FORTINET-NSE56 Practice Test 18 — 15 Questions

Question 1

Which TWO of the following are valid log file types supported by FortiAnalyzer?

Accepted Answer

Event logs. FortiAnalyzer natively stores and indexes log types such as Event logs (B) and Traffic logs (E), which correspond to the standard log categories generated by FortiGate and other Fortinet devices (traffic, event, security, anomaly, VoIP, etc.). Event logs (B) capture system, administrative, and user activity events, while Traffic logs (E) record session-level connection details, and both are core log types FortiAnalyzer is designed to receive, archive, and analyze. PDF reports (A) are generated output artifacts, not log file types, and HTML dashboards (C) are visualization interfaces rather than logs. Firmware images (D) are OS binaries for devices, not log data, so they are not supported log file types in FortiAnalyzer.

Answer

PDF reports

Answer

HTML dashboards

Answer

Firmware images

Question 2

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

Accepted Answer

To view the topology and status of connected devices. The Security Fabric dashboard on FortiGate provides a visual topology map showing all Fabric-connected devices (FortiGates, FortiSwitches, FortiAPs, FortiManager, FortiAnalyzer, etc.) along with their health and status. It is the primary place to verify Fabric topology and device connectivity, not to manage billing, signatures, or VPNs.

Answer

To manage FortiCloud billing

Answer

To update antivirus signatures

Answer

To configure VPN tunnels

Question 3

Where do you check the current status of the FortiMail services?

Accepted Answer

On the dashboard.. The FortiMail dashboard provides a real-time status view of system services, including mail services (SMTP, IMAP, POP3, webmail), system resources, and service health indicators. Administrators use the dashboard as the first place to confirm whether services are running or stopped. This makes it the correct location for checking current service status.

Answer

In the system report.

Answer

In the quarantine folder.

Answer

In the mail log.

Question 4

Which THREE components are visible in the 'Log View' interface?

Accepted Answer

Log table (raw data). The Log View interface is designed for inspecting and querying collected log data, so it exposes the Log table (raw data) (A), which displays the actual log entries received from monitored devices, and the Log search bar (D), which lets analysts filter and query those entries using search syntax. It also includes the Time period selection (E), which scopes the displayed logs to a specific time window so results are relevant and performant. The Playbook builder (B) belongs to the automation/response workflow area rather than the log inspection view, and Device provisioning templates (C) are part of onboarding/configuration management, so neither is rendered within Log View.

Answer

Playbook builder

Answer

Device provisioning templates

Question 5

When adding a FortiGate to a FortiAnalyzer, which information is required?

Accepted Answer

Device serial number. When adding a FortiGate to FortiAnalyzer, the device serial number is required because FortiAnalyzer uses it as the unique identifier to authenticate and authorize the device for log storage and management. The serial number ensures that only the correct FortiGate can send logs and receive configuration from the FortiAnalyzer, preventing unauthorized devices from registering. This is part of the initial device authorization process, where the FortiAnalyzer admin adds the serial number and then the FortiGate is configured to point to the FortiAnalyzer.

Answer

The admin password of the FortiAnalyzer

Answer

The SQL database password

Answer

The log file format

Question 6

What is the benefit of using FortiAnalyzer in the Security Fabric?

Accepted Answer

Centralized logging and reporting. FortiAnalyzer provides centralized logging, analysis, and reporting for the Security Fabric, aggregating logs from FortiGate, FortiMail, and other devices. This enables correlation, compliance reporting, and long-term retention. It does not provide hardware acceleration or manage ISP failover.

Answer

It provides hardware acceleration for the FortiGate

Answer

It manages ISP failover

Answer

It replaces the FortiGate firewall

Question 7

Which component of FortiAnalyzer is used to identify top talkers on the network?

Accepted Answer

FortiView. FortiView is FortiAnalyzer's analytics module that aggregates logs into visual dashboards showing top talkers, top applications, top destinations, and threat activity. It is specifically designed to answer 'who is using the most bandwidth or generating the most sessions' by ranking sources, destinations, and applications. The other modules are for raw log inspection, device management, or automated alerting.

Answer

System Dashboard

Answer

Log View

Answer

Event Handler

Question 8

Which configuration file format is used for importing user lists?

Accepted Answer

CSV.. FortiGate devices support importing user lists from CSV (Comma Separated Values) files. This is the standard format for bulk user creation, allowing administrators to define multiple local users with attributes like username, password, and email in a simple tabular structure. The CSV file can be uploaded via GUI (User & Device > User Definition > Import) or CLI, and the FortiGate parses each row to create user objects. Other formats like XML or JSON are not natively supported for this specific import function.

