FORTINET-NSE56 Practice Test 4 — 25 Questions

Question 1

An administrator wants to ensure that all outgoing emails are archived to a secondary server. Where is this configured?

Accepted Answer

Archiving policy. In FortiMail, archiving policies are specifically designed to capture and store email messages to a secondary server for compliance, eDiscovery, or backup purposes. The archiving policy defines the direction (incoming/outgoing), the matching criteria (sender, recipient, etc.), and the archive server destination. This is the only option that directly provides email archiving functionality.

Answer

Access Control rule

Answer

AntiSpam profile

Answer

Routing policy

Question 2

You notice that the FortiMail system time is incorrect, causing issues with SSL/TLS certificate validation. How do you correct this?

Accepted Answer

Configure an NTP server.. Incorrect system time on FortiMail breaks SSL/TLS certificate validation because certificates have validity windows and the TLS handshake checks the current time against 'notBefore' and 'notAfter'. The correct fix is to configure an NTP server so FortiMail synchronizes its clock accurately and continuously.

Answer

Disable SSL certificate validation.

Answer

Restart the system clock service.

Answer

Manually update via the CLI.

Question 3

How can you view the current number of emails in the quarantine?

Accepted Answer

On the dashboard.. The current number of emails in the quarantine can be viewed on the dashboard. FortiMail's dashboard provides a real-time summary of system status, including quarantine statistics such as the number of messages currently held. This is the quickest way to see quarantine counts without running reports or digging into logs.

Answer

By running a hardware diagnostic.

Answer

In the policy editor.

Answer

In the system logs.

Question 4

You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?

Accepted Answer

Data Leak Prevention profile. The Data Leak Prevention profile in FortiWeb is designed to inspect outbound HTTP responses for patterns that match sensitive information, such as credit card numbers, social security numbers, or internal server details. When an application generates an error message that includes stack traces, database queries, or file paths, this profile can detect and mask or block that data before it reaches the client. This directly prevents the disclosure of sensitive server-side information, which is the goal stated in the question.

Answer

XSS profile

Answer

SQL Injection profile

Answer

Cookie security profile

Question 5

What is the function of the 'Check for Updates' feature in FortiManager's FortiGuard settings?

Accepted Answer

To update antivirus, IPS, and application control signatures.. The 'Check for Updates' feature in FortiManager's FortiGuard settings queries the FortiGuard Distribution Network (FDN) to retrieve the latest antivirus, IPS, application control, web filter, and other security service signature packages. These signatures are then distributed to managed FortiGate devices so their security profiles can detect current threats. It does not touch hardware inventory, licensing, or FortiManager's own firmware.

Answer

To check for new FortiGate hardware models.

Answer

To verify the license key.

Answer

To update the FortiManager firmware.

Question 6

An administrator wants to perform a 'Re-install Policy' on a subset of devices without changing their current configuration settings. Which install option should be selected?

Accepted Answer

Re-install Policy. The 'Re-install Policy' option pushes the existing policy package to the target devices without altering device-level settings or object definitions, effectively re-applying the current policy configuration. It is used when policies need to be re-pushed (e.g., after a failed install or to resynchronize) while preserving the device's current configuration.

Answer

Install Config and Policy

Answer

Factory Reset and Install

Answer

Install Device Settings

Answer

Re-install Objects Only

Question 7

What is the primary benefit of deploying FortiMail in a cluster?

Accepted Answer

To provide high availability and fault tolerance.. Deploying FortiMail in a cluster (HA) provides high availability and fault tolerance: if one unit fails, another takes over seamlessly, ensuring mail flow and spam/virus scanning continue without interruption. This is the primary design goal of FortiMail HA, which supports active-passive and config-sync modes.

Answer

To bypass the need for a mail server.

Answer

To reduce the cost of licensing.

Answer

To increase the number of physical ports.

Question 8

What is the primary difference between a Gateway and a Server mode deployment?

Accepted Answer

Gateway mode relays to backend servers.. In Fortinet's email security deployments, Gateway mode acts as a relay or SMTP proxy that receives email and forwards it to backend mail servers (e.g., Exchange) after scanning. Server mode, by contrast, stores mailboxes locally and provides final delivery. The primary difference is therefore that Gateway mode relays to backend servers, while Server mode is the final destination.

Answer

Gateway mode provides storage.

Answer

Gateway mode supports LDAP.

Answer

Gateway mode ignores AntiSpam.

Question 9

In which configuration area are 'Content Profiles' created and modified?

Accepted Answer

Profile settings.. Content Profiles in FortiMail are created and modified under the Profile settings configuration area. This is where administrators define the scanning behavior for content — including banned words, file types, and encryption rules — that can then be applied to access control rules and policies. The Profile settings area is the central repository for all profile-type objects (AntiSpam, AntiVirus, Content, Resource).

Answer

Domain settings.

Answer

System settings.

Answer

Network settings.

Question 10

A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?

Accepted Answer

In the API Explorer within the FortiADC GUI. FortiADC includes a built-in API Explorer accessible from the GUI (typically under System > API Explorer or via a /api/v1/... endpoint) that documents all REST API endpoints, request/response schemas, and parameters. It is the authoritative, version-matched reference for developers writing automation against FortiADC.

Answer

On the FortiGuard portal

Answer

In the CLI reference guide

Answer

By calling technical support

Question 11

Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?

Accepted Answer

TXT record containing the public key. DKIM (DomainKeys Identified Mail) uses a public key published as a TXT record in DNS, typically at a selector._domainkey.domain.com. The receiving server uses this public key to verify the signature added to outgoing emails. This ensures authenticity and integrity.

