FORTINET-NSE56 Timed Hard Questions — 25 Difficult Questions

Question 1

You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?

Accepted Answer

ADOM settings. The 'Log Policy' or 'Disk Quota' settings under System Settings define how logs are managed when storage is full.

Answer

FortiView settings

Answer

Log forwarding settings

Answer

Report settings

Question 2

When setting up a 'FortiSoC' playbook to send an email, what must be configured first?

Accepted Answer

The SMTP server settings. You must set up the 'Mail Server' or 'SMTP' settings in the System Settings to allow the FortiAnalyzer to send emails.

Answer

The report schedule

Answer

The log forwarder

Answer

The ADOM mode

Question 3

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

Accepted Answer

It cannot run reports. Collector mode is optimized for log reception and forwarding, but it cannot generate reports.

Answer

It cannot forward logs

Answer

It cannot store logs

Answer

It cannot receive logs from FortiGate

Question 4

In FortiSoC, what is the purpose of the 'Playbook Trigger'?

Accepted Answer

To define the start condition. The trigger defines the condition (e.g., an event) that initiates the playbook execution.

Answer

To start the logging process

Answer

To generate a report

Answer

To pause the FortiAnalyzer

Question 5

Which TWO of the following are valid log file types supported by FortiAnalyzer?

Accepted Answer

Event logs. FortiAnalyzer processes logs from various Fortinet devices, and they are typically stored as indexed database entries or raw archives.

Answer

PDF reports

Answer

HTML dashboards

Answer

Firmware images

Question 6

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Accepted Answer

The number of matches. The count field specifies the number of occurrences of an event that must happen before an alert is triggered.

Answer

The total number of logs

Answer

The priority of the alert

Answer

The time window in seconds

Question 7

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Accepted Answer

diagnose sql status. 'diagnose sql status' is the primary command to check the health and status of the SQL database which stores the logs.

Answer

show system logs

Answer

get log status

Answer

get system status

Question 8

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Accepted Answer

Overwriting old logs. By default, FortiAnalyzer performs 'Log Overwrite' when the disk is full, but this behavior can be configured.

Answer

Shutdown the device

Answer

Alert via SNMP only

Answer

Pause all services

Question 9

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

Accepted Answer

The ADOM selection is incorrect. If logs are not being indexed or if the device is not registered, FortiView cannot display data. Also, ensure the ADOM is selected correctly.

Answer

The FortiGate is powered off

Answer

The report is still running

Answer

The FortiAnalyzer is too slow

Question 10

Which TWO methods can be used to back up FortiAnalyzer configuration?

Accepted Answer

Scheduled backup to FTP/SCP. Configurations can be backed up manually or scheduled for automated export to a remote server.

Answer

FortiView snapshots

Answer

Log archiving

Answer

Device provisioning

Question 11

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Accepted Answer

FortiAuthenticator SAML log. The SAML debug logs on the FortiAuthenticator provide detail on the assertion exchange and attribute mapping.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 12

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Accepted Answer

diagnose sniffer packet any 'port 25' 4. The 'diagnose sniffer packet' command is the standard way to capture and view traffic in real-time on Fortinet appliances.

Answer

show log traffic

Answer

execute telnet

Answer

get system status

Question 13

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

Accepted Answer

The FortiManager database is updated with the device configuration.. Retrieving the config pulls those changes into the FortiManager, bringing the database into sync.

Answer

All policies are deleted.

Answer

The FortiGate resets to factory settings.

Answer

The FortiGate goes offline.

Question 14

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. Enabling 'Report Data Masking' or using 'Report Cache' improves performance for long-duration reports.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change

Question 15

Which TWO actions can be triggered by a FortiSoC Playbook?

Accepted Answer

Sending an email notification. Playbooks can perform actions like notifying an admin via email or updating a security object on a FortiGate.

Answer

Deleting the ADOM

Answer

Changing system time

Answer

Rebooting the FortiAnalyzer

Question 16

What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?

Accepted Answer

The FortiGate must be added and authorized in the Device Manager.. The FortiGate must be added to the ADOM and authorized by an administrator.

Answer

The ADOM must be in 'Advanced' mode.

Answer

A policy package must be created first.

Answer

The FortiGate must be in a 'Disconnected' state.

Question 17

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

Accepted Answer

ADOM Log Policy. Each ADOM has its own 'Log Policy' or 'Disk Quota' configuration.

Answer

FortiView Filters

Answer

Report Settings

Answer

Global System Settings

Question 18

Which of the following is true about 'Report Data Masking'?

Accepted Answer

It masks sensitive information. Data masking allows you to hide sensitive information (like internal IPs or usernames) in reports while maintaining the ability to see trends.

Answer

It encrypts the report file

Answer

It deletes the logs

Answer

It hides the entire report

Question 19

Which THREE actions can be taken by a DLP filter when a match is found?

Accepted Answer

Encrypt. DLP filters can be configured to log, quarantine, or block/reject messages based on the rule.

Answer

Modify sender

Answer

Route to another interface

Question 20

An administrator wants to ensure that all outgoing emails are archived to a secondary server. Where is this configured?

Accepted Answer

Archiving policy. Archiving policies are configured to define the source and destination for email archival.

Answer

Access Control rule

Answer

AntiSpam profile

Answer

Routing policy