FORTINET-NSE56 Practice Exam 3 — 20 Questions

Question 1

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Accepted Answer

Cookie Insert. Cookie Insert persistence is the most appropriate method for a cookie-based application because FortiADC inserts a cookie into the HTTP response that identifies the backend server, ensuring subsequent requests from the same client are directed to the same server. This works even when clients are behind NAT or proxies, unlike source IP persistence. It also handles SSL offloading scenarios where SSL Session ID persistence would fail.

Answer

Source IP Persistence

Answer

SSL Session ID

Answer

Round Robin

Question 2

Which of the following is a component of the Fortinet Security Fabric?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is a core component of the Fortinet Security Fabric, providing centralized logging, analysis, and reporting. It integrates with other Fortinet devices to collect and correlate security events. The other options are not Fortinet Security Fabric components.

Answer

A personal printer

Answer

A standard consumer router

Answer

A generic web server

Question 3

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

Accepted Answer

Set Notification Email. In an Install Workflow, the option 'Set Notification Email' (B) is correct because it lets administrators specify the recipient address that receives status messages about the deployment, enabling monitoring of the install process. 'Auto-install on Approve' (C) is correct because it defines whether the installation proceeds automatically once an approval is granted, removing the need for a separate manual trigger. 'Enable Approval' (E) is correct because it turns on the approval gate in the workflow, requiring an authorized user to approve the deployment before it can continue. The remaining options do not belong: 'Change Firmware automatically' (A) is a hardware/firmware update action rather than an Install Workflow deployment setting, and 'Delete Policy after Install' (D) is a policy lifecycle/cleanup action, not a configurable option for managing the deployment process itself.

Answer

Change Firmware automatically

Answer

Delete Policy after Install

Question 4

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Accepted Answer

Sources (Map View). FortiView's Sources view includes a Map View that plots traffic by geographic origin, letting administrators visualize which countries or regions are generating traffic. This is the tool designed for geographic traffic pattern analysis.

Answer

Event Handler

Answer

Reports

Answer

Log View

Question 5

What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?

Accepted Answer

It allows users to manage their own quarantined emails.. The FortiMail Quarantine portal is a self-service web interface that lets end-users view, release, delete, and manage their own quarantined messages without administrator intervention. This offloads administrative overhead and reduces helpdesk tickets, which is the primary advantage. Options A, B, and D describe incidental or incorrect behaviors rather than the core purpose of the portal.

Answer

It hides spam messages.

Answer

It deletes all mail automatically.

Answer

It provides full system logs.

Question 6

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

Accepted Answer

Time skew between IDP and SP. SAML assertions contain a NotOnOrAfter timestamp that defines the validity window. If the clocks on the FortiAuthenticator (IdP) and the service provider (SP) are not synchronized, the SP may consider the assertion expired even if it was just issued. This is the most common cause of 'Assertion expired' errors in SAML debugging.

Answer

The browser is blocked

Answer

The SAML certificate is self-signed

Answer

The user password is too old

Question 7

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Accepted Answer

Log Forwarding. Log Forwarding is the FortiAnalyzer feature that sends logs to an external syslog server, CEF server, or another FortiAnalyzer. It is configured under the Log Forwarding section, where you define the remote server address, port, protocol, and which log types to forward. This is the standard way to offload logs for long-term retention or third-party SIEM ingestion.

Answer

Device Manager

Answer

FortiView

Answer

Report Settings

Question 8

Which protocol does FortiAnalyzer primarily use for Web UI access?

Accepted Answer

HTTPS. FortiAnalyzer's Web UI is accessed over HTTPS (TCP 443) by default, providing encrypted administrative access to the GUI. Administrators browse to the FortiAnalyzer management IP or hostname using https:// to log in and manage reports, logs, and settings. HTTPS ensures credentials and session data are protected in transit.

Answer

SSH

Answer

FTP

Answer

HTTP

Question 9

What is the primary function of the 'AntiSpam' profile?

Accepted Answer

To block unwanted emails.. The AntiSpam profile in FortiGate is a security profile applied to firewall policies that inspects inbound and outbound email traffic (SMTP, IMAP, POP3, and optionally MAPI) to detect and block unsolicited bulk email. Its core function is to identify spam using DNSBL lookups, heuristics, banned word lists, and greylisting, then take action such as tagging, quarantining, or discarding the message. It does not perform encryption, compression, or routing — those are handled by other FortiGate features or external systems.

Answer

To encrypt mail.

Answer

To compress mail.

Answer

To route mail.

Question 10

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Accepted Answer

It can route traffic based on HTTP headers or URL patterns. Option A is correct because FortiADC's Layer 7 (HTTP/HTTPS) virtual servers can inspect application-layer content and use content routing rules to direct traffic based on HTTP headers (for example, Host or X-Forwarded-For) or URL patterns/paths. Option C is correct because FortiADC supports HTTP content rewriting, allowing it to add, modify, or delete HTTP request and response headers (such as inserting X-Forwarded-For or stripping Server headers) as traffic passes through the virtual server. Option B is incorrect because Layer 7 load balancing does not require backend servers to share a subnet; real servers can reside on different networks as long as routing to them exists. Option D is incorrect because Layer 7 load balancing specifically handles application protocols like HTTP and HTTPS, not only raw TCP. Option E is incorrect because FortiADC performs health checks on web servers using HTTP/HTTPS monitors (and other monitor types) to verify real server availability.

