FORTINET-NSE56 Practice Test 1 — 25 Questions

Question 1

Which dashboard provides a 'Threat Map'?

Accepted Answer

FortiView. The FortiView 'Threat Map' shows real-time global threat activity.

Answer

Report module

Answer

Device Manager

Answer

Log View

Question 2

Which THREE types of information are displayed in the System Information widget?

Accepted Answer

Firmware version. The system information widget provides at-a-glance status of uptime, firmware, and resource usage.

Answer

ADOM mode

Answer

Log forwarding destination

Question 3

An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?

Accepted Answer

Policy Packages. Policy Packages allow administrators to group policies and apply them specifically to selected device groups or individual devices.

Answer

Global Policy Packages

Answer

Provisioning Templates

Answer

Device Groups

Question 4

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

Accepted Answer

Assign to a specific ADOM. You assign the administrator to an 'Admin Profile' and associate them with a specific ADOM.

Answer

Change their password

Answer

Create a log filter

Answer

Enable 2FA

Question 5

You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?

Accepted Answer

ADOM settings. The 'Log Policy' or 'Disk Quota' settings under System Settings define how logs are managed when storage is full.

Answer

FortiView settings

Answer

Log forwarding settings

Answer

Report settings

Question 6

When should you use 'Log Archive' instead of 'Log Database'?

Accepted Answer

For long-term storage. 'Log Archive' is used for long-term cold storage of raw logs, whereas the database is for active searching.

Answer

For real-time traffic analysis

Answer

For triggering alerts

Answer

For generating daily reports

Question 7

When setting up a 'FortiSoC' playbook to send an email, what must be configured first?

Accepted Answer

The SMTP server settings. You must set up the 'Mail Server' or 'SMTP' settings in the System Settings to allow the FortiAnalyzer to send emails.

Answer

The report schedule

Answer

The log forwarder

Answer

The ADOM mode

Question 8

Which TWO of these are valid administrative roles in FortiAnalyzer?

Accepted Answer

Log_Admin. FortiAnalyzer supports predefined roles such as Super_User and Log_Admin.

Answer

Storage_Manager

Answer

Firewall_Admin

Answer

Report_Guest

Question 9

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

Accepted Answer

It cannot run reports. Collector mode is optimized for log reception and forwarding, but it cannot generate reports.

Answer

It cannot forward logs

Answer

It cannot store logs

Answer

It cannot receive logs from FortiGate

Question 10

In FortiSoC, what is the purpose of the 'Playbook Trigger'?

Accepted Answer

To define the start condition. The trigger defines the condition (e.g., an event) that initiates the playbook execution.

Answer

To start the logging process

Answer

To generate a report

Answer

To pause the FortiAnalyzer

Question 11

Which TWO of the following are valid log file types supported by FortiAnalyzer?

Accepted Answer

Event logs. FortiAnalyzer processes logs from various Fortinet devices, and they are typically stored as indexed database entries or raw archives.

Answer

PDF reports

Answer

HTML dashboards

Answer

Firmware images

Question 12

What is the default port used for log transmission from FortiGate to FortiAnalyzer?

Accepted Answer

514. FortiAnalyzer uses TCP port 514 for Syslog, but OFTP/FortiGate-to-Analyzer traffic typically uses port 514 or SSL-encrypted channels.

Answer

443

Answer

80

Answer

8888

Question 13

Which component of FortiAnalyzer is used to identify top talkers on the network?

Accepted Answer

FortiView. FortiView's 'Sources' or 'Destinations' widgets show traffic volume rankings.

Answer

System Dashboard

Answer

Log View

Answer

Event Handler

Question 14

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Accepted Answer

The number of matches. The count field specifies the number of occurrences of an event that must happen before an alert is triggered.

Answer

The total number of logs

Answer

The priority of the alert

Answer

The time window in seconds

Question 15

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Accepted Answer

Log Forwarding. Log forwarding is managed in the Device Manager or under System Settings for log forwarding configurations.

Answer

Device Manager

Answer

FortiView

Answer

Report Settings

Question 16

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

Accepted Answer

Log View. The 'Log View' page shows incoming logs in real-time.

Answer

Report module

Answer

FortiSoC module

Answer

Device Manager

Question 17

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Accepted Answer

Sources (Map View). The 'Sources' or 'Map' widget in FortiView provides visual geographic location data.

Answer

Event Handler

Answer

Reports

Answer

Log View

Question 18

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Accepted Answer

diagnose sql status. 'diagnose sql status' is the primary command to check the health and status of the SQL database which stores the logs.

Answer

show system logs

Answer

get log status

Answer

get system status

Question 19

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Accepted Answer

Overwriting old logs. By default, FortiAnalyzer performs 'Log Overwrite' when the disk is full, but this behavior can be configured.

Answer

Shutdown the device

Answer

Alert via SNMP only

Answer

Pause all services

Question 20

What is the purpose of 'Report Templates'?

Accepted Answer

To provide consistent report formats. Report templates provide predefined structures for generating consistent reports.

Answer

To update firmware

Answer

To filter logs

Answer

To configure alerts