FORTINET-NSE56 Nse6 Fortimail Secure Email Gateway — 30 Questions

Question 1

When configuring DMARC on FortiMail, which THREE components are required to successfully implement a 'reject' policy?

Accepted Answer

A valid DKIM public key in DNS.. Option E is correct because a DMARC TXT record published in the domain's DNS (e.g., v=DMARC1; p=reject; ...) is the foundational requirement that defines the policy and tells receivers to reject failing mail. Option D is correct because DMARC alignment relies on SPF authentication, so a valid SPF record in DNS must exist for the domain to pass SPF checks and align with the From header. Option A is correct because DKIM authentication also feeds DMARC alignment, requiring a valid DKIM public key published in DNS so receivers can verify the signature. Option B is not required because DMARC enforcement is handled by the DMARC/SPF/DKIM mechanisms, not by a custom FortiMail antispam filter. Option C is not required because LDAP user authentication is unrelated to DMARC policy evaluation and enforcement.

Answer

A custom antispam filter for all emails.

Answer

An LDAP server for user authentication.

Question 2

A customer is experiencing false positives with the FortiMail Antispam engine. Which feature should be configured to allow trusted sender domains while still performing virus scanning?

Accepted Answer

Create an Access Control List (ACL) policy with the 'Bypass antispam' action.. An Access Control List (ACL) policy with the 'Bypass antispam' action allows specific senders or domains to skip antispam processing while still undergoing virus scanning. This is the correct way to whitelist trusted sender domains without disabling antispam globally or affecting other recipients. The ACL policy is evaluated before antispam, so it can selectively bypass the antispam engine for trusted sources.

Answer

Disable the Antispam engine globally.

Answer

Add the sender to the Global Whitelist in the Antispam Profile.

Answer

Modify the recipient's personal whitelist.

Question 3

A user reports that legitimate emails are being quarantined due to a high spam score. You want to add the sender's email address to a whitelist. Where should this be configured to be effective for the specific user?

Accepted Answer

Personal Safe List in the quarantine portal. The Personal Safe List in the quarantine portal is the correct place because it is user-specific and directly affects how that individual's quarantined messages are scored and released. When a user adds a sender to their personal safe list, FortiGate/FortiMail exempts that sender from spam scoring for that recipient only, resolving the false positive without impacting other users. This is the granular, per-user override mechanism designed exactly for this scenario.

Answer

AntiSpam profile block list

Answer

Recipient policy whitelist

Answer

System global whitelist

Question 4

Which TWO of the following are valid options for FortiMail deployment?

Accepted Answer

Gateway mode. Gateway mode (A) is a valid FortiMail deployment option because FortiMail can be placed at the network perimeter to relay and scan all inbound and outbound SMTP mail before it reaches internal mail servers. Transparent mode (E) is also valid because FortiMail can operate as a Layer 2 bridge inline with the mail flow, inspecting SMTP traffic without changing IP addressing. Proxy mode (B) is not a FortiMail deployment mode; FortiMail's modes are gateway, transparent, and server (and its built-in MTA functions), so proxy is not the correct terminology here. NAT mode (C) is a FortiGate interface/operation mode, not a FortiMail deployment option. Endpoint mode (D) is not a FortiMail deployment mode; endpoint protection is associated with FortiClient, not FortiMail.

Answer

Proxy mode

Answer

NAT mode

Answer

Endpoint mode

Question 5

Which THREE actions can be taken by a DLP filter when a match is found?

Accepted Answer

Encrypt. In a DLP (Data Loss Prevention) filter, when a match is found, the filter can take several enforcement actions on the message or data. Option B (Encrypt) is correct because DLP can automatically encrypt the matched content or message to protect sensitive data before it leaves the organization. Option D (Delete) is correct because DLP can delete the message or the matched content entirely to prevent data leakage. Option E (Quarantine) is correct because DLP can quarantine the message, holding it for review or blocking delivery until an administrator releases it. Option A (Modify sender) is not a standard DLP filter action, as DLP typically does not alter the sender address. Option C (Route to another interface) is also not a standard DLP action; routing is a network function, not a DLP enforcement action.

Answer

Modify sender

Answer

Route to another interface

Question 6

Which TWO types of logs can be generated by FortiMail?

Accepted Answer

AntiSpam logs. FortiMail generates AntiSpam logs (C) because its core function is antispam and anti-malware filtering, and each message processed by the antispam engine produces log entries recording the spam verdict, score, and action taken. FortiMail also generates Event logs (E), which record system-level and administrative activity such as configuration changes, admin logins, HA events, and mail queue operations. These two log categories are part of FortiMail's standard logging options, alongside others like History, System, and Mail logs. User profile logs (A) are not a FortiMail log type; user profiles are configuration objects, not log categories. Packet capture files (B) are diagnostic outputs produced by packet sniffer tools, not a log type generated by FortiMail. Hardware logs (D) are not a FortiMail log category; hardware monitoring is handled through system event logging rather than a dedicated hardware log type.

Answer

User profile logs

Answer

Packet capture files

Answer

Hardware logs

Question 7

Which THREE factors are used by the FortiMail sender reputation service to evaluate an IP address?

