FORTINET-NSE56 Nse6 Security Fabric Specialist Topics — Timed 40 Questions

Question 1

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

40 minute time limit — choose an answer to begin.

Accepted Answer

FortiAuthenticator SAML log. FortiAuthenticator, when acting as a SAML Service Provider (SP), generates dedicated SAML logs that record the receipt and parsing of SAML assertions from the Identity Provider (IdP). These logs are essential for troubleshooting SAML authentication failures because they show whether the assertion was successfully received, its validity, and any parsing errors. The FortiAuthenticator SAML log is the authoritative source for SP-side SAML processing events.

Answer

FortiAnalyzer Traffic Log

Answer

FortiGate Event Log

Answer

RADIUS Authentication Log

Question 2

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

Accepted Answer

OFTP. OFTP (Over-Fabric Transfer Protocol) is the secure protocol used for telemetry and log transport in the Security Fabric.

Answer

HTTPS

Answer

SNMP

Answer

Syslog

Question 3

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

Accepted Answer

Via CLI using the 'exec switch authorize' command. In a FortiGate Security Fabric, a downstream FortiSwitch is discovered but remains unauthorized until an administrator explicitly authorizes it. The CLI command 'execute switch-controller authorize' (commonly referenced as 'exec switch authorize') is the mechanism used to approve the switch so the FortiGate can manage it as part of the fabric.

Answer

By adding it to the FortiAnalyzer

Answer

By enabling LLDP on the port

Answer

By rebooting the switch

Question 4

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

Accepted Answer

WAF Policy. On FortiWeb, the WAF Policy (also called a protection profile or inline protection profile) is the component that contains the actual security rules — signatures, HTTP protocol constraints, and anomaly detection logic — that inspect traffic for protocol-specific attacks such as HTTP Request Smuggling, HTTP verb tampering, and malformed header attacks. It is bound to a server policy to enforce inspection on matching traffic.

Answer

Service Object

Answer

Virtual Server

Answer

Server Pool

Question 5

Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?

Accepted Answer

FortiToken. FortiToken is Fortinet's proprietary one-time password (OTP) solution, available as hardware tokens, software tokens, or mobile push. It is natively integrated with FortiAuthenticator and provides strong MFA out-of-the-box, with support for TOTP, HOTP, and push notifications. Unlike external identity providers or directory services, FortiToken is purpose-built for MFA and requires minimal configuration, making it the most recommended choice for MFA within FortiAuthenticator.

Answer

SAML External IDP

Answer

OpenLDAP

Answer

Local Database

Question 6

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

Accepted Answer

Session Synchronization. Session Synchronization (also called session replication or session sharing) is the FortiWeb feature that shares the session table across cluster members so that any member can process requests belonging to a session established on another member. This ensures persistence and continuity in an HA FortiWeb cluster.

Answer

Persistence Sharing

Answer

State Replication

Answer

Configuration Sync

Question 7

You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?

Accepted Answer

X-Forwarded-For header insertion. When FortiADC performs SSL offloading, the client's TCP connection terminates at the ADC, so backend servers see the ADC's IP as the source. Enabling X-Forwarded-For (XFF) header insertion causes FortiADC to add an HTTP header containing the original client IP, which backend servers or logging systems can parse to recover the true source address. This is the standard Layer 7 method for preserving client IP across a reverse proxy.

Answer

HTTP compression

Answer

SSL session resumption

Answer

Source IP NAT

Question 8

Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?

Accepted Answer

SAML. Option A (SAML) is correct because FortiAuthenticator can act as a SAML Identity Provider or Service Provider, receiving user identity attributes through SAML assertions exchanged with external IdPs or SPs during authentication. Option D (LDAP) is correct because FortiAuthenticator natively integrates with external LDAP directories (such as Active Directory or OpenLDAP) to query and import user information for authentication and group mapping. SNMP Traps (B) are used for network monitoring and event notifications, not for user identity data. ICMP (C) is a network diagnostic protocol with no user-information capability. HTTP Proxy (E) forwards web traffic and does not serve as a method for FortiAuthenticator to receive user information from an external source.

Answer

SNMP Traps

Answer

ICMP

Answer

HTTP Proxy

Question 9

Which TWO methods are used to share user group information in the Security Fabric?

