FORTINET-NSE56 Practice Test 20 — 15 Questions

Question 1

In FortiManager, what is the result of using the 'Re-install Policy' option instead of the 'Install Wizard'?

Accepted Answer

It uses the last saved installation parameters to re-push the configuration.. 'Re-install Policy' in FortiManager re-pushes the last successfully installed policy package and configuration to the managed FortiGate using the saved installation parameters (target device, ADOM, and revision). It does not run the full Install Wizard again, so it is faster and preserves the prior install scope. This is useful when a device was restored or a config drift needs to be corrected without re-selecting targets.

Answer

It forces a factory reset of the FortiGate.

Answer

It deletes all objects not in use.

Answer

It performs an automatic firmware update.

Question 2

Which TWO types of report formats can be generated by FortiAnalyzer?

Accepted Answer

CSV. FortiAnalyzer can generate reports in CSV format (Option A), which exports raw log and analytics data into comma-separated values for further processing in spreadsheets or SIEM tools, and in PDF format (Option D), which produces formatted, presentation-ready reports with charts and tables for management review. These are the two standard output formats supported by FortiAnalyzer's report engine, alongside XML and HTML in some versions, but CSV and PDF are the recognized report formats tested here. The other options do not belong: EXE (Option B) is a Windows executable, ISO (Option C) is a disk image, and MP4 (Option E) is a video container — none of which are report output formats produced by FortiAnalyzer.

Answer

EXE

Answer

ISO

Answer

MP4

Question 3

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

Accepted Answer

Prevention mode with signature-based scanning enabled. Prevention mode with signature-based scanning is the most effective because it actively blocks SQL injection attempts by matching known attack patterns (signatures) in real time. This mode enforces the policy, dropping malicious requests before they reach the backend server. Signature-based scanning specifically targets SQLi patterns, reducing false positives compared to anomaly-based detection, which can flag legitimate traffic. In production, this balance of security and accuracy is critical.

Answer

Offline mode with learning enabled

Answer

Transparent mode with only DoS prevention

Answer

Detection mode with no signatures

Question 4

When using 'VPN Manager', what is the main benefit compared to manual VPN configuration?

Accepted Answer

It automates the creation of complex VPN topologies.. VPN Manager in FortiManager automates the creation and deployment of VPN topologies (hub-and-spoke, full mesh, etc.) across multiple FortiGates. Instead of manually configuring IPsec on each device, you define the topology once and VPN Manager generates and pushes the configuration, reducing errors and effort.

Answer

It automatically updates the ISP routing.

Answer

It increases encryption strength.

Answer

It removes the need for IPsec.

Question 5

What is the purpose of the 'License' section in the FortiMail menu?

Accepted Answer

To view and manage product licenses.. The 'License' section in the FortiMail menu is where administrators view and manage product licenses, including FortiMail VM licenses, antispam/antivirus signature licenses, and FortiGuard service entitlements (C). It shows license status, expiry dates, and allows uploading or refreshing license files. This is essential for ensuring security services remain active and the appliance stays compliant.

Answer

To check for updates.

Answer

To reboot the system.

Answer

To view logs.

Question 6

You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?

Accepted Answer

System > Log Settings > Remote Logging. FortiAuthenticator's remote logging configuration is located under System > Log Settings > Remote Logging. This section allows administrators to define one or more remote syslog servers by specifying the server IP/hostname, port, and protocol (UDP/TCP/TLS). It is the dedicated interface for exporting logs to external syslog destinations, separate from local logging and other event sources.

Answer

Authentication > RADIUS > Logging

Answer

General > Reporting

Answer

Network > Interfaces

Question 7

Which TWO of the following are allowed in an ADOM?

Accepted Answer

Multiple policy packages.. Option A is correct because an ADOM (Administrative Domain) is a logical container in FortiManager that can hold multiple policy packages, allowing different sets of firewall policies to be managed and assigned to different managed devices within that domain. Option E is correct because an ADOM is designed to group and manage multiple FortiGate devices (or other supported Fortinet devices) under a single administrative boundary, which is the core purpose of an ADOM. Option B is incorrect because ADOMs are the top-level administrative domains themselves; nesting multiple administrative domains inside one ADOM is not supported. Option C is incorrect because FortiManager units are separate management appliances, not objects contained within an ADOM. Option D is incorrect because an ADOM does not permit multiple firmware versions per device; each managed device runs its own firmware, and ADOM-level firmware management does not allow a single device to hold multiple firmware versions.

