FORTINET-NSE56 Practice Test 19 — 15 Questions

Question 1

Which TWO of the following are valid states for a device in FortiManager?

Accepted Answer

Synchronized.. In FortiManager, a managed device's configuration status is shown by states such as Synchronized (option B), meaning the device's configuration matches the policy package and object database stored on FortiManager, and Modified (option D), meaning the device's configuration differs from what FortiManager has, typically because local changes were made or a policy/object change has not yet been installed. These two are the standard device configuration status values used in the Device Manager to indicate whether the device is in sync with FortiManager. The other options are not valid FortiManager device states: Upgrading (A) and Formatting (E) describe firmware or disk operations rather than a device configuration status, and Archived (C) is not a FortiManager device state (archiving relates to configuration revisions, not a device status).

Answer

Upgrading.

Answer

Archived.

Answer

Formatting.

Question 2

What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?

Accepted Answer

They are overwritten (by default). By default, when a FortiAnalyzer reaches its configured Maximum Storage limit, it overwrites the oldest logs to make room for new ones, ensuring continuous log ingestion. This behavior is controlled by the 'Log file management' setting, which can be configured to overwrite or to stop logging when full, but the default is overwrite.

Answer

The FortiGate blocks all traffic

Answer

They are moved to a USB drive

Answer

The FortiAnalyzer reboots

Question 3

You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?

Accepted Answer

RADIUS VSAs are not correctly configured to include group information. FortiAuthenticator communicates group membership to FortiGate via RADIUS attributes, specifically Vendor-Specific Attributes (VSAs) such as Fortinet-Group-Name (attribute 1) or the Class attribute. If these VSAs are not configured or not mapped correctly, FortiGate receives only the authentication success but no group information, so it cannot match the user to group-based firewall policies. This is the classic cause of 'user authenticates but wrong/no policy applies' in FortiAuthenticator-FortiGate SSO integrations.

Answer

The FortiGate is not joined to the AD domain

Answer

The VPN tunnel is using IKEv1 instead of IKEv2

Answer

The FortiAuthenticator is in local authentication mode

Question 4

You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?

Accepted Answer

Cookie Persistence. Cookie Persistence is the correct method because it ties a client to a specific backend server based on a cookie inserted or provided by the backend application. FortiADC can insert a cookie or use an existing application cookie to maintain session affinity, ensuring that subsequent requests from the same user go to the same real server. This is the standard approach when the application itself issues a session cookie that must be honored for stateful sessions.

Answer

Source IP Persistence

Answer

Round Robin

Answer

Least Connections

Question 5

Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?

Accepted Answer

TACACS+. FortiAuthenticator supports TACACS+ (option B) as a valid authentication protocol, allowing it to receive and process authentication requests from network devices such as routers and switches that use TACACS+ for administrative login. FortiAuthenticator also supports RADIUS (option C), which is one of its primary authentication protocols for receiving user authentication requests from firewalls, VPNs, and other RADIUS clients. NTP (option A) is a time synchronization protocol and does not carry authentication requests. ARP (option D) is a layer-2 address resolution protocol used to map IP addresses to MAC addresses, not for authentication. ICMP (option E) is a network diagnostic and error-reporting protocol and has no role in user authentication.

Answer

NTP

Answer

ARP

Answer

ICMP

Question 6

Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?

Accepted Answer

Assign a name to the ADOM. Enabling ADOMs in System Settings (D) is mandatory because the ADOM feature is disabled by default in FortiManager; until you turn it on under System Settings > Admin > System Settings (or via the CLI), no ADOM can exist or be created. Assigning a name to the ADOM (C) is also mandatory, since every ADOM must have a unique name that identifies it in the ADOM list and is used when adding devices or policies to that ADOM. In contrast, configuring global policies (A) is optional and only applies if you use Global ADOM/global policy features, scheduling backups (B) is an administrative maintenance task unrelated to ADOM creation, and assigning a firewall to the ADOM (E) happens after the ADOM exists and is not required to create it.

Answer

Configure global policies

Answer

Schedule backups

Answer

Assign a firewall to the ADOM

Question 7

An administrator is using the 'Policy Lookup' tool in FortiManager. What does this tool provide?

Accepted Answer

It identifies which policy matches a specific traffic scenario.. The 'Policy Lookup' tool in FortiManager allows administrators to simulate a traffic flow by specifying source, destination, service, etc., and it identifies which policy (or policies) would match that traffic on a managed FortiGate. This helps troubleshoot policy ordering and rule matching.

