FORTINET-NSE56 Practice Test 2 — 30 Questions

Question 1

An administrator wants to ensure that a specific policy is always included in all policy packages within an ADOM. What feature should be used?

Accepted Answer

Global Policy.. Global Policies in FortiManager are objects created at the ADOM level that are automatically inherited by every policy package within that ADOM. This ensures a consistent baseline policy (for example, a deny-all or management-access rule) is always present regardless of which package an administrator installs. Because they are enforced at the ADOM scope, they cannot be accidentally omitted from a package.

Answer

Script.

Answer

Provisioning Template.

Answer

Standard Policy.

Question 2

If an administrator wants to perform a 'Config Check' to see what changes will be deployed during an installation, which option should they select in the 'Install Wizard'?

Accepted Answer

Install Preview. The 'Install Preview' option in the FortiManager Install Wizard generates a diff showing exactly what configuration changes will be pushed to the target device before the install actually runs. This lets administrators review the delta and catch unintended changes before deployment.

Answer

Policy Check

Answer

Install Config

Answer

Sync Device

Question 3

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Accepted Answer

Enable SQL Injection in the WAF profile. FortiWeb's WAF profile includes a specific signature set for SQL injection (SQLi) detection, which matches patterns like ' OR 1=1, UNION SELECT, and other database query manipulations. Enabling SQL Injection in the WAF profile activates these signatures and applies them to incoming requests. This directly addresses the requirement to block SQL injection patterns. Other protections target different attack types and would not cover SQLi.

Answer

Enable Buffer Overflow protection

Answer

Enable HTTP Protocol Validation

Answer

Enable Cross-site Scripting protection

Question 4

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

Accepted Answer

User Portal. The User Portal component of FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens. It provides a web interface for users to enroll tokens, reset passwords, and manage their profiles. This offloads administrative tasks and empowers users.

Answer

AD Connector

Answer

Admin GUI

Answer

RADIUS Server

Question 5

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

Accepted Answer

Client SSL Profile. SSL offloading on FortiADC is configured via the Client SSL Profile, which holds the server certificate, private key, and TLS parameters used to terminate client-side HTTPS connections on the ADC. Once terminated, the ADC can inspect and load-balance the decrypted traffic before re-encrypting to backends if needed. This is the object that performs the offload.

Answer

Content Routing Policy

Answer

Server SSL Profile

Answer

Layer 7 Persistence Rule

Question 6

Which THREE are key benefits of using FortiWeb to protect web applications?

Accepted Answer

Protection against SQL Injection. Option C is correct because FortiWeb is a web application firewall (WAF) that inspects HTTP/HTTPS traffic and uses signatures and anomaly detection to block SQL Injection attacks against web applications. Option D is correct because FortiWeb can terminate TLS/SSL sessions, performing SSL offloading so backend web servers are freed from encryption/decryption overhead while FortiWeb inspects the decrypted traffic. Option E is correct because FortiWeb provides logging, reporting, and compliance-oriented dashboards that help organizations demonstrate adherence to regulations such as PCI DSS. Option A is not a FortiWeb function, since replacing an ISP is a connectivity/business decision unrelated to application security. Option B is also unrelated, as physical security of the server room is handled by facility controls, not by a WAF.

Answer

Replacing the ISP

Answer

Physical security of the server room

Question 7

What is the consequence of deleting a device from an ADOM in FortiManager?

Accepted Answer

The FortiGate is no longer managed by that ADOM.. Deleting a device from an ADOM in FortiManager only removes the management association between that FortiGate and the ADOM. The FortiGate itself keeps running with its current configuration and continues passing traffic; it simply is no longer managed within that ADOM.

Answer

The FortiGate is automatically rebooted.

Answer

The FortiGate will stop passing traffic.

Answer

The FortiGate configuration is wiped.

Question 8

Which TWO features in FortiMail help prevent email spoofing?

Accepted Answer

DKIM. DKIM (D) is correct because it cryptographically signs outbound messages with a private key and lets receiving servers verify the signature against a published public key in DNS, so a spoofed sender cannot produce a valid signature and the message fails authentication. SPF (E) is correct because it publishes a DNS TXT record listing the authorized sending hosts for a domain, allowing the receiving FortiMail to check the envelope sender's connecting IP and reject or flag mail from unauthorized servers. Both are standard email authentication mechanisms FortiMail uses in its antispam and sender-verification policies to detect forged sender addresses. Syslog (A) is only a logging/event transport and does not authenticate senders, Antivirus (B) scans message content for malware rather than verifying sender identity, and POP3 (C) is a mailbox retrieval protocol with no role in preventing spoofing.

Answer

Syslog

Answer

Antivirus

Answer

POP3

Question 9

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

Accepted Answer

FortiView Applications. FortiView Applications aggregates traffic by application identity, showing which applications consume the most bandwidth in a visual, ranked format. This directly answers the administrator's need to identify the top bandwidth consumer efficiently. The other FortiView views focus on sources, destinations, or logs rather than application-level bandwidth breakdown.

Answer

Log View

Answer

FortiView Sources

Answer

FortiView Destinations

Answer

Reports

Question 10

When modifying a policy package, what does 'Lock' indicate?

Accepted Answer

The package cannot be edited by other admins.. In FortiManager, locking a policy package indicates that an administrator has taken exclusive edit control over it. While locked, other administrators cannot modify the package, preventing concurrent edits and configuration conflicts. The lock must be released before others can edit or before the package can be installed (in some workflows).

Answer

The package is deleted.

Answer

The package is ready to be pushed.