Answer

Multiple administrative domains.

Answer

Multiple FortiManager units.

Answer

Multiple firmware versions per device.

Question 8

Which of these is a legitimate reason to place a sender on the 'Block' list in the AntiSpam profile?

Accepted Answer

The sender consistently sends unwanted spam emails.. The Block list in the AntiSpam profile is used to explicitly deny email from senders, domains, or IP addresses that are known to send unwanted spam. A sender who consistently sends spam is the textbook legitimate reason to block them, as this is the intended use of the block list to enforce policy. Blocking is a deliberate administrative action based on observed malicious or unwanted behavior, not on legitimate business relationships or technical configurations.

Answer

The sender's domain has a valid SPF record.

Answer

The sender is a partner company.

Answer

The sender is an internal employee.

Question 9

An administrator is attempting to move a device from one ADOM to another. Which condition must be met for this to succeed?

Accepted Answer

The device must not be assigned to any policy package.. A device cannot be moved between ADOMs while it is still referenced by a policy package, because the package and its objects belong to the source ADOM and would create dangling references. FortiManager therefore requires that the device be unassigned from any policy package before the move. Once unassigned, the device can be moved to the target ADOM and re-assigned to packages there.

Answer

The device must be in an 'Unregistered' state.

Answer

The device must be placed in a 'Group' folder first.

Answer

The device must be running the latest firmware version.

Question 10

A FortiMail appliance is deployed in gateway mode as an outbound relay for an internal application server. The application sends notification emails to external customers using the envelope sender notifications@corp.example.com, but the messages are being rejected by several recipient mail servers with SPF failures. The network team confirms the FortiMail's public IP is 203.0.113.45, and the SPF record for corp.example.com is 'v=spf1 mx -all'. The MX record for corp.example.com points to 198.51.100.20, which is the inbound FortiMail cluster. Which FortiMail configuration change will resolve the SPF failures for outbound mail sent through this relay?

Accepted Answer

Add 203.0.113.45 to the SPF record for corp.example.com, for example 'v=spf1 mx ip4:203.0.113.45 -all', so the outbound relay's public IP is authorized to send on behalf of the domain.. SPF authorizes specific sending IP addresses for a domain. In this deployment, FortiMail relays outbound mail from 203.0.113.45, but the domain's SPF record only lists its MX host at 198.51.100.20, so external receivers reject the messages. Publishing the relay's public IP in the SPF record aligns the sending IP with the domain's authorized senders, which directly resolves the failures without changing sender identity or disabling security controls.

Answer

Disable SPF checking on the outbound session profile in FortiMail so that outbound messages are not subjected to SPF validation before they leave the gateway.

Answer

Configure a sender-dependent outbound relay rule that rewrites the envelope sender to notifications@relay.corp.example.com, where relay.corp.example.com has an SPF record authorizing 203.0.113.45.

Answer

Enable the 'Use Sender Domain as Envelope From' option under the outbound session profile so FortiMail rewrites the envelope sender to match the authenticated user's domain.

Question 11

A security team stores logs from several FortiGate devices in a single ADOM on their FortiAnalyzer appliance. They need to run a report that includes data from only two of those devices while excluding all others. What is the most appropriate way to accomplish this on FortiAnalyzer?

Accepted Answer

Create a device group containing the two FortiGates and select that group as the report data source.. Device groups within an ADOM are the supported way to aggregate a subset of managed devices for reporting and analysis. Selecting the group as the report source limits the output to those FortiGates while leaving the other devices and their logs untouched in the same ADOM.

Answer

Apply a log filter on the Log View page that matches the two devices, then export the filtered view as the report.

Answer

Delete the logs of the excluded devices from the ADOM before running the report.

Answer

Move the two FortiGates into a dedicated ADOM and generate the report from that ADOM.

