FORTINET-NSE56 Nse6 Fortimail Secure Email Gateway — Timed 15 Questions

Question 1

When configuring DMARC on FortiMail, which THREE components are required to successfully implement a 'reject' policy?

Accepted Answer

A valid DKIM public key in DNS.. Option E is correct because a DMARC TXT record published in the domain's DNS (e.g., v=DMARC1; p=reject; ...) is the foundational requirement that defines the policy and tells receivers to reject failing mail. Option D is correct because DMARC alignment relies on SPF authentication, so a valid SPF record in DNS must exist for the domain to pass SPF checks and align with the From header. Option A is correct because DKIM authentication also feeds DMARC alignment, requiring a valid DKIM public key published in DNS so receivers can verify the signature. Option B is not required because DMARC enforcement is handled by the DMARC/SPF/DKIM mechanisms, not by a custom FortiMail antispam filter. Option C is not required because LDAP user authentication is unrelated to DMARC policy evaluation and enforcement.

Answer

A custom antispam filter for all emails.

Answer

An LDAP server for user authentication.

Question 2

A customer is experiencing false positives with the FortiMail Antispam engine. Which feature should be configured to allow trusted sender domains while still performing virus scanning?

Accepted Answer

Create an Access Control List (ACL) policy with the 'Bypass antispam' action.. An Access Control List (ACL) policy with the 'Bypass antispam' action allows specific senders or domains to skip antispam processing while still undergoing virus scanning. This is the correct way to whitelist trusted sender domains without disabling antispam globally or affecting other recipients. The ACL policy is evaluated before antispam, so it can selectively bypass the antispam engine for trusted sources.

Answer

Disable the Antispam engine globally.

Answer

Add the sender to the Global Whitelist in the Antispam Profile.

Answer

Modify the recipient's personal whitelist.

Question 3

A user reports that legitimate emails are being quarantined due to a high spam score. You want to add the sender's email address to a whitelist. Where should this be configured to be effective for the specific user?

Accepted Answer

Personal Safe List in the quarantine portal. The Personal Safe List in the quarantine portal is the correct place because it is user-specific and directly affects how that individual's quarantined messages are scored and released. When a user adds a sender to their personal safe list, FortiGate/FortiMail exempts that sender from spam scoring for that recipient only, resolving the false positive without impacting other users. This is the granular, per-user override mechanism designed exactly for this scenario.

Answer

AntiSpam profile block list

Answer

Recipient policy whitelist

Answer

System global whitelist

Question 4

Which TWO of the following are valid options for FortiMail deployment?

Accepted Answer

Gateway mode. Gateway mode (A) is a valid FortiMail deployment option because FortiMail can be placed at the network perimeter to relay and scan all inbound and outbound SMTP mail before it reaches internal mail servers. Transparent mode (E) is also valid because FortiMail can operate as a Layer 2 bridge inline with the mail flow, inspecting SMTP traffic without changing IP addressing. Proxy mode (B) is not a FortiMail deployment mode; FortiMail's modes are gateway, transparent, and server (and its built-in MTA functions), so proxy is not the correct terminology here. NAT mode (C) is a FortiGate interface/operation mode, not a FortiMail deployment option. Endpoint mode (D) is not a FortiMail deployment mode; endpoint protection is associated with FortiClient, not FortiMail.

Answer

Proxy mode

Answer

NAT mode

Answer

Endpoint mode

Question 5

Which THREE actions can be taken by a DLP filter when a match is found?

Accepted Answer

Encrypt. In a DLP (Data Loss Prevention) filter, when a match is found, the filter can take several enforcement actions on the message or data. Option B (Encrypt) is correct because DLP can automatically encrypt the matched content or message to protect sensitive data before it leaves the organization. Option D (Delete) is correct because DLP can delete the message or the matched content entirely to prevent data leakage. Option E (Quarantine) is correct because DLP can quarantine the message, holding it for review or blocking delivery until an administrator releases it. Option A (Modify sender) is not a standard DLP filter action, as DLP typically does not alter the sender address. Option C (Route to another interface) is also not a standard DLP action; routing is a network function, not a DLP enforcement action.

Answer

Modify sender

Answer

Route to another interface

Question 6

Which TWO types of logs can be generated by FortiMail?

Accepted Answer

AntiSpam logs. FortiMail generates AntiSpam logs (C) because its core function is antispam and anti-malware filtering, and each message processed by the antispam engine produces log entries recording the spam verdict, score, and action taken. FortiMail also generates Event logs (E), which record system-level and administrative activity such as configuration changes, admin logins, HA events, and mail queue operations. These two log categories are part of FortiMail's standard logging options, alongside others like History, System, and Mail logs. User profile logs (A) are not a FortiMail log type; user profiles are configuration objects, not log categories. Packet capture files (B) are diagnostic outputs produced by packet sniffer tools, not a log type generated by FortiMail. Hardware logs (D) are not a FortiMail log category; hardware monitoring is handled through system event logging rather than a dedicated hardware log type.

Answer

User profile logs

Answer

Packet capture files

Answer

Hardware logs

Question 7

Which THREE factors are used by the FortiMail sender reputation service to evaluate an IP address?

