301 questions total · 5pages · All types, answers revealed
What is the primary function of the Security Fabric's 'Automation Stitch' feature?
Automation stitches use triggers and actions for automated response.
Why this answer
Automation Stitches trigger actions based on specific events detected by the Security Fabric.
Which TWO methods can be used to back up FortiAnalyzer configuration?
Automated off-box backup is supported.
Why this answer
Configurations can be backed up manually or scheduled for automated export to a remote server.
What is the purpose of 'Revision History' when it comes to policy packages?
Revision history is designed for policy and configuration state management.
Why this answer
It allows administrators to maintain versions of policy packages, facilitating easy rollbacks if a change causes issues.
A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?
A TCP connect check verifies the port is accepting connections.
A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?
Selecting the wrong ADOM is a common reason for missing data.
Why this answer
If logs are not being indexed or if the device is not registered, FortiView cannot display data. Also, ensure the ADOM is selected correctly.
You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?
The test tool allows you to validate the logic against existing logs.
Why this answer
The 'Test' or 'Filter' verification within the event handler configuration is the primary way to check if logs match the trigger.
Which THREE steps are required to implement a new firewall policy using the FortiManager workflow mode?
Workflow requires formal submission.
Why this answer
Workflow mode requires a sequential process of creating, reviewing, and approving changes.
Which TWO of the following are valid log file types supported by FortiAnalyzer?
Event logs are a standard log type.
Why this answer
FortiAnalyzer processes logs from various Fortinet devices, and they are typically stored as indexed database entries or raw archives.
Which THREE settings are required for successful DKIM signing on outgoing mail?
The domain must be identified for signing.
Why this answer
DKIM signing requires a key, a selector, and the configuration of the signing domain.
Which TWO actions can be automated via a FortiGate Automation Stitch?
Host isolation is a common security action.
Why this answer
Automation stitches commonly trigger alerts (email/logs) or network actions (quarantine).
What is the purpose of the 'Security Fabric' dashboard on the FortiGate?
The Fabric dashboard shows the health and connectivity of the entire security ecosystem.
Why this answer
The dashboard provides a visual topology and overview of all connected Fabric devices.
Where do you check the current status of the FortiMail services?
The dashboard provides a real-time status summary.
Why this answer
The dashboard provides an overview of system status and active services.
Which TWO of the following are valid ways to monitor the status of managed FortiGate devices in the Device Manager?
The dashboard displays summaries of managed devices.
Why this answer
Device manager provides real-time connection status and sync status indicators.
Which THREE components are visible in the 'Log View' interface?
The table shows the actual log entries.
Why this answer
Log View allows you to see the log table, use filters, and select the time period.
Which TWO conditions must be met to successfully use an 'Install Config' wizard for device-level settings?
FMG must have the latest config state to calculate changes.
Why this answer
The device must be registered and the database must be synchronized.
When adding a FortiGate to a FortiAnalyzer, which information is required?
The serial number is the unique identifier for registration.
Why this answer
You need the serial number and the IP/registration configuration on the FortiGate side.
In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?
FortiMail typically rejects unknown recipients during the SMTP conversation to prevent backscatter.
Why this answer
By default, FortiMail acts as a relay. If it doesn't recognize the recipient, it may reject the connection or try to relay it based on relay policies.
What is the purpose of an 'Event Handler' in FortiAnalyzer?
Event handlers are the engine for alerts.
Why this answer
Event handlers monitor incoming logs and trigger alerts when specific conditions are met.
What is the benefit of using FortiAnalyzer in the Security Fabric?
The primary role of FortiAnalyzer is log management and forensic reporting.
Why this answer
FortiAnalyzer provides centralized log aggregation and analytics for the entire Fabric.
Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?
Discards the request.
Why this answer
Standard actions include blocking, alerting, and monitoring traffic.
Which component of FortiAnalyzer is used to identify top talkers on the network?
FortiView identifies top talkers/threats.
Why this answer
FortiView's 'Sources' or 'Destinations' widgets show traffic volume rankings.
Which TWO types of logs can be generated by FortiMail?
Logs specific to mail filtering.
Why this answer
FortiMail generates various logs including Event and Spam logs.
Which configuration file format is used for importing user lists?
CSV is the standard format for user lists.
Why this answer
FortiMail typically supports CSV files for the bulk import of user addresses.
You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?
The 'Modified' status indicates a configuration mismatch between the manager and the managed device.
Why this answer
Modified status means the device configuration in FortiManager differs from the configuration running on the physical FortiGate.
Where do you configure the email server settings for FortiManager alert notifications?
System-wide settings like mail servers are configured here.
Why this answer
Email server settings are located in System Settings under the Mail Server configuration.
Which THREE actions are available in the 'DLP' section of a policy?
Discarding is a common action for policy violations.