Answer

The package is corrupted.

Question 11

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Accepted Answer

Cookie Insert. Cookie Insert persistence is the most appropriate method for a cookie-based application because FortiADC inserts a cookie into the HTTP response that identifies the backend server, ensuring subsequent requests from the same client are directed to the same server. This works even when clients are behind NAT or proxies, unlike source IP persistence. It also handles SSL offloading scenarios where SSL Session ID persistence would fail.

Answer

Source IP Persistence

Answer

SSL Session ID

Answer

Round Robin

Question 12

Which of the following is a component of the Fortinet Security Fabric?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is a core component of the Fortinet Security Fabric, providing centralized logging, analysis, and reporting. It integrates with other Fortinet devices to collect and correlate security events. The other options are not Fortinet Security Fabric components.

Answer

A personal printer

Answer

A standard consumer router

Answer

A generic web server

Question 13

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

Accepted Answer

Set Notification Email. In an Install Workflow, the option 'Set Notification Email' (B) is correct because it lets administrators specify the recipient address that receives status messages about the deployment, enabling monitoring of the install process. 'Auto-install on Approve' (C) is correct because it defines whether the installation proceeds automatically once an approval is granted, removing the need for a separate manual trigger. 'Enable Approval' (E) is correct because it turns on the approval gate in the workflow, requiring an authorized user to approve the deployment before it can continue. The remaining options do not belong: 'Change Firmware automatically' (A) is a hardware/firmware update action rather than an Install Workflow deployment setting, and 'Delete Policy after Install' (D) is a policy lifecycle/cleanup action, not a configurable option for managing the deployment process itself.

Answer

Change Firmware automatically

Answer

Delete Policy after Install

Question 14

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Accepted Answer

Sources (Map View). FortiView's Sources view includes a Map View that plots traffic by geographic origin, letting administrators visualize which countries or regions are generating traffic. This is the tool designed for geographic traffic pattern analysis.

Answer

Event Handler

Answer

Reports

Answer

Log View

Question 15

What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?

Accepted Answer

It allows users to manage their own quarantined emails.. The FortiMail Quarantine portal is a self-service web interface that lets end-users view, release, delete, and manage their own quarantined messages without administrator intervention. This offloads administrative overhead and reduces helpdesk tickets, which is the primary advantage. Options A, B, and D describe incidental or incorrect behaviors rather than the core purpose of the portal.

Answer

It hides spam messages.

Answer

It deletes all mail automatically.

Answer

It provides full system logs.

Question 16

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

Accepted Answer

Time skew between IDP and SP. SAML assertions contain a NotOnOrAfter timestamp that defines the validity window. If the clocks on the FortiAuthenticator (IdP) and the service provider (SP) are not synchronized, the SP may consider the assertion expired even if it was just issued. This is the most common cause of 'Assertion expired' errors in SAML debugging.

Answer

The browser is blocked

Answer

The SAML certificate is self-signed

Answer

The user password is too old

Question 17

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Accepted Answer

Log Forwarding. Log Forwarding is the FortiAnalyzer feature that sends logs to an external syslog server, CEF server, or another FortiAnalyzer. It is configured under the Log Forwarding section, where you define the remote server address, port, protocol, and which log types to forward. This is the standard way to offload logs for long-term retention or third-party SIEM ingestion.

Answer

Device Manager

Answer

FortiView

Answer

Report Settings

Question 18

Which protocol does FortiAnalyzer primarily use for Web UI access?

Accepted Answer

HTTPS. FortiAnalyzer's Web UI is accessed over HTTPS (TCP 443) by default, providing encrypted administrative access to the GUI. Administrators browse to the FortiAnalyzer management IP or hostname using https:// to log in and manage reports, logs, and settings. HTTPS ensures credentials and session data are protected in transit.

Answer

SSH

Answer

FTP

Answer

HTTP

Question 19

What is the primary function of the 'AntiSpam' profile?

Accepted Answer

To block unwanted emails.. The AntiSpam profile in FortiGate is a security profile applied to firewall policies that inspects inbound and outbound email traffic (SMTP, IMAP, POP3, and optionally MAPI) to detect and block unsolicited bulk email. Its core function is to identify spam using DNSBL lookups, heuristics, banned word lists, and greylisting, then take action such as tagging, quarantining, or discarding the message. It does not perform encryption, compression, or routing — those are handled by other FortiGate features or external systems.

Answer

To encrypt mail.

Answer

To compress mail.

Answer

To route mail.

Question 20

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Accepted Answer

It can route traffic based on HTTP headers or URL patterns. Option A is correct because FortiADC's Layer 7 (HTTP/HTTPS) virtual servers can inspect application-layer content and use content routing rules to direct traffic based on HTTP headers (for example, Host or X-Forwarded-For) or URL patterns/paths. Option C is correct because FortiADC supports HTTP content rewriting, allowing it to add, modify, or delete HTTP request and response headers (such as inserting X-Forwarded-For or stripping Server headers) as traffic passes through the virtual server. Option B is incorrect because Layer 7 load balancing does not require backend servers to share a subnet; real servers can reside on different networks as long as routing to them exists. Option D is incorrect because Layer 7 load balancing specifically handles application protocols like HTTP and HTTPS, not only raw TCP. Option E is incorrect because FortiADC performs health checks on web servers using HTTP/HTTPS monitors (and other monitor types) to verify real server availability.

Answer

It requires all backend servers to be on the same subnet

Answer

It only supports TCP-based traffic

Answer

It cannot perform health checks on web servers