Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) (FORTINET-NSE56) (FORTINET-NSE56) — Questions 1–75

The 'log-server' setting on the FortiGate must be correctly configured to point to the FortiAnalyzer IP.

Custom signatures or exception rules allow for granular bypassing of specific signatures that trigger false positives.

The 'Log Policy' or 'Disk Quota' settings under System Settings define how logs are managed when storage is full.

The Dashboard and Monitor sections show live traffic and status indicators.

Conflicts in object references or synchronization issues are frequent causes of failure.

DMARC settings are managed within the 'AntiSpam' profile under 'Domain settings' or specific DMARC control configurations.

Importing creates the configuration, but you must run 'Import Policy' to move the firewall policies into the ADOM database.

Detection mode allows the FortiWeb to analyze traffic and build a baseline without actively blocking requests.

Session sync (or HA synchronization) is essential for maintaining stateful connections during failover.

FortiAnalyzer includes system dashboards, FortiView, and user-defined custom dashboards.

Yes, you can apply filters to log forwarding profiles to only send specific traffic types.

The global whitelist is found within the AntiSpam profile settings to ensure that senders are always allowed.

An ADOM must have a version selected that matches the firmware version of the FortiGate devices it will manage.

You must set up the 'Mail Server' or 'SMTP' settings in the System Settings to allow the FortiAnalyzer to send emails.

Setting up strict relaying/access control rules and AntiSpam profiles on outbound traffic is necessary to prevent relaying spam.

The SAML debug logs on the FortiAuthenticator provide detail on the assertion exchange and attribute mapping.

HTTPS is used for management and SSH for CLI, while Syslog/OFTP are for log traffic.

The Log View tab provides access to traffic and event logs collected from managed devices.

Since malware in password-protected ZIPs cannot be scanned, blocking these archives is a standard security practice in the AV profile.

The 'Log View' page shows incoming logs in real-time.

Integration requires defining the FortiAuthenticator as a RADIUS server on the FortiGate and ensuring the FortiGate is a registered client on the FortiAuthenticator.

The root FortiGate is the top-level management device that orchestrates other members in the Fabric.

You can configure the AV profile to either block, quarantine, or scan if possible; blocking is often safer for encrypted archives.

Changing the ADOM version updates the supported firmware features and requires existing devices to match the new version.

Cloning creates an exact copy of a policy package, which is useful for creating variations for different deployments.

DMARC checks the From domain, SPF/DKIM alignment, and policy flags.

Policy Packages allow administrators to group policies and apply them specifically to selected device groups or individual devices.

The reputation service uses real-time data to block senders who are known to be malicious, saving system resources.

Auto-cache pre-calculates the data for a report to ensure it can be generated quickly on demand.

Analyzer mode provides the full set of FortiAnalyzer features, including reports, SOC, and analysis.

Connectors are used to integrate FortiAnalyzer with external systems like FortiGate or email servers for automated actions.

FortiAuthenticator serves as an LDAP/RADIUS server for centralized credential management.

Load balancing requires a real server, a server pool, and a virtual server to bind them.

The Quarantine maintenance settings allow for the automatic purging of messages after a set number of days to conserve disk space.

The relay host defines the next hop for outgoing mail, usually the ISP's server or another MTA.

The 'Mail Queue' monitoring page shows all messages currently awaiting delivery or retry.

FortiGate and FortiAuthenticator work together to provide identity-based access control.

'diagnose sql status' is the primary command to check the health and status of the SQL database which stores the logs.

SSL certificates must be synchronized across the cluster to ensure consistent decryption of incoming traffic.

Session synchronization is required in clusters to maintain state if a failover occurs.

Connectors link the Security Fabric to external cloud and virtualization platforms.

Device Manager is where Fortinet devices are registered and their connection status is monitored.

ADOMs provide administrative separation, allow for different firmware version management, and improve scalability.

Revision History allows administrators to view, compare, and revert to previous configuration states.

Restricted ADOMs with granular permissions ensure that data visibility is limited based on the administrator's assigned ADOM and device profile.

The 'Action' field in a policy determines if the email is accepted, rejected, relayed, or quarantined based on matching criteria.

Meta fields allow for dynamic variables that can be defined once and applied across multiple devices.

FortiMail supports Gateway, Transparent, and Server modes.

In reverse proxy mode, the FortiWeb handles the traffic; the servers should communicate back through the load balancer or the network gateway.

Admin password policies are managed within the Administrator settings section of System Settings.

Following the principle of least privilege ensures that the compromise of the service account does not compromise the entire domain.

When storage is full, the system may stop accepting new quarantined items or fail to save new mail.

Device Manager is for registering devices and managing their connection status.

The FortiADC system logs, specifically those related to health check events, provide details on why a node is marked as down.

Global objects allow you to define objects once and push them to multiple ADOMs for consistency.

The 'Preview' feature in the installation wizard provides a side-by-side diff of the changes to be pushed.

Layer 7 load balancing allows for content-based routing and cookie-based persistence.

LDAP (Lightweight Directory Access Protocol) is the standard for directory-based user authentication.

Session limits prevent resource exhaustion by limiting the number of concurrent connections from a single IP.

FortiMail supports internal authentication and external services like LDAP or RADIUS.

The Policy & Objects tab is the central location for managing firewall rules, addresses, services, and schedules.

A 'Modified' status indicates the configuration on the FortiGate has diverged from the configuration stored in the FortiManager database.

Global objects must be assigned to an ADOM before they can be used within that ADOM's policy packages.

FortiWeb logs include traffic, attack, and system events for comprehensive auditing.

The FortiAnalyzer will stop inserting logs into the SQL database, making them unavailable for reports and FortiView, storing them only as raw files.

Log management includes the ingestion/storage of logs and the maintenance (archiving/deletion) of those logs.

Policy packages contain firewall policies, address objects, and services used by those rules.

IMAPS (IMAP over SSL) provides encryption for the retrieval process, making it the most secure choice.

Data masking allows you to hide sensitive information (like internal IPs or usernames) in reports while maintaining the ability to see trends.

FortiGuard provides real-time updates for spam and virus signatures, keeping the appliance protected against new threats.

Configuring the system to only listen on HTTPS (443) and redirecting HTTP (80) requests enforces encryption.

With IBE, the recipient gets a notification email with a link to a secure portal where they can read the encrypted message.

Log View provides a raw, searchable view of the logs stored in the database.

System Settings contains global configurations like administrators, mail servers, and maintenance tasks.

Content profiles are managed under the 'Policy' or 'Profile' sections depending on the firmware version, focusing on content inspection.