FORTINET-NSE56 Practice Questions 2 — 50 Questions

Question 1

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager's Device Manager let you define reusable configuration templates (e.g., system settings, interface configs, firewall objects) and apply them to multiple FortiGate devices or device groups at once. This is the intended feature for bulk-pushing configuration changes across many devices.

Answer

Log Forwarding

Answer

Report scheduling

Answer

ADOM grouping

Question 2

Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?

Accepted Answer

LDAP. Option B (LDAP) is correct because FortiMail can query an external LDAP directory (for example Active Directory or OpenLDAP) to authenticate users who log in to the quarantine portal, allowing centralized credential verification. Option E (Local user database) is correct because FortiMail also supports authenticating quarantine portal users against its own locally defined user accounts when no external server is used. Options A (Syslog), C (SNMP), and D (ICMP) are incorrect because they are logging, monitoring/management, and network diagnostic protocols respectively, and none of them provide user authentication for portal access.

Answer

Syslog

Answer

SNMP

Answer

ICMP

Question 3

Which of these is a benefit of 'Transparent' mode?

Accepted Answer

It requires no changes to mail server settings.. In Transparent mode, the FortiMail unit is inserted into the existing network path without requiring any changes to the IP addresses or configurations of the mail servers behind it. It acts as a Layer 2 bridge, so the mail server's default gateway remains the same and no MX record or relay settings need to be modified. This makes deployment simple and non-disruptive, which is the primary benefit of Transparent mode.

Answer

It is faster than Gateway mode.

Answer

It supports only one domain.

Answer

It hides the mail server IP.

Question 4

How can you view the 'Total' number of policies in a specific policy package?

Accepted Answer

In the Policy & Objects tab list view.. The total number of policies in a policy package is displayed in the Policy & Objects tab list view, where FortiManager shows the policy list along with a count. This is the standard GUI location for reviewing and counting policies within a package.

Answer

In the Device Manager.

Answer

Using a CLI script.

Answer

By going to the Dashboard.

Question 5

Which dashboard provides a 'Threat Map'?

Accepted Answer

FortiView. FortiView is the FortiGate dashboard module that includes the Threat Map, a geographic visualization of attacks and threats detected by the device. It aggregates log data into interactive widgets showing top threats, sources, and destinations on a world map. The Threat Map is accessed from FortiView, not from the Report, Device Manager, or Log View modules.

Answer

Report module

Answer

Device Manager

Answer

Log View

Question 6

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

Accepted Answer

The installation fails during the validation phase.. When the FortiManager Install Wizard pushes a policy package, it performs a validation phase that checks whether all referenced objects exist on the target FortiGate. If any object is missing, the installation fails during validation rather than proceeding, because FortiManager will not push a policy that references undefined objects. This prevents broken or incomplete configurations from being deployed.

Answer

The installation proceeds and ignores the missing objects.

Answer

The FortiGate automatically creates the missing objects using default settings.

Answer

The objects are pushed as CLI commands only.

Question 7

What is the purpose of 'Report Templates'?

Accepted Answer

To provide consistent report formats. Report Templates in FortiAnalyzer/FortiManager define the layout, sections, charts, and formatting used when generating reports, so that recurring reports share a uniform structure and appearance. They are reusable blueprints that administrators attach to report schedules, ensuring every generated PDF/HTML report follows the same corporate or compliance format. This is why the correct answer is 'to provide consistent report formats' rather than any operational function like firmware, filtering, or alerting.

Answer

To update firmware

Answer

To filter logs

Answer

To configure alerts

Question 8

In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?

Accepted Answer

Reject the email at the SMTP level.. In Gateway mode, FortiMail acts as an SMTP gateway and by default rejects email for unknown recipients at the SMTP level with a 550 error. This prevents backscatter and reduces load from spam directed at non-existent addresses. The behavior is controlled by the 'unknown recipient' policy, which defaults to reject.

Answer

Accept the email and store it in a general box.

Answer

Forward the email to the administrator.

Answer

Queue the email for 24 hours.

Question 9

Which dashboard widget provides a high-level summary of system resource usage?

Accepted Answer

System Information. The System Information dashboard widget in FortiGate displays a high-level summary of system resource usage, including CPU utilization, memory usage, disk usage, and session counts. It provides administrators with an at-a-glance view of the device's health and performance metrics directly on the dashboard.

Answer

Report Settings

Answer

Log View

Answer

FortiView Threats

Question 10

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Accepted Answer

The FortiGate remote group is not defined for the LDAP server. For a FortiGate policy to match an LDAP group, the group must first be imported/defined as a remote group under User & Authentication > LDAP Servers on the FortiGate. If the remote group is not defined, the policy cannot reference it and the user's group membership is never evaluated, causing access denial even though authentication succeeded.

Answer

The LDAP user account is locked

Answer

FortiAuthenticator is in maintenance mode

Answer

The user is using the wrong password

Question 11

Where do you configure the email server settings for FortiManager alert notifications?

