FORTINET-NSE56 Practice Test 5 — 10 Questions

Question 1

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Accepted Answer

Cookie Insert. Cookie Insert persistence is the most appropriate method for a cookie-based application because FortiADC inserts a cookie into the HTTP response that identifies the backend server, ensuring subsequent requests from the same client are directed to the same server. This works even when clients are behind NAT or proxies, unlike source IP persistence. It also handles SSL offloading scenarios where SSL Session ID persistence would fail.

Answer

Source IP Persistence

Answer

SSL Session ID

Answer

Round Robin

Question 2

Which of the following is a component of the Fortinet Security Fabric?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is a core component of the Fortinet Security Fabric, providing centralized logging, analysis, and reporting. It integrates with other Fortinet devices to collect and correlate security events. The other options are not Fortinet Security Fabric components.

Answer

A personal printer

Answer

A standard consumer router

Answer

A generic web server

Question 3

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

Accepted Answer

Set Notification Email. In an Install Workflow, the option 'Set Notification Email' (B) is correct because it lets administrators specify the recipient address that receives status messages about the deployment, enabling monitoring of the install process. 'Auto-install on Approve' (C) is correct because it defines whether the installation proceeds automatically once an approval is granted, removing the need for a separate manual trigger. 'Enable Approval' (E) is correct because it turns on the approval gate in the workflow, requiring an authorized user to approve the deployment before it can continue. The remaining options do not belong: 'Change Firmware automatically' (A) is a hardware/firmware update action rather than an Install Workflow deployment setting, and 'Delete Policy after Install' (D) is a policy lifecycle/cleanup action, not a configurable option for managing the deployment process itself.

Answer

Change Firmware automatically

Answer

Delete Policy after Install

Question 4

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Accepted Answer

Sources (Map View). FortiView's Sources view includes a Map View that plots traffic by geographic origin, letting administrators visualize which countries or regions are generating traffic. This is the tool designed for geographic traffic pattern analysis.

Answer

Event Handler

Answer

Reports

Answer

Log View

Question 5

What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?

Accepted Answer

It allows users to manage their own quarantined emails.. The FortiMail Quarantine portal is a self-service web interface that lets end-users view, release, delete, and manage their own quarantined messages without administrator intervention. This offloads administrative overhead and reduces helpdesk tickets, which is the primary advantage. Options A, B, and D describe incidental or incorrect behaviors rather than the core purpose of the portal.

Answer

It hides spam messages.

Answer

It deletes all mail automatically.

Answer

It provides full system logs.

Question 6

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

Accepted Answer

Time skew between IDP and SP. SAML assertions contain a NotOnOrAfter timestamp that defines the validity window. If the clocks on the FortiAuthenticator (IdP) and the service provider (SP) are not synchronized, the SP may consider the assertion expired even if it was just issued. This is the most common cause of 'Assertion expired' errors in SAML debugging.

Answer

The browser is blocked

Answer

The SAML certificate is self-signed

Answer

The user password is too old

Question 7

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Accepted Answer

Log Forwarding. Log Forwarding is the FortiAnalyzer feature that sends logs to an external syslog server, CEF server, or another FortiAnalyzer. It is configured under the Log Forwarding section, where you define the remote server address, port, protocol, and which log types to forward. This is the standard way to offload logs for long-term retention or third-party SIEM ingestion.

Answer

Device Manager

Answer

FortiView

Answer

Report Settings

Question 8

Which protocol does FortiAnalyzer primarily use for Web UI access?

Accepted Answer

HTTPS. FortiAnalyzer's Web UI is accessed over HTTPS (TCP 443) by default, providing encrypted administrative access to the GUI. Administrators browse to the FortiAnalyzer management IP or hostname using https:// to log in and manage reports, logs, and settings. HTTPS ensures credentials and session data are protected in transit.

Answer

SSH

Answer

FTP

Answer

HTTP

Question 9

What is the primary function of the 'AntiSpam' profile?

Accepted Answer

To block unwanted emails.. The AntiSpam profile in FortiGate is a security profile applied to firewall policies that inspects inbound and outbound email traffic (SMTP, IMAP, POP3, and optionally MAPI) to detect and block unsolicited bulk email. Its core function is to identify spam using DNSBL lookups, heuristics, banned word lists, and greylisting, then take action such as tagging, quarantining, or discarding the message. It does not perform encryption, compression, or routing — those are handled by other FortiGate features or external systems.

Answer

To encrypt mail.

Answer

To compress mail.

Answer

To route mail.

Question 10

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Accepted Answer

It can route traffic based on HTTP headers or URL patterns. Option A is correct because FortiADC's Layer 7 (HTTP/HTTPS) virtual servers can inspect application-layer content and use content routing rules to direct traffic based on HTTP headers (for example, Host or X-Forwarded-For) or URL patterns/paths. Option C is correct because FortiADC supports HTTP content rewriting, allowing it to add, modify, or delete HTTP request and response headers (such as inserting X-Forwarded-For or stripping Server headers) as traffic passes through the virtual server. Option B is incorrect because Layer 7 load balancing does not require backend servers to share a subnet; real servers can reside on different networks as long as routing to them exists. Option D is incorrect because Layer 7 load balancing specifically handles application protocols like HTTP and HTTPS, not only raw TCP. Option E is incorrect because FortiADC performs health checks on web servers using HTTP/HTTPS monitors (and other monitor types) to verify real server availability.

Answer

It requires all backend servers to be on the same subnet

Answer

It only supports TCP-based traffic

Answer

It cannot perform health checks on web servers