FORTINET-NSE56 Hard Questions — 25 Difficult Questions

Question 1

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

Accepted Answer

FortiAuthenticator Authentication Logs. When a user is denied access through a FortiAuthenticator-backed portal, the FortiAuthenticator Authentication Logs are the authoritative source because they record the full RADIUS/LDAP exchange, including whether the user was found, whether group membership was evaluated, and the exact rejection reason. Since the user exists in the mapped AD group, the failure is likely in the authentication flow itself (bind failure, group filter mismatch, or policy mapping), all of which are visible in these logs. Checking logs first follows the standard troubleshooting methodology of gathering evidence before changing configuration.

Answer

The AD domain controller's disk space

Answer

The FortiGate session table

Answer

The WAF policy on FortiWeb

Question 2

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Accepted Answer

The number of matches. In a FortiAnalyzer Event Handler, the Threshold defines the trigger condition and the Count field specifies how many matching log entries must occur within the configured time window before the handler fires. In other words, Count is the number of matches, not the total logs received or a priority value. This lets administrators say 'alert me when 10 failed logins occur in 5 minutes' by setting Count=10 and the time window accordingly.

Answer

The total number of logs

Answer

The priority of the alert

Answer

The time window in seconds

Question 3

Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?

Accepted Answer

telnet 25. The telnet command (D) allows you to test TCP connectivity to a specific port, such as port 25 for SMTP. By running 'telnet 25', you can verify if the remote mail server is reachable and accepting connections on that port. This is a standard network troubleshooting step.

Answer

ping <IP>

Answer

arp -a

Answer

traceroute <IP>

Question 4

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

Accepted Answer

The Shared Secret. The Shared Secret is the pre-shared key used to secure RADIUS communication between the FortiAuthenticator (RADIUS server) and the third-party VPN gateway (RADIUS client). Both devices must be configured with the identical shared secret; otherwise, RADIUS authentication requests will be rejected due to message integrity check failures. The other settings are either optional or not required to match for basic authentication.

Answer

The RADIUS accounting port

Answer

The NAS-IP-Address

Answer

The VSA Vendor ID

Question 5

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

Accepted Answer

Policy & Objects > Task Monitor. FortiManager logs all policy installation tasks in the Task Monitor, accessible under Policy & Objects > Task Monitor. When an installation fails due to an object conflict or any other reason, the Task Monitor shows the task status, the affected device, and a detailed log with the specific error message (e.g., which object conflicted and why). This is the primary place to diagnose installation failures.

Answer

Device Manager > Revision History

Answer

System Settings > Event Log

Answer

Policy & Objects > Installation Targets

Question 6

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Accepted Answer

Playbook Execution logs. FortiSOAR (and FortiGate's automation stitches) maintain dedicated Playbook Execution logs that record each playbook run, the actions executed, their results, and any errors. When a playbook fails to execute an action, the Playbook Execution logs are the correct place to inspect the execution history and diagnose the failure.

Answer

Device manager logs

Answer

System logs

Answer

FortiView

Question 7

Which TWO factors impact the performance of report generation?

Accepted Answer

Whether report caching is enabled. Option C is correct because enabling report caching allows previously generated report results to be reused instead of recomputed, directly reducing the time and resource load required for each report generation. Option D is correct because the size of the log data determines how much data must be queried, aggregated, and rendered, so larger log volumes increase processing time and can slow report generation. The number of registered devices (A) and firmware version (B) may affect the environment but are not direct determinants of report-generation performance, and CPU temperature (E) is a hardware/environmental symptom rather than a defined performance factor for report generation.

Answer

The number of registered devices

Answer

The firmware version of the devices

Answer

The CPU temperature

Question 8

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Accepted Answer

Traffic Monitor / SSL Dashboard. The Traffic Monitor / SSL Dashboard in FortiADC provides real-time visibility into SSL handshake times, including metrics like SSL negotiation duration. This tool is specifically designed to monitor SSL/TLS performance and identify bottlenecks in the handshake process.

Answer

Packet Capture (sniffer)

Answer

Log Access

Answer

System Health Monitor

Question 9

How can you restrict management access to the FortiMail GUI to only specific IP addresses?

Accepted Answer

Use the 'Trusted Host' feature in the administrator profile.. FortiMail administrators can restrict GUI access to specific source IP addresses by configuring the 'Trusted Host' setting in the administrator's profile. This limits login attempts to the defined IPs/subnets, effectively whitelisting management access. It is the built-in mechanism for source-IP-based GUI restriction.

Answer

Change the management port.

Answer

Disable GUI access.

Answer

Configure a firewall policy.

Question 10

An administrator wants to ensure that a specific policy is always included in all policy packages within an ADOM. What feature should be used?

Accepted Answer

Global Policy.. Global Policies in FortiManager are objects created at the ADOM level that are automatically inherited by every policy package within that ADOM. This ensures a consistent baseline policy (for example, a deny-all or management-access rule) is always present regardless of which package an administrator installs. Because they are enforced at the ADOM scope, they cannot be accidentally omitted from a package.

Answer

Script.

Answer

Provisioning Template.

Answer

Standard Policy.

Question 11

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Accepted Answer

Cookie Insert. Cookie Insert persistence is the most appropriate method for a cookie-based application because FortiADC inserts a cookie into the HTTP response that identifies the backend server, ensuring subsequent requests from the same client are directed to the same server. This works even when clients are behind NAT or proxies, unlike source IP persistence. It also handles SSL offloading scenarios where SSL Session ID persistence would fail.

