Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) (FORTINET-NSE56) FORTINET-NSE56 Questions 151–225 | Page 3/4

151

MCQhard

In FortiManager, what is the result of using the 'Re-install Policy' option instead of the 'Install Wizard'?

A.It forces a factory reset of the FortiGate.

B.It deletes all objects not in use.

C.It uses the last saved installation parameters to re-push the configuration.

D.It performs an automatic firmware update.

AnswerC

Re-install Policy re-pushes the policy package using the installation parameters stored from the previous install, without prompting for target device or scope. This satisfies the scenario's requirement to repeat a deployment quickly, whereas the Install Wizard forces you to reselect devices and options each time.

Why this answer

'Re-install Policy' in FortiManager re-pushes the last successfully installed policy package and configuration to the managed FortiGate using the saved installation parameters (target device, ADOM, and revision). It does not run the full Install Wizard again, so it is faster and preserves the prior install scope. This is useful when a device was restored or a config drift needs to be corrected without re-selecting targets.

Exam trap

FORTINET-NSE56 often tests the confusion between 'Re-install Policy' (replay last install) and 'Install Wizard' (new install with target selection), tricking candidates into thinking re-install resets or upgrades the device.

How to eliminate wrong answers

Option A is wrong because 'Re-install Policy' does not factory-reset a FortiGate; factory reset is a separate device action and would wipe the config, which is not what re-install does. Option B is wrong because unused object cleanup is a separate FortiManager feature (e.g., 'Delete Unused Objects' or ADOM cleanup), not part of re-install. Option D is wrong because firmware upgrades are handled by FortiManager's firmware management or FortiGuard upgrade features, not by re-installing a policy package.

Full explanation →

152

MCQhard

You notice that the FortiMail system time is incorrect, causing issues with SSL/TLS certificate validation. How do you correct this?

A.Disable SSL certificate validation.

B.Configure an NTP server.

C.Restart the system clock service.

D.Manually update via the CLI.

AnswerB

Configuring an NTP server synchronises FortiMail's system clock against an authoritative time source, directly resolving the drift that invalidates SSL/TLS certificate validity checks. Certificate validation depends on accurate timestamps, so correcting the clock through NTP satisfies the stem's requirement and restores trusted connections.

Why this answer

Incorrect system time on FortiMail breaks SSL/TLS certificate validation because certificates have validity windows and the TLS handshake checks the current time against 'notBefore' and 'notAfter'. The correct fix is to configure an NTP server so FortiMail synchronizes its clock accurately and continuously.

Exam trap

FORTINET-NSE56 often tests whether candidates choose the quick workaround (disable validation) over the root-cause fix (NTP) — the trap is picking 'disable SSL certificate validation' because it makes the error message disappear.

How to eliminate wrong answers

Option A is wrong because disabling SSL certificate validation is a security downgrade that masks the symptom rather than fixing the root cause of incorrect time. Option C is wrong because there is no separate 'system clock service' to restart — the clock is maintained by the OS and NTP daemon. Option D is wrong because manually setting the time via CLI is a temporary workaround that drifts and does not provide ongoing accuracy; NTP is the proper solution.

Full explanation →

153

MCQeasy

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

A.Offline mode with learning enabled

B.Prevention mode with signature-based scanning enabled

C.Transparent mode with only DoS prevention

D.Detection mode with no signatures

AnswerB

Prevention mode actively drops matching requests rather than merely logging them, and signature-based scanning detects known SQL injection patterns with high specificity. Combining both blocks attacks inline while limiting false positives that would disrupt legitimate production traffic.

Why this answer

Prevention mode with signature-based scanning is the most effective because it actively blocks SQL injection attempts by matching known attack patterns (signatures) in real time. This mode enforces the policy, dropping malicious requests before they reach the backend server. Signature-based scanning specifically targets SQLi patterns, reducing false positives compared to anomaly-based detection, which can flag legitimate traffic.

In production, this balance of security and accuracy is critical.

Exam trap

FORTINET-NSE56 often tests the distinction between detection and prevention modes, and the role of signatures versus learning, causing candidates to confuse passive monitoring with active blocking.

How to eliminate wrong answers

Option A is wrong because offline mode only logs traffic without blocking, and learning mode is for baselining, not active protection. Option C is wrong because transparent mode with only DoS prevention focuses on volumetric attacks, not application-layer SQLi, and lacks deep inspection. Option D is wrong because detection mode only alerts without blocking, and without signatures it cannot reliably identify SQLi patterns.

