FORTINET-NSE56 Nse6 Fortimail Secure Email Gateway Practice Test 3 — 15 Questions

Question 1

Which THREE items are checked by the AntiSpam profile during email processing?

Accepted Answer

SPF validation. The AntiSpam profile in email security gateways evaluates sender authenticity and reputation at the SMTP/header level, so SPF validation (A) is checked because the profile verifies whether the sending MTA's IP is authorized by the domain's SPF record to detect spoofing. Sender reputation via RBL (C) is also checked, as the profile queries real-time blocklists (DNSBL/RBL) against the connecting IP to reject known spam sources. DKIM verification (E) is included because the profile validates the cryptographic signature in the DKIM-Signature header to confirm message integrity and domain authentication. TLS certificate validation (B) belongs to transport-layer encryption handling, not spam scoring, and attachment file size (D) is enforced by content/size filtering policies rather than the AntiSpam profile.

Answer

TLS certificate validation

Answer

Attachment file size

Question 2

Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?

Accepted Answer

LDAP. Option B (LDAP) is correct because FortiMail can query an external LDAP directory (for example Active Directory or OpenLDAP) to authenticate users who log in to the quarantine portal, allowing centralized credential verification. Option E (Local user database) is correct because FortiMail also supports authenticating quarantine portal users against its own locally defined user accounts when no external server is used. Options A (Syslog), C (SNMP), and D (ICMP) are incorrect because they are logging, monitoring/management, and network diagnostic protocols respectively, and none of them provide user authentication for portal access.

Answer

Syslog

Answer

SNMP

Answer

ICMP

Question 3

Which TWO of the following are components of the FortiMail AntiSpam framework?

Accepted Answer

Heuristic scanning. D. Heuristic scanning is correct because FortiMail's AntiSpam framework includes heuristic rules that detect spam based on suspicious patterns and characteristics in message content and headers, catching new or evolving spam that signature-based filters miss. E. Bayesian analysis is correct because FortiMail uses statistical Bayesian filtering, which learns from previously classified spam and legitimate (ham) messages to calculate the probability that a new message is spam, forming a core part of the antispam detection engine. The other options do not belong: A. Traffic shaping is a bandwidth/QoS mechanism, not an antispam detection component; B. IPsec VPN is a site-to-site or client tunneling protocol for secure transport, unrelated to spam classification; and C. Antivirus quarantine is part of the antivirus/malware handling workflow, not the antispam framework itself.

Answer

Traffic shaping

Answer

IPsec VPN

Answer

Antivirus quarantine

Question 4

Which TWO features in FortiMail help prevent email spoofing?

Accepted Answer

DKIM. DKIM (D) is correct because it cryptographically signs outbound messages with a private key and lets receiving servers verify the signature against a published public key in DNS, so a spoofed sender cannot produce a valid signature and the message fails authentication. SPF (E) is correct because it publishes a DNS TXT record listing the authorized sending hosts for a domain, allowing the receiving FortiMail to check the envelope sender's connecting IP and reject or flag mail from unauthorized servers. Both are standard email authentication mechanisms FortiMail uses in its antispam and sender-verification policies to detect forged sender addresses. Syslog (A) is only a logging/event transport and does not authenticate senders, Antivirus (B) scans message content for malware rather than verifying sender identity, and POP3 (C) is a mailbox retrieval protocol with no role in preventing spoofing.

Answer

Syslog

Answer

Antivirus

Answer

POP3

Question 5

Which THREE settings are required for successful DKIM signing on outgoing mail?

Accepted Answer

Domain definition. DKIM signing requires a domain definition (B) because the signing identity is tied to the sending domain (the d= tag in the DKIM-Signature header), so the mail system must know which domain it is signing for. Private key generation (C) is required because the domain owner generates a private key used to cryptographically sign the message hash, while the matching public key is published in DNS. A selector name (D) is also required because the selector (the s= tag) identifies which public key record to look up at ._domainkey., allowing multiple keys per domain. A user password (A) is not a DKIM signing requirement, since DKIM relies on key pairs rather than user credentials, and SMTP port 25 configuration (E) is unrelated to DKIM signing itself, as signing occurs independently of the transport port used for delivery.

Answer

User password

Answer

SMTP port 25 configuration

Question 6

Which TWO actions occur during the FortiMail inspection process before an email is delivered?

Accepted Answer

AntiSpam filtering. During FortiMail's inbound inspection pipeline, the email is first subjected to AntiSpam filtering (C), where reputation checks, RBL lookups, heuristics, and Bayesian/rule-based scoring determine whether the message is spam before it is allowed to proceed. The message then undergoes Antivirus scanning (E), which uses FortiGuard AV signatures and heuristic engines to detect malware in the body and attachments; both actions happen in the pre-delivery inspection phase. DNS query caching (A) is a performance/resolver function, not an inspection action applied to the email itself. User login authentication (B) applies to accessing FortiMail's webmail or admin GUI, not to the SMTP message inspection flow. Email compression (D) is not a FortiMail inspection step; messages are not compressed as part of the scanning process.