Question 12

You are troubleshooting a Security Fabric deployment where a downstream FortiGate is not appearing in the Fabric topology on the root FortiGate. You have verified that the downstream FortiGate is configured with the correct root FortiGate IP and that network connectivity exists. Which action should you take next to resolve the issue?

Accepted Answer

Check the downstream FortiGate's Fabric settings to ensure the Security Fabric is enabled.. The most likely cause is that the Security Fabric is not enabled on the downstream FortiGate. Without it, the device will not initiate the Fabric join process. Verifying this setting is a logical next step after confirming connectivity and root IP configuration. The other actions are either irrelevant or premature.

Answer

Delete and re-add the downstream FortiGate on the root FortiGate.

Answer

Restart the FortiAnalyzer service.

Answer

Reconfigure the root FortiGate's management IP.

Question 13

A network administrator needs to back up the FortiManager configuration, including all managed device configurations and policy packages. Which method should be used to ensure a complete backup that can be restored to a new FortiManager appliance if necessary?

Accepted Answer

Use the 'Backup' option in the FortiManager GUI under System Settings > Configuration > Backup/Restore.. A complete FortiManager backup is performed via System Settings > Configuration > Backup/Restore. This backup includes the FortiManager configuration, the device database, and all policy packages. It can be restored to a new FortiManager appliance, ensuring a full recovery of the management environment. Other methods, such as exporting policy packages or backing up individual FortiGates, do not capture the entire FortiManager state and are not suitable for disaster recovery.

Answer

Use the 'Backup' option in the Device Manager for each managed FortiGate.

Answer

Use the 'Backup' option in the FortiManager GUI under System Settings > Dashboard.

Answer

Use the 'Export' option in the Policy & Objects tab to export all policy packages.

Question 14

A network security analyst is troubleshooting why certain inbound emails are being marked as spam by FortiMail even though they originate from a trusted partner's domain. The partner's domain has a valid SPF record, but the emails are failing the 'Domain-based Message Authentication, Reporting, and Conformance' (DMARC) check. The analyst confirms that the partner's emails are being forwarded by a third-party mailing list. What is the most likely reason for the DMARC failure?

Accepted Answer

The third-party mailing list is not included in the partner's SPF record, causing SPF to fail, which in turn causes DMARC to fail if DKIM is not aligned.. DMARC fails when neither SPF nor DKIM passes with alignment to the 'From' domain. In this case, the third-party mailing list forwards the email from its own IP, which is not authorized in the partner's SPF record, causing SPF to fail. If the mailing list also breaks the DKIM signature (e.g., by modifying the message), DKIM alignment fails too. Thus, DMARC fails, and FortiMail marks the email as spam based on its DMARC policy.

Answer

The partner's DMARC policy is set to 'p=reject', which causes FortiMail to quarantine all emails from that domain.

Answer

The third-party mailing list is modifying the 'From' header, breaking the DMARC alignment.

Answer

FortiMail is not configured to perform DKIM verification, so DMARC cannot pass even if SPF fails.

Question 15

You are the network security analyst for a company that has FortiGates at the headquarters and at 12 branch offices, all managed by a central FortiManager. The company recently added a FortiAnalyzer appliance and wants to ensure that all Security Fabric devices send their logs to it. You have added the FortiAnalyzer to the root FortiGate's Security Fabric and enabled log forwarding. However, the branch FortiGates are not showing any logs on the FortiAnalyzer. What is the most likely reason?

Accepted Answer

The Security Fabric is not enabled on the branch FortiGates.. In a Security Fabric, the root FortiGate aggregates logs from downstream fabric devices and forwards them to FortiAnalyzer. For a branch FortiGate to be recognized as a fabric device, the Security Fabric must be enabled on it. Without that, the root FortiGate does not include it in the fabric topology, so its logs are not forwarded.

Answer

The branch FortiGates are not in the same administrative domain as the root FortiGate.

Answer

The branch FortiGates are not authorized on the FortiAnalyzer.

Answer

The FortiAnalyzer's IP address is not configured as a syslog server on each branch FortiGate.