Accepted Answer

System Settings.. Email server settings for FortiManager alert notifications (SMTP server, port, authentication, sender address) are configured under System Settings > Alert Email, which is the centralized location for notification delivery configuration.

Answer

FortiView.

Answer

Policy & Objects.

Answer

Device Manager.

Question 12

How are Revision Histories primarily used in FortiManager when a device configuration has been modified locally on the FortiGate?

Accepted Answer

To perform a diff between the current device configuration and stored revisions.. Revision History in FortiManager stores snapshots of device configuration each time a change is made, whether pushed from FortiManager or detected from the FortiGate. When a device has been modified locally, the administrator can use Revision History to run a diff between the current running configuration and any stored revision, revealing exactly what changed out-of-band. This is the primary diagnostic use of the feature.

Answer

To automatically roll back local changes without user input.

Answer

To create new ADOMs.

Answer

To schedule daily firmware upgrades.

Question 13

You are creating a new policy package. You need to ensure that shared objects from the Global ADOM are available. What is the correct workflow?

Accepted Answer

Assign the Global ADOM to the target ADOM.. To make shared objects from the Global ADOM available in a policy package, you must assign the Global ADOM to the target ADOM. This creates a parent-child relationship where the target ADOM inherits global objects, which can then be referenced in local policies. The other options involve manual export/import or wizard-based syncing, which are not the correct workflow for global object availability.

Answer

Use the 'Install Wizard' to sync global objects.

Answer

Export objects from the Global ADOM and re-import them.

Answer

Import the objects directly into the local policy package.

Question 14

Which protocol is used for communication between the FortiMail and a remote LDAP server for user authentication?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the protocol used to query directory services such as Active Directory or OpenLDAP for user authentication and attribute lookup. FortiMail connects to a remote LDAP server over TCP port 389 (or 636 for LDAPS) to validate recipient addresses and authenticate users. The other protocols listed serve entirely different purposes in the mail flow.

Answer

SMTP

Answer

POP3

Answer

SNMP

Question 15

When using 'Log Forwarding', can you filter the logs before they are forwarded?

Accepted Answer

Yes, using log filters. FortiGate log forwarding supports log filters that allow administrators to selectively forward only specific log types, severity levels, or events to external destinations. This filtering is configured per forwarding destination (e.g., syslog, FortiAnalyzer, CEF) and reduces noise and bandwidth by excluding irrelevant logs. Therefore, yes, logs can be filtered before forwarding using log filters.

Answer

Only for FortiAnalyzer destinations

Answer

No, all logs are forwarded

Answer

Only for Syslog

Question 16

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

Accepted Answer

Log View. Log View is the FortiAnalyzer module that displays logs as they are received, with real-time refresh and filtering by ADOM, device, log type, and time. It is the direct equivalent of a live log console and is where administrators confirm that logs are actually arriving from a FortiGate. The other modules serve analytics, management, or reporting purposes.

Answer

Report module

Answer

FortiSoC module

Answer

Device Manager

Question 17

Which feature allows FortiMail to perform automatic cleanup of old messages in the quarantine?

Accepted Answer

Quarantine maintenance. FortiMail's Quarantine maintenance feature (configured under System > Maintenance or via the quarantine settings) automates the cleanup of old messages in the quarantine by defining retention periods and scheduled deletion. It is the built-in mechanism specifically designed to prevent quarantine storage from growing unbounded. Administrators configure it to purge messages older than a specified age on a recurring schedule.

Answer

Policy-based expiration

Answer

Daily report schedule

Answer

Storage quota limit

Answer

Email Archiving

Question 18

Which of the following is a mandatory step when creating a new ADOM in FortiManager?

Accepted Answer

Selecting a firmware version.. When creating a new Administrative Domain (ADOM) in FortiManager, you must specify the firmware version that the managed devices in that ADOM will run. This is because FortiManager uses the firmware version to determine the available objects, features, and schema for policy packages and device configurations within the ADOM. Without selecting a firmware version, the ADOM cannot be created, as the version dictates the database structure and compatibility.

Answer

Assigning an IP address.

Answer

Defining a policy package.

Answer

Configuring SNMP.

Question 19

Which tab in the FortiManager GUI is primarily used for managing firewall policies and objects?

Accepted Answer

Policy & Objects. The 'Policy & Objects' tab in FortiManager is specifically designed for centralized management of firewall policies and address/service objects across multiple FortiGate devices. It allows administrators to create, edit, and install policy packages and object definitions, which are then pushed to managed devices. This tab provides a unified interface for policy orchestration, making it the primary location for these tasks.

Answer

FortiView

Answer

Device Manager

Answer

System Settings

Question 20

What is the purpose of 'Revision History' when it comes to policy packages?

Accepted Answer

To store and revert changes made to policies.. Revision History in FortiManager records every change made to policy packages, including who made the change, when, and what was modified. Its primary purpose is to allow administrators to view past versions and revert to a previous configuration if a change causes problems. This provides rollback capability and change accountability for policy packages.

Answer

To synchronize objects across ADOMs.

Answer

To generate audit reports.

Answer

To archive logs.