FORTINET-NSE56 Nse6 Security Fabric Specialist Topics — All Questions With Answers

Question 1

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Accepted Answer

FortiAuthenticator SAML log. FortiAuthenticator, when acting as a SAML Service Provider (SP), generates dedicated SAML logs that record the receipt and parsing of SAML assertions from the Identity Provider (IdP). These logs are essential for troubleshooting SAML authentication failures because they show whether the assertion was successfully received, its validity, and any parsing errors. The FortiAuthenticator SAML log is the authoritative source for SP-side SAML processing events.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 2

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

Accepted Answer

OFTP. OFTP (Over-Fabric Transfer Protocol) is the secure protocol used for telemetry and log transport in the Security Fabric.

Answer

HTTPS

Answer

SNMP

Answer

Syslog

Question 3

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

Accepted Answer

Via CLI using the 'exec switch authorize' command. In a FortiGate Security Fabric, a downstream FortiSwitch is discovered but remains unauthorized until an administrator explicitly authorizes it. The CLI command 'execute switch-controller authorize' (commonly referenced as 'exec switch authorize') is the mechanism used to approve the switch so the FortiGate can manage it as part of the fabric.

Answer

By adding it to the FortiAnalyzer

Answer

By enabling LLDP on the port

Answer

By rebooting the switch

Question 4

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

Accepted Answer

WAF Policy. On FortiWeb, the WAF Policy (also called a protection profile or inline protection profile) is the component that contains the actual security rules — signatures, HTTP protocol constraints, and anomaly detection logic — that inspect traffic for protocol-specific attacks such as HTTP Request Smuggling, HTTP verb tampering, and malformed header attacks. It is bound to a server policy to enforce inspection on matching traffic.

Answer

Service Object

Answer

Virtual Server

Answer

Server Pool

Question 5

Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?

Accepted Answer

FortiToken. FortiToken is Fortinet's proprietary one-time password (OTP) solution, available as hardware tokens, software tokens, or mobile push. It is natively integrated with FortiAuthenticator and provides strong MFA out-of-the-box, with support for TOTP, HOTP, and push notifications. Unlike external identity providers or directory services, FortiToken is purpose-built for MFA and requires minimal configuration, making it the most recommended choice for MFA within FortiAuthenticator.

Answer

SAML External IDP

Answer

OpenLDAP

Answer

Local Database

Question 6

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

Accepted Answer

Session Synchronization. Session Synchronization (also called session replication or session sharing) is the FortiWeb feature that shares the session table across cluster members so that any member can process requests belonging to a session established on another member. This ensures persistence and continuity in an HA FortiWeb cluster.

Answer

Persistence Sharing

Answer

State Replication

Answer

Configuration Sync

Question 7

You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?

Accepted Answer

X-Forwarded-For header insertion. When FortiADC performs SSL offloading, the client's TCP connection terminates at the ADC, so backend servers see the ADC's IP as the source. Enabling X-Forwarded-For (XFF) header insertion causes FortiADC to add an HTTP header containing the original client IP, which backend servers or logging systems can parse to recover the true source address. This is the standard Layer 7 method for preserving client IP across a reverse proxy.

Answer

HTTP compression

Answer

SSL session resumption

Answer

Source IP NAT

Question 8

Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?

Accepted Answer

SAML. Option A (SAML) is correct because FortiAuthenticator can act as a SAML Identity Provider or Service Provider, receiving user identity attributes through SAML assertions exchanged with external IdPs or SPs during authentication. Option D (LDAP) is correct because FortiAuthenticator natively integrates with external LDAP directories (such as Active Directory or OpenLDAP) to query and import user information for authentication and group mapping. SNMP Traps (B) are used for network monitoring and event notifications, not for user identity data. ICMP (C) is a network diagnostic protocol with no user-information capability. HTTP Proxy (E) forwards web traffic and does not serve as a method for FortiAuthenticator to receive user information from an external source.

Answer

SNMP Traps

Answer

ICMP

Answer

HTTP Proxy

Question 9

Which TWO methods are used to share user group information in the Security Fabric?