Answer

It requires all backend servers to be on the same subnet

Answer

It only supports TCP-based traffic

Answer

It cannot perform health checks on web servers

Question 11

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager's Device Manager let you define reusable configuration templates (e.g., system settings, interface configs, firewall objects) and apply them to multiple FortiGate devices or device groups at once. This is the intended feature for bulk-pushing configuration changes across many devices.

Answer

Log Forwarding

Answer

Report scheduling

Answer

ADOM grouping

Question 12

Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?

Accepted Answer

LDAP. Option B (LDAP) is correct because FortiMail can query an external LDAP directory (for example Active Directory or OpenLDAP) to authenticate users who log in to the quarantine portal, allowing centralized credential verification. Option E (Local user database) is correct because FortiMail also supports authenticating quarantine portal users against its own locally defined user accounts when no external server is used. Options A (Syslog), C (SNMP), and D (ICMP) are incorrect because they are logging, monitoring/management, and network diagnostic protocols respectively, and none of them provide user authentication for portal access.

Answer

Syslog

Answer

SNMP

Answer

ICMP

Question 13

Which of these is a benefit of 'Transparent' mode?

Accepted Answer

It requires no changes to mail server settings.. In Transparent mode, the FortiMail unit is inserted into the existing network path without requiring any changes to the IP addresses or configurations of the mail servers behind it. It acts as a Layer 2 bridge, so the mail server's default gateway remains the same and no MX record or relay settings need to be modified. This makes deployment simple and non-disruptive, which is the primary benefit of Transparent mode.

Answer

It is faster than Gateway mode.

Answer

It supports only one domain.

Answer

It hides the mail server IP.

Question 14

How can you view the 'Total' number of policies in a specific policy package?

Accepted Answer

In the Policy & Objects tab list view.. The total number of policies in a policy package is displayed in the Policy & Objects tab list view, where FortiManager shows the policy list along with a count. This is the standard GUI location for reviewing and counting policies within a package.

Answer

In the Device Manager.

Answer

Using a CLI script.

Answer

By going to the Dashboard.

Question 15

Which dashboard provides a 'Threat Map'?

Accepted Answer

FortiView. FortiView is the FortiGate dashboard module that includes the Threat Map, a geographic visualization of attacks and threats detected by the device. It aggregates log data into interactive widgets showing top threats, sources, and destinations on a world map. The Threat Map is accessed from FortiView, not from the Report, Device Manager, or Log View modules.

Answer

Report module

Answer

Device Manager

Answer

Log View

Question 16

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

Accepted Answer

The installation fails during the validation phase.. When the FortiManager Install Wizard pushes a policy package, it performs a validation phase that checks whether all referenced objects exist on the target FortiGate. If any object is missing, the installation fails during validation rather than proceeding, because FortiManager will not push a policy that references undefined objects. This prevents broken or incomplete configurations from being deployed.

Answer

The installation proceeds and ignores the missing objects.

Answer

The FortiGate automatically creates the missing objects using default settings.

Answer

The objects are pushed as CLI commands only.

Question 17

What is the purpose of 'Report Templates'?

Accepted Answer

To provide consistent report formats. Report Templates in FortiAnalyzer/FortiManager define the layout, sections, charts, and formatting used when generating reports, so that recurring reports share a uniform structure and appearance. They are reusable blueprints that administrators attach to report schedules, ensuring every generated PDF/HTML report follows the same corporate or compliance format. This is why the correct answer is 'to provide consistent report formats' rather than any operational function like firmware, filtering, or alerting.

Answer

To update firmware

Answer

To filter logs

Answer

To configure alerts

Question 18

In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?

Accepted Answer

Reject the email at the SMTP level.. In Gateway mode, FortiMail acts as an SMTP gateway and by default rejects email for unknown recipients at the SMTP level with a 550 error. This prevents backscatter and reduces load from spam directed at non-existent addresses. The behavior is controlled by the 'unknown recipient' policy, which defaults to reject.

Answer

Accept the email and store it in a general box.

Answer

Forward the email to the administrator.

Answer

Queue the email for 24 hours.

Question 19

Which dashboard widget provides a high-level summary of system resource usage?

Accepted Answer

System Information. The System Information dashboard widget in FortiGate displays a high-level summary of system resource usage, including CPU utilization, memory usage, disk usage, and session counts. It provides administrators with an at-a-glance view of the device's health and performance metrics directly on the dashboard.

Answer

Report Settings

Answer

Log View

Answer

FortiView Threats

Question 20

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Accepted Answer

The FortiGate remote group is not defined for the LDAP server. For a FortiGate policy to match an LDAP group, the group must first be imported/defined as a remote group under User & Authentication > LDAP Servers on the FortiGate. If the remote group is not defined, the policy cannot reference it and the user's group membership is never evaluated, causing access denial even though authentication succeeded.

Answer

The LDAP user account is locked

Answer

FortiAuthenticator is in maintenance mode

Answer

The user is using the wrong password