FORTINET-NSE56 Nse6 Security Fabric Specialist Topics Practice Test 2 — 15 Questions

Question 1

You are the security administrator for a company that has deployed a Security Fabric with a root FortiGate, two downstream FortiGates, and a FortiAnalyzer. You need to ensure that all FortiGates can share dynamic routing information and object definitions to simplify management. Which Security Fabric feature should you enable on the root FortiGate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Fabric > Fabric Settings > Synchronize Objects and Routes. Enabling object and route synchronization on the root FortiGate ensures that all downstream FortiGates receive consistent address objects, virtual IPs, and routing information. This reduces administrative overhead and prevents policy mismatches, which is essential in a multi-device Security Fabric deployment. The other options address different aspects of Fabric integration, such as third-party device onboarding, centralized management, or authentication, but not the synchronization of objects and routes.

Answer

Fabric SSO

Answer

Fabric Connector

Answer

FortiManager integration

Question 2

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

To trigger actions based on system events. Automation Stitches in the Security Fabric let you define event-driven workflows: a trigger (such as a compromised host detection, IOC match, or log event) fires a set of actions (quarantine, block, notify, run a CLI script) across Fabric devices. This is the core mechanism for automated threat response and orchestration. It is not about syncing users, scanning, or load balancing.

Answer

To synchronize user databases

Answer

To scan for vulnerabilities

Answer

To load balance traffic

Question 3

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

Accepted Answer

Client SSL Profile. SSL offloading on FortiADC is configured via the Client SSL Profile, which holds the server certificate, private key, and TLS parameters used to terminate client-side HTTPS connections on the ADC. Once terminated, the ADC can inspect and load-balance the decrypted traffic before re-encrypting to backends if needed. This is the object that performs the offload.

Answer

Content Routing Policy

Answer

Server SSL Profile

Answer

Layer 7 Persistence Rule

Question 4

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Accepted Answer

Prevention mode. Prevention mode in a FortiWeb server policy actively blocks detected attacks such as SQL injection while allowing legitimate traffic to pass. This is the operational mode that enforces the WAF's security rules and takes action against malicious requests. Detection mode only logs, and learning mode builds a baseline without blocking.

Answer

Transparent mode

Answer

Learning mode

Answer

Detection mode

Question 5

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Accepted Answer

Configure FortiAuthenticator as a RADIUS Server on FortiGate. Option C is correct because the FortiGate must be explicitly configured with a RADIUS server entry pointing to the FortiAuthenticator (via config user radius, specifying the FortiAuthenticator's IP and shared secret) so that the FortiGate can send authentication requests to it. Option E is correct because FortiAuthenticator only accepts RADIUS requests from clients it recognizes, so the FortiGate's IP address must be added as a RADIUS client (with a matching shared secret) under RADIUS Service > Clients on the FortiAuthenticator. Option A is not required for RADIUS authentication, since web certificates are used for HTTPS/SSL inspection or SAML, not RADIUS. Option B is not required because LDAP is a separate authentication protocol and FortiAuthenticator can act as a RADIUS server without enabling LDAP. Option D is not required because SAML is a different federation protocol used for single sign-on, not for RADIUS authentication.

Answer

Install a web certificate on the FortiGate

Answer

Enable LDAP on the FortiAuthenticator

Answer

Configure SAML on the FortiGate

Question 6

You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?

Accepted Answer

Create a WAF Exception for the specific signature ID. In FortiWeb, when a legitimate request triggers a SQL injection false positive, the correct approach is to create a WAF Exception for the specific signature ID that is causing the block. This allows the traffic that matches that signature to bypass the SQL injection detection while keeping all other security protections active. The exception is granular, targeting only the offending signature, so the overall security posture remains strong. This is the recommended method to resolve false positives without disabling the entire scanner or changing the deployment mode.

Answer

Enable Auto Learning

Answer

Disable the SQL Injection scanner entirely

Answer

Switch to Transparent mode

Question 7

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Accepted Answer

Enable SQL Injection in the WAF profile. FortiWeb's WAF profile includes a specific signature set for SQL injection (SQLi) detection, which matches patterns like ' OR 1=1, UNION SELECT, and other database query manipulations. Enabling SQL Injection in the WAF profile activates these signatures and applies them to incoming requests. This directly addresses the requirement to block SQL injection patterns. Other protections target different attack types and would not cover SQLi.