Answer

It shows which user is logged in.

Answer

It modifies traffic parameters.

Answer

It scans for unused objects.

Question 8

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Accepted Answer

SPF validation. SPF (Sender Policy Framework) validation is the correct answer because it specifically checks the DNS TXT record of the sending domain to verify that the sending mail server's IP address is authorized to send email on behalf of that domain. The SPF record, published as a DNS TXT record, lists the authorized sending hosts. When an email is received, the receiving server queries the DNS TXT record for the envelope sender's domain and compares the connecting IP against the list. This directly prevents email spoofing by rejecting messages from unauthorized servers.

Answer

DKIM verification

Answer

DMARC policy

Answer

Sender Reputation

Question 9

What is the primary function of the 'Object' menu within the Policy & Objects tab?

Accepted Answer

To create reusable entities like IP addresses, services, and address groups.. The Object menu under Policy & Objects is the central repository for reusable configuration entities such as firewall addresses, IP ranges, FQDNs, services, service groups, address groups, VIPs, and IP pools. These objects are defined once and then referenced by firewall policies, NAT rules, and other features, which simplifies administration and reduces configuration errors. This is distinct from system-level or monitoring functions found elsewhere in the GUI.

Answer

To manage administrator accounts.

Answer

To configure system interfaces.

Answer

To monitor log traffic.

Question 10

Which THREE elements are part of the Event Handler configuration?

Accepted Answer

Alert action (email/SNMP). In an Event Handler configuration, the three required elements are the Alert action (A), which defines how notifications are delivered via email or SNMP traps when the event fires; the Log filter (D), which specifies which log messages or event patterns the handler monitors; and the Threshold (E), which sets the count and/or time window that must be met before the handler triggers. These three components work together: the log filter selects the events, the threshold determines when enough events have occurred, and the alert action defines the resulting notification. Report output profiles (B) belong to reporting configuration, not event handling, and firmware update schedules (C) are managed under system maintenance or update settings, so neither is part of an Event Handler configuration.

Answer

Report output profile

Answer

Firmware update schedule

Question 11

What is the primary benefit of using a 'Device Group' in FortiManager?

Accepted Answer

They allow for easier organization and bulk actions on devices.. A Device Group in FortiManager is a logical container that lets administrators organize managed FortiGates and apply bulk operations — such as installing policy packages, pushing configuration, or running scripts — to all members at once. It is purely an organizational and operational convenience, not a functional or performance feature.

Answer

They are required for ADOM creation.

Answer

They provide better firewall performance.

Answer

They enable automatic failover.

Question 12

Which interface mode is best suited for high-availability setups where you need to minimize configuration changes on existing infrastructure?

Accepted Answer

Transparent mode. Transparent mode allows a FortiMail (or FortiGate) device to be inserted into an existing network without changing IP addressing or routing on surrounding devices. The device operates as a Layer 2 bridge, inspecting traffic inline while keeping the same subnet and gateway configuration. This minimizes configuration changes on existing infrastructure, making it ideal for high-availability deployments where you want to add security without re-architecting the network.

Answer

NAT mode

Answer

Gateway mode

Answer

Server mode

Question 13

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

Accepted Answer

Group Mapping. Group Mapping in FortiAuthenticator is the feature that binds an external directory group (such as an LDAP group) to a locally defined FortiAuthenticator group. This binding lets the appliance assign administrative roles and permissions based on the user's membership in the external directory, so LDAP-authenticated admins inherit the correct local privileges.

Answer

SSO Domain

Answer

LDAP Filter

Answer

RADIUS Client

Question 14

What is the purpose of 'Policy Package' import?

Accepted Answer

To add existing FortiGate policies to the FortiManager.. Policy Package import in FortiManager is used to bring existing firewall policies from a managed FortiGate into FortiManager so they can be centrally managed, versioned, and deployed. This is typically done during initial onboarding of a device that was previously managed locally.

Answer

To backup policies.

Answer

To share policies between ADOMs.

Answer

To push policies to a new device.

Question 15

What is the primary role of the 'Administrator' profile?

Accepted Answer

To manage administrative access and permissions.. The Administrator profile in FortiMail defines what administrative users can see and do within the management interface — it controls role-based access, permission scopes, and which configuration areas an admin account may modify. It is the mechanism for delegating and restricting administrative privileges, not for handling mail processing functions.

Answer

To store quarantined emails.

Answer

To filter email content.

Answer

To configure mail routing.