Answer

DNS query caching

Answer

User login authentication

Answer

Email compression

Question 7

What is the primary benefit of deploying FortiMail in a cluster?

Accepted Answer

To provide high availability and fault tolerance.. Deploying FortiMail in a cluster (HA) provides high availability and fault tolerance: if one unit fails, another takes over seamlessly, ensuring mail flow and spam/virus scanning continue without interruption. This is the primary design goal of FortiMail HA, which supports active-passive and config-sync modes.

Answer

To bypass the need for a mail server.

Answer

To reduce the cost of licensing.

Answer

To increase the number of physical ports.

Question 8

When configuring a Recipient Policy, what does the 'Action' field determine?

Accepted Answer

Whether the email is allowed, blocked, or quarantined.. In FortiMail Recipient Policies, the 'Action' field determines the disposition of the email for that recipient — whether it is allowed (relayed/delivered), blocked (rejected), or quarantined. This is the core decision point that controls how the message is handled after all other policy criteria (sender, recipient, IP, etc.) are matched.

Answer

The language of the notification.

Answer

The storage location of the email.

Answer

The encryption algorithm used.

Question 9

An administrator wants to ensure that all outgoing emails are archived to a secondary server. Where is this configured?

Accepted Answer

Archiving policy. In FortiMail, archiving policies are specifically designed to capture and store email messages to a secondary server for compliance, eDiscovery, or backup purposes. The archiving policy defines the direction (incoming/outgoing), the matching criteria (sender, recipient, etc.), and the archive server destination. This is the only option that directly provides email archiving functionality.

Answer

Access Control rule

Answer

AntiSpam profile

Answer

Routing policy

Question 10

Which protocol is used for communication between the FortiMail and a remote LDAP server for user authentication?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the protocol used to query directory services such as Active Directory or OpenLDAP for user authentication and attribute lookup. FortiMail connects to a remote LDAP server over TCP port 389 (or 636 for LDAPS) to validate recipient addresses and authenticate users. The other protocols listed serve entirely different purposes in the mail flow.

Answer

SMTP

Answer

POP3

Answer

SNMP

Question 11

What is the purpose of the 'Session Limit' setting in an Access Control Rule?

Accepted Answer

To prevent DoS attacks by restricting concurrent connections.. The Session Limit setting in an Access Control Rule caps the number of concurrent sessions (connections) that match the rule, per source or overall depending on configuration. By restricting concurrent connections, it prevents a single host or botnet from exhausting firewall or server resources, which is a classic DoS mitigation. This is a resource-protection control, not a user-count or storage control.

Answer

To limit the number of users.

Answer

To control the speed of virus scanning.

Answer

To limit the total email storage space.

Question 12

Which interface mode is best suited for high-availability setups where you need to minimize configuration changes on existing infrastructure?

Accepted Answer

Transparent mode. Transparent mode allows a FortiMail (or FortiGate) device to be inserted into an existing network without changing IP addressing or routing on surrounding devices. The device operates as a Layer 2 bridge, inspecting traffic inline while keeping the same subnet and gateway configuration. This minimizes configuration changes on existing infrastructure, making it ideal for high-availability deployments where you want to add security without re-architecting the network.

Answer

NAT mode

Answer

Gateway mode

Answer

Server mode

Question 13

When an email is encrypted using FortiMail's Identity-Based Encryption (IBE), what does the recipient receive?

Accepted Answer

A notification email with a link to the secure portal.. With FortiMail Identity-Based Encryption (IBE), the recipient does not need a pre-shared key or certificate. Instead, they receive a notification email containing a link to a secure web portal where they authenticate (often via a one-time password or identity verification) to read and reply to the encrypted message. The message itself is stored on the FortiMail secure portal.

Answer

The email is blocked.

Answer

A password protected PDF file.

Answer

The encrypted message attached to the email.

Question 14

What is the primary difference between a Gateway and a Server mode deployment?

Accepted Answer

Gateway mode relays to backend servers.. In Fortinet's email security deployments, Gateway mode acts as a relay or SMTP proxy that receives email and forwards it to backend mail servers (e.g., Exchange) after scanning. Server mode, by contrast, stores mailboxes locally and provides final delivery. The primary difference is therefore that Gateway mode relays to backend servers, while Server mode is the final destination.

Answer

Gateway mode provides storage.

Answer

Gateway mode supports LDAP.

Answer

Gateway mode ignores AntiSpam.

Question 15

You notice that the FortiMail system time is incorrect, causing issues with SSL/TLS certificate validation. How do you correct this?

Accepted Answer

Configure an NTP server.. Incorrect system time on FortiMail breaks SSL/TLS certificate validation because certificates have validity windows and the TLS handshake checks the current time against 'notBefore' and 'notAfter'. The correct fix is to configure an NTP server so FortiMail synchronizes its clock accurately and continuously.

Answer

Disable SSL certificate validation.

Answer

Restart the system clock service.

Answer

Manually update via the CLI.