FORTINET-NSE56 Practice Questions

Question 1

Which TWO of the following are valid methods to back up a FortiManager configuration?

Accepted Answer

Manual backup via the System Settings GUI.. Option B is correct because FortiManager's System Settings GUI includes a Backup/Restore page where an administrator can manually export the full configuration (including ADOMs and device databases) to a local file. Option D is correct because FortiManager supports scheduled backups that push configuration backups to an FTP, SFTP, or SCP server via the 'set backup-mode' and related CLI/GUI scheduling settings. Option A is not a native FortiManager backup method, as USB copy is not a supported configuration backup mechanism on FortiManager. Option C is wrong because the Backup button belongs to FortiGate, not FortiManager. Option E is wrong because FortiManager does not perform automatic cloud sync of its configuration to FortiCloud.

Answer

Copying files via USB drive.

Answer

Using the 'Backup' button on the FortiGate.

Answer

Automatic cloud sync to FortiCloud.

Question 2

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

Accepted Answer

FortiAuthenticator Authentication Logs. When a user is denied access through a FortiAuthenticator-backed portal, the FortiAuthenticator Authentication Logs are the authoritative source because they record the full RADIUS/LDAP exchange, including whether the user was found, whether group membership was evaluated, and the exact rejection reason. Since the user exists in the mapped AD group, the failure is likely in the authentication flow itself (bind failure, group filter mismatch, or policy mapping), all of which are visible in these logs. Checking logs first follows the standard troubleshooting methodology of gathering evidence before changing configuration.

Answer

The AD domain controller's disk space

Answer

The FortiGate session table

Answer

The WAF policy on FortiWeb

Question 3

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Accepted Answer

The number of matches. In a FortiAnalyzer Event Handler, the Threshold defines the trigger condition and the Count field specifies how many matching log entries must occur within the configured time window before the handler fires. In other words, Count is the number of matches, not the total logs received or a priority value. This lets administrators say 'alert me when 10 failed logins occur in 5 minutes' by setting Count=10 and the time window accordingly.

Answer

The total number of logs

Answer

The priority of the alert

Answer

The time window in seconds

Question 4

Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?

Accepted Answer

telnet 25. The telnet command (D) allows you to test TCP connectivity to a specific port, such as port 25 for SMTP. By running 'telnet 25', you can verify if the remote mail server is reachable and accepting connections on that port. This is a standard network troubleshooting step.

Answer

ping <IP>

Answer

arp -a

Answer

traceroute <IP>

Question 5

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

Accepted Answer

The ADOM contains devices. An ADOM cannot be deleted while it still contains devices; the delete option is greyed out until all devices (and their associated objects) are removed or moved to another ADOM. This is a built-in safeguard to prevent accidental loss of device configurations and log data. Read-only mode, log data, and admin rights do not cause the delete option to be greyed out in the same way.

Answer

The ADOM is set to 'Read-Only'

Answer

The ADOM has log data

Answer

The administrator lacks super_admin rights

Question 6

What is the purpose of the 'Add Device' wizard?

Accepted Answer

To register a new device to be managed by FortiManager.. The 'Add Device' wizard in FortiManager is specifically designed to add and register a new FortiGate or other supported device so that it can be centrally managed by FortiManager. This process involves specifying the device's serial number, IP address, and credentials, after which FortiManager can push configuration, policies, and firmware updates to the device. It is the initial step to bring a device under FortiManager's management umbrella.

Answer

To update the FortiGate firmware.

Answer

To migrate policies.

Answer

To configure VPN tunnels.

Question 7

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

Accepted Answer

The Shared Secret. The Shared Secret is the pre-shared key used to secure RADIUS communication between the FortiAuthenticator (RADIUS server) and the third-party VPN gateway (RADIUS client). Both devices must be configured with the identical shared secret; otherwise, RADIUS authentication requests will be rejected due to message integrity check failures. The other settings are either optional or not required to match for basic authentication.

Answer

The RADIUS accounting port

Answer

The NAS-IP-Address

Answer

The VSA Vendor ID

Question 8

Which menu path is used to create a new Administrator account?

Accepted Answer

System Settings > Admin. In the FortiGate GUI, administrator accounts are created under System Settings > Admin, where you define the username, password, admin profile, and trusted hosts. This is the standard location for local admin management on FortiOS.