Answer

Source IP Persistence

Answer

SSL Session ID

Answer

Round Robin

Question 12

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

Accepted Answer

Set Notification Email. In an Install Workflow, the option 'Set Notification Email' (B) is correct because it lets administrators specify the recipient address that receives status messages about the deployment, enabling monitoring of the install process. 'Auto-install on Approve' (C) is correct because it defines whether the installation proceeds automatically once an approval is granted, removing the need for a separate manual trigger. 'Enable Approval' (E) is correct because it turns on the approval gate in the workflow, requiring an authorized user to approve the deployment before it can continue. The remaining options do not belong: 'Change Firmware automatically' (A) is a hardware/firmware update action rather than an Install Workflow deployment setting, and 'Delete Policy after Install' (D) is a policy lifecycle/cleanup action, not a configurable option for managing the deployment process itself.

Answer

Change Firmware automatically

Answer

Delete Policy after Install

Question 13

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Accepted Answer

Overwriting old logs. When FortiAnalyzer reaches its Maximum Storage limit, the default behavior is to overwrite the oldest logs to make room for new ones, so log ingestion continues rather than halting. This rolling behavior is controlled by the 'When log disk is full' setting, which defaults to overwrite.

Answer

Shutdown the device

Answer

Alert via SNMP only

Answer

Pause all services

Question 14

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Accepted Answer

diagnose sniffer packet any 'port 25' 4. The 'diagnose sniffer packet any "port 25" 4' command captures live packets on all interfaces matching TCP port 25 (SMTP) with verbose level 4, which includes interface names and packet payload — ideal for real-time SMTP troubleshooting. Verbose level 4 shows the interface, source/destination, and hex/ASCII payload, letting you inspect the SMTP dialogue (EHLO, MAIL FROM, RCPT TO, DATA) as it happens. This is the standard FortiMail CLI tool for live packet inspection.

Answer

show log traffic

Answer

execute telnet

Answer

get system status

Question 15

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. To prevent report generation from timing out when querying six months of historical traffic data, you must configure the report cache, which stores precomputed report data and allows the report to be generated from cached results rather than querying the full log database in real time. This significantly reduces processing time and avoids timeout errors.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change

Question 16

A FortiManager administrator needs to migrate an existing local FortiGate policy into a shared policy package. Which process must be followed?

Accepted Answer

Use the Policy Import tool to move to Global ADOM. FortiManager's Policy Import tool (also called the 'Import Policy' wizard) is the supported mechanism to pull an existing local FortiGate policy into a shared policy package or Global ADOM. It reads the device's current policy configuration and maps it into FortiManager's policy/object database so it can be managed centrally. Manually recreating or re-importing the whole config is not the correct migration path.

Answer

Manually re-import the config

Answer

Disable policy management

Answer

Delete local policy and recreate

Question 17

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

Accepted Answer

Time skew between IDP and SP. SAML assertions contain a NotOnOrAfter timestamp that defines the validity window. If the clocks on the FortiAuthenticator (IdP) and the service provider (SP) are not synchronized, the SP may consider the assertion expired even if it was just issued. This is the most common cause of 'Assertion expired' errors in SAML debugging.

Answer

The browser is blocked

Answer

The SAML certificate is self-signed

Answer

The user password is too old

Question 18

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Accepted Answer

It can route traffic based on HTTP headers or URL patterns. Option A is correct because FortiADC's Layer 7 (HTTP/HTTPS) virtual servers can inspect application-layer content and use content routing rules to direct traffic based on HTTP headers (for example, Host or X-Forwarded-For) or URL patterns/paths. Option C is correct because FortiADC supports HTTP content rewriting, allowing it to add, modify, or delete HTTP request and response headers (such as inserting X-Forwarded-For or stripping Server headers) as traffic passes through the virtual server. Option B is incorrect because Layer 7 load balancing does not require backend servers to share a subnet; real servers can reside on different networks as long as routing to them exists. Option D is incorrect because Layer 7 load balancing specifically handles application protocols like HTTP and HTTPS, not only raw TCP. Option E is incorrect because FortiADC performs health checks on web servers using HTTP/HTTPS monitors (and other monitor types) to verify real server availability.

Answer

It requires all backend servers to be on the same subnet

Answer

It only supports TCP-based traffic

Answer

It cannot perform health checks on web servers

Question 19

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

Accepted Answer

Session Synchronization. Session Synchronization (also called session replication or session sharing) is the FortiWeb feature that shares the session table across cluster members so that any member can process requests belonging to a session established on another member. This ensures persistence and continuity in an HA FortiWeb cluster.

Answer

Persistence Sharing

Answer

State Replication

Answer

Configuration Sync

Question 20

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Accepted Answer

The FortiGate remote group is not defined for the LDAP server. For a FortiGate policy to match an LDAP group, the group must first be imported/defined as a remote group under User & Authentication > LDAP Servers on the FortiGate. If the remote group is not defined, the policy cannot reference it and the user's group membership is never evaluated, causing access denial even though authentication succeeded.

Answer

The LDAP user account is locked

Answer

FortiAuthenticator is in maintenance mode

Answer

The user is using the wrong password