FORTINET-NSE56 Nse6 Security Fabric Specialist Topics — 30 Questions

Question 1

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

To trigger actions based on system events. Automation Stitches trigger actions based on specific events detected by the Security Fabric.

Answer

To synchronize user databases

Answer

To scan for vulnerabilities

Answer

To load balance traffic

Question 2

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

Accepted Answer

Client SSL Profile. SSL offloading requires a Client SSL profile applied to the Virtual Server to handle the handshake and decryption.

Answer

Content Routing Policy

Answer

Server SSL Profile

Answer

Layer 7 Persistence Rule

Question 3

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Accepted Answer

Prevention mode. Prevention mode is the standard setting for WAF policies to actively block detected threats based on configured signatures.

Answer

Transparent mode

Answer

Learning mode

Answer

Detection mode

Question 4

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Accepted Answer

Configure FortiAuthenticator as a RADIUS Server on FortiGate. Integration requires defining the FortiAuthenticator as a RADIUS server on the FortiGate and ensuring the FortiGate is a registered client on the FortiAuthenticator.

Answer

Install a web certificate on the FortiGate

Answer

Enable LDAP on the FortiAuthenticator

Answer

Configure SAML on the FortiGate

Question 5

You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?

Accepted Answer

Create a WAF Exception for the specific signature ID. Custom signatures or exception rules allow for granular bypassing of specific signatures that trigger false positives.

Answer

Enable Auto Learning

Answer

Disable the SQL Injection scanner entirely

Answer

Switch to Transparent mode

Question 6

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Accepted Answer

Enable SQL Injection in the WAF profile. SQL injection protection is a core feature of the signature-based protection in FortiWeb WAF profiles.

Answer

Enable Buffer Overflow protection

Answer

Enable HTTP Protocol Validation

Answer

Enable Cross-site Scripting protection

Question 7

Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?

Accepted Answer

Single Sign-On (SSO) agentless polling. FortiAuthenticator handles LDAP synchronization, certificate management, and SSO token issuance for the Fabric.

Answer

Web Application Firewall (WAF) traffic inspection

Answer

FortiGate firewall policy enforcement

Question 8

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

Accepted Answer

Use a Header Rewrite script. FortiADC content routing and header modification rules are used to manipulate HTTP headers.

Answer

Configure a SNAT pool

Answer

Apply a WAF profile

Answer

Modify the Virtual Server interface

Question 9

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Accepted Answer

FortiAuthenticator SAML log. The SAML debug logs on the FortiAuthenticator provide detail on the assertion exchange and attribute mapping.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 10

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Accepted Answer

Cookie Insert. Cookie insert persistence is the industry standard for tracking sessions in HTTP applications at Layer 7.

Answer

Source IP Persistence

Answer

SSL Session ID

Answer

Round Robin

Question 11

You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?

Accepted Answer

Detection Mode. Detection mode allows the FortiWeb to analyze traffic and build a baseline without actively blocking requests.

Answer

Bypass Mode

Answer

Offline Mode

Answer

Prevention Mode

Question 12

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

Accepted Answer

OFTP. OFTP (Over-Fabric Transfer Protocol) is the secure protocol used for telemetry and log transport in the Security Fabric.

Answer

HTTPS

Answer

SNMP

Answer

Syslog

Question 13

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

Accepted Answer

Group Mapping. Group mapping enables the synchronization of external directory groups with internal policies.

Answer

SSO Domain

Answer

LDAP Filter

Answer

RADIUS Client

Question 14

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Accepted Answer

The FortiGate remote group is not defined for the LDAP server. If the group is not correctly mapped in the FortiGate's remote group list, the user will not match the policy.

Answer

The LDAP user account is locked

Answer

FortiAuthenticator is in maintenance mode

Answer

The user is using the wrong password

Question 15

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

Accepted Answer

Via CLI using the 'exec switch authorize' command. Authorization is required in the Managed FortiSwitch list to establish the management connection.

Answer

By adding it to the FortiAnalyzer

Answer

By enabling LLDP on the port

Answer

By rebooting the switch

Question 16

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

Accepted Answer

WAF Policy. The WAF policy contains the inspection profiles and rules required to detect protocol-level anomalies.

Answer

Service Object

Answer

Virtual Server

Answer

Server Pool

Question 17

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

Automating incident response actions. Automation stitches allow for triggering actions (like isolating a host) based on detected events.

Answer

Improving log compression

Answer

Increasing bandwidth

Answer

Updating firmware

Question 18

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

Accepted Answer

To view the topology and status of connected devices. The dashboard provides a visual topology and overview of all connected Fabric devices.

Answer

To manage FortiCloud billing

Answer

To update antivirus signatures

Answer

To configure VPN tunnels

Question 19

What is the benefit of using FortiAnalyzer in the Security Fabric?

Accepted Answer

Centralized logging and reporting. FortiAnalyzer provides centralized log aggregation and analytics for the entire Fabric.

Answer

It provides hardware acceleration for the FortiGate

Answer

It manages ISP failover

Answer

It replaces the FortiGate firewall

Question 20

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

Accepted Answer

Expected Response code in the Health Check object. The health check method and the expected status code in the response are critical for verification.

Answer

The ADC management IP

Answer

Server RAM utilization

Answer

The switch MTU