FORTINET-NSE56 Nse6 Fortimail Secure Email Gateway — 25 Questions

Question 1

Which feature allows the FortiMail to verify the sender's domain using a DNS record?

Accepted Answer

SPF.. SPF (Sender Policy Framework) is the standard method for verifying the sender domain via DNS.

Answer

DMARC.

Answer

DKIM.

Answer

RBL.

Question 2

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Accepted Answer

SPF validation. SPF (Sender Policy Framework) is used to verify that the sending IP is authorized by checking the sender domain's DNS TXT records.

Answer

DKIM verification

Answer

DMARC policy

Answer

Sender Reputation

Question 3

When configuring DMARC on FortiMail, which THREE components are required to successfully implement a 'reject' policy?

Accepted Answer

A valid DKIM public key in DNS.. DMARC relies on SPF and DKIM for alignment, and the DMARC record in DNS dictates the policy.

Answer

A custom antispam filter for all emails.

Answer

An LDAP server for user authentication.

Question 4

A customer is experiencing false positives with the FortiMail Antispam engine. Which feature should be configured to allow trusted sender domains while still performing virus scanning?

Accepted Answer

Create an Access Control List (ACL) policy with the 'Bypass antispam' action.. The Access Control List (ACL) allows you to define policies based on sender IP/domain to bypass antispam scanning while maintaining other security layers.

Answer

Disable the Antispam engine globally.

Answer

Add the sender to the Global Whitelist in the Antispam Profile.

Answer

Modify the recipient's personal whitelist.

Question 5

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

Accepted Answer

In the public DNS records for the domain.. DKIM verification relies on the public key being published as a TXT record in the DNS zone of the sending domain.

Answer

On the SMTP server of the recipient's domain.

Answer

In the FortiMail's relay host configuration.

Answer

On the FortiMail server's local certificate store.

Question 6

You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?

Accepted Answer

Configure the Bridge pair under Network > Interface.. Transparent mode operates at Layer 2. You must define the Bridge pair interfaces and ensure the FortiMail acts as a transparent bridge.

Answer

Configure the Bridge pair and disable IP forwarding.

Answer

Configure static IP routing on the management interface.

Answer

Assign a virtual IP to the WAN interface.

Question 7

A user reports that legitimate emails are being quarantined due to a high spam score. You want to add the sender's email address to a whitelist. Where should this be configured to be effective for the specific user?

Accepted Answer

Personal Safe List in the quarantine portal. The Personal Address Book or the per-user Safe List in the user's quarantine portal allows for individual whitelisting.

Answer

AntiSpam profile block list

Answer

Recipient policy whitelist

Answer

System global whitelist

Question 8

Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?

Accepted Answer

Delete the message.. Global quarantine management allows administrators to release or delete messages, and potentially download them for forensic analysis.

Answer

Modify the sender's IP address.

Answer

Re-encrypt the message body.

Answer

Change the recipient's email address.

Question 9

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

Accepted Answer

You must configure a bridge pair of interfaces to pass traffic transparently.. Transparent mode operates at Layer 2; the FortiMail must have a bridge pair configured to inspect traffic without requiring changes to the mail server IP addressing.

Answer

The mail server must point to the FortiMail IP as its default gateway.

Answer

The FortiMail must be configured with a unique IP address for each physical port for routing.

Answer

The FortiMail must be configured as a mail relay agent.

Question 10

Which TWO of the following are valid options for FortiMail deployment?

Accepted Answer

Gateway mode. FortiMail supports Gateway, Transparent, and Server modes.

Answer

Proxy mode

Answer

NAT mode

Answer

Endpoint mode

Question 11

When using FortiMail in Server Mode, how does the appliance handle incoming mail?

Accepted Answer

It accepts mail directly for local mailboxes and provides access via POP3/IMAP.. In Server Mode, FortiMail acts as the actual mail server (providing POP3/IMAP/Webmail services), so it receives mail directly for local domains.

Answer

It only filters outgoing mail.

Answer

It relays all mail to an internal backend mail server.

Answer

It inspects traffic in-line without terminating the connection.

Question 12

What is the primary function of the FortiMail 'Quarantine' feature?

Accepted Answer

To hold emails identified as spam or viruses for review.. The quarantine stores suspicious emails that have been flagged by filters, allowing administrators or users to review them rather than automatically deleting them.

Answer

To provide long-term email archiving.

Answer

To compress outgoing attachments.

Answer

To bypass SMTP authentication.

Question 13

You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?

Accepted Answer

DLP dictionary. Dictionary-based scanning allows for the definition of patterns (using regex or built-in types) to match sensitive data like credit card numbers.

Answer

Access Control Rule

Answer

Content profile

Answer

Antivirus policy

Question 14

An administrator needs to enforce DMARC 'reject' policy for incoming mail. Where is this enforced in FortiMail?

Accepted Answer

AntiSpam profile. DMARC settings are managed within the 'AntiSpam' profile under 'Domain settings' or specific DMARC control configurations.

Answer

Access Control rules

Answer

Antivirus policy

Answer

Routing policy

Question 15

Which feature allows FortiMail to perform automatic cleanup of old messages in the quarantine?

Accepted Answer

Quarantine maintenance. The Quarantine maintenance settings allow for the automatic purging of messages after a set number of days to conserve disk space.

Answer

Policy-based expiration

Answer

Daily report schedule

Answer

Storage quota limit

Answer

Email Archiving

Question 16

In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?

Accepted Answer

Reject the email at the SMTP level.. By default, FortiMail acts as a relay. If it doesn't recognize the recipient, it may reject the connection or try to relay it based on relay policies.

Answer

Accept the email and store it in a general box.

Answer

Forward the email to the administrator.

Answer

Queue the email for 24 hours.

Question 17

Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?

Accepted Answer

TXT record containing the public key. DKIM uses a public key published in a DNS TXT record so that receiving servers can verify the signature added to the email header.

Answer

PTR record

Answer

A record

Answer

MX record

Question 18

Which THREE items are checked by the AntiSpam profile during email processing?

Accepted Answer

SPF validation. AntiSpam profiles utilize various techniques including RBLs, SPF/DKIM validation, and heuristics.

Answer

TLS certificate validation

Answer

Attachment file size

Question 19

Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?

Accepted Answer

LDAP. FortiMail supports internal authentication and external services like LDAP or RADIUS.

Answer

Syslog

Answer

SNMP

Answer

ICMP

Question 20

Which THREE actions can be taken by a DLP filter when a match is found?

Accepted Answer

Encrypt. DLP filters can be configured to log, quarantine, or block/reject messages based on the rule.

Answer

Modify sender

Answer

Route to another interface