Answer

PTR record

Answer

A record

Answer

MX record

Question 12

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

Accepted Answer

It cannot run reports. In FortiAnalyzer, 'Collector' mode is designed purely for high-volume log collection and forwarding/storage — it does not include the analytics and reporting engine. As a result, a FortiAnalyzer operating in Collector mode cannot generate reports, run log-based analytics, or provide the full GUI reporting features available in Analyzer mode. This mode is typically used in large distributed environments where a dedicated collector forwards logs to a central analyzer.

Answer

It cannot forward logs

Answer

It cannot store logs

Answer

It cannot receive logs from FortiGate

Question 13

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

Accepted Answer

To send logs to external systems. Log Forwarding in FortiAnalyzer enables the appliance to relay received logs to external destinations such as syslog servers, CEF collectors, or another FortiAnalyzer. This is essential for integrating FortiAnalyzer into a broader SIEM ecosystem (e.g., Splunk, ArcSight) or for long-term archival on external storage. The feature does not alter local storage, CPU, or configuration backup behavior — it simply duplicates/forwards log streams to configured remote endpoints.

Answer

To backup the configuration

Answer

To increase report speed

Answer

To reduce CPU usage

Question 14

An administrator notices that the 'Device Manager' status is 'Unsynchronized'. What is the recommended first step to resolve this?

Accepted Answer

Retrieve Config.. When the Device Manager status shows 'Unsynchronized', it means the FortiManager's configuration database is out of sync with the managed FortiGate. The recommended first step is to retrieve the configuration from the FortiGate ('Retrieve Config') to update FortiManager with the current device configuration, which resolves the synchronization issue.

Answer

Change the ADOM version.

Answer

Reboot the FortiGate.

Answer

Re-install the firmware.

Question 15

You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?

Accepted Answer

Configure the Bridge pair under Network > Interface.. In FortiMail Transparent mode, the mandatory step is to configure a Bridge pair under Network > Interface. The bridge pair binds two interfaces together so FortiMail can inspect email traffic inline without altering IP headers, effectively acting as a Layer 2 bridge. This is the defining configuration for Transparent mode operation.

Answer

Configure the Bridge pair and disable IP forwarding.

Answer

Configure static IP routing on the management interface.

Answer

Assign a virtual IP to the WAN interface.

Question 16

What is the purpose of the 'Relay Host' setting in FortiMail?

Accepted Answer

To define the destination for outgoing mail.. The 'Relay Host' setting in FortiMail specifies the destination server to which outgoing mail is forwarded. It acts as a smart host or relay, directing email to the next-hop MTA for delivery. This is essential when FortiMail is not the final destination and needs to pass mail to an internal or external mail server.

Answer

To handle administrative login.

Answer

To store incoming mail.

Answer

To manage the quarantine.

Question 17

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Accepted Answer

Configure FortiAuthenticator as a RADIUS Server on FortiGate. Option C is correct because the FortiGate must be explicitly configured with a RADIUS server entry pointing to the FortiAuthenticator (via config user radius, specifying the FortiAuthenticator's IP and shared secret) so that the FortiGate can send authentication requests to it. Option E is correct because FortiAuthenticator only accepts RADIUS requests from clients it recognizes, so the FortiGate's IP address must be added as a RADIUS client (with a matching shared secret) under RADIUS Service > Clients on the FortiAuthenticator. Option A is not required for RADIUS authentication, since web certificates are used for HTTPS/SSL inspection or SAML, not RADIUS. Option B is not required because LDAP is a separate authentication protocol and FortiAuthenticator can act as a RADIUS server without enabling LDAP. Option D is not required because SAML is a different federation protocol used for single sign-on, not for RADIUS authentication.

Answer

Install a web certificate on the FortiGate

Answer

Enable LDAP on the FortiAuthenticator

Answer

Configure SAML on the FortiGate

Question 18

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

Accepted Answer

Expected Response code in the Health Check object. When a FortiADC health check fails despite the server being up, the most common cause is a mismatch between the expected response and what the server returns. The health check object defines an expected response code (for example, HTTP 200); if the server returns a different code (301, 403, 404), the check fails. Verifying this setting first is the fastest diagnostic step.

Answer

The ADC management IP

Answer

Server RAM utilization

Answer

The switch MTU

Question 19

Which THREE actions are available in the 'DLP' section of a policy?

Accepted Answer

Discard. In the DLP (Data Loss Prevention) section of a policy, the available actions are Discard (A), Log (D), and Quarantine (E). Discard (A) is correct because it blocks the transfer of sensitive data by dropping the file or message entirely. Log (D) is correct because it records the DLP event for auditing and monitoring without necessarily blocking the action. Quarantine (E) is correct because it isolates the sensitive data, often moving it to a secure location for review. Rename file (B) and Create copy (C) are not DLP policy actions; they are file operations that do not enforce data loss prevention.

Answer

Rename file

Answer

Create copy

Question 20

Which THREE items are found in the 'System Settings' area?

Accepted Answer

Administrators. In the System Settings area, option A 'Administrators' is correct because administrator accounts, profiles, and their access permissions are configured there. Option C 'Mail Server settings' is correct because the SMTP server used for alert emails and notifications is defined under System Settings. Option E 'Disk maintenance' is correct because disk-related tasks such as formatting, logging, and disk usage are managed in System Settings. Option B 'Report templates' is not part of System Settings; report templates are configured in the Reports section. Option D 'FortiView widget configuration' is not part of System Settings; FortiView widgets are configured in the FortiView/dashboard area.

Answer

Report templates

Answer

FortiView widget configuration