Accepted Answer

SSO. In the Fortinet Security Fabric, user group information is shared between FortiGate devices through SSO (option A), which uses the FSSO (Fortinet Single Sign-On) mechanism to propagate authenticated user-to-group mappings from a collector agent or FortiAuthenticator to all Fabric members, enabling consistent identity-based policies across the fabric. LDAP group synchronization (option C) is also correct because FortiGates can synchronize user groups directly from an LDAP server (e.g., Active Directory) and share that group membership data across the Security Fabric for unified policy enforcement. VLAN tagging (option B) is a Layer 2 segmentation technique and does not convey user group identity between devices. DHCP option 43 (option D) is used to deliver vendor-specific information such as controller IP addresses to endpoints, not user group data. DNS records (option E) resolve names to addresses and play no role in sharing user group information.

Answer

VLAN tagging

Answer

DHCP option 43

Answer

DNS records

Question 10

Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?

Accepted Answer

Server IP Address. Option B (Server IP Address) is correct because the FortiGate must be configured with the FortiAuthenticator's actual IP address as the RADIUS server target, otherwise authentication requests are sent to the wrong host and fail. Option D (Shared Secret) is correct because both devices must use the identical shared secret to encrypt and validate RADIUS Access-Request/Access-Accept packets; a mismatch causes the FortiAuthenticator to silently discard requests. Option A (RADIUS port) is not required to match in the sense of being a negotiated parameter — the FortiGate simply must be pointed at the port the FortiAuthenticator listens on (default 1812 for authentication), but the port is a configurable endpoint value rather than a credential that must be identical on both sides. Option C (Device MAC address) is irrelevant since RADIUS authentication is IP/UDP-based and does not use MAC addresses. Option E (System hostname) is not used for RADIUS matching; the FortiGate identifies the server by IP and secret, not by hostname.

Answer

RADIUS port

Answer

Device MAC address

Answer

System hostname

Question 11

Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?

Accepted Answer

Block. In a FortiWeb WAF policy, the Action setting determines how the policy handles matching traffic, and the three available actions are Block, Monitor, and Alert. Option A (Block) is correct because it actively denies the matching request, typically returning an HTTP error or resetting the connection. Option B (Monitor) is correct because it allows the traffic to pass while logging and observing it, which is used for tuning policies without disrupting users. Option C (Alert) is correct because it permits the request but generates a notification/log entry to flag the event for administrators. Option D (Encrypt) is not a policy Action setting; encryption is handled by SSL/TLS offloading or profile settings, not by the WAF action. Option E (Bypass) is not one of the three Action choices in a FortiWeb WAF policy; bypass behavior is configured through other mechanisms such as exception or allow rules, not the Action field.

Answer

Encrypt

Answer

Bypass

Question 12

Which THREE elements are essential to define a user in FortiAuthenticator?

Accepted Answer

Group Membership. In FortiAuthenticator, a local user account is fundamentally identified by three required elements: the Username (D), which serves as the unique login identifier for authentication; the Password / Auth method (C), which defines the credential (local password, token, or other authentication mechanism) used to verify the user; and Group Membership (B), which determines the user's role, RADIUS/LDAP policy assignment, and authorization scope within the FortiAuthenticator configuration. These three fields are mandatory when creating a local user under Authentication > User Management > Local Users, since FortiAuthenticator requires an identity, a means of authentication, and group-based policy association. Home address (A) is optional profile metadata and is not required for authentication or authorization. Operating System Version (E) is irrelevant to FortiAuthenticator user definition and is not a configurable required attribute for local users.

Answer

Home address

Answer

Operating System Version

Question 13

Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?