Full explanation →

154

MCQeasy

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

A.The mail server must point to the FortiMail IP as its default gateway.

B.The FortiMail must be configured with a unique IP address for each physical port for routing.

C.The FortiMail must be configured as a mail relay agent.

D.You must configure a bridge pair of interfaces to pass traffic transparently.

AnswerD

Transparent mode requires a bridge pair: two interfaces bound together so FortiMail forwards traffic without altering IP addressing or routing. This bridge pair is mandatory, as it lets FortiMail inspect mail transparently while remaining invisible to the surrounding network.

Why this answer

FortiMail Transparent Mode requires a bridge pair — two interfaces bridged together so FortiMail sits inline between the mail server and the network without changing IP addressing. Traffic passes through the bridge, and FortiMail inspects SMTP transparently. This bridge pair is the mandatory network configuration for transparent deployment.

Exam trap

FORTINET-NSE56 often tests the difference between transparent mode (bridge pair, no IP changes) and gateway mode (routed, MX changes), catching candidates who pick gateway-mode requirements.

How to eliminate wrong answers

Option A is wrong because in transparent mode FortiMail does not act as a gateway; the mail server keeps its existing default gateway, and FortiMail is simply inline. Option B is wrong because unique IPs per port are used in gateway (routed) mode, not transparent mode. Option C is wrong because mail relay agent configuration is a role setting, not the mandatory network requirement for transparent mode; the bridge pair is the defining requirement.

Full explanation →

155

MCQmedium

You are troubleshooting a Security Fabric deployment where a downstream FortiGate is not appearing in the Fabric topology on the root FortiGate. You have verified that the downstream FortiGate is configured with the correct root FortiGate IP and that network connectivity exists. Which action should you take next to resolve the issue?

A.Check the downstream FortiGate's Fabric settings to ensure the Security Fabric is enabled.

B.Delete and re-add the downstream FortiGate on the root FortiGate.

C.Restart the FortiAnalyzer service.

D.Reconfigure the root FortiGate's management IP.

AnswerA

If the Security Fabric is not enabled on the downstream FortiGate, it will not attempt to join the Fabric, even if the root IP is configured. Enabling the Fabric on the downstream device is a prerequisite for it to appear in the topology. This is a common oversight during deployment.

Why this answer

The most likely cause is that the Security Fabric is not enabled on the downstream FortiGate. Without it, the device will not initiate the Fabric join process. Verifying this setting is a logical next step after confirming connectivity and root IP configuration.

The other actions are either irrelevant or premature.

Exam trap

The trap here is overlooking that the downstream FortiGate must have the Security Fabric feature explicitly enabled; configuring the root IP alone is insufficient.

Full explanation →

156

MCQhard

When using 'VPN Manager', what is the main benefit compared to manual VPN configuration?

A.It automates the creation of complex VPN topologies.

B.It automatically updates the ISP routing.

C.It increases encryption strength.

D.It removes the need for IPsec.

AnswerA

VPN Manager automates the creation of complex VPN topologies such as hub-and-spoke and full mesh, generating the required Phase 1 and Phase 2 settings across managed devices. This satisfies the requirement by removing the manual per-device configuration effort.

Why this answer

VPN Manager in FortiManager automates the creation and deployment of VPN topologies (hub-and-spoke, full mesh, etc.) across multiple FortiGates. Instead of manually configuring IPsec on each device, you define the topology once and VPN Manager generates and pushes the configuration, reducing errors and effort.

Exam trap

The trap is assuming VPN Manager does more than it does — candidates pick options about routing or encryption, but VPN Manager's core value is topology automation, not routing or crypto changes.

How to eliminate wrong answers

Option B is wrong because VPN Manager does not manage ISP routing — routing is handled by the FortiGate's routing configuration and SD-WAN, not by VPN Manager. Option C is wrong because VPN Manager does not change encryption strength; encryption algorithms are set in the IPsec phase1/phase2 proposals, which VPN Manager can template but does not inherently strengthen. Option D is wrong because VPN Manager still uses IPsec; it automates IPsec configuration, it does not eliminate the need for it.

Full explanation →

157

MCQhard

Where do you configure the expiration period for messages in the quarantine?

A.Access rules.

B.Quarantine maintenance settings.

C.System logs.

D.AntiSpam profile.

