FORTINET-NSE56 Nse6 Security Fabric Specialist Topics — 10 Questions

Question 1

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiAuthenticator SAML log. FortiAuthenticator, when acting as a SAML Service Provider (SP), generates dedicated SAML logs that record the receipt and parsing of SAML assertions from the Identity Provider (IdP). These logs are essential for troubleshooting SAML authentication failures because they show whether the assertion was successfully received, its validity, and any parsing errors. The FortiAuthenticator SAML log is the authoritative source for SP-side SAML processing events.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 2

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

Accepted Answer

OFTP. OFTP (Over-Fabric Transfer Protocol) is the secure protocol used for telemetry and log transport in the Security Fabric.

Answer

HTTPS

Answer

SNMP

Answer

Syslog

Question 3

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

Accepted Answer

Via CLI using the 'exec switch authorize' command. In a FortiGate Security Fabric, a downstream FortiSwitch is discovered but remains unauthorized until an administrator explicitly authorizes it. The CLI command 'execute switch-controller authorize' (commonly referenced as 'exec switch authorize') is the mechanism used to approve the switch so the FortiGate can manage it as part of the fabric.

Answer

By adding it to the FortiAnalyzer

Answer

By enabling LLDP on the port

Answer

By rebooting the switch

Question 4

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

Accepted Answer

WAF Policy. On FortiWeb, the WAF Policy (also called a protection profile or inline protection profile) is the component that contains the actual security rules — signatures, HTTP protocol constraints, and anomaly detection logic — that inspect traffic for protocol-specific attacks such as HTTP Request Smuggling, HTTP verb tampering, and malformed header attacks. It is bound to a server policy to enforce inspection on matching traffic.

Answer

Service Object

Answer

Virtual Server

Answer

Server Pool

Question 5

Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?

Accepted Answer

FortiToken. FortiToken is Fortinet's proprietary one-time password (OTP) solution, available as hardware tokens, software tokens, or mobile push. It is natively integrated with FortiAuthenticator and provides strong MFA out-of-the-box, with support for TOTP, HOTP, and push notifications. Unlike external identity providers or directory services, FortiToken is purpose-built for MFA and requires minimal configuration, making it the most recommended choice for MFA within FortiAuthenticator.

Answer

SAML External IDP

Answer

OpenLDAP

Answer

Local Database

Question 6

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

Accepted Answer

Session Synchronization. Session Synchronization (also called session replication or session sharing) is the FortiWeb feature that shares the session table across cluster members so that any member can process requests belonging to a session established on another member. This ensures persistence and continuity in an HA FortiWeb cluster.

Answer

Persistence Sharing

Answer

State Replication

Answer

Configuration Sync

Question 7

You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?

Accepted Answer

X-Forwarded-For header insertion. When FortiADC performs SSL offloading, the client's TCP connection terminates at the ADC, so backend servers see the ADC's IP as the source. Enabling X-Forwarded-For (XFF) header insertion causes FortiADC to add an HTTP header containing the original client IP, which backend servers or logging systems can parse to recover the true source address. This is the standard Layer 7 method for preserving client IP across a reverse proxy.

Answer

HTTP compression

Answer

SSL session resumption

Answer

Source IP NAT

Question 8

Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?

Accepted Answer

SAML. Option A (SAML) is correct because FortiAuthenticator can act as a SAML Identity Provider or Service Provider, receiving user identity attributes through SAML assertions exchanged with external IdPs or SPs during authentication. Option D (LDAP) is correct because FortiAuthenticator natively integrates with external LDAP directories (such as Active Directory or OpenLDAP) to query and import user information for authentication and group mapping. SNMP Traps (B) are used for network monitoring and event notifications, not for user identity data. ICMP (C) is a network diagnostic protocol with no user-information capability. HTTP Proxy (E) forwards web traffic and does not serve as a method for FortiAuthenticator to receive user information from an external source.

Answer

SNMP Traps

Answer

ICMP

Answer

HTTP Proxy

Question 9

Which TWO methods are used to share user group information in the Security Fabric?

Accepted Answer

SSO. In the Fortinet Security Fabric, user group information is shared between FortiGate devices through SSO (option A), which uses the FSSO (Fortinet Single Sign-On) mechanism to propagate authenticated user-to-group mappings from a collector agent or FortiAuthenticator to all Fabric members, enabling consistent identity-based policies across the fabric. LDAP group synchronization (option C) is also correct because FortiGates can synchronize user groups directly from an LDAP server (e.g., Active Directory) and share that group membership data across the Security Fabric for unified policy enforcement. VLAN tagging (option B) is a Layer 2 segmentation technique and does not convey user group identity between devices. DHCP option 43 (option D) is used to deliver vendor-specific information such as controller IP addresses to endpoints, not user group data. DNS records (option E) resolve names to addresses and play no role in sharing user group information.

Answer

VLAN tagging

Answer

DHCP option 43

Answer

DNS records

Question 10

Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?

Accepted Answer

Server IP Address. Option B (Server IP Address) is correct because the FortiGate must be configured with the FortiAuthenticator's actual IP address as the RADIUS server target, otherwise authentication requests are sent to the wrong host and fail. Option D (Shared Secret) is correct because both devices must use the identical shared secret to encrypt and validate RADIUS Access-Request/Access-Accept packets; a mismatch causes the FortiAuthenticator to silently discard requests. Option A (RADIUS port) is not required to match in the sense of being a negotiated parameter — the FortiGate simply must be pointed at the port the FortiAuthenticator listens on (default 1812 for authentication), but the port is a configurable endpoint value rather than a credential that must be identical on both sides. Option C (Device MAC address) is irrelevant since RADIUS authentication is IP/UDP-based and does not use MAC addresses. Option E (System hostname) is not used for RADIUS matching; the FortiGate identifies the server by IP and secret, not by hostname.

Answer

RADIUS port

Answer

Device MAC address

Answer

System hostname