Answer

Device Manager

Answer

Report Settings

Answer

FortiSoC

Question 9

Which configuration is required to allow external users to access the Webmail portal?

Accepted Answer

An Access Control rule.. Access Control rules in FortiMail define which source IP addresses or networks are permitted to reach specific services, including the Webmail portal. To allow external users to access Webmail, an administrator must create an access control rule that permits the relevant source addresses to connect to the Webmail service on the appropriate interface. Without this rule, connections are denied by default.

Answer

An AntiSpam profile.

Answer

A relay host.

Answer

A static route.

Question 10

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

Accepted Answer

You must configure a bridge pair of interfaces to pass traffic transparently.. FortiMail Transparent Mode requires a bridge pair — two interfaces bridged together so FortiMail sits inline between the mail server and the network without changing IP addressing. Traffic passes through the bridge, and FortiMail inspects SMTP transparently. This bridge pair is the mandatory network configuration for transparent deployment.

Answer

The mail server must point to the FortiMail IP as its default gateway.

Answer

The FortiMail must be configured with a unique IP address for each physical port for routing.

Answer

The FortiMail must be configured as a mail relay agent.

Question 11

Which TWO of the following are true about 'Scripts' in FortiManager?

Accepted Answer

They can be scheduled to run at specific times.. Option B is correct because FortiManager scripts support scheduling, allowing an administrator to define when a script executes (for example, a one-time run at a future date/time or a recurring schedule) rather than only running it manually on demand. Option E is correct because FortiManager scripts can be executed against multiple managed FortiGate devices at once, either by selecting several devices or by targeting a device group, which is a core benefit of centralized script management. Option A is wrong because scripts are not limited to a single execution; they can be run repeatedly and can also be scheduled. Option C is wrong because scripts execute CLI commands or configuration snippets on devices and do not automatically transform into policy objects or policy packages. Option D is wrong because scripting is a built-in FortiManager feature and does not require a separate add-on license.

Answer

They can only be run once.

Answer

They automatically convert to policies.

Answer

They require a separate license.

Question 12

When should you use 'Log Archive' instead of 'Log Database'?

Accepted Answer

For long-term storage. Log Archive is designed for long-term storage and compliance retention, storing logs in a compressed format that is not indexed for fast querying. Log Database, by contrast, is optimized for real-time analysis and fast searches. Therefore, Log Archive should be used when the primary requirement is long-term retention rather than immediate analytics.

Answer

For real-time traffic analysis

Answer

For triggering alerts

Answer

For generating daily reports

Question 13

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

Accepted Answer

Policy & Objects > Task Monitor. FortiManager logs all policy installation tasks in the Task Monitor, accessible under Policy & Objects > Task Monitor. When an installation fails due to an object conflict or any other reason, the Task Monitor shows the task status, the affected device, and a detailed log with the specific error message (e.g., which object conflicted and why). This is the primary place to diagnose installation failures.

Answer

Device Manager > Revision History

Answer

System Settings > Event Log

Answer

Policy & Objects > Installation Targets

Question 14

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Accepted Answer

Automating incident response actions. Automation Stitches in the Security Fabric let you define trigger-action workflows that automatically respond to security events, such as quarantining a compromised endpoint or blocking an IP. The primary benefit is automating incident response actions across Fabric-connected devices. This reduces response time and manual effort.

Answer

Improving log compression

Answer

Increasing bandwidth

Answer

Updating firmware

Question 15

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Accepted Answer

Playbook Execution logs. FortiSOAR (and FortiGate's automation stitches) maintain dedicated Playbook Execution logs that record each playbook run, the actions executed, their results, and any errors. When a playbook fails to execute an action, the Playbook Execution logs are the correct place to inspect the execution history and diagnose the failure.

Answer

Device manager logs

Answer

System logs

Answer

FortiView

Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) FORTINET-NSE56 practice test

Three ways to study

Study FORTINET-NSE56 by domain

Study FORTINET-NSE56 by topic

Nse5 Fortianalyzer Operations practice questions

Nse6 Fortimail Secure Email Gateway practice questions

Nse5 Fortimanager Operations practice questions

Nse6 Security Fabric Specialist Topics practice questions

FORTINET-NSE56 fundamentals practice questions

FORTINET-NSE56 scenario practice questions

FORTINET-NSE56 troubleshooting practice questions

Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) (FORTINET-NSE56) practice questions