AnswerB

Quarantine maintenance settings govern retention behaviour, including the expiration period after which quarantined messages are purged. Configuring this value here satisfies the requirement to define how long messages remain before automatic deletion, rather than per-policy or notification options.

Why this answer

The expiration period for quarantined messages in FortiMail is configured under Quarantine maintenance settings. This area controls how long messages remain in quarantine before being automatically deleted, along with other maintenance tasks like database cleanup. It is the correct location for setting quarantine retention policies.

Exam trap

FORTINET-NSE56 often tests the difference between configuring what happens to a message (AntiSpam profile or access rule) versus how long it is retained (Quarantine maintenance settings), causing candidates to pick the profile.

How to eliminate wrong answers

Option A is wrong because access rules determine message handling (accept, reject, quarantine) but do not control how long quarantined messages are retained. Option C is wrong because system logs record events and do not manage quarantine expiration. Option D is wrong because AntiSpam profiles define spam detection thresholds and actions, not quarantine retention periods — the profile may send a message to quarantine, but the expiration is set in maintenance settings.

Full explanation →

158

MCQeasy

What is the purpose of the 'License' section in the FortiMail menu?

A.To check for updates.

B.To reboot the system.

C.To view and manage product licenses.

D.To view logs.

AnswerC

The License section exists solely to display FortiMail's installed entitlements—such as antivirus, antispam and FortiSandbox signatures—and to apply or renew activation codes. It satisfies the stem's requirement by providing the administrative interface for viewing and managing product licences, rather than configuring mail policies or system settings.

Why this answer

The 'License' section in the FortiMail menu is where administrators view and manage product licenses, including FortiMail VM licenses, antispam/antivirus signature licenses, and FortiGuard service entitlements (C). It shows license status, expiry dates, and allows uploading or refreshing license files. This is essential for ensuring security services remain active and the appliance stays compliant.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse the License section with Maintenance or FortiGuard update sections — all three are administrative, but only License handles entitlements and expiry.

How to eliminate wrong answers

Option A is wrong because checking for updates is done through the FortiGuard or System > Maintenance sections, not the License section — updates are a separate function from license management. Option B is wrong because rebooting the system is performed under System > Maintenance or via the CLI 'execute reboot' command, not from the License menu. Option D is wrong because viewing logs is done through Log & Report, not the License section — logs and licenses are unrelated administrative domains.

Full explanation →

159

Multi-Selectmedium

Which TWO of the following are allowed in an ADOM?

Select 2 answers

A.Multiple policy packages.

B.Multiple administrative domains.

C.Multiple FortiManager units.

D.Multiple firmware versions per device.

E.Multiple FortiGate devices.

AnswersA, E

An ADOM can hold multiple policy packages, satisfying the requirement that several independent sets of firewall policies coexist within one administrative domain. Each package binds to its own managed devices and installation targets, so distinct policy scopes remain isolated without requiring separate ADOMs.

Why this answer

Option A is correct because an ADOM (Administrative Domain) is a logical container in FortiManager that can hold multiple policy packages, allowing different sets of firewall policies to be managed and assigned to different managed devices within that domain. Option E is correct because an ADOM is designed to group and manage multiple FortiGate devices (or other supported Fortinet devices) under a single administrative boundary, which is the core purpose of an ADOM. Option B is incorrect because ADOMs are the top-level administrative domains themselves; nesting multiple administrative domains inside one ADOM is not supported.

Option C is incorrect because FortiManager units are separate management appliances, not objects contained within an ADOM. Option D is incorrect because an ADOM does not permit multiple firmware versions per device; each managed device runs its own firmware, and ADOM-level firmware management does not allow a single device to hold multiple firmware versions.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse what an ADOM contains (policy packages, devices) with what it cannot contain (other ADOMs, multiple FortiManagers, mixed firmware versions).

Full explanation →

160

MCQhard

You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?

A.System > Log Settings > Remote Logging

B.Authentication > RADIUS > Logging

C.General > Reporting

D.Network > Interfaces

AnswerA

FortiAuthenticator's remote syslog export is defined under System > Log Settings > Remote Logging, where you specify the syslog server address, port and facility. This is the only path that configures an external logging destination, satisfying the requirement to forward logs to a remote server.

Why this answer

FortiAuthenticator's remote logging configuration is located under System > Log Settings > Remote Logging. This section allows administrators to define one or more remote syslog servers by specifying the server IP/hostname, port, and protocol (UDP/TCP/TLS). It is the dedicated interface for exporting logs to external syslog destinations, separate from local logging and other event sources.