Answer

XML.

Answer

PDF.

Answer

JSON.

Question 9

You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?

Accepted Answer

The configuration on the FortiManager differs from the configuration on the FortiGate.. 'Modified' in Device Status indicates that the configuration on FortiManager differs from the configuration on the FortiGate. This means the device has out-of-sync changes, either because the FortiGate was changed locally or the FortiManager has pending changes not installed.

Answer

The FortiGate has been re-registered.

Answer

A firmware upgrade is pending.

Answer

The device is unreachable.

Question 10

Which FortiMail feature helps to prevent 'backscatter' when dealing with spam?

Accepted Answer

Rejecting unknown recipients at the SMTP gateway.. Backscatter occurs when a mail server accepts a message and later generates a bounce (NDR) to a forged sender address, effectively spamming an innocent third party. Rejecting unknown recipients at the SMTP gateway during the session (with a 5xx response) means FortiMail never accepts the message in the first place, so no bounce is ever generated. This is the standard anti-backscatter technique recommended in RFC 5321 and implemented via FortiMail's recipient verification/unknown-recipient rejection.

Answer

Increasing the quarantine size.

Answer

Disabling SPF.

Answer

Sender reputation.

Question 11

When using 'Install Wizard', what does the 'Auto-update' check-box do?

Accepted Answer

It automatically pushes changes to the device.. In the Install Wizard, the 'Auto-update' checkbox controls whether FortiManager automatically pushes the selected changes to the target device(s) as part of the install operation. When enabled, the install proceeds without requiring a separate manual push step; when disabled, changes are staged and must be pushed manually.

Answer

It triggers a backup.

Answer

It updates the device firmware.

Answer

It deletes duplicate policies.

Question 12

What is a 'Playbook' in the context of FortiSoC?

Accepted Answer

An automated incident response workflow. In FortiSOC, a Playbook is a predefined, automated sequence of actions that orchestrates incident response. It combines triggers, conditions, and tasks—such as isolating an endpoint, blocking an IP, or notifying a team—to reduce manual effort and response time. This aligns with the SOAR (Security Orchestration, Automation, and Response) capabilities of FortiSOC, where playbooks are central to automating workflows across integrated security tools.

Answer

A report template

Answer

A device registration script

Answer

A log storage policy

Question 13

Which TWO of the following are components of the FortiMail AntiSpam framework?

Accepted Answer

Heuristic scanning. D. Heuristic scanning is correct because FortiMail's AntiSpam framework includes heuristic rules that detect spam based on suspicious patterns and characteristics in message content and headers, catching new or evolving spam that signature-based filters miss. E. Bayesian analysis is correct because FortiMail uses statistical Bayesian filtering, which learns from previously classified spam and legitimate (ham) messages to calculate the probability that a new message is spam, forming a core part of the antispam detection engine. The other options do not belong: A. Traffic shaping is a bandwidth/QoS mechanism, not an antispam detection component; B. IPsec VPN is a site-to-site or client tunneling protocol for secure transport, unrelated to spam classification; and C. Antivirus quarantine is part of the antivirus/malware handling workflow, not the antispam framework itself.

Answer

Traffic shaping

Answer

IPsec VPN

Answer

Antivirus quarantine

Question 14

You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?

Accepted Answer

Policy Check. Policy Check is the FortiManager feature that verifies policies for syntax errors, conflicts, and compliance before installation. It helps ensure that the policy package is valid and can be successfully installed on FortiGates, reducing the risk of misconfigurations.

Answer

Install Wizard

Answer

Revision History

Answer

Device Manager

Question 15

Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?

Accepted Answer

FortiAP. FortiAP (A) is a correct answer because FortiAP wireless access points are Fabric components that send telemetry such as client association, RF, and security data to the FortiGate, which can then apply wireless controller and security policies. FortiSwitch (B) is correct because FortiSwitch units are managed by the FortiGate and provide telemetry including port statistics, device detection, and NAC-related information through the FortiLink connection. FortiAnalyzer (C) is correct because it is a Security Fabric component that receives logs from FortiGate and can return enriched analytics, event data, and threat intelligence back to the FortiGate for correlation and response. Option D is not correct because a local DNS server without a Forti agent is not a recognized Security Fabric component and cannot natively send telemetry to the FortiGate. Option E is not correct because a standard third-party unmanaged switch lacks Fabric integration and does not provide FortiGate telemetry.

Answer

A local DNS server without a Forti agent

Answer

A standard third-party unmanaged switch