FORTINET-NSE56 Practice Test 19 — 15 Questions

Question 1

Which THREE components are visible in the 'Log View' interface?

Accepted Answer

Log table (raw data). Log View allows you to see the log table, use filters, and select the time period.

Answer

Playbook builder

Answer

Device provisioning templates

Question 2

Which THREE features are available when FortiAnalyzer is configured in 'Analyzer' mode?

Accepted Answer

Report generation. Analyzer mode provides the full set of FortiAnalyzer features, including reports, SOC, and analysis.

Answer

Collector-only mode

Answer

Hardware acceleration

Question 3

Which TWO conditions must be met for a report to run successfully?

Accepted Answer

Report queries must be valid. The report must have valid query parameters and the necessary log data must be available and processed in the database.

Answer

All logs must be archived

Answer

The system must be in collector mode

Answer

The FortiGate must be offline

Question 4

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

Accepted Answer

The ADOM contains devices. An ADOM cannot be deleted if there are still devices registered within it.

Answer

The ADOM is set to 'Read-Only'

Answer

The ADOM has log data

Answer

The administrator lacks super_admin rights

Question 5

If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?

Accepted Answer

Trusted hosts. Trusted hosts and multifactor authentication (MFA) are the primary security controls for administrative access.

Answer

Log encryption

Answer

ADOM mode switching

Answer

Report scheduling

Question 6

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

Accepted Answer

Use a Header Rewrite script. FortiADC content routing and header modification rules are used to manipulate HTTP headers.

Answer

Configure a SNAT pool

Answer

Apply a WAF profile

Answer

Modify the Virtual Server interface

Question 7

Which feature is essential for protecting against password-based malware in attachments?

Accepted Answer

AV blocking of encrypted archives.. Since malware in password-protected ZIPs cannot be scanned, blocking these archives is a standard security practice in the AV profile.

Answer

Sender reputation.

Answer

Bayesian filtering.

Answer

Access control rules.

Question 8

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Accepted Answer

SPF validation. SPF (Sender Policy Framework) is used to verify that the sending IP is authorized by checking the sender domain's DNS TXT records.

Answer

DKIM verification

Answer

DMARC policy

Answer

Sender Reputation

Question 9

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

Accepted Answer

Session Synchronization. Session synchronization is required in clusters to maintain state if a failover occurs.

Answer

Persistence Sharing

Answer

State Replication

Answer

Configuration Sync

Question 10

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

Accepted Answer

FortiView Applications. The Applications dashboard in FortiView is designed specifically to aggregate bandwidth usage by application.

Answer

Log View

Answer

FortiView Sources

Answer

FortiView Destinations

Answer

Reports

Question 11

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Accepted Answer

Prevention mode. Prevention mode is the standard setting for WAF policies to actively block detected threats based on configured signatures.

Answer

Transparent mode

Answer

Learning mode

Answer

Detection mode

Question 12

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

Accepted Answer

In the public DNS records for the domain.. DKIM verification relies on the public key being published as a TXT record in the DNS zone of the sending domain.

Answer

On the SMTP server of the recipient's domain.

Answer

In the FortiMail's relay host configuration.

Answer

On the FortiMail server's local certificate store.

Question 13

What is the purpose of an 'Event Handler' in FortiAnalyzer?

Accepted Answer

To generate alerts. Event handlers monitor incoming logs and trigger alerts when specific conditions are met.

Answer

To push firmware

Answer

To store logs

Answer

To clear disk space

Question 14

Which THREE items are found in the 'System Settings' area?

Accepted Answer

Administrators. System Settings contains global configurations like administrators, mail servers, and maintenance tasks.

Answer

Report templates

Answer

FortiView widget configuration

Question 15

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

Automating incident response actions. Automation stitches allow for triggering actions (like isolating a host) based on detected events.

Answer

Improving log compression

Answer

Increasing bandwidth

Answer

Updating firmware