FORTINET-NSE56 Nse6 Security Fabric Specialist Topics Practice Test 4 — 15 Questions

Question 1

Which service does FortiAuthenticator provide to enable centralized management of user identities?

Accepted Answer

Identity and Access Management (IAM). FortiAuthenticator is Fortinet's dedicated identity and access management (IAM) appliance, providing centralized authentication, authorization, and accounting for users across the network. It supports RADIUS, LDAP, SAML, and TACACS+ to consolidate user identity management, which is exactly what the question describes. The other options describe network security functions handled by other Fortinet products (FortiGate, FortiWeb, FortiADC), not FortiAuthenticator.

Answer

Packet filtering

Answer

Load balancing

Answer

Web application firewalling

Question 2

A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?

Accepted Answer

The server has reached its max connection limit. In FortiADC, a 'Server Busy' status for a pool member indicates that the server has reached its configured maximum connection limit. FortiADC tracks concurrent connections per real server, and when the limit is hit, it marks the server as busy and stops sending new connections to it until existing ones close. This is a load-balancing health/status indicator, not a health check failure or a device-down state.

Answer

The server is rejected by the health check

Answer

The server is down

Answer

The ADC is experiencing high CPU

Question 3

What is the primary function of the 'FortiToken'?

Accepted Answer

Two-factor authentication (2FA). FortiToken is Fortinet's hardware or software token used for two-factor authentication (2FA). It generates time-based one-time passwords (TOTP) that supplement username/password authentication, adding a second factor to verify user identity. FortiToken can be a physical hardware token or a mobile app (FortiToken Mobile).

Answer

User database management

Answer

Secure storage for passwords

Answer

VPN encryption

Question 4

Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?

Accepted Answer

Rate Limiting / Thresholds. Brute force attacks are characterized by a high volume of repeated login attempts from one or more sources within a short window. FortiWeb's Rate Limiting / Thresholds feature (often configured as a brute-force login protection policy) counts failed login attempts per source IP or user and triggers blocking or challenge actions once a threshold is exceeded. This directly detects and mitigates credential-guessing behavior.

Answer

IP Reputation

Answer

Cookie signing

Answer

SQL Injection protection

Question 5

When integrating FortiAuthenticator with a Windows Active Directory, why is it recommended to use a service account with limited privileges?

Accepted Answer

To adhere to the principle of least privilege. Integrating FortiAuthenticator with Active Directory requires a bind account to query AD for user objects, group memberships, and authentication data. Best practice dictates this account should have only the minimum read permissions needed (typically delegated read access to the relevant OUs), because if the credentials are compromised, an attacker cannot modify AD objects, escalate privileges, or perform lateral movement. This directly embodies the principle of least privilege, a foundational security tenet tested throughout Fortinet exams.

Answer

To allow easier backup

Answer

To increase speed

Answer

To bypass password expiration

Question 6

Which THREE of the following are core components of the Fortinet Security Fabric?

Accepted Answer

FortiGate. FortiGate (A) is correct because it is the foundational next-generation firewall (NGFW) that serves as the core security enforcement point of the Fortinet Security Fabric, providing firewall, IPS, antivirus, and other security functions. FortiAnalyzer (D) is correct because it is a core Fabric component for centralized logging, analytics, and reporting, collecting and correlating security events from Fabric devices. FortiManager (E) is correct because it is the central management platform for the Fabric, enabling single-pane-of-glass configuration and policy orchestration across FortiGate and other Fortinet devices. A standard web browser (B) is not a Fabric component; it is merely a client used to access management GUIs. A third-party printer (C) is not a Fabric component either, as it is an unrelated network endpoint device.

Answer

Standard Web Browser

Answer

Third-party printer

Question 7

Which THREE features are provided by the FortiADC when acting as an application delivery controller?

Accepted Answer

Layer 7 Load Balancing. FortiADC is an application delivery controller (ADC), and its core function is Layer 7 load balancing (option B), inspecting application-layer protocols such as HTTP/HTTPS to distribute requests across backend servers based on content, headers, or URLs. It also provides a Web Application Firewall (option C), which inspects and filters HTTP/HTTPS traffic to block attacks like SQL injection and cross-site scripting, a standard ADC security feature. Additionally, FortiADC supports Global Server Load Balancing (option D), directing clients to the best data center or site based on health, proximity, or performance across geographically distributed resources. Email routing (option A) is a mail-transfer function handled by mail servers or secure email gateways, not an ADC capability, and a DHCP server (option E) provides IP address leasing, which is unrelated to application delivery and load balancing.

Answer

Email routing

Answer

DHCP server

Question 8

Which TWO actions can be automated via a FortiGate Automation Stitch?

Accepted Answer

Quarantine a host. Option B is correct because a FortiGate Automation Stitch can trigger a Quarantine action, typically via the Quarantine FortiClient endpoint or the 'quarantine-host' action, which isolates a compromised host by applying a quarantine firewall address or NAC policy when a trigger such as a failed IPS signature or compromised-host detection fires. Option D is correct because Automation Stitches support an Email notification action, allowing the FortiGate to send an alert via a configured mail server (SMTP) to administrators when the stitch trigger occurs. Option A is not valid because BIOS settings are managed at the hardware/firmware level and are outside the scope of FortiOS automation actions. Option C is not valid because purchasing hardware is a procurement/business process, not a FortiGate automation function. Option E is not valid because FortiGate Automation Stitches cannot perform software updates on external servers; that would require a separate management or patch-management tool.