Accepted Answer

Incorrect IP/Port connectivity. Option C is correct because the Security Fabric connection between a FortiGate and FortiAnalyzer depends on reachable IP connectivity and the correct TCP port (default 514 for OFTP/log transmission, with registration/management traffic also requiring the appropriate Fabric ports); if the FortiAnalyzer's IP address or the port is wrong or blocked by routing, NAT, or a firewall policy, the Fabric tunnel cannot establish. Option E is correct because the FortiGate must authenticate to the FortiAnalyzer using valid Fabric credentials — the FortiAnalyzer serial number and the authorization/registration password configured under 'config system central-management' or the Fabric authorization settings; invalid or mismatched credentials cause the registration to be rejected. Option A is wrong because a keyboard layout mismatch only affects local typing input and has no bearing on network Fabric negotiation. Option B is wrong because an outdated browser affects the GUI rendering of the management interface, not the underlying Fabric protocol connection. Option D is wrong because, while high CPU on the FortiGate could degrade performance or delay processing, it is not a common root cause of a Fabric connection failure — connectivity and credential problems are the typical culprits.

Answer

Keyboard layout mismatch

Answer

Outdated browser

Answer

High CPU on FortiGate

Question 14

Which object in FortiWeb is used to define the specific web server or virtual host that the WAF should inspect?

Accepted Answer

Server Policy. In FortiWeb, the Server Policy is the top-level object that ties together the protected server (defined by a Server object), the inspection profile, and the virtual host or domain that FortiWeb should protect. It is the policy that actually tells FortiWeb which web server or virtual host to inspect and which protection rules to apply.

Answer

Inspection Profile

Answer

Server Object

Answer

Virtual Host Profile

Question 15

Which THREE items are required to successfully integrate a FortiAuthenticator with an Active Directory (AD) environment for identity-based policies?

Accepted Answer

Service account with read permissions. Option A is correct because FortiAuthenticator needs a service account with at least read permissions to query AD objects (users, groups, attributes) during LDAP bind and search operations. Option B is correct because FortiAuthenticator must be configured with the LDAP server's IP address or FQDN to establish the connection to the AD domain controller. Option D is correct because a bind user with domain administrator credentials (or equivalent delegated rights) is required so FortiAuthenticator can authenticate to AD and perform the necessary LDAP queries for identity-based policies. Option C is incorrect because client machine MAC addresses are not used for AD/LDAP integration; identity-based policies rely on user/group identity, not MAC addresses. Option E is incorrect because exporting the AD database file (NTDS.dit) is neither required nor a supported method for integrating FortiAuthenticator with AD; integration is done via LDAP/RADIUS queries, not offline database imports.

Answer

A list of all client machine MAC addresses

Answer

The AD database file export

Question 16

You are the security administrator for a company that has deployed a Security Fabric with a root FortiGate, two downstream FortiGates, and a FortiAnalyzer. You need to ensure that all FortiGates can share dynamic routing information and object definitions to simplify management. Which Security Fabric feature should you enable on the root FortiGate?

Accepted Answer

Security Fabric > Fabric Settings > Synchronize Objects and Routes. Enabling object and route synchronization on the root FortiGate ensures that all downstream FortiGates receive consistent address objects, virtual IPs, and routing information. This reduces administrative overhead and prevents policy mismatches, which is essential in a multi-device Security Fabric deployment. The other options address different aspects of Fabric integration, such as third-party device onboarding, centralized management, or authentication, but not the synchronization of objects and routes.

Answer

Fabric SSO

Answer

Fabric Connector

Answer

FortiManager integration

Question 17

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

To trigger actions based on system events. Automation Stitches in the Security Fabric let you define event-driven workflows: a trigger (such as a compromised host detection, IOC match, or log event) fires a set of actions (quarantine, block, notify, run a CLI script) across Fabric devices. This is the core mechanism for automated threat response and orchestration. It is not about syncing users, scanning, or load balancing.

Answer

To synchronize user databases

Answer

To scan for vulnerabilities

Answer

To load balance traffic

Question 18

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

Accepted Answer

Client SSL Profile. SSL offloading on FortiADC is configured via the Client SSL Profile, which holds the server certificate, private key, and TLS parameters used to terminate client-side HTTPS connections on the ADC. Once terminated, the ADC can inspect and load-balance the decrypted traffic before re-encrypting to backends if needed. This is the object that performs the offload.