Accepted Answer

Recent spam volume. FortiMail's sender reputation service evaluates an IP address using several behavioral and infrastructure factors. Option A (Recent spam volume) is correct because the service tracks how much spam has recently originated from that IP, which directly lowers its reputation score. Option B (DNS PTR record existence) is correct because a valid reverse DNS (PTR) record indicates the sending IP is properly configured and legitimate, improving its reputation. Option E (Connection frequency) is correct because the service monitors how often the IP connects to the FortiMail unit; unusually high or bursty connection rates suggest spam or botnet activity and degrade reputation. Option C (Email body content) is not used for IP reputation—content is analyzed separately by antispam content filters, not by the sender reputation engine. Option D (TLS version) is not a reputation factor; TLS is a transport encryption attribute handled by TLS policy, not by sender reputation scoring.

Answer

Email body content

Answer

TLS version

Question 8

Where do you configure the global whitelist to ensure specific email addresses are never blocked by AntiSpam?

Accepted Answer

AntiSpam profile. The global whitelist for ensuring specific email addresses are never blocked by AntiSpam is configured in the AntiSpam profile. FortiMail's AntiSpam profiles include a whitelist section where administrators can add trusted sender addresses or domains that bypass spam scanning. This is the correct location for global whitelist configuration.

Answer

Access Control rules

Answer

System network settings

Answer

Mail Server settings

Question 9

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Accepted Answer

diagnose sniffer packet any 'port 25' 4. The 'diagnose sniffer packet any "port 25" 4' command captures live packets on all interfaces matching TCP port 25 (SMTP) with verbose level 4, which includes interface names and packet payload — ideal for real-time SMTP troubleshooting. Verbose level 4 shows the interface, source/destination, and hex/ASCII payload, letting you inspect the SMTP dialogue (EHLO, MAIL FROM, RCPT TO, DATA) as it happens. This is the standard FortiMail CLI tool for live packet inspection.

Answer

show log traffic

Answer

execute telnet

Answer

get system status

Question 10

When configuring an Antivirus profile, which option is best to handle password-protected ZIP files?

Accepted Answer

Block or quarantine.. Password-protected ZIP files cannot be scanned for malware because the antivirus engine cannot decrypt them without the password. The safest action is to block or quarantine such files so they can be inspected manually or released by an administrator, preventing malware from bypassing inspection. FortiMail's antivirus profile provides this option specifically for encrypted archives.

Answer

Force decryption.

Answer

Allow all.

Answer

Always ignore.

Question 11

Which feature allows the FortiMail to verify the sender's domain using a DNS record?

Accepted Answer

SPF.. SPF (Sender Policy Framework) is the standard method for verifying the sender domain via DNS.

Answer

DMARC.

Answer

DKIM.

Answer

RBL.

Question 12

An administrator sees a large volume of '451 4.7.1' errors in the logs. What does this indicate?

Accepted Answer

The sender is being greylisted.. The SMTP reply code 451 4.7.1 is a transient (4xx) error indicating the message was temporarily rejected, typically because the sending server is being greylisted by the recipient's anti-spam system. Greylisting works by initially rejecting unknown senders with a temporary failure, expecting legitimate mail servers to retry after a delay while spam bots give up. The '4.7.1' enhanced status code specifically means 'delivery not authorized, message refused' in a temporary context.

Answer

The recipient domain is invalid.

Answer

The email has a virus.

Answer

The server is down.

Question 13

Which THREE items are included in a standard email header for DMARC validation?

Accepted Answer

DKIM signature. A DKIM signature is included in the header as the DKIM-Signature field, which carries the cryptographic signature and tags (such as d=, s=, and b=) that DMARC uses to verify the message's authenticity and domain alignment. The SPF result is conveyed in the Received-SPF or Authentication-Results header, added by the receiving MTA after checking the envelope sender against the sending IP, and DMARC relies on this result for its alignment evaluation. The From domain appears in the visible From: header field, and DMARC specifically requires that this RFC5322.From domain align with the domain authenticated by SPF or DKIM, making it a core element of DMARC validation. By contrast, an attachment name is part of the MIME body structure (Content-Disposition/Content-Type), not the header data used for DMARC, and a user password is never transmitted in a standard email header, so neither participates in DMARC validation.

Answer

Attachment name

Answer

User password

Question 14

Which TWO methods can be used to perform 'Greylisting' in FortiMail?

Accepted Answer

By sender email address. In FortiMail, greylisting is implemented by temporarily rejecting mail from unknown senders so that legitimate SMTP servers retry later, while spammers typically do not. Option B is correct because FortiMail can greylist based on the sender email address, tracking the envelope sender (MAIL FROM) so that a first-time sender is deferred and only accepted after a successful retry. Option C is correct because FortiMail can also greylist based on the sender IP address, deferring connections from previously unseen source IPs until they retry, which is the classic greylisting behavior. Options A, D, and E are not greylisting methods: attachment type and email subject are content-based filtering criteria, and recipient password relates to authentication, none of which define the deferral-and-retry mechanism used by greylisting.