Why this answer
DLP allows for logging, quarantining, and rejecting content.
A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?
The ADC tracks server capacity and marks it busy when limits are hit.
Why this answer
The 'Server Busy' status usually means the server has reached its connection limit as defined in the server object.
Which FortiMail feature helps to prevent 'backscatter' when dealing with spam?
This prevents the creation of NDRs.
Why this answer
Backscatter occurs when the server sends NDRs (non-delivery reports) for spam that was spoofed; rejecting at the SMTP stage prevents this.
You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?
Receiving servers query DNS to verify the signature using the published public key.
Why this answer
DKIM verification relies on the public key being published as a TXT record in the DNS zone of the sending domain.
When using 'Install Wizard', what does the 'Auto-update' check-box do?
It facilitates automated configuration synchronization.
Why this answer
Auto-update, when enabled, keeps the FortiManager and device in sync after policy changes.
If an administrator needs to ensure that a specific set of CLI commands is always applied during the deployment of a new device, which tool should be used?
CLI templates are specifically designed for this provisioning scenario.
Why this answer
Provisioning templates allow administrators to define 'CLI Templates' which can be associated with devices upon registration or deployment.
How can you restrict management access to the FortiMail GUI to only specific IP addresses?
Trusted hosts restrict access by IP.
Why this answer
Access control can be restricted in the 'Access' or 'Admin' profile settings by defining allowed source IPs.
In FortiSoC, what is the purpose of the 'Playbook Trigger'?
The trigger is the event that initiates the logic.
Why this answer
The trigger defines the condition (e.g., an event) that initiates the playbook execution.
Which THREE of the following are features of the FortiManager 'Global Settings'?
Account creation is a system setting.
Why this answer
Global settings cover administrative access, system time, and service parameters.
Which dashboard provides a 'Threat Map'?
FortiView contains the Threat Map.
Why this answer
The FortiView 'Threat Map' shows real-time global threat activity.
Which TWO settings are configurable in a 'Recipient Policy'?
Profiles are assigned via policy.
Why this answer
Recipient policies control relaying and the AntiSpam/AV profiles applied to messages.
What is a 'Playbook' in the context of FortiSoC?
Playbooks automate incident handling.
Why this answer
A playbook is an automated sequence of tasks designed to respond to security incidents.
A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?
This specifically tracks playbook runs and errors.
Why this answer
The 'Playbook Execution' view provides logs for each task performed by a playbook.
Which TWO of the following are components of the FortiMail AntiSpam framework?
Heuristic scanning is a core component.
Why this answer
Heuristic scanning and Bayesian analysis are both key components of the AntiSpam engine.
You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?
Policy Check verifies the integrity and validity of the policy package.
Why this answer
The 'Policy Check' feature validates the configuration logic and syntax of policy packages before installation.
In the context of FortiAuthenticator, what does 'SSO' stand for?
SSO enables centralized authentication across multiple platforms.
Why this answer
Single Sign-On is the feature that allows users to authenticate once to access multiple resources.
In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?
SSL Offloading terminates the client SSL and provides inspection capabilities.
Why this answer
SSL Offloading (or SSL Termination) allows the FortiADC to decrypt the traffic, inspect it, and then re-encrypt it before sending it to the backend.
What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?
Device registration and authorization are the required initial steps.
Why this answer
The FortiGate must be added to the ADOM and authorized by an administrator.
Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?
FortiAP provides wireless access telemetry.
Why this answer
The Security Fabric is designed to integrate FortiSwitch, FortiAP, FortiAnalyzer, and other devices for shared intelligence.
Which TWO of the following are valid states for a device in FortiManager?
This is a healthy state.
Why this answer
Devices can be synchronized, modified, or in a state requiring retrieval.
Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?
FortiToken provides seamless MFA integration within the FortiAuthenticator environment.
Why this answer
FortiToken is the native MFA solution integrated deeply with the FortiAuthenticator platform.
Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?
Network issues prevent the Fabric handshake.
Why this answer
Network reachability and mismatched credentials/certificates are the most common causes for connection drops.
Which of the following is a valid method for importing a FortiGate configuration into FortiManager?
Uploading a config file is a supported way to import existing device configurations.
Why this answer
Direct connection from the FortiManager to the FortiGate via the Add Device wizard is the primary import method.
Which protocol is utilized for log forwarding between FortiAnalyzer units?
OFTP is the Fortinet-specific protocol for log forwarding.
Why this answer
FortiAnalyzer uses the proprietary OFTP protocol to securely forward logs between devices.
Which dashboard shows the health status of all registered devices?
Shows connectivity and health of devices.
Why this answer
The Device Manager dashboard provides a quick view of the status of all registered devices.
Which THREE actions can be performed on a policy package within the Policy & Objects tab?
Packages can be cloned to create variations.
