FORTINET-NSE56 Practice Test 2 — 10 Questions

Question 1

Which TWO of the following are true about 'Scripts' in FortiManager?

Accepted Answer

They can be scheduled to run at specific times.. Option B is correct because FortiManager scripts support scheduling, allowing an administrator to define when a script executes (for example, a one-time run at a future date/time or a recurring schedule) rather than only running it manually on demand. Option E is correct because FortiManager scripts can be executed against multiple managed FortiGate devices at once, either by selecting several devices or by targeting a device group, which is a core benefit of centralized script management. Option A is wrong because scripts are not limited to a single execution; they can be run repeatedly and can also be scheduled. Option C is wrong because scripts execute CLI commands or configuration snippets on devices and do not automatically transform into policy objects or policy packages. Option D is wrong because scripting is a built-in FortiManager feature and does not require a separate add-on license.

Answer

They can only be run once.

Answer

They automatically convert to policies.

Answer

They require a separate license.

Question 2

When should you use 'Log Archive' instead of 'Log Database'?

Accepted Answer

For long-term storage. Log Archive is designed for long-term storage and compliance retention, storing logs in a compressed format that is not indexed for fast querying. Log Database, by contrast, is optimized for real-time analysis and fast searches. Therefore, Log Archive should be used when the primary requirement is long-term retention rather than immediate analytics.

Answer

For real-time traffic analysis

Answer

For triggering alerts

Answer

For generating daily reports

Question 3

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

Accepted Answer

Policy & Objects > Task Monitor. FortiManager logs all policy installation tasks in the Task Monitor, accessible under Policy & Objects > Task Monitor. When an installation fails due to an object conflict or any other reason, the Task Monitor shows the task status, the affected device, and a detailed log with the specific error message (e.g., which object conflicted and why). This is the primary place to diagnose installation failures.

Answer

Device Manager > Revision History

Answer

System Settings > Event Log

Answer

Policy & Objects > Installation Targets

Question 4

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

Automating incident response actions. Automation Stitches in the Security Fabric let you define trigger-action workflows that automatically respond to security events, such as quarantining a compromised endpoint or blocking an IP. The primary benefit is automating incident response actions across Fabric-connected devices. This reduces response time and manual effort.

Answer

Improving log compression

Answer

Increasing bandwidth

Answer

Updating firmware

Question 5

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Accepted Answer

Playbook Execution logs. FortiSOAR (and FortiGate's automation stitches) maintain dedicated Playbook Execution logs that record each playbook run, the actions executed, their results, and any errors. When a playbook fails to execute an action, the Playbook Execution logs are the correct place to inspect the execution history and diagnose the failure.

Answer

Device manager logs

Answer

System logs

Answer

FortiView

Question 6

Which TWO factors impact the performance of report generation?

Accepted Answer

Whether report caching is enabled. Option C is correct because enabling report caching allows previously generated report results to be reused instead of recomputed, directly reducing the time and resource load required for each report generation. Option D is correct because the size of the log data determines how much data must be queried, aggregated, and rendered, so larger log volumes increase processing time and can slow report generation. The number of registered devices (A) and firmware version (B) may affect the environment but are not direct determinants of report-generation performance, and CPU temperature (E) is a hardware/environmental symptom rather than a defined performance factor for report generation.

Answer

The number of registered devices

Answer

The firmware version of the devices

Answer

The CPU temperature

Question 7

When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?

Accepted Answer

It indicates if the package is in sync with the device.. In the Install Wizard, the Policy Package Status column shows whether the policy package currently installed on the target device matches the version in FortiManager — i.e., whether the device is in sync or out of sync. This lets the administrator see at a glance which devices need a policy install. A green/consistent status means no changes are pending; a modified status means the FortiManager copy differs from the device.

Answer

It displays the device firmware version.

Answer

It shows the last modified date.

Answer

It shows the number of policies in the package.

Question 8

Which TWO of the following protocols does FortiMail support for mail retrieval?

Accepted Answer

POP3. FortiMail supports POP3 (option A) for mail retrieval, allowing clients to download messages from the FortiMail mail store to their local mail client, which is a standard retrieval protocol for receiving email. FortiMail also supports IMAP (option C), which enables clients to access and manage mail on the server without downloading everything locally, and is commonly used for webmail and mobile synchronization. FTP (option B) is a file transfer protocol and is not used for retrieving email messages. HTTP (option D) is used for web browsing and webmail interfaces, not as a mail retrieval protocol in this context. DNS (option E) resolves domain names to IP addresses and does not retrieve mail.

Answer

FTP

Answer

HTTP

Answer

DNS

Question 9

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Accepted Answer

Traffic Monitor / SSL Dashboard. The Traffic Monitor / SSL Dashboard in FortiADC provides real-time visibility into SSL handshake times, including metrics like SSL negotiation duration. This tool is specifically designed to monitor SSL/TLS performance and identify bottlenecks in the handshake process.

Answer

Packet Capture (sniffer)

Answer

Log Access

Answer

System Health Monitor

Question 10

What is the function of the FortiGate's 'Security Fabric' connector?

Accepted Answer

To integrate with external platforms like AWS or Azure. The Security Fabric connector on FortiGate enables integration with external platforms and services — including public cloud providers like AWS and Azure, as well as other Fortinet and third-party security products — to share threat intelligence and automate responses. It extends the Fabric beyond Fortinet devices to external ecosystems. This is distinct from internal Fabric devices, which are Fortinet products joined via Fabric root.

Answer

To connect to physical power outlets

Answer

To reset the firewall

Answer

To bypass the firewall