Answer

By attachment type

Answer

By recipient password

Answer

By email subject

Question 15

What should you do to ensure that an encrypted email sent via IBE reaches the recipient correctly?

Accepted Answer

Configure the IBE settings and verify internet connectivity.. Identity-Based Encryption (IBE) in FortiMail requires the IBE service to be properly configured (certificate, key server, and domain settings) before encrypted mail can be decrypted by recipients. Verifying internet connectivity ensures the recipient can reach the IBE portal or key service to retrieve their decryption credentials. Without both, the encrypted message cannot be delivered or opened correctly.

Answer

Disable antivirus.

Answer

Increase the disk space.

Answer

Remove the sender from the whitelist.

Question 16

An administrator at a company using FortiMail in Gateway mode notices that outbound messages from the internal mail server are being rejected with an SMTP 550 error stating the sender domain is not authorized. The internal mail server is configured to send all outbound mail through the FortiMail unit, but the FortiMail is performing an outbound recipient verification against the sender's domain. What should the administrator do to resolve this issue?

Accepted Answer

Configure the outbound session profile to allow the sender domain by adding it to the 'Sender Domain Check' exception list or disable the check for the internal mail server's IP.. The 550 error indicates FortiMail's outbound sender domain authorization is blocking the internal mail server because its domain is not recognized as authorized for that IP. The correct fix is to add the sender domain to the exception list or disable the check for the internal mail server's IP in the outbound session profile. This allows legitimate outbound mail while still protecting against spoofing from other sources.

Answer

Disable the 'Sender Domain Check' in the session profile used for outbound mail.

Answer

Enable 'SMTP Authentication' on the FortiMail for the internal mail server and configure the mail server to authenticate before sending.

Answer

Add the internal mail server's IP address to the trusted MTA list in the outbound session profile and enable 'Bypass' for sender domain authorization.

Question 17

A FortiMail administrator is configuring a new inbound recipient policy to handle email for a domain that has multiple subdomains. The administrator wants to ensure that emails sent to any subdomain are subject to the same antispam and antivirus policies as the parent domain. The administrator plans to use a wildcard pattern in the recipient policy. Which two statements about wildcard patterns in FortiMail recipient policies are correct? (Choose two.)

Accepted Answer

The wildcard character '*' can be used in the local part of the email address to match any recipient name.. In FortiMail recipient policies, the asterisk wildcard is supported in the local part of the email address, allowing patterns like '*@domain.com' to match any recipient at that domain. However, wildcards are not supported in the domain portion, so matching subdomains requires separate policies or regex patterns. Understanding these limitations is essential for designing effective recipient policies that cover multiple subdomains without missing messages.

Answer

A wildcard pattern such as '*@*.domain.com' will match recipients in any subdomain of domain.com.

Answer

Wildcard patterns in recipient policies are case-sensitive and must match the exact case of the email address.

Answer

A wildcard pattern can be used to match all recipients in a domain and its subdomains by using the format '*@domain.com'.

Question 18

A security analyst is investigating a spike in spam messages that are bypassing FortiMail's antispam filters. The analyst notices that the spam messages are arriving via SMTP but are not being scanned by the antispam profile. The FortiMail is deployed in Gateway mode, and the analyst confirms that the antispam profile is applied to the inbound recipient policy. Which FortiMail feature should the analyst check to ensure that SMTP connections from specific IP addresses are not being exempted from antispam scanning?

Accepted Answer

The 'Bypass' options in the session profile applied to the inbound SMTP connection.. FortiMail session profiles contain bypass options that can exempt connections from antispam, antivirus, and other scans. If spam is bypassing antispam filters, the analyst should verify whether the session profile applied to the inbound SMTP connection has antispam bypass enabled for certain IP addresses. This is the most direct way to ensure that SMTP connections are not being exempted from scanning.

Answer

The 'Trusted IPs' list under the antispam profile settings.

Answer

The 'Antispam Exemption' list under the global antispam settings.

Answer

The 'SMTP Access Control' rules that allow connections from certain IPs without scanning.

Question 19

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Accepted Answer

SPF validation. SPF (Sender Policy Framework) validation is the correct answer because it specifically checks the DNS TXT record of the sending domain to verify that the sending mail server's IP address is authorized to send email on behalf of that domain. The SPF record, published as a DNS TXT record, lists the authorized sending hosts. When an email is received, the receiving server queries the DNS TXT record for the envelope sender's domain and compares the connecting IP against the list. This directly prevents email spoofing by rejecting messages from unauthorized servers.

Answer

DKIM verification

Answer

DMARC policy

Answer

Sender Reputation

Question 20

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

Accepted Answer

In the public DNS records for the domain.. The public key for DKIM must be published in the public DNS records for the sending domain, typically as a TXT record at a selector-based name like selector._domainkey.example.com. Receiving MTAs query DNS to retrieve the public key and validate the DKIM signature. Without DNS publication, validation fails.

Answer

On the SMTP server of the recipient's domain.

Answer

In the FortiMail's relay host configuration.

Answer

On the FortiMail server's local certificate store.