FORTINET-NSE56 Nse6 Fortimail Secure Email Gateway Practice Test 4 — 15 Questions

Question 1

Which of these is a legitimate reason to place a sender on the 'Block' list in the AntiSpam profile?

Accepted Answer

The sender consistently sends unwanted spam emails.. The Block list in the AntiSpam profile is used to explicitly deny email from senders, domains, or IP addresses that are known to send unwanted spam. A sender who consistently sends spam is the textbook legitimate reason to block them, as this is the intended use of the block list to enforce policy. Blocking is a deliberate administrative action based on observed malicious or unwanted behavior, not on legitimate business relationships or technical configurations.

Answer

The sender's domain has a valid SPF record.

Answer

The sender is a partner company.

Answer

The sender is an internal employee.

Question 2

What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?

Accepted Answer

It allows users to manage their own quarantined emails.. The FortiMail Quarantine portal is a self-service web interface that lets end-users view, release, delete, and manage their own quarantined messages without administrator intervention. This offloads administrative overhead and reduces helpdesk tickets, which is the primary advantage. Options A, B, and D describe incidental or incorrect behaviors rather than the core purpose of the portal.

Answer

It hides spam messages.

Answer

It deletes all mail automatically.

Answer

It provides full system logs.

Question 3

How does FortiMail identify the policy to apply to an incoming email?

Accepted Answer

By the sender IP and recipient domain.. FortiMail evaluates incoming email against access control rules (recipient policies) that match on criteria including sender IP/domain and recipient domain. These are the primary matching attributes used to determine which policy — and thus which antivirus, antispam, and content actions — apply to the message. The policy lookup happens early in the inbound flow, before content inspection.

Answer

By the size of the email.

Answer

By the file type.

Answer

By the subject line.

Question 4

What is the default port for SMTP communication?

Accepted Answer

25. SMTP (Simple Mail Transfer Protocol) uses TCP port 25 by default for message transfer between mail servers. This is defined in RFC 5321 and remains the standard port for SMTP relay and server-to-server communication. Port 25 is the well-known port assigned to SMTP by IANA.

Answer

110

Answer

80

Answer

443

Question 5

In which configuration area are 'Content Profiles' created and modified?

Accepted Answer

Profile settings.. Content Profiles in FortiMail are created and modified under the Profile settings configuration area. This is where administrators define the scanning behavior for content — including banned words, file types, and encryption rules — that can then be applied to access control rules and policies. The Profile settings area is the central repository for all profile-type objects (AntiSpam, AntiVirus, Content, Resource).

Answer

Domain settings.

Answer

System settings.

Answer

Network settings.

Question 6

Which type of scan should be enabled to detect known malware in email attachments?

Accepted Answer

Antivirus scanning.. Antivirus scanning is the scan type that inspects email attachments for known malware by matching file content against virus signatures and heuristic patterns. It is specifically designed to detect and block malicious payloads in attachments.

Answer

Spam scanning.

Answer

Reputation scanning.

Answer

Content scanning.

Question 7

What is the purpose of the 'Relay Host' setting in FortiMail?

Accepted Answer

To define the destination for outgoing mail.. The 'Relay Host' setting in FortiMail specifies the destination server to which outgoing mail is forwarded. It acts as a smart host or relay, directing email to the next-hop MTA for delivery. This is essential when FortiMail is not the final destination and needs to pass mail to an internal or external mail server.

Answer

To handle administrative login.

Answer

To store incoming mail.

Answer

To manage the quarantine.

Question 8

How can you restrict management access to the FortiMail GUI to only specific IP addresses?

Accepted Answer

Use the 'Trusted Host' feature in the administrator profile.. FortiMail administrators can restrict GUI access to specific source IP addresses by configuring the 'Trusted Host' setting in the administrator's profile. This limits login attempts to the defined IPs/subnets, effectively whitelisting management access. It is the built-in mechanism for source-IP-based GUI restriction.

Answer

Change the management port.

Answer

Disable GUI access.

Answer

Configure a firewall policy.

Question 9

Where do you check the current status of the FortiMail services?

Accepted Answer

On the dashboard.. The FortiMail dashboard provides a real-time status view of system services, including mail services (SMTP, IMAP, POP3, webmail), system resources, and service health indicators. Administrators use the dashboard as the first place to confirm whether services are running or stopped. This makes it the correct location for checking current service status.