Accepted Answer

SSO. In the Fortinet Security Fabric, user group information is shared between FortiGate devices through SSO (option A), which uses the FSSO (Fortinet Single Sign-On) mechanism to propagate authenticated user-to-group mappings from a collector agent or FortiAuthenticator to all Fabric members, enabling consistent identity-based policies across the fabric. LDAP group synchronization (option C) is also correct because FortiGates can synchronize user groups directly from an LDAP server (e.g., Active Directory) and share that group membership data across the Security Fabric for unified policy enforcement. VLAN tagging (option B) is a Layer 2 segmentation technique and does not convey user group identity between devices. DHCP option 43 (option D) is used to deliver vendor-specific information such as controller IP addresses to endpoints, not user group data. DNS records (option E) resolve names to addresses and play no role in sharing user group information.

Answer

VLAN tagging

Answer

DHCP option 43

Answer

DNS records

Question 10

Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?

Accepted Answer

Server IP Address. Option B (Server IP Address) is correct because the FortiGate must be configured with the FortiAuthenticator's actual IP address as the RADIUS server target, otherwise authentication requests are sent to the wrong host and fail. Option D (Shared Secret) is correct because both devices must use the identical shared secret to encrypt and validate RADIUS Access-Request/Access-Accept packets; a mismatch causes the FortiAuthenticator to silently discard requests. Option A (RADIUS port) is not required to match in the sense of being a negotiated parameter — the FortiGate simply must be pointed at the port the FortiAuthenticator listens on (default 1812 for authentication), but the port is a configurable endpoint value rather than a credential that must be identical on both sides. Option C (Device MAC address) is irrelevant since RADIUS authentication is IP/UDP-based and does not use MAC addresses. Option E (System hostname) is not used for RADIUS matching; the FortiGate identifies the server by IP and secret, not by hostname.

Answer

RADIUS port

Answer

Device MAC address

Answer

System hostname

Question 11

Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?

Accepted Answer

Block. In a FortiWeb WAF policy, the Action setting determines how the policy handles matching traffic, and the three available actions are Block, Monitor, and Alert. Option A (Block) is correct because it actively denies the matching request, typically returning an HTTP error or resetting the connection. Option B (Monitor) is correct because it allows the traffic to pass while logging and observing it, which is used for tuning policies without disrupting users. Option C (Alert) is correct because it permits the request but generates a notification/log entry to flag the event for administrators. Option D (Encrypt) is not a policy Action setting; encryption is handled by SSL/TLS offloading or profile settings, not by the WAF action. Option E (Bypass) is not one of the three Action choices in a FortiWeb WAF policy; bypass behavior is configured through other mechanisms such as exception or allow rules, not the Action field.

Answer

Encrypt

Answer

Bypass

Question 12

Which THREE elements are essential to define a user in FortiAuthenticator?

Accepted Answer

Group Membership. In FortiAuthenticator, a local user account is fundamentally identified by three required elements: the Username (D), which serves as the unique login identifier for authentication; the Password / Auth method (C), which defines the credential (local password, token, or other authentication mechanism) used to verify the user; and Group Membership (B), which determines the user's role, RADIUS/LDAP policy assignment, and authorization scope within the FortiAuthenticator configuration. These three fields are mandatory when creating a local user under Authentication > User Management > Local Users, since FortiAuthenticator requires an identity, a means of authentication, and group-based policy association. Home address (A) is optional profile metadata and is not required for authentication or authorization. Operating System Version (E) is irrelevant to FortiAuthenticator user definition and is not a configurable required attribute for local users.

Answer

Home address

Answer

Operating System Version

Question 13

Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?

Accepted Answer

Incorrect IP/Port connectivity. Option C is correct because the Security Fabric connection between a FortiGate and FortiAnalyzer depends on reachable IP connectivity and the correct TCP port (default 514 for OFTP/log transmission, with registration/management traffic also requiring the appropriate Fabric ports); if the FortiAnalyzer's IP address or the port is wrong or blocked by routing, NAT, or a firewall policy, the Fabric tunnel cannot establish. Option E is correct because the FortiGate must authenticate to the FortiAnalyzer using valid Fabric credentials — the FortiAnalyzer serial number and the authorization/registration password configured under 'config system central-management' or the Fabric authorization settings; invalid or mismatched credentials cause the registration to be rejected. Option A is wrong because a keyboard layout mismatch only affects local typing input and has no bearing on network Fabric negotiation. Option B is wrong because an outdated browser affects the GUI rendering of the management interface, not the underlying Fabric protocol connection. Option D is wrong because, while high CPU on the FortiGate could degrade performance or delay processing, it is not a common root cause of a Fabric connection failure — connectivity and credential problems are the typical culprits.

Answer

Keyboard layout mismatch

Answer

Outdated browser

Answer

High CPU on FortiGate

Question 14

Which object in FortiWeb is used to define the specific web server or virtual host that the WAF should inspect?

