answer

It merges the FortiGate policies into the FortiManager policy package.. The 'Import Policy' function in FortiManager retrieves the policy configuration from a managed FortiGate and merges it into the FortiManager policy package for that device or ADOM. This is used when a FortiGate has been configured locally and the administrator wants FortiManager's database to reflect the device's actual policy set, enabling centralized management going forward.

Answer

It forces a firmware downgrade.

Answer

It automatically creates a new ADOM.

Answer

It deletes all existing policies in the ADOM.

Question 4

Which component of the FortiADC performs the translation between the virtual IP and the real server IP?

Accepted Answer

The Virtual Server. The Virtual Server on FortiADC is the configuration object that binds a virtual IP (VIP) and port to a pool of real servers. When a client connects to the VIP, the Virtual Server performs destination NAT (DNAT), translating the VIP to the selected real server's IP and port. It also handles the reverse translation for return traffic, ensuring session persistence and load balancing. Thus, the Virtual Server is the component that directly performs the IP translation between virtual and real server IPs.

Answer

The Real Server group

Answer

The Health Check probe

Answer

The Content Routing policy

Question 5

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

Accepted Answer

Log the request details. Option B is correct because FortiWeb can log the full details of a violating request (source IP, URL, matched signature/rule, and action taken) to its attack, traffic, and event logs for auditing and forensic analysis. Option C is correct because FortiWeb supports a redirect action that sends the offending client to a customizable block page (for example, an HTML page hosted on FortiWeb) instead of returning the protected application's content. Option E is correct because FortiWeb can drop or reset the connection, terminating the TCP session (RST) so the malicious request never reaches the backend server. Option A is not a FortiWeb function: FortiWeb is a WAF and does not patch vulnerabilities on backend servers; patching is an administrative task on the server itself. Option D is also outside FortiWeb's role, since it cannot increase backend server CPU resources; that would be handled by the server or virtualization/cloud platform.

Answer

Automatically patch the server vulnerability

Answer

Increase the backend server CPU

Question 6

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Accepted Answer

Remote server IP address. Option A (Remote server IP address) is correct because FortiAnalyzer must know the destination address of the remote Syslog server to open the connection and forward logs to it; without a valid IP/FQDN the logs cannot be delivered. Option D (Syslog server port) is correct because the remote Syslog daemon listens on a specific port (typically UDP/TCP 514, or 6514 for TLS), and FortiAnalyzer must use the matching port or the server will not accept the forwarded logs. Option B (Log filter criteria) only determines which logs are sent, not whether the server accepts them, so it is not required for acceptance. Option C (Enable compression for all logs) is an optional transport optimization and not needed for the server to accept logs. Option E (Include device hostname in logs) affects log content/formatting but is not a connectivity parameter required for the remote server to accept the logs.

Answer

Log filter criteria

Answer

Enable compression for all logs

Answer

Include device hostname in logs

Question 7

Which of the following is true about 'Report Data Masking'?

Accepted Answer

It masks sensitive information. Report Data Masking in FortiAnalyzer/FortiManager replaces sensitive data (such as usernames, IP addresses, or other PII) in generated reports with masked values, protecting privacy while still allowing report distribution. It does not alter the underlying logs or encrypt the report file — it only obscures specific fields in the report output.

Answer

It encrypts the report file

Answer

It deletes the logs

Answer

It hides the entire report

Question 8

Which setting in the 'System Settings' is used to define the administrator's password policy?

Accepted Answer

Administrator settings.. In FortiGate's GUI, the administrator password policy is configured under System > Settings > Administrator Settings. This section allows you to enforce password complexity, minimum length, expiration, and reuse restrictions for local admin accounts. The other options are unrelated to password policy configuration.

Answer

Device Manager.

Answer

Policy & Objects.

Answer

FortiGuard.

Question 9

When using the Workflow mode for policy management, what happens immediately after a policy change request is submitted?

Accepted Answer

The policy is locked and sent to the approval queue.. In Workflow mode, FortiManager enforces a change-control process: when an administrator submits a policy change request, the policy is locked so no other changes can be made to it, and it is placed into the approval queue. It is not installed on the device until an approver reviews and approves the request. This ensures separation of duties and prevents unauthorized or unreviewed policy changes from reaching production devices.

Answer

The policy is pushed to the device automatically.

Answer

The device immediately reboots.

Answer

The policy is applied to the 'Staging' ADOM.

Question 10

Which THREE actions can be performed on a policy package within the Policy & Objects tab?

Accepted Answer

Clone. In the Policy & Objects tab, a policy package can be cloned (A) to create a duplicate copy of the package with all its policies and objects, which is useful for replicating configurations across different scopes. It can also be deleted (C) to remove the package entirely from the policy management structure when it is no longer needed. Additionally, a policy package can be locked (E) to prevent other administrators from making concurrent changes, which helps avoid configuration conflicts in multi-admin environments. Options B (Factory Reset) and D (Firmware Upgrade) are not valid actions for a policy package; factory reset and firmware upgrade are device-level operations performed on the firewall itself, not on a policy package within the Policy & Objects tab.

Answer

Factory Reset

Answer

Firmware Upgrade

Question 11

An administrator needs to quickly distribute a CLI command to fifty managed FortiGate devices. Which feature should they use to automate this task efficiently?

Accepted Answer

Scripts. FortiManager Scripts allow an administrator to run CLI command scripts against multiple managed devices simultaneously, making it the ideal tool for pushing a single command to fifty FortiGates at once. Scripts can be executed on selected devices or device groups, providing efficient bulk automation.

Answer

Device Groups

Answer

Policy Packages

Answer

Provisioning Templates

Question 12

What does the 'Heuristic' score measure in the AntiSpam engine?

Accepted Answer

The probability that the email content is spam.. The Heuristic score in FortiMail's AntiSpam engine is a computed probability (0–100) that a message's content exhibits spam-like characteristics, based on rules analyzing headers, body text, and structure. It is a content-based score, not a reputation or metadata metric. Administrators set thresholds to tag or quarantine messages above a given score.

Answer

The sender's reputation.

Answer

The attachment size.

Answer

The speed of the sender.

Question 13

Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?

Accepted Answer

Using the Script Manager.. The Script Manager in FortiManager allows administrators to create and run CLI scripts on multiple managed FortiGate devices simultaneously. It is the most efficient method to apply a specific set of CLI commands to many devices at once, as it supports scheduling, targeting device groups, and executing scripts in parallel. This avoids manual CLI access and is more direct than modifying provisioning templates for ad-hoc changes.

Answer

Updating the firmware.

Answer

Manual CLI access to each device.

Answer

Modifying the Provisioning Template.

Question 14

Which component manages the 'Daily Report' schedule?

Accepted Answer

Report settings.. The Daily Report schedule in FortiMail is managed under Report settings. This area lets administrators configure when reports are generated, what data they include, and who receives them. Report settings is the dedicated configuration section for all report-related scheduling and delivery parameters.

Answer

Access control rules.

Answer

Quarantine settings.

Answer

System logs.

Question 15

Where do you configure the expiration period for messages in the quarantine?

Accepted Answer

Quarantine maintenance settings.. The expiration period for quarantined messages in FortiMail is configured under Quarantine maintenance settings. This area controls how long messages remain in quarantine before being automatically deleted, along with other maintenance tasks like database cleanup. It is the correct location for setting quarantine retention policies.

Answer

Access rules.

Answer

System logs.

Answer

AntiSpam profile.