FORTINET-NSE56 Practice Test 2 — 25 Questions

Question 1

Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?

Accepted Answer

LDAP. FortiAnalyzer supports both local authentication and external directory services (LDAP/RADIUS).

Answer

FTP

Answer

DHCP

Answer

Syslog

Question 2

Which TWO methods can be used to back up FortiAnalyzer configuration?

Accepted Answer

Scheduled backup to FTP/SCP. Configurations can be backed up manually or scheduled for automated export to a remote server.

Answer

FortiView snapshots

Answer

Log archiving

Answer

Device provisioning

Question 3

What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?

Accepted Answer

It simplifies ADOM management. Normal mode simplifies the ADOM by disabling features like per-device log management, but it may require removing devices.

Answer

It forces all devices to reboot

Answer

It increases storage capacity

Answer

It enables full FortiSoC capabilities

Question 4

Which dashboard shows the health status of all registered devices?

Accepted Answer

Device Manager. The Device Manager dashboard provides a quick view of the status of all registered devices.

Answer

FortiView

Answer

Reports

Answer

Event Handler

Question 5

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Accepted Answer

FortiAuthenticator SAML log. The SAML debug logs on the FortiAuthenticator provide detail on the assertion exchange and attribute mapping.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 6

Which TWO types of logs can be generated by FortiMail?

Accepted Answer

AntiSpam logs. FortiMail generates various logs including Event and Spam logs.

Answer

User profile logs

Answer

Packet capture files

Answer

Hardware logs

Question 7

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Accepted Answer

diagnose sniffer packet any 'port 25' 4. The 'diagnose sniffer packet' command is the standard way to capture and view traffic in real-time on Fortinet appliances.

Answer

show log traffic

Answer

execute telnet

Answer

get system status

Question 8

Which THREE items are included in a standard email header for DMARC validation?

Accepted Answer

DKIM signature. DMARC checks the From domain, SPF/DKIM alignment, and policy flags.

Answer

Attachment name

Answer

User password

Question 9

How can you ensure that only encrypted traffic is allowed for webmail access?

Accepted Answer

Enable HTTPS and redirect HTTP to HTTPS.. Configuring the system to only listen on HTTPS (443) and redirecting HTTP (80) requests enforces encryption.

Answer

Use a VPN for all traffic.

Answer

Set the port to 25.

Answer

Disable the Webmail service.

Question 10

What is the purpose of the 'License' section in the FortiMail menu?

Accepted Answer

To view and manage product licenses.. The license section allows you to manage and verify the status of your product licenses.

Answer

To check for updates.

Answer

To reboot the system.

Answer

To view logs.

Question 11

Which TWO of the following are allowed in an ADOM?

Accepted Answer

Multiple policy packages.. ADOMs can contain multiple devices and multiple policy packages.

Answer

Multiple administrative domains.

Answer

Multiple FortiManager units.

Answer

Multiple firmware versions per device.

Question 12

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

Accepted Answer

The FortiManager database is updated with the device configuration.. Retrieving the config pulls those changes into the FortiManager, bringing the database into sync.

Answer

All policies are deleted.

Answer

The FortiGate resets to factory settings.

Answer

The FortiGate goes offline.

Question 13

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. Enabling 'Report Data Masking' or using 'Report Cache' improves performance for long-duration reports.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change

Question 14

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Accepted Answer

Provisioning Templates. 'Provisioning Templates' allow centralized configuration management.

Answer

Log Forwarding

Answer

Report scheduling

Answer

ADOM grouping

Question 15

Which TWO actions can be triggered by a FortiSoC Playbook?

Accepted Answer

Sending an email notification. Playbooks can perform actions like notifying an admin via email or updating a security object on a FortiGate.

Answer

Deleting the ADOM

Answer

Changing system time

Answer

Rebooting the FortiAnalyzer

Question 16

When an email is encrypted using FortiMail's Identity-Based Encryption (IBE), what does the recipient receive?

Accepted Answer

A notification email with a link to the secure portal.. With IBE, the recipient gets a notification email with a link to a secure portal where they can read the encrypted message.

Answer

The email is blocked.

Answer

A password protected PDF file.

Answer

The encrypted message attached to the email.

Question 17

What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?

Accepted Answer

The FortiGate must be added and authorized in the Device Manager.. The FortiGate must be added to the ADOM and authorized by an administrator.

Answer

The ADOM must be in 'Advanced' mode.

Answer

A policy package must be created first.

Answer

The FortiGate must be in a 'Disconnected' state.

Question 18

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

Accepted Answer

ADOM Log Policy. Each ADOM has its own 'Log Policy' or 'Disk Quota' configuration.

Answer

FortiView Filters

Answer

Report Settings

Answer

Global System Settings

Question 19

When adding a FortiGate to a FortiAnalyzer, which information is required?

Accepted Answer

Device serial number. You need the serial number and the IP/registration configuration on the FortiGate side.

Answer

The admin password of the FortiAnalyzer

Answer

The SQL database password

Answer

The log file format

Question 20

What does the 'FortiView' module provide?

Accepted Answer

Visual traffic analytics. FortiView provides a visual representation of network traffic and threats.

Answer

Configuration templates

Answer

Raw log data

Answer

Firmware management