Exam trap

FORTINET-NSE56 often tests the exact menu path for remote logging, and candidates may confuse it with RADIUS or reporting settings because those also involve logs or authentication events.

How to eliminate wrong answers

Option B is wrong because Authentication > RADIUS > Logging does not exist as a configuration path for remote syslog; RADIUS-related settings are for authentication policies and do not control log export destinations. Option C is wrong because General > Reporting is not a valid FortiAuthenticator menu path for defining remote logging; reporting typically refers to generating reports, not configuring syslog forwarding. Option D is wrong because Network > Interfaces is used to configure network interfaces (IP addresses, VLANs, etc.), not to set up remote log destinations.

Full explanation →

161

MCQeasy

Which of these is a legitimate reason to place a sender on the 'Block' list in the AntiSpam profile?

A.The sender's domain has a valid SPF record.

B.The sender is a partner company.

C.The sender is an internal employee.

D.The sender consistently sends unwanted spam emails.

AnswerD

Block listing is intended for senders whose mail should be rejected outright; consistent unwanted spam fits this precisely. The stem asks for a legitimate reason, and repeated spam delivery satisfies the criterion for permanent blocking rather than greylisting or tagging.

Why this answer

The Block list in the AntiSpam profile is used to explicitly deny email from senders, domains, or IP addresses that are known to send unwanted spam. A sender who consistently sends spam is the textbook legitimate reason to block them, as this is the intended use of the block list to enforce policy. Blocking is a deliberate administrative action based on observed malicious or unwanted behavior, not on legitimate business relationships or technical configurations.

Exam trap

FORTINET-NSE56 often tests the distinction between legitimate reasons to block (observed spam behavior) and legitimate reasons to allow (trusted partners, valid SPF, internal users) — candidates may incorrectly associate technical legitimacy like SPF with blocking.

How to eliminate wrong answers

Option A is wrong because a valid SPF record indicates the sender's domain is properly configured to prevent spoofing — this is a sign of a legitimate sender and a reason to allow, not block. Option B is wrong because a partner company is a trusted business entity whose mail should typically be allowed or whitelisted, not blocked; blocking a partner would disrupt business communications. Option C is wrong because an internal employee is part of the organization and their mail should be permitted by default; blocking an internal sender would be a policy violation unless there is a specific security incident, which is not stated.

Full explanation →

162

MCQhard

You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?

A.Access Control Rule

B.Content profile

C.DLP dictionary

D.Antivirus policy

AnswerC

The DLP dictionary holds the patterns and regular expressions that identify sensitive data such as credit card numbers. Configuring it supplies the pattern matching the DLP sensor references when blocking emails, satisfying the detection requirement in the stem.

Why this answer

A DLP dictionary defines the patterns (such as regular expressions or predefined patterns for credit card numbers, SSNs, etc.) that the DLP engine uses to identify sensitive data. To block emails containing credit card numbers, you must configure a DLP dictionary with the appropriate pattern (e.g., a regex for 16-digit numbers with Luhn check) and then reference it in a DLP profile or content profile.

Exam trap

The trap is thinking that the content profile or access control rule defines the pattern, when in fact the DLP dictionary is the component that holds the actual pattern matching logic.

How to eliminate wrong answers

Option A is wrong because an Access Control Rule determines whether traffic is allowed or denied based on source/destination/service, but it does not define data patterns for DLP. Option B is wrong because a content profile may reference DLP dictionaries, but the pattern matching itself is defined in the dictionary, not the content profile. Option D is wrong because an antivirus policy scans for malware signatures, not for credit card number patterns.

Full explanation →

163

MCQhard

An administrator is attempting to move a device from one ADOM to another. Which condition must be met for this to succeed?

A.The device must not be assigned to any policy package.

B.The device must be in an 'Unregistered' state.

C.The device must be placed in a 'Group' folder first.

D.The device must be running the latest firmware version.

AnswerA

Moving a device between ADOMs requires it to be unassigned from any policy package, because policy packages are bound to a specific ADOM and cannot span administrative domains. FortiManager blocks the move while such an assignment exists, so removing the device from its policy package satisfies the prerequisite for the transfer to succeed.

Why this answer

A device cannot be moved between ADOMs while it is still referenced by a policy package, because the package and its objects belong to the source ADOM and would create dangling references. FortiManager therefore requires that the device be unassigned from any policy package before the move. Once unassigned, the device can be moved to the target ADOM and re-assigned to packages there.