Accepted Answer

Server Policy. In FortiWeb, the Server Policy is the top-level object that ties together the protected server (defined by a Server object), the inspection profile, and the virtual host or domain that FortiWeb should protect. It is the policy that actually tells FortiWeb which web server or virtual host to inspect and which protection rules to apply.

Answer

Inspection Profile

Answer

Server Object

Answer

Virtual Host Profile

Question 15

Which THREE items are required to successfully integrate a FortiAuthenticator with an Active Directory (AD) environment for identity-based policies?

Accepted Answer

Service account with read permissions. Option A is correct because FortiAuthenticator needs a service account with at least read permissions to query AD objects (users, groups, attributes) during LDAP bind and search operations. Option B is correct because FortiAuthenticator must be configured with the LDAP server's IP address or FQDN to establish the connection to the AD domain controller. Option D is correct because a bind user with domain administrator credentials (or equivalent delegated rights) is required so FortiAuthenticator can authenticate to AD and perform the necessary LDAP queries for identity-based policies. Option C is incorrect because client machine MAC addresses are not used for AD/LDAP integration; identity-based policies rely on user/group identity, not MAC addresses. Option E is incorrect because exporting the AD database file (NTDS.dit) is neither required nor a supported method for integrating FortiAuthenticator with AD; integration is done via LDAP/RADIUS queries, not offline database imports.

Answer

A list of all client machine MAC addresses

Answer

The AD database file export

Question 16

You are the security administrator for a company that has deployed a Security Fabric with a root FortiGate, two downstream FortiGates, and a FortiAnalyzer. You need to ensure that all FortiGates can share dynamic routing information and object definitions to simplify management. Which Security Fabric feature should you enable on the root FortiGate?

Accepted Answer

Security Fabric > Fabric Settings > Synchronize Objects and Routes. Enabling object and route synchronization on the root FortiGate ensures that all downstream FortiGates receive consistent address objects, virtual IPs, and routing information. This reduces administrative overhead and prevents policy mismatches, which is essential in a multi-device Security Fabric deployment. The other options address different aspects of Fabric integration, such as third-party device onboarding, centralized management, or authentication, but not the synchronization of objects and routes.

Answer

Fabric SSO

Answer

Fabric Connector

Answer

FortiManager integration

Question 17

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

To trigger actions based on system events. Automation Stitches in the Security Fabric let you define event-driven workflows: a trigger (such as a compromised host detection, IOC match, or log event) fires a set of actions (quarantine, block, notify, run a CLI script) across Fabric devices. This is the core mechanism for automated threat response and orchestration. It is not about syncing users, scanning, or load balancing.

Answer

To synchronize user databases

Answer

To scan for vulnerabilities

Answer

To load balance traffic

Question 18

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

Accepted Answer

Client SSL Profile. SSL offloading on FortiADC is configured via the Client SSL Profile, which holds the server certificate, private key, and TLS parameters used to terminate client-side HTTPS connections on the ADC. Once terminated, the ADC can inspect and load-balance the decrypted traffic before re-encrypting to backends if needed. This is the object that performs the offload.

Answer

Content Routing Policy

Answer

Server SSL Profile

Answer

Layer 7 Persistence Rule

Question 19

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Accepted Answer

Prevention mode. Prevention mode in a FortiWeb server policy actively blocks detected attacks such as SQL injection while allowing legitimate traffic to pass. This is the operational mode that enforces the WAF's security rules and takes action against malicious requests. Detection mode only logs, and learning mode builds a baseline without blocking.

Answer

Transparent mode

Answer

Learning mode

Answer

Detection mode

Question 20

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Accepted Answer

Configure FortiAuthenticator as a RADIUS Server on FortiGate. Option C is correct because the FortiGate must be explicitly configured with a RADIUS server entry pointing to the FortiAuthenticator (via config user radius, specifying the FortiAuthenticator's IP and shared secret) so that the FortiGate can send authentication requests to it. Option E is correct because FortiAuthenticator only accepts RADIUS requests from clients it recognizes, so the FortiGate's IP address must be added as a RADIUS client (with a matching shared secret) under RADIUS Service > Clients on the FortiAuthenticator. Option A is not required for RADIUS authentication, since web certificates are used for HTTPS/SSL inspection or SAML, not RADIUS. Option B is not required because LDAP is a separate authentication protocol and FortiAuthenticator can act as a RADIUS server without enabling LDAP. Option D is not required because SAML is a different federation protocol used for single sign-on, not for RADIUS authentication.

Answer

Install a web certificate on the FortiGate

Answer

Enable LDAP on the FortiAuthenticator

Answer

Configure SAML on the FortiGate