Answer

Content Routing Policy

Answer

Server SSL Profile

Answer

Layer 7 Persistence Rule

Question 19

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Accepted Answer

Prevention mode. Prevention mode in a FortiWeb server policy actively blocks detected attacks such as SQL injection while allowing legitimate traffic to pass. This is the operational mode that enforces the WAF's security rules and takes action against malicious requests. Detection mode only logs, and learning mode builds a baseline without blocking.

Answer

Transparent mode

Answer

Learning mode

Answer

Detection mode

Question 20

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Accepted Answer

Configure FortiAuthenticator as a RADIUS Server on FortiGate. Option C is correct because the FortiGate must be explicitly configured with a RADIUS server entry pointing to the FortiAuthenticator (via config user radius, specifying the FortiAuthenticator's IP and shared secret) so that the FortiGate can send authentication requests to it. Option E is correct because FortiAuthenticator only accepts RADIUS requests from clients it recognizes, so the FortiGate's IP address must be added as a RADIUS client (with a matching shared secret) under RADIUS Service > Clients on the FortiAuthenticator. Option A is not required for RADIUS authentication, since web certificates are used for HTTPS/SSL inspection or SAML, not RADIUS. Option B is not required because LDAP is a separate authentication protocol and FortiAuthenticator can act as a RADIUS server without enabling LDAP. Option D is not required because SAML is a different federation protocol used for single sign-on, not for RADIUS authentication.

Answer

Install a web certificate on the FortiGate

Answer

Enable LDAP on the FortiAuthenticator

Answer

Configure SAML on the FortiGate

FORTINET-NSE56 Nse6 Security Fabric Specialist Topics — All Questions With Answers

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?

Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?

Which TWO methods are used to share user group information in the Security Fabric?

Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?

Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?

Which THREE elements are essential to define a user in FortiAuthenticator?

Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?

Which object in FortiWeb is used to define the specific web server or virtual host that the WAF should inspect?

Which THREE items are required to successfully integrate a FortiAuthenticator with an Active Directory (AD) environment for identity-based policies?

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

What is the benefit of using FortiAnalyzer in the Security Fabric?

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?

Which component of the FortiADC performs the translation between the virtual IP and the real server IP?

In a FortiWeb high-availability cluster, how are the synchronization settings for SSL certificates managed?

When integrating FortiWeb with FortiAnalyzer, which information is passed to FortiAnalyzer?

In the context of FortiAuthenticator, what does 'SSO' stand for?

Which FortiWeb feature allows you to block traffic based on the geographic origin of the IP address?

A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?

What is the function of the FortiGate's 'Security Fabric' connector?

Which of the following is a component of the Fortinet Security Fabric?

A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?

In the context of the Security Fabric, what is a 'root' FortiGate?

Which service does FortiAuthenticator provide to enable centralized management of user identities?

A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?

What is the primary function of the 'FortiToken'?

Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?

When integrating FortiAuthenticator with a Windows Active Directory, why is it recommended to use a service account with limited privileges?

Which THREE of the following are core components of the Fortinet Security Fabric?

Which THREE features are provided by the FortiADC when acting as an application delivery controller?

Which TWO actions can be automated via a FortiGate Automation Stitch?

Which THREE types of logs can be generated by FortiWeb?

Which THREE are key benefits of using FortiWeb to protect web applications?

Which TWO products provide identity-based security within the Fortinet portfolio?

Which THREE objects are required to configure a basic load balancing setup in FortiADC?

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?

You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?

In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

You have multiple FortiADC nodes in a High Availability (HA) cluster. Which synchronization method ensures that the session table is shared between nodes to prevent user disconnects during a failover?

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?

Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?

You are configuring a Security Fabric with a root FortiGate and a downstream FortiGate. You want to ensure that if the root FortiGate fails, the downstream FortiGate can still provide security services and maintain Fabric connectivity. Which configuration should you implement?

FORTINET-NSE56 Nse6 Security Fabric Specialist Topics — All Questions With Answers

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?