FORTINET-NSE56 Nse6 Fortimail Secure Email Gateway Practice Test 2 — 15 Questions

Question 1

An administrator at a company using FortiMail in Gateway mode notices that outbound messages from the internal mail server are being rejected with an SMTP 550 error stating the sender domain is not authorized. The internal mail server is configured to send all outbound mail through the FortiMail unit, but the FortiMail is performing an outbound recipient verification against the sender's domain. What should the administrator do to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the outbound session profile to allow the sender domain by adding it to the 'Sender Domain Check' exception list or disable the check for the internal mail server's IP.. The 550 error indicates FortiMail's outbound sender domain authorization is blocking the internal mail server because its domain is not recognized as authorized for that IP. The correct fix is to add the sender domain to the exception list or disable the check for the internal mail server's IP in the outbound session profile. This allows legitimate outbound mail while still protecting against spoofing from other sources.

Answer

Disable the 'Sender Domain Check' in the session profile used for outbound mail.

Answer

Enable 'SMTP Authentication' on the FortiMail for the internal mail server and configure the mail server to authenticate before sending.

Answer

Add the internal mail server's IP address to the trusted MTA list in the outbound session profile and enable 'Bypass' for sender domain authorization.

Question 2

A FortiMail administrator is configuring a new inbound recipient policy to handle email for a domain that has multiple subdomains. The administrator wants to ensure that emails sent to any subdomain are subject to the same antispam and antivirus policies as the parent domain. The administrator plans to use a wildcard pattern in the recipient policy. Which two statements about wildcard patterns in FortiMail recipient policies are correct? (Choose two.)

Accepted Answer

The wildcard character '*' can be used in the local part of the email address to match any recipient name.. In FortiMail recipient policies, the asterisk wildcard is supported in the local part of the email address, allowing patterns like '*@domain.com' to match any recipient at that domain. However, wildcards are not supported in the domain portion, so matching subdomains requires separate policies or regex patterns. Understanding these limitations is essential for designing effective recipient policies that cover multiple subdomains without missing messages.

Answer

A wildcard pattern such as '*@*.domain.com' will match recipients in any subdomain of domain.com.

Answer

Wildcard patterns in recipient policies are case-sensitive and must match the exact case of the email address.

Answer

A wildcard pattern can be used to match all recipients in a domain and its subdomains by using the format '*@domain.com'.

Question 3

A security analyst is investigating a spike in spam messages that are bypassing FortiMail's antispam filters. The analyst notices that the spam messages are arriving via SMTP but are not being scanned by the antispam profile. The FortiMail is deployed in Gateway mode, and the analyst confirms that the antispam profile is applied to the inbound recipient policy. Which FortiMail feature should the analyst check to ensure that SMTP connections from specific IP addresses are not being exempted from antispam scanning?

Accepted Answer

The 'Bypass' options in the session profile applied to the inbound SMTP connection.. FortiMail session profiles contain bypass options that can exempt connections from antispam, antivirus, and other scans. If spam is bypassing antispam filters, the analyst should verify whether the session profile applied to the inbound SMTP connection has antispam bypass enabled for certain IP addresses. This is the most direct way to ensure that SMTP connections are not being exempted from scanning.

Answer

The 'Trusted IPs' list under the antispam profile settings.

Answer

The 'Antispam Exemption' list under the global antispam settings.

Answer

The 'SMTP Access Control' rules that allow connections from certain IPs without scanning.

Question 4

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Accepted Answer

SPF validation. SPF (Sender Policy Framework) validation is the correct answer because it specifically checks the DNS TXT record of the sending domain to verify that the sending mail server's IP address is authorized to send email on behalf of that domain. The SPF record, published as a DNS TXT record, lists the authorized sending hosts. When an email is received, the receiving server queries the DNS TXT record for the envelope sender's domain and compares the connecting IP against the list. This directly prevents email spoofing by rejecting messages from unauthorized servers.

Answer

DKIM verification

Answer

DMARC policy

Answer

Sender Reputation

Question 5

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

Accepted Answer

In the public DNS records for the domain.. The public key for DKIM must be published in the public DNS records for the sending domain, typically as a TXT record at a selector-based name like selector._domainkey.example.com. Receiving MTAs query DNS to retrieve the public key and validate the DKIM signature. Without DNS publication, validation fails.

Answer

On the SMTP server of the recipient's domain.

Answer

In the FortiMail's relay host configuration.

Answer

On the FortiMail server's local certificate store.

Question 6

You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?

Accepted Answer

Configure the Bridge pair under Network > Interface.. In FortiMail Transparent mode, the mandatory step is to configure a Bridge pair under Network > Interface. The bridge pair binds two interfaces together so FortiMail can inspect email traffic inline without altering IP headers, effectively acting as a Layer 2 bridge. This is the defining configuration for Transparent mode operation.

Answer

Configure the Bridge pair and disable IP forwarding.

Answer

Configure static IP routing on the management interface.

Answer

Assign a virtual IP to the WAN interface.

Question 7

Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?