Accepted Answer

Recent spam volume. FortiMail's sender reputation service evaluates an IP address using several behavioral and infrastructure factors. Option A (Recent spam volume) is correct because the service tracks how much spam has recently originated from that IP, which directly lowers its reputation score. Option B (DNS PTR record existence) is correct because a valid reverse DNS (PTR) record indicates the sending IP is properly configured and legitimate, improving its reputation. Option E (Connection frequency) is correct because the service monitors how often the IP connects to the FortiMail unit; unusually high or bursty connection rates suggest spam or botnet activity and degrade reputation. Option C (Email body content) is not used for IP reputation—content is analyzed separately by antispam content filters, not by the sender reputation engine. Option D (TLS version) is not a reputation factor; TLS is a transport encryption attribute handled by TLS policy, not by sender reputation scoring.

Answer

Email body content

Answer

TLS version

Question 8

Where do you configure the global whitelist to ensure specific email addresses are never blocked by AntiSpam?

Accepted Answer

AntiSpam profile. The global whitelist for ensuring specific email addresses are never blocked by AntiSpam is configured in the AntiSpam profile. FortiMail's AntiSpam profiles include a whitelist section where administrators can add trusted sender addresses or domains that bypass spam scanning. This is the correct location for global whitelist configuration.

Answer

Access Control rules

Answer

System network settings

Answer

Mail Server settings

Question 9

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Accepted Answer

diagnose sniffer packet any 'port 25' 4. The 'diagnose sniffer packet any "port 25" 4' command captures live packets on all interfaces matching TCP port 25 (SMTP) with verbose level 4, which includes interface names and packet payload — ideal for real-time SMTP troubleshooting. Verbose level 4 shows the interface, source/destination, and hex/ASCII payload, letting you inspect the SMTP dialogue (EHLO, MAIL FROM, RCPT TO, DATA) as it happens. This is the standard FortiMail CLI tool for live packet inspection.

Answer

show log traffic

Answer

execute telnet

Answer

get system status

Question 10

When configuring an Antivirus profile, which option is best to handle password-protected ZIP files?

Accepted Answer

Block or quarantine.. Password-protected ZIP files cannot be scanned for malware because the antivirus engine cannot decrypt them without the password. The safest action is to block or quarantine such files so they can be inspected manually or released by an administrator, preventing malware from bypassing inspection. FortiMail's antivirus profile provides this option specifically for encrypted archives.

Answer

Force decryption.

Answer

Allow all.

Answer

Always ignore.

Question 11

Which feature allows the FortiMail to verify the sender's domain using a DNS record?

Accepted Answer

SPF.. SPF (Sender Policy Framework) is the standard method for verifying the sender domain via DNS.

Answer

DMARC.

Answer

DKIM.

Answer

RBL.

Question 12

An administrator sees a large volume of '451 4.7.1' errors in the logs. What does this indicate?

Accepted Answer

The sender is being greylisted.. The SMTP reply code 451 4.7.1 is a transient (4xx) error indicating the message was temporarily rejected, typically because the sending server is being greylisted by the recipient's anti-spam system. Greylisting works by initially rejecting unknown senders with a temporary failure, expecting legitimate mail servers to retry after a delay while spam bots give up. The '4.7.1' enhanced status code specifically means 'delivery not authorized, message refused' in a temporary context.

Answer

The recipient domain is invalid.

Answer

The email has a virus.

Answer

The server is down.

Question 13

Which THREE items are included in a standard email header for DMARC validation?

Accepted Answer

DKIM signature. A DKIM signature is included in the header as the DKIM-Signature field, which carries the cryptographic signature and tags (such as d=, s=, and b=) that DMARC uses to verify the message's authenticity and domain alignment. The SPF result is conveyed in the Received-SPF or Authentication-Results header, added by the receiving MTA after checking the envelope sender against the sending IP, and DMARC relies on this result for its alignment evaluation. The From domain appears in the visible From: header field, and DMARC specifically requires that this RFC5322.From domain align with the domain authenticated by SPF or DKIM, making it a core element of DMARC validation. By contrast, an attachment name is part of the MIME body structure (Content-Disposition/Content-Type), not the header data used for DMARC, and a user password is never transmitted in a standard email header, so neither participates in DMARC validation.

Answer

Attachment name

Answer

User password

Question 14

Which TWO methods can be used to perform 'Greylisting' in FortiMail?

Accepted Answer

By sender email address. In FortiMail, greylisting is implemented by temporarily rejecting mail from unknown senders so that legitimate SMTP servers retry later, while spammers typically do not. Option B is correct because FortiMail can greylist based on the sender email address, tracking the envelope sender (MAIL FROM) so that a first-time sender is deferred and only accepted after a successful retry. Option C is correct because FortiMail can also greylist based on the sender IP address, deferring connections from previously unseen source IPs until they retry, which is the classic greylisting behavior. Options A, D, and E are not greylisting methods: attachment type and email subject are content-based filtering criteria, and recipient password relates to authentication, none of which define the deferral-and-retry mechanism used by greylisting.

Answer

By attachment type

Answer

By recipient password

Answer

By email subject

Question 15

What should you do to ensure that an encrypted email sent via IBE reaches the recipient correctly?

Accepted Answer

Configure the IBE settings and verify internet connectivity.. Identity-Based Encryption (IBE) in FortiMail requires the IBE service to be properly configured (certificate, key server, and domain settings) before encrypted mail can be decrypted by recipients. Verifying internet connectivity ensures the recipient can reach the IBE portal or key service to retrieve their decryption credentials. Without both, the encrypted message cannot be delivered or opened correctly.

Answer

Disable antivirus.

Answer

Increase the disk space.

Answer

Remove the sender from the whitelist.