FORTINET-NSE56 Practice Test 18 — 15 Questions

Question 1

What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?

Accepted Answer

They are overwritten (by default). The system follows the configured 'Log Policy', which usually defaults to deleting the oldest logs.

Answer

The FortiGate blocks all traffic

Answer

They are moved to a USB drive

Answer

The FortiAnalyzer reboots

Question 2

Which TWO items are required to configure log forwarding to a remote FortiAnalyzer?

Accepted Answer

Remote server IP address. You need the target server's IP and the authentication credentials/key to establish the secure connection.

Answer

The current report schedule

Answer

A copy of the local firmware

Answer

SNMP community string

Question 3

Which THREE settings are part of an ADOM's configuration?

Accepted Answer

Assigned Devices. ADOMs are configured with a name, a mode (Normal/Advanced), and the specific devices assigned to them.

Answer

Report server IP

Answer

Firmware version

Question 4

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

Accepted Answer

Event rate limiting. Event handlers support 'Threshold' and 'Frequency' settings to prevent alert fatigue.

Answer

Log aggregation

Answer

Database auto-delete

Answer

Log forwarding filter

Question 5

You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?

Accepted Answer

Assign device-based administrative profiles. Restricted ADOMs with granular permissions ensure that data visibility is limited based on the administrator's assigned ADOM and device profile.

Answer

Enable ADOM-level disk quotas

Answer

Use individual management VDOMs for every device

Answer

Enable log encryption per device

Question 6

An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). ADOMs are used to group devices and organize logs into separate logical containers.

Answer

FortiView Filters

Answer

Log Filtering

Answer

Log Forwarding

Question 7

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Accepted Answer

Remote server IP address. The server IP and the log format (Syslog) are critical for successful handshakes.

Answer

Log filter criteria

Answer

Enable compression for all logs

Answer

Include device hostname in logs

Question 8

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

Accepted Answer

To send logs to external systems. It allows you to send logs to a secondary system (like another FortiAnalyzer or a Syslog server).

Answer

To backup the configuration

Answer

To increase report speed

Answer

To reduce CPU usage

Question 9

What is the primary function of the FortiAnalyzer 'Log View' page?

Accepted Answer

Viewing raw log data. Log View provides a raw, searchable view of the logs stored in the database.

Answer

Configuring device passwords

Answer

Creating SOC playbooks

Answer

Generating PDF reports

Question 10

If a user is locked out of the FortiAnalyzer GUI, which command is used to unlock the account?

Accepted Answer

execute user unlock. Using the CLI as an admin, you can use 'execute user unlock <username>' or reset the password via the system admin account.

Answer

config system admin

Answer

get system status

Answer

set password

Question 11

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Accepted Answer

Use the 'Test' button in the Event Handler definition. The 'Test' or 'Filter' verification within the event handler configuration is the primary way to check if logs match the trigger.

Answer

Run a manual report

Answer

Rebuild the SQL database

Answer

Check the FortiAnalyzer system logs

Question 12

How can you verify that a FortiGate is sending logs to the FortiAnalyzer?

Accepted Answer

By checking the log status in Device Manager. Check the 'Log View' or 'Device Manager' for active log status.

Answer

By checking the interface status

Answer

By looking at the routing table

Answer

By running a report

Question 13

What is a 'Playbook' in the context of FortiSoC?

Accepted Answer

An automated incident response workflow. A playbook is an automated sequence of tasks designed to respond to security incidents.

Answer

A report template

Answer

A device registration script

Answer

A log storage policy

Question 14

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Accepted Answer

Enable SQL Injection in the WAF profile. SQL injection protection is a core feature of the signature-based protection in FortiWeb WAF profiles.

Answer

Enable Buffer Overflow protection

Answer

Enable HTTP Protocol Validation

Answer

Enable Cross-site Scripting protection

Question 15

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Accepted Answer

Configure FortiAuthenticator as a RADIUS Server on FortiGate. Integration requires defining the FortiAuthenticator as a RADIUS server on the FortiGate and ensuring the FortiGate is a registered client on the FortiAuthenticator.

Answer

Install a web certificate on the FortiGate

Answer

Enable LDAP on the FortiAuthenticator

Answer

Configure SAML on the FortiGate