FORTINET-NSE56 Practice Exam 2 — 20 Questions

Question 1

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

Accepted Answer

The ADOM selection is incorrect. If logs are not being indexed or if the device is not registered, FortiView cannot display data. Also, ensure the ADOM is selected correctly.

Answer

The FortiGate is powered off

Answer

The report is still running

Answer

The FortiAnalyzer is too slow

Question 2

Which administrative account type has full access to all ADOMs and system settings?

Accepted Answer

Super_User. The 'Super_User' account has unrestricted access.

Answer

Report Admin

Answer

Log Admin

Answer

Restricted Admin

Question 3

Which THREE elements are part of the Event Handler configuration?

Accepted Answer

Alert action (email/SNMP). Event handlers are configured with a filter, a trigger/threshold, and the resulting alert method.

Answer

Report output profile

Answer

Firmware update schedule

Question 4

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

Accepted Answer

Global objects.. Global objects allow you to define objects once and push them to multiple ADOMs for consistency.

Answer

Provisioning templates.

Answer

Local ADOM objects.

Answer

CLI templates.

Question 5

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

Accepted Answer

The installation fails during the validation phase.. FortiManager validates the configuration before pushing and will fail the installation if referenced objects are missing.

Answer

The installation proceeds and ignores the missing objects.

Answer

The FortiGate automatically creates the missing objects using default settings.

Answer

The objects are pushed as CLI commands only.

Question 6

Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?

Accepted Answer

LDAP. FortiAnalyzer supports both local authentication and external directory services (LDAP/RADIUS).

Answer

FTP

Answer

DHCP

Answer

Syslog

Question 7

Which TWO methods can be used to back up FortiAnalyzer configuration?

Accepted Answer

Scheduled backup to FTP/SCP. Configurations can be backed up manually or scheduled for automated export to a remote server.

Answer

FortiView snapshots

Answer

Log archiving

Answer

Device provisioning

Question 8

What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?

Accepted Answer

It simplifies ADOM management. Normal mode simplifies the ADOM by disabling features like per-device log management, but it may require removing devices.

Answer

It forces all devices to reboot

Answer

It increases storage capacity

Answer

It enables full FortiSoC capabilities

Question 9

Which dashboard shows the health status of all registered devices?

Accepted Answer

Device Manager. The Device Manager dashboard provides a quick view of the status of all registered devices.

Answer

FortiView

Answer

Reports

Answer

Event Handler

Question 10

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Accepted Answer

FortiAuthenticator SAML log. The SAML debug logs on the FortiAuthenticator provide detail on the assertion exchange and attribute mapping.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 11

Which TWO types of logs can be generated by FortiMail?

Accepted Answer

AntiSpam logs. FortiMail generates various logs including Event and Spam logs.

Answer

User profile logs

Answer

Packet capture files

Answer

Hardware logs

Question 12

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Accepted Answer

diagnose sniffer packet any 'port 25' 4. The 'diagnose sniffer packet' command is the standard way to capture and view traffic in real-time on Fortinet appliances.

Answer

show log traffic

Answer

execute telnet

Answer

get system status

Question 13

Which THREE items are included in a standard email header for DMARC validation?

Accepted Answer

DKIM signature. DMARC checks the From domain, SPF/DKIM alignment, and policy flags.

Answer

Attachment name

Answer

User password

Question 14

How can you ensure that only encrypted traffic is allowed for webmail access?

Accepted Answer

Enable HTTPS and redirect HTTP to HTTPS.. Configuring the system to only listen on HTTPS (443) and redirecting HTTP (80) requests enforces encryption.

Answer

Use a VPN for all traffic.

Answer

Set the port to 25.

Answer

Disable the Webmail service.

Question 15

What is the purpose of the 'License' section in the FortiMail menu?

Accepted Answer

To view and manage product licenses.. The license section allows you to manage and verify the status of your product licenses.

Answer

To check for updates.

Answer

To reboot the system.

Answer

To view logs.

Question 16

Which TWO of the following are allowed in an ADOM?

Accepted Answer

Multiple policy packages.. ADOMs can contain multiple devices and multiple policy packages.

Answer

Multiple administrative domains.

Answer

Multiple FortiManager units.

Answer

Multiple firmware versions per device.

Question 17

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

Accepted Answer

The FortiManager database is updated with the device configuration.. Retrieving the config pulls those changes into the FortiManager, bringing the database into sync.

Answer

All policies are deleted.

Answer

The FortiGate resets to factory settings.

Answer

The FortiGate goes offline.

Question 18

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. Enabling 'Report Data Masking' or using 'Report Cache' improves performance for long-duration reports.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change

Question 19

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Accepted Answer

Provisioning Templates. 'Provisioning Templates' allow centralized configuration management.

Answer

Log Forwarding

Answer

Report scheduling

Answer

ADOM grouping

Question 20

Which TWO actions can be triggered by a FortiSoC Playbook?

Accepted Answer

Sending an email notification. Playbooks can perform actions like notifying an admin via email or updating a security object on a FortiGate.

Answer

Deleting the ADOM

Answer

Changing system time

Answer

Rebooting the FortiAnalyzer