FORTINET-NSE56 Nse6 Security Fabric Specialist Topics Practice Test 5 — 15 Questions

Question 1

You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RADIUS VSAs are not correctly configured to include group information. FortiAuthenticator communicates group membership to FortiGate via RADIUS attributes, specifically Vendor-Specific Attributes (VSAs) such as Fortinet-Group-Name (attribute 1) or the Class attribute. If these VSAs are not configured or not mapped correctly, FortiGate receives only the authentication success but no group information, so it cannot match the user to group-based firewall policies. This is the classic cause of 'user authenticates but wrong/no policy applies' in FortiAuthenticator-FortiGate SSO integrations.

Answer

The FortiGate is not joined to the AD domain

Answer

The VPN tunnel is using IKEv1 instead of IKEv2

Answer

The FortiAuthenticator is in local authentication mode

Question 2

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

Accepted Answer

System Event Logs. FortiADC health checks are internal system-level operations, and failures (e.g., connection refused, timeout, unexpected response code) are recorded in the System Event Logs. These logs capture the health check probe results, the reason for marking a server as down, and any configuration or connectivity errors, making them the primary source for diagnosing why a health check is failing.

Answer

Session Table Logs

Answer

Application Traffic Logs

Answer

Security Policy Logs

Answer

SNMP Traps

Question 3

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

Accepted Answer

FortiAuthenticator Authentication Logs. When a user is denied access through a FortiAuthenticator-backed portal, the FortiAuthenticator Authentication Logs are the authoritative source because they record the full RADIUS/LDAP exchange, including whether the user was found, whether group membership was evaluated, and the exact rejection reason. Since the user exists in the mapped AD group, the failure is likely in the authentication flow itself (bind failure, group filter mismatch, or policy mapping), all of which are visible in these logs. Checking logs first follows the standard troubleshooting methodology of gathering evidence before changing configuration.

Answer

The AD domain controller's disk space

Answer

The FortiGate session table

Answer

The WAF policy on FortiWeb

Question 4

You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?

Accepted Answer

Cookie Persistence. Cookie Persistence is the correct method because it ties a client to a specific backend server based on a cookie inserted or provided by the backend application. FortiADC can insert a cookie or use an existing application cookie to maintain session affinity, ensuring that subsequent requests from the same user go to the same real server. This is the standard approach when the application itself issues a session cookie that must be honored for stateful sessions.

Answer

Source IP Persistence

Answer

Round Robin

Answer

Least Connections

Question 5

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

Accepted Answer

The Shared Secret. The Shared Secret is the pre-shared key used to secure RADIUS communication between the FortiAuthenticator (RADIUS server) and the third-party VPN gateway (RADIUS client). Both devices must be configured with the identical shared secret; otherwise, RADIUS authentication requests will be rejected due to message integrity check failures. The other settings are either optional or not required to match for basic authentication.

Answer

The RADIUS accounting port

Answer

The NAS-IP-Address

Answer

The VSA Vendor ID

Question 6

You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?

Accepted Answer

To the FortiWeb internal interface. In Reverse Proxy mode, FortiWeb sits inline between clients and backend servers, so all return traffic from the servers must traverse FortiWeb for inspection and NAT. The backend servers' default gateway must therefore point to FortiWeb's internal (server-facing) interface IP, ensuring symmetric traffic flow. If the gateway pointed elsewhere, return traffic would bypass FortiWeb, breaking the proxy session and defeating protection.

Answer

To a secondary FortiGate

Answer

To the Loopback interface

Answer

Directly to the Internet

Question 7

In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?

Accepted Answer

Automation Stitch. Automation Stitch in the Security Fabric lets you define trigger-action workflows across Fabric devices. When one device (e.g., FortiSandbox or FortiAnalyzer) detects a compromised host, it can send a trigger that the FortiGate consumes to automatically quarantine that host (e.g., via a quarantine action or address group update). This is the automation mechanism for cross-device response.

Answer

Security Rating

Answer

Fabric Connector

Answer

Log Correlation

Question 8

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Accepted Answer

Traffic Monitor / SSL Dashboard. The Traffic Monitor / SSL Dashboard in FortiADC provides real-time visibility into SSL handshake times, including metrics like SSL negotiation duration. This tool is specifically designed to monitor SSL/TLS performance and identify bottlenecks in the handshake process.

Answer

Packet Capture (sniffer)

Answer

Log Access

Answer

System Health Monitor

Question 9

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

Accepted Answer

User Portal. The User Portal component of FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens. It provides a web interface for users to enroll tokens, reset passwords, and manage their profiles. This offloads administrative tasks and empowers users.