Answer

Enable Buffer Overflow protection

Answer

Enable HTTP Protocol Validation

Answer

Enable Cross-site Scripting protection

Question 8

Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?

Accepted Answer

Single Sign-On (SSO) agentless polling. FortiAuthenticator provides agentless polling SSO (option A), which collects login events from domain controllers via WMI/event log polling so the Security Fabric can map users to IP addresses without installing agents on endpoints. It also provides Certificate Authority (CA) services (option B), issuing and managing user/device certificates for certificate-based authentication and SCEP enrollment. Additionally, it performs LDAP/RADIUS user directory synchronization (option C), importing users and groups from directories such as Active Directory or LDAP and serving as a RADIUS/LDAP authentication source for identity-based policies. Option D is incorrect because WAF traffic inspection is a function of FortiWeb, not FortiAuthenticator. Option E is incorrect because firewall policy enforcement is performed by FortiGate, while FortiAuthenticator supplies the identity and authentication data that FortiGate uses.

Answer

Web Application Firewall (WAF) traffic inspection

Answer

FortiGate firewall policy enforcement

Question 9

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

Accepted Answer

Use a Header Rewrite script. FortiADC provides Header Rewrite scripts specifically for manipulating HTTP request and response headers at Layer 7. To insert or rewrite X-Forwarded-For with the client IP, you create a Header Rewrite policy/script and bind it to the virtual server or content rule. This is the intended tool for header manipulation in FortiADC's L7 processing pipeline.

Answer

Configure a SNAT pool

Answer

Apply a WAF profile

Answer

Modify the Virtual Server interface

Question 10

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Accepted Answer

Cookie Insert. Cookie Insert persistence is the most appropriate method for a cookie-based application because FortiADC inserts a cookie into the HTTP response that identifies the backend server, ensuring subsequent requests from the same client are directed to the same server. This works even when clients are behind NAT or proxies, unlike source IP persistence. It also handles SSL offloading scenarios where SSL Session ID persistence would fail.

Answer

Source IP Persistence

Answer

SSL Session ID

Answer

Round Robin

Question 11

You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?

Accepted Answer

Detection Mode. Detection Mode is the correct starting mode because it allows FortiWeb to learn legitimate user behavior by monitoring and logging traffic without blocking any requests. This mode builds a baseline of normal application usage, which is essential before enabling Prevention Mode. Starting in Detection Mode avoids false positives that could disrupt legitimate users.

Answer

Bypass Mode

Answer

Offline Mode

Answer

Prevention Mode

Question 12

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

Accepted Answer

Group Mapping. Group Mapping in FortiAuthenticator is the feature that binds an external directory group (such as an LDAP group) to a locally defined FortiAuthenticator group. This binding lets the appliance assign administrative roles and permissions based on the user's membership in the external directory, so LDAP-authenticated admins inherit the correct local privileges.

Answer

SSO Domain

Answer

LDAP Filter

Answer

RADIUS Client

Question 13

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Accepted Answer

The FortiGate remote group is not defined for the LDAP server. For a FortiGate policy to match an LDAP group, the group must first be imported/defined as a remote group under User & Authentication > LDAP Servers on the FortiGate. If the remote group is not defined, the policy cannot reference it and the user's group membership is never evaluated, causing access denial even though authentication succeeded.

Answer

The LDAP user account is locked

Answer

FortiAuthenticator is in maintenance mode

Answer

The user is using the wrong password

Question 14

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

Automating incident response actions. Automation Stitches in the Security Fabric let you define trigger-action workflows that automatically respond to security events, such as quarantining a compromised endpoint or blocking an IP. The primary benefit is automating incident response actions across Fabric-connected devices. This reduces response time and manual effort.

Answer

Improving log compression

Answer

Increasing bandwidth

Answer

Updating firmware

Question 15

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

Accepted Answer

To view the topology and status of connected devices. The Security Fabric dashboard on FortiGate provides a visual topology map showing all Fabric-connected devices (FortiGates, FortiSwitches, FortiAPs, FortiManager, FortiAnalyzer, etc.) along with their health and status. It is the primary place to verify Fabric topology and device connectivity, not to manage billing, signatures, or VPNs.

Answer

To manage FortiCloud billing

Answer

To update antivirus signatures

Answer

To configure VPN tunnels