FORTINET-NSE56 Practice Test 17 — 15 Questions

Question 1

What is the function of the 'Device Manager' in FortiAnalyzer?

Accepted Answer

To manage registered devices. The Device Manager in FortiAnalyzer is the interface used to manage registered devices — it lists all FortiGates and other Fortinet devices that have been added, shows their status, allows ADOM assignment, and provides actions like authorize, de-authorize, delete, and view device details. It is the central inventory of managed devices.

Answer

To view live threats

Answer

To create playbooks

Answer

To run reports

Question 2

When configuring a Recipient Policy, what does the 'Action' field determine?

Accepted Answer

Whether the email is allowed, blocked, or quarantined.. In FortiMail Recipient Policies, the 'Action' field determines the disposition of the email for that recipient — whether it is allowed (relayed/delivered), blocked (rejected), or quarantined. This is the core decision point that controls how the message is handled after all other policy criteria (sender, recipient, IP, etc.) are matched.

Answer

The language of the notification.

Answer

The storage location of the email.

Answer

The encryption algorithm used.

Question 3

You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?

Accepted Answer

To the FortiWeb internal interface. In Reverse Proxy mode, FortiWeb sits inline between clients and backend servers, so all return traffic from the servers must traverse FortiWeb for inspection and NAT. The backend servers' default gateway must therefore point to FortiWeb's internal (server-facing) interface IP, ensuring symmetric traffic flow. If the gateway pointed elsewhere, return traffic would bypass FortiWeb, breaking the proxy session and defeating protection.

Answer

To a secondary FortiGate

Answer

To the Loopback interface

Answer

Directly to the Internet

Question 4

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

Accepted Answer

System Event Logs. FortiADC health checks are internal system-level operations, and failures (e.g., connection refused, timeout, unexpected response code) are recorded in the System Event Logs. These logs capture the health check probe results, the reason for marking a server as down, and any configuration or connectivity errors, making them the primary source for diagnosing why a health check is failing.

Answer

Session Table Logs

Answer

Application Traffic Logs

Answer

Security Policy Logs

Answer

SNMP Traps

Question 5

Which TWO actions are commonly performed within the 'Device Manager' module?

Accepted Answer

Monitoring device connection status. Option C is correct because the Device Manager module in FortiManager provides real-time visibility into managed devices, letting administrators monitor each FortiGate's connection status (up/down) and other health indicators. Option E is correct because Device Manager is where administrators add and register new FortiGate devices to FortiManager, either individually or via discovery, so they can be centrally managed. The remaining options do not belong: creating custom reports (A) is done in the Reports module, archiving old log files (B) is handled through Log & Report/log settings rather than Device Manager, and configuring event handlers (D) is performed in the Event Management or automation/trigger configuration area, not in Device Manager.

Answer

Creating custom reports

Answer

Archiving old log files

Answer

Configuring event handlers

Question 6

What is the purpose of the 'Session Limit' setting in an Access Control Rule?

Accepted Answer

To prevent DoS attacks by restricting concurrent connections.. The Session Limit setting in an Access Control Rule caps the number of concurrent sessions (connections) that match the rule, per source or overall depending on configuration. By restricting concurrent connections, it prevents a single host or botnet from exhausting firewall or server resources, which is a classic DoS mitigation. This is a resource-protection control, not a user-count or storage control.

Answer

To limit the number of users.

Answer

To control the speed of virus scanning.

Answer

To limit the total email storage space.

Question 7

What is the primary function of the 'FortiToken'?

Accepted Answer

Two-factor authentication (2FA). FortiToken is Fortinet's hardware or software token used for two-factor authentication (2FA). It generates time-based one-time passwords (TOTP) that supplement username/password authentication, adding a second factor to verify user identity. FortiToken can be a physical hardware token or a mobile app (FortiToken Mobile).

Answer

User database management

Answer

Secure storage for passwords

Answer

VPN encryption

Question 8

Which THREE types of logs can be generated by FortiWeb?

Accepted Answer

Event Log. FortiWeb generates an Event Log (B), which records system-level activities such as administrative logins, configuration changes, HA events, and daemon status messages. It also generates a Traffic Log (C), which records the HTTP/HTTPS requests and responses handled by the FortiWeb proxy, including the action taken (allow, block, alert) and details like source IP, URL, and policy matched. The Attack Log (E) is also a valid FortiWeb log type, capturing detected attacks and violations such as SQL injection, XSS, and other signatures from the FortiWeb attack definitions, along with severity and action. Packet Capture Log (A) is not a FortiWeb log category — packet capture is a diagnostic tool (via the CLI/GUI packet capture feature), not a log type. User Billing Log (D) is not a FortiWeb log type; billing/user accounting logs are associated with other Fortinet products or RADIUS accounting, not FortiWeb's logging categories.