Answer

Modify the BIOS settings

Answer

Purchase hardware

Answer

Perform a software update on a server

Question 9

Which THREE types of logs can be generated by FortiWeb?

Accepted Answer

Event Log. FortiWeb generates an Event Log (B), which records system-level activities such as administrative logins, configuration changes, HA events, and daemon status messages. It also generates a Traffic Log (C), which records the HTTP/HTTPS requests and responses handled by the FortiWeb proxy, including the action taken (allow, block, alert) and details like source IP, URL, and policy matched. The Attack Log (E) is also a valid FortiWeb log type, capturing detected attacks and violations such as SQL injection, XSS, and other signatures from the FortiWeb attack definitions, along with severity and action. Packet Capture Log (A) is not a FortiWeb log category — packet capture is a diagnostic tool (via the CLI/GUI packet capture feature), not a log type. User Billing Log (D) is not a FortiWeb log type; billing/user accounting logs are associated with other Fortinet products or RADIUS accounting, not FortiWeb's logging categories.

Answer

Packet Capture Log

Answer

User Billing Log

Question 10

Which THREE are key benefits of using FortiWeb to protect web applications?

Accepted Answer

Protection against SQL Injection. Option C is correct because FortiWeb is a web application firewall (WAF) that inspects HTTP/HTTPS traffic and uses signatures and anomaly detection to block SQL Injection attacks against web applications. Option D is correct because FortiWeb can terminate TLS/SSL sessions, performing SSL offloading so backend web servers are freed from encryption/decryption overhead while FortiWeb inspects the decrypted traffic. Option E is correct because FortiWeb provides logging, reporting, and compliance-oriented dashboards that help organizations demonstrate adherence to regulations such as PCI DSS. Option A is not a FortiWeb function, since replacing an ISP is a connectivity/business decision unrelated to application security. Option B is also unrelated, as physical security of the server room is handled by facility controls, not by a WAF.

Answer

Replacing the ISP

Answer

Physical security of the server room

Question 11

Which TWO products provide identity-based security within the Fortinet portfolio?

Accepted Answer

FortiGate. FortiGate (D) is correct because it is Fortinet's NGFW that performs identity-based security by integrating with directory services and acting as a Fortinet Single Sign-On (FSSO) collector, allowing policies to be enforced based on authenticated user or group identity rather than just IP address. FortiAuthenticator (E) is correct because it is Fortinet's dedicated identity and access management appliance, providing authentication services such as RADIUS, LDAP, SAML, and two-factor authentication, and it can feed user identity information to FortiGate for identity-based policy enforcement. FortiSwitch (A) and FortiAP (B) are network access devices that provide Layer 2 switching and wireless connectivity, respectively, and while they can participate in security fabrics, they do not themselves deliver identity-based security. FortiADC (C) is an application delivery controller focused on load balancing, SSL offloading, and application acceleration, not identity-based security.

Answer

FortiSwitch

Answer

FortiAP

Answer

FortiADC

Question 12

Which THREE objects are required to configure a basic load balancing setup in FortiADC?

Accepted Answer

Virtual Server. In FortiADC, a basic load balancing configuration requires a Virtual Server (option A), which is the client-facing object that receives incoming traffic on a defined IP address and port and forwards it according to its load-balancing method. It also requires a Server Pool (option B), which groups the backend nodes and defines health checks and load-balancing algorithms used to distribute requests. Finally, it requires at least one Real Server (option E), which represents the actual backend server (IP address and port) that handles the traffic and is a member of the Server Pool. Options C and D are not required for a basic setup: a WAF Policy is an optional security feature for web application protection, and a Content Routing Policy is an optional layer-7 mechanism for directing traffic based on content, neither of which is mandatory for basic load balancing.

Answer

WAF Policy

Answer

Content Routing Policy

Question 13

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

Accepted Answer

Prevention mode with signature-based scanning enabled. Prevention mode with signature-based scanning is the most effective because it actively blocks SQL injection attempts by matching known attack patterns (signatures) in real time. This mode enforces the policy, dropping malicious requests before they reach the backend server. Signature-based scanning specifically targets SQLi patterns, reducing false positives compared to anomaly-based detection, which can flag legitimate traffic. In production, this balance of security and accuracy is critical.

Answer

Offline mode with learning enabled

Answer

Transparent mode with only DoS prevention

Answer

Detection mode with no signatures

Question 14

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

Accepted Answer

Enable the Security Fabric connector on the FortiGate. To add a FortiWeb appliance to the Security Fabric, the FortiGate must have the Security Fabric connector enabled. This connector is the mechanism that allows the FortiGate to discover, authorize, and manage Fabric devices including FortiWeb. Without it enabled, the FortiGate will not recognize or accept the FortiWeb as a Fabric member, regardless of network connectivity.

Answer

Configure static routing between the devices

Answer

Disable all firewall policies

Answer

Manually create an IPsec tunnel between devices

Question 15

In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?

Accepted Answer

SSL Offloading. SSL Offloading in FortiADC is the feature that terminates client SSL connections at the load balancer and establishes a separate connection to the backend server. This allows the ADC to decrypt, inspect, and optionally re-encrypt traffic, and it offloads CPU-intensive TLS handshakes from backend servers. The question explicitly describes termination at the ADC and a new connection to the backend, which is the definition of SSL offloading (specifically SSL bridging/termination).

Answer

Server Persistence

Answer

HTTP Header Insertion

Answer

Layer 4 Load Balancing