Answer

In the system report.

Answer

In the quarantine folder.

Answer

In the mail log.

Question 10

Which FortiMail feature helps to prevent 'backscatter' when dealing with spam?

Accepted Answer

Rejecting unknown recipients at the SMTP gateway.. Backscatter occurs when a mail server accepts a message and later generates a bounce (NDR) to a forged sender address, effectively spamming an innocent third party. Rejecting unknown recipients at the SMTP gateway during the session (with a 5xx response) means FortiMail never accepts the message in the first place, so no bounce is ever generated. This is the standard anti-backscatter technique recommended in RFC 5321 and implemented via FortiMail's recipient verification/unknown-recipient rejection.

Answer

Increasing the quarantine size.

Answer

Disabling SPF.

Answer

Sender reputation.

Question 11

Which TWO settings are configurable in a 'Recipient Policy'?

Accepted Answer

Antivirus profile selection. In a FortiMail Recipient Policy, the administrator defines which security profiles are applied to mail matching that policy, so option D (Antivirus profile selection) is correct because the policy can bind an antivirus profile to scan messages for the specified recipients. Option E (AntiSpam profile selection) is likewise correct because the same recipient policy can attach an antispam profile to filter unwanted mail for those recipients. These profile bindings are core to how FortiMail enforces per-recipient content security. By contrast, option A (System admin email) is a global system/administrator notification setting, not a recipient-policy field, and options B (Network interface speed) and C (Hard drive disk space) are hardware/system-level attributes that cannot be configured inside a Recipient Policy.

Answer

System admin email

Answer

Network interface speed

Answer

Hard drive disk space

Question 12

What is the benefit of using 'FortiGuard' services with FortiMail?

Accepted Answer

It provides updated spam and antivirus signatures.. FortiGuard is Fortinet's subscription-based threat intelligence service that continuously pushes updated spam signatures, antivirus definitions, and other security databases to FortiMail. Because email threats evolve constantly, FortiMail relies on FortiGuard to keep its anti-spam and antivirus engines current without manual intervention. This is the core value proposition of the FortiGuard subscription bundled with FortiMail.

Answer

It replaces the need for local policies.

Answer

It provides cloud-based email storage.

Answer

It allows remote management by Fortinet.

Question 13

Which THREE actions are available in the 'DLP' section of a policy?

Accepted Answer

Discard. In the DLP (Data Loss Prevention) section of a policy, the available actions are Discard (A), Log (D), and Quarantine (E). Discard (A) is correct because it blocks the transfer of sensitive data by dropping the file or message entirely. Log (D) is correct because it records the DLP event for auditing and monitoring without necessarily blocking the action. Quarantine (E) is correct because it isolates the sensitive data, often moving it to a secure location for review. Rename file (B) and Create copy (C) are not DLP policy actions; they are file operations that do not enforce data loss prevention.

Answer

Rename file

Answer

Create copy

Question 14

Which TWO of the following protocols does FortiMail support for mail retrieval?

Accepted Answer

POP3. FortiMail supports POP3 (option A) for mail retrieval, allowing clients to download messages from the FortiMail mail store to their local mail client, which is a standard retrieval protocol for receiving email. FortiMail also supports IMAP (option C), which enables clients to access and manage mail on the server without downloading everything locally, and is commonly used for webmail and mobile synchronization. FTP (option B) is a file transfer protocol and is not used for retrieving email messages. HTTP (option D) is used for web browsing and webmail interfaces, not as a mail retrieval protocol in this context. DNS (option E) resolves domain names to IP addresses and does not retrieve mail.

Answer

FTP

Answer

HTTP

Answer

DNS

Question 15

What happens if a message matches multiple policies?

Accepted Answer

The first matching policy is applied.. FortiMail processes policies in a top-down, first-match order, similar to firewall policy evaluation. Once a message matches a policy, that policy's action is applied and evaluation stops — subsequent policies are not evaluated. This makes policy ordering critical, since a broad permissive policy placed above a specific restrictive one will shadow the latter.

Answer

The system throws an error.

Answer

All matching policies are applied.

Answer

The most restrictive action is taken.