Answer

AD Connector

Answer

Admin GUI

Answer

RADIUS Server

Question 10

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

Accepted Answer

It provides centralized logging and advanced analytics. Integrating FortiWeb with FortiAnalyzer in the Security Fabric provides centralized logging and advanced analytics — FortiWeb forwards its WAF logs (attacks, violations, traffic) to FortiAnalyzer, where they are correlated with logs from FortiGate, FortiSandbox, and other Fabric devices. This enables unified dashboards, compliance reports, and threat correlation that would be impossible with FortiWeb's local logs alone.

Answer

It enables hardware acceleration on FortiWeb

Answer

It bypasses the need for WAF policies

Answer

It allows FortiWeb to perform SSL offloading

Question 11

You have multiple FortiADC nodes in a High Availability (HA) cluster. Which synchronization method ensures that the session table is shared between nodes to prevent user disconnects during a failover?

Accepted Answer

Session Synchronization. Session Synchronization in a FortiADC HA cluster replicates the Layer 4/Layer 7 session table between nodes so that established connections survive a failover. Without it, a failover would drop active sessions and force users to reconnect. It is the specific mechanism designed for stateful session sharing.

Answer

Database Replication

Answer

VRRP Heartbeat

Answer

Configuration Sync

Question 12

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Accepted Answer

It can route traffic based on HTTP headers or URL patterns. Option A is correct because FortiADC's Layer 7 (HTTP/HTTPS) virtual servers can inspect application-layer content and use content routing rules to direct traffic based on HTTP headers (for example, Host or X-Forwarded-For) or URL patterns/paths. Option C is correct because FortiADC supports HTTP content rewriting, allowing it to add, modify, or delete HTTP request and response headers (such as inserting X-Forwarded-For or stripping Server headers) as traffic passes through the virtual server. Option B is incorrect because Layer 7 load balancing does not require backend servers to share a subnet; real servers can reside on different networks as long as routing to them exists. Option D is incorrect because Layer 7 load balancing specifically handles application protocols like HTTP and HTTPS, not only raw TCP. Option E is incorrect because FortiADC performs health checks on web servers using HTTP/HTTPS monitors (and other monitor types) to verify real server availability.

Answer

It requires all backend servers to be on the same subnet

Answer

It only supports TCP-based traffic

Answer

It cannot perform health checks on web servers

Question 13

Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?

Accepted Answer

TACACS+. FortiAuthenticator supports TACACS+ (option B) as a valid authentication protocol, allowing it to receive and process authentication requests from network devices such as routers and switches that use TACACS+ for administrative login. FortiAuthenticator also supports RADIUS (option C), which is one of its primary authentication protocols for receiving user authentication requests from firewalls, VPNs, and other RADIUS clients. NTP (option A) is a time synchronization protocol and does not carry authentication requests. ARP (option D) is a layer-2 address resolution protocol used to map IP addresses to MAC addresses, not for authentication. ICMP (option E) is a network diagnostic and error-reporting protocol and has no role in user authentication.

Answer

NTP

Answer

ARP

Answer

ICMP

Question 14

Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?

Accepted Answer

Offloading SSL/TLS processing from backend servers. Option C is correct because a WAF such as FortiWeb commonly performs SSL/TLS offloading, terminating HTTPS connections and decrypting traffic so backend web servers do not have to handle the cryptographic processing, which reduces their load and centralizes certificate management. Option E is correct because a core WAF function is inspecting HTTP/HTTPS requests and blocking application-layer attacks such as SQL injection and cross-site scripting (XSS) using signatures and behavioral rules. Option A is incorrect because local user account provisioning is an identity and access management function, not a WAF role. Option B is incorrect because scanning email attachments for malware is the job of an email security gateway or antivirus, not a WAF, which focuses on web traffic. Option D is incorrect because routing static IP traffic between subnets is a Layer 3 routing function performed by routers or firewalls, not a WAF's primary purpose.

Answer

Managing local user account provisioning

Answer

Performing deep packet inspection for malware on email attachments

Answer

Routing static IP traffic between subnets

Question 15

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

Accepted Answer

Log the request details. Option B is correct because FortiWeb can log the full details of a violating request (source IP, URL, matched signature/rule, and action taken) to its attack, traffic, and event logs for auditing and forensic analysis. Option C is correct because FortiWeb supports a redirect action that sends the offending client to a customizable block page (for example, an HTML page hosted on FortiWeb) instead of returning the protected application's content. Option E is correct because FortiWeb can drop or reset the connection, terminating the TCP session (RST) so the malicious request never reaches the backend server. Option A is not a FortiWeb function: FortiWeb is a WAF and does not patch vulnerabilities on backend servers; patching is an administrative task on the server itself. Option D is also outside FortiWeb's role, since it cannot increase backend server CPU resources; that would be handled by the server or virtualization/cloud platform.

Answer

Automatically patch the server vulnerability

Answer

Increase the backend server CPU