Answer

Packet Capture Log

Answer

User Billing Log

Question 9

What happens when you change the 'Log Policy' to 'Archive only'?

Accepted Answer

Real-time analysis stops. In FortiAnalyzer, the 'Log Policy' setting controls how logs are processed. When set to 'Archive only', logs are stored but not analyzed in real time. This means that features like real-time log correlation, alerting, and reporting that depend on immediate analysis are disabled. The logs are still available for later retrieval and offline analysis.

Answer

Logs are deleted

Answer

The system reboots

Answer

The system automatically upgrades

Question 10

Which protocol is most secure for retrieving email from the FortiMail server?

Accepted Answer

IMAPS.. IMAPS (IMAP over SSL/TLS) is the most secure protocol for retrieving email because it encrypts the entire session, protecting credentials and message content in transit. IMAP itself allows server-side storage and synchronization, and adding SSL/TLS (typically on port 993) ensures confidentiality and integrity. This is the recommended protocol for secure email retrieval.

Answer

Telnet.

Answer

SMTP.

Answer

POP3.

Question 11

What is the benefit of using 'FortiGuard' services with FortiMail?

Accepted Answer

It provides updated spam and antivirus signatures.. FortiGuard is Fortinet's subscription-based threat intelligence service that continuously pushes updated spam signatures, antivirus definitions, and other security databases to FortiMail. Because email threats evolve constantly, FortiMail relies on FortiGuard to keep its anti-spam and antivirus engines current without manual intervention. This is the core value proposition of the FortiGuard subscription bundled with FortiMail.

Answer

It replaces the need for local policies.

Answer

It provides cloud-based email storage.

Answer

It allows remote management by Fortinet.

Question 12

When an email is encrypted using FortiMail's Identity-Based Encryption (IBE), what does the recipient receive?

Accepted Answer

A notification email with a link to the secure portal.. With FortiMail Identity-Based Encryption (IBE), the recipient does not need a pre-shared key or certificate. Instead, they receive a notification email containing a link to a secure web portal where they authenticate (often via a one-time password or identity verification) to read and reply to the encrypted message. The message itself is stored on the FortiMail secure portal.

Answer

The email is blocked.

Answer

A password protected PDF file.

Answer

The encrypted message attached to the email.

Question 13

Which TWO methods can be used to back up FortiAnalyzer configuration?

Accepted Answer

Scheduled backup to FTP/SCP. Option A (Scheduled backup to FTP/SCP) is correct because FortiAnalyzer supports scheduled configuration backups that are transferred to a remote FTP or SCP server, allowing automated, off-box protection of the configuration. Option E (Manual backup via CLI/GUI) is correct because administrators can trigger an on-demand configuration backup through the GUI (System Settings > Dashboard > Backup) or the CLI using the 'execute backup config' command. The other options do not belong: FortiView snapshots (B) are visual reports of traffic/log data, not configuration backups; log archiving (C) stores log data rather than the FortiAnalyzer configuration; and device provisioning (D) is a management feature for onboarding and configuring managed devices, not for backing up FortiAnalyzer itself.

Answer

FortiView snapshots

Answer

Log archiving

Answer

Device provisioning

Question 14

A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?

Accepted Answer

TCP. For load balancing SMTP traffic, a TCP health check is the appropriate choice because SMTP operates over TCP (typically port 25, 587, or 465). A TCP health check verifies that the server is accepting TCP connections on the specified port, which is sufficient to determine SMTP service availability without needing application-layer parsing. HTTP, RADIUS, and DNS health checks are protocol-specific and would not correctly validate an SMTP service.

Answer

RADIUS

Answer

HTTP

Answer

DNS

Question 15

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

Accepted Answer

The ADOM selection is incorrect. FortiView data is scoped to an ADOM, so if the administrator is viewing the wrong ADOM, the specific device's data will not appear even though logs exist. Selecting the correct ADOM (the one containing the device and its logs) is required before FortiView can display that device's traffic, applications, or threats. This makes an incorrect ADOM selection the most likely cause of missing FortiView data.

Answer

The FortiGate is powered off

Answer

The report is still running

Answer

The FortiAnalyzer is too slow