FORTINET-NSE56 Practice Test 3 — 10 Questions

Question 1

Which TWO components can be included in a 'Provisioning Template' to manage device settings?

Accepted Answer

System Templates. In FortiManager, a Provisioning Template is used to preconfigure devices before or during onboarding, and it can contain two types of components: System Templates (option A) and CLI Templates (option C). System Templates (A) are correct because they define standardized system-level settings such as DNS, NTP, SNMP, and administrative parameters that can be applied to managed devices. CLI Templates (C) are correct because they let you push raw FortiOS CLI configuration snippets to devices, allowing granular or vendor-specific settings that system templates do not cover. ADOM Variables (B) are not standalone provisioning template components; they are variables referenced within templates and policies, not a template type themselves. Firewall Policies (D) are managed through policy packages, not provisioning templates. Firmware Images (E) are handled via firmware management tasks or upgrade tools, not as provisioning template components.

Answer

ADOM Variables

Answer

Firewall Policies

Answer

Firmware Images

Question 2

An administrator needs to revert a firewall configuration to a state from two weeks ago. Which feature in FortiManager allows for this recovery?

Accepted Answer

Revision History. FortiManager's Revision History stores every configuration revision pushed to or pulled from a managed FortiGate, including timestamps and diffs. An administrator can browse revisions, compare them, and revert the device to any prior revision — including one from two weeks ago — directly from the Device Manager.

Answer

Provisioning Templates

Answer

Configuration Backup

Answer

Script Manager

Question 3

What is the primary purpose of using 'Provisioning Templates' in FortiManager?

Accepted Answer

To standardize system settings like NTP, DNS, and logging on multiple devices.. Provisioning Templates in FortiManager are used to standardize and automate the configuration of system-level settings such as NTP, DNS, logging, and other device-wide parameters across multiple FortiGate devices. They ensure consistency and reduce manual configuration errors when onboarding or managing many devices. They are not used for firewall policies, endpoint management, or reporting.

Answer

To manage FortiClient endpoints.

Answer

To create firewall policies across all devices.

Answer

To generate performance reports.

Question 4

Which THREE of the following are core components of the Fortinet Security Fabric?

Accepted Answer

FortiGate. FortiGate (A) is correct because it is the foundational next-generation firewall (NGFW) that serves as the core security enforcement point of the Fortinet Security Fabric, providing firewall, IPS, antivirus, and other security functions. FortiAnalyzer (D) is correct because it is a core Fabric component for centralized logging, analytics, and reporting, collecting and correlating security events from Fabric devices. FortiManager (E) is correct because it is the central management platform for the Fabric, enabling single-pane-of-glass configuration and policy orchestration across FortiGate and other Fortinet devices. A standard web browser (B) is not a Fabric component; it is merely a client used to access management GUIs. A third-party printer (C) is not a Fabric component either, as it is an unrelated network endpoint device.

Answer

Standard Web Browser

Answer

Third-party printer

Question 5

How can you restrict management access to the FortiMail GUI to only specific IP addresses?

Accepted Answer

Use the 'Trusted Host' feature in the administrator profile.. FortiMail administrators can restrict GUI access to specific source IP addresses by configuring the 'Trusted Host' setting in the administrator's profile. This limits login attempts to the defined IPs/subnets, effectively whitelisting management access. It is the built-in mechanism for source-IP-based GUI restriction.

Answer

Change the management port.

Answer

Disable GUI access.

Answer

Configure a firewall policy.

Question 6

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

Accepted Answer

Global objects.. Global objects in FortiManager are shared across all ADOMs, making them the correct choice for enforcing a consistent naming convention for address objects across multiple ADOMs. When a global object is created, it is available to every ADOM and can be referenced in policies, ensuring uniform naming and values everywhere. This centralizes object management and prevents naming drift between ADOMs.

Answer

Provisioning templates.

Answer

Local ADOM objects.

Answer

CLI templates.

Question 7

Which administrative account type has full access to all ADOMs and system settings?

Accepted Answer

Super_User. The Super_User administrative profile in FortiManager/FortiAnalyzer has full read-write access to all ADOMs and all system settings, including device management, policy packages, and system configuration. It is the highest-privilege built-in account type and is not restricted to any single ADOM or functional area. This is why Super_User is the correct answer for full access across ADOMs and system settings.

Answer

Report Admin

Answer

Log Admin

Answer

Restricted Admin

Question 8

What does the 'FortiView' module provide?

Accepted Answer

Visual traffic analytics. FortiView is FortiAnalyzer's visual analytics module that provides dashboards, drill-down charts, and interactive views of traffic, threats, applications, and user activity. It transforms raw log data into visual traffic analytics, allowing administrators to quickly identify top talkers, threat patterns, and bandwidth consumers without writing queries.

Answer

Configuration templates

Answer

Raw log data

Answer

Firmware management

Question 9

A compliance officer needs FortiAnalyzer to alert the security team by email whenever an administrator logs in to the FortiGate at a branch office outside business hours. Which FortiAnalyzer capability should be configured to satisfy this requirement?

Accepted Answer

A log-based alert with a schedule and event filter that triggers on administrator login events from that device.. Event-driven alerting with a time schedule is the mechanism that turns matching log entries into timely email notifications. Scoping the filter to administrator logins from the branch FortiGate keeps the alert precise and avoids notifying on unrelated activity.

Answer

A real-time log forwarding rule that relays all branch logs to an external SIEM for correlation.

Answer

A report schedule that emails a summary of administrator activity once per day.

Answer

A dashboard widget that displays recent administrator logins across all managed devices.

Question 10

Which 'Install Wizard' option ensures that configuration changes on the FortiManager are synchronized back to the device's configuration file?

Accepted Answer

Install Policy Package & Device Settings.. 'Install Policy Package & Device Settings' pushes both the policy package and the device-level settings (interfaces, routing, system config) from FortiManager to the managed FortiGate, ensuring the device's configuration file is synchronized with what FortiManager has stored. This is the option that covers full config synchronization back to the device.

Answer

Install Policy Package only.

Answer

Device Settings only.

Answer

Retrieve Config.