Why this answer
Policy packages support cloning, deleting, and locking as part of their management lifecycle.
In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?
Header rewrite scripts are designed for this modification.
Why this answer
FortiADC content routing and header modification rules are used to manipulate HTTP headers.
You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?
If the server returns 200 OK but the health check expects 302, it will fail.
Why this answer
The health check method and the expected status code in the response are critical for verification.
Which THREE actions can be taken by a DLP filter when a match is found?
Encryption can be triggered by DLP policy.
Why this answer
DLP filters can be configured to log, quarantine, or block/reject messages based on the rule.
Which THREE features are provided by the FortiADC when acting as an application delivery controller?
L7 load balancing allows traffic routing based on content.
Why this answer
FortiADC provides load balancing, WAF capabilities, and global traffic management.
When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?
FortiManager performs a validation check; if it detects an inconsistency, it will stop the install process.
Why this answer
FortiManager validates the configuration before pushing and will fail the installation if referenced objects are missing.
Without the correct VSA attributes, the FortiGate cannot map the user to the correct policy group.
Why this answer
FortiAuthenticator must pass the group membership information to the FortiGate via the RADIUS VSA (Vendor Specific Attribute) or FSSO, and the FortiGate must be configured to map these groups.
What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?
Standard policy is to overwrite the oldest logs.
Why this answer
The system follows the configured 'Log Policy', which usually defaults to deleting the oldest logs.
Which FortiView tool allows you to see traffic patterns based on geographical origin?
The map view uses GeoIP data to visualize traffic origins.
Why this answer
The 'Sources' or 'Map' widget in FortiView provides visual geographic location data.
Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?
LDAP is a standard external auth method.
Why this answer
FortiAnalyzer supports both local authentication and external directory services (LDAP/RADIUS).
You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?
Cookie persistence allows the load balancer to track the user session via application cookies.
Why this answer
Cookie-based persistence, specifically 'Insert Cookie' or 'Passive Cookie', is the standard for application-level persistence.
Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?
TACACS+ is used for administrative access control and is supported.
Which component of the FortiADC performs the translation between the virtual IP and the real server IP?
The virtual server is the front-end entity that processes incoming traffic.
Why this answer
The Virtual Server binds the VIP to the server pool, performing the actual load balancing and NAT.
When using FortiMail in Server Mode, how does the appliance handle incoming mail?
Server Mode makes FortiMail the primary mail server.
Why this answer
In Server Mode, FortiMail acts as the actual mail server (providing POP3/IMAP/Webmail services), so it receives mail directly for local domains.
Which THREE items are checked by the AntiSpam profile during email processing?
SPF is a part of AntiSpam/Authentication checks.
Why this answer
AntiSpam profiles utilize various techniques including RBLs, SPF/DKIM validation, and heuristics.
Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?
Naming the ADOM is a mandatory step during creation.
Why this answer
Enabling ADOMs and setting the mode are the primary requirements for initial setup.
You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?
Enabling X-Forwarded-For ensures the backend server sees the real client IP.
Why this answer
The X-Forwarded-For header is the standard way to inject the client IP into the HTTP request headers for the backend server.
When configuring DMARC on FortiMail, which THREE components are required to successfully implement a 'reject' policy?
DKIM is a prerequisite for DMARC alignment.
Why this answer
DMARC relies on SPF and DKIM for alignment, and the DMARC record in DNS dictates the policy.
A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?
The GUI includes an integrated API explorer for testing and documentation.
Why this answer
The API documentation is accessible directly through the FortiADC web interface.
An administrator is using the 'Policy Lookup' tool in FortiManager. What does this tool provide?
This tool is used to simulate and verify policy matching.
Why this answer
Policy Lookup allows admins to test traffic flow by entering source, destination, and service to see which policy would match.
Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?
The client must know the IP address of the RADIUS server.
Why this answer
Shared secret and server IP address are essential for RADIUS communication.
Which TWO of the following are valid methods to initiate a configuration backup of a managed FortiGate device from FortiManager?
This is a direct method to force a backup.
Why this answer
Backups can be triggered manually via the 'Backup' button in Device Manager or via the 'Revision History' save function.
Which TWO actions can be triggered by a FortiSoC Playbook?
Email is a standard playbook action.
Why this answer
Playbooks can perform actions like notifying an admin via email or updating a security object on a FortiGate.
An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?
SPF checks the DNS TXT record for authorized sending IPs.
Why this answer
SPF (Sender Policy Framework) is used to verify that the sending IP is authorized by checking the sender domain's DNS TXT records.
Which TWO actions occur during the FortiMail inspection process before an email is delivered?
AntiSpam filtering is a core inspection step.
Why this answer
Inspection involves AV scanning and AntiSpam filtering.
Practice FORTINET-NSE56 by domain
Target a specific domain to shore up weak areas.