Accepted Answer

Delete the message.. Option C (Delete the message) is correct because FortiMail's global quarantine management interface allows administrators to permanently remove quarantined items, purging them from the quarantine database so they are never delivered. Option E (Release the message to the intended recipient) is correct because the quarantine's core function is to hold suspicious mail for review, and administrators can release a message, which forwards it to the original recipient's mailbox as if it had been delivered normally. Options A, B, and D are incorrect because the global quarantine does not provide editing of envelope or header data such as the sender's IP address or the recipient's email address, nor does it re-encrypt the message body; those actions would require modifying the message itself, which quarantine management does not support.

Answer

Modify the sender's IP address.

Answer

Re-encrypt the message body.

Answer

Change the recipient's email address.

Question 8

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

Accepted Answer

You must configure a bridge pair of interfaces to pass traffic transparently.. FortiMail Transparent Mode requires a bridge pair — two interfaces bridged together so FortiMail sits inline between the mail server and the network without changing IP addressing. Traffic passes through the bridge, and FortiMail inspects SMTP transparently. This bridge pair is the mandatory network configuration for transparent deployment.

Answer

The mail server must point to the FortiMail IP as its default gateway.

Answer

The FortiMail must be configured with a unique IP address for each physical port for routing.

Answer

The FortiMail must be configured as a mail relay agent.

Question 9

When using FortiMail in Server Mode, how does the appliance handle incoming mail?

Accepted Answer

It accepts mail directly for local mailboxes and provides access via POP3/IMAP.. In Server Mode, FortiMail acts as the final destination mail server (MTA/MDA) for one or more protected domains, accepting inbound SMTP connections directly and delivering messages into local mailboxes. Users then retrieve their mail using POP3, IMAP, or webmail (FortiMail's built-in web interface). This contrasts with Gateway Mode, where FortiMail sits in front of an existing backend mail server and relays filtered mail to it.

Answer

It only filters outgoing mail.

Answer

It relays all mail to an internal backend mail server.

Answer

It inspects traffic in-line without terminating the connection.

Question 10

What is the primary function of the FortiMail 'Quarantine' feature?

Accepted Answer

To hold emails identified as spam or viruses for review.. FortiMail's Quarantine feature holds messages flagged as spam, virus-infected, or otherwise suspicious so they are not delivered to end users' inboxes but remain available for review, release, or deletion. It acts as a safety net that prevents false positives from being permanently lost while blocking threats.

Answer

To provide long-term email archiving.

Answer

To compress outgoing attachments.

Answer

To bypass SMTP authentication.

Question 11

You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?

Accepted Answer

DLP dictionary. A DLP dictionary defines the patterns (such as regular expressions or predefined patterns for credit card numbers, SSNs, etc.) that the DLP engine uses to identify sensitive data. To block emails containing credit card numbers, you must configure a DLP dictionary with the appropriate pattern (e.g., a regex for 16-digit numbers with Luhn check) and then reference it in a DLP profile or content profile.

Answer

Access Control Rule

Answer

Content profile

Answer

Antivirus policy

Question 12

An administrator needs to enforce DMARC 'reject' policy for incoming mail. Where is this enforced in FortiMail?

Accepted Answer

AntiSpam profile. DMARC policy enforcement in FortiMail is handled by the AntiSpam profile, which includes the DMARC check and the action to take (e.g., reject) when a message fails DMARC alignment. The profile's DMARC settings allow the administrator to specify the policy for messages that fail DMARC, including the 'reject' action. This is where the DMARC policy is applied to incoming mail, not in access control, antivirus, or routing policies.

Answer

Access Control rules

Answer

Antivirus policy

Answer

Routing policy

Question 13

Which feature allows FortiMail to perform automatic cleanup of old messages in the quarantine?

Accepted Answer

Quarantine maintenance. FortiMail's Quarantine maintenance feature (configured under System > Maintenance or via the quarantine settings) automates the cleanup of old messages in the quarantine by defining retention periods and scheduled deletion. It is the built-in mechanism specifically designed to prevent quarantine storage from growing unbounded. Administrators configure it to purge messages older than a specified age on a recurring schedule.

Answer

Policy-based expiration

Answer

Daily report schedule

Answer

Storage quota limit

Answer

Email Archiving

Question 14

In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?

Accepted Answer

Reject the email at the SMTP level.. In Gateway mode, FortiMail acts as an SMTP gateway and by default rejects email for unknown recipients at the SMTP level with a 550 error. This prevents backscatter and reduces load from spam directed at non-existent addresses. The behavior is controlled by the 'unknown recipient' policy, which defaults to reject.

Answer

Accept the email and store it in a general box.

Answer

Forward the email to the administrator.

Answer

Queue the email for 24 hours.

Question 15

Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?

Accepted Answer

TXT record containing the public key. DKIM (DomainKeys Identified Mail) uses a public key published as a TXT record in DNS, typically at a selector._domainkey.domain.com. The receiving server uses this public key to verify the signature added to outgoing emails. This ensures authenticity and integrity.

Answer

PTR record

Answer

A record

Answer

MX record