Exam trap

FORTINET-NSE56 often tests the prerequisite for ADOM migration, and candidates incorrectly assume firmware or registration state matters when the real blocker is an active policy package assignment.

How to eliminate wrong answers

Option B is wrong because an 'Unregistered' state is not required — a device can be registered and managed yet still be moved, provided it is not bound to a policy package. Option C is wrong because placing a device in a Group folder is an organizational convenience for grouping devices, not a prerequisite for ADOM migration. Option D is wrong because firmware version has no bearing on ADOM membership; FortiManager can manage devices on different firmware branches within supported ranges.

Full explanation →

164

MCQeasy

Which dashboard widget provides a high-level summary of system resource usage?

A.System Information

B.Report Settings

C.Log View

D.FortiView Threats

AnswerA

The System Information widget aggregates CPU, memory, disk and session counts into a single high-level summary panel, giving administrators an at-a-glance overview of overall system resource usage rather than the detailed per-resource graphs shown elsewhere.

Why this answer

The System Information dashboard widget in FortiGate displays a high-level summary of system resource usage, including CPU utilization, memory usage, disk usage, and session counts. It provides administrators with an at-a-glance view of the device's health and performance metrics directly on the dashboard.

Exam trap

FORTINET-NSE56 often tests widget-purpose mapping — candidates confuse FortiView (threat/analytics visualization) with System Information (resource metrics) because both appear on the dashboard and sound like monitoring tools.

How to eliminate wrong answers

Option B is wrong because Report Settings is a configuration menu for defining scheduled reports and their delivery, not a dashboard widget showing resource usage. Option C is wrong because Log View displays raw or filtered log entries (traffic, event, security logs) and does not summarize system resource metrics. Option D is wrong because FortiView Threats is a visualization tool for threat analytics and attack patterns, not a system resource usage summary.

Full explanation →

165

MCQeasy

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

A.To backup the configuration

B.To increase report speed

C.To reduce CPU usage

D.To send logs to external systems

AnswerD

Log Forwarding transmits collected logs to external destinations such as syslog servers, SIEM platforms or other FortiAnalyzers. It satisfies the stated purpose by relaying log data off-box for centralised correlation, long-term retention or third-party analysis beyond FortiAnalyzer's own storage.

Why this answer

Log Forwarding in FortiAnalyzer enables the appliance to relay received logs to external destinations such as syslog servers, CEF collectors, or another FortiAnalyzer. This is essential for integrating FortiAnalyzer into a broader SIEM ecosystem (e.g., Splunk, ArcSight) or for long-term archival on external storage. The feature does not alter local storage, CPU, or configuration backup behavior — it simply duplicates/forwards log streams to configured remote endpoints.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Log Forwarding (external relay) with local log storage, backup, or performance tuning — the misconception that forwarding somehow optimizes the FortiAnalyzer itself.

How to eliminate wrong answers

Option A is wrong because configuration backup is handled via 'execute backup' commands or the System Settings > Backup page, not Log Forwarding. Option B is wrong because Log Forwarding adds outbound network traffic and processing overhead; it does not accelerate report generation. Option C is wrong because forwarding logs consumes CPU and bandwidth rather than reducing them — local log processing still occurs.

Full explanation →

166

MCQmedium

An administrator notices that the 'Device Manager' status is 'Unsynchronized'. What is the recommended first step to resolve this?

A.Retrieve Config.

B.Change the ADOM version.

C.Reboot the FortiGate.

D.Re-install the firmware.

AnswerA

Retrieving the configuration pulls the managed device's current config into FortiManager, re-establishing the synchronisation baseline. This directly resolves the 'Unsynchronized' state, which occurs when FortiManager's stored revision diverges from the device's running config, so it is the recommended first step.

Why this answer

When the Device Manager status shows 'Unsynchronized', it means the FortiManager's configuration database is out of sync with the managed FortiGate. The recommended first step is to retrieve the configuration from the FortiGate ('Retrieve Config') to update FortiManager with the current device configuration, which resolves the synchronization issue.

Exam trap

The trap is overcomplicating the issue by rebooting or changing ADOM version, when the simple and correct first step is to retrieve the configuration from the device.

How to eliminate wrong answers

Option B is wrong because changing the ADOM version is a drastic step that can cause compatibility issues and is not the first troubleshooting step for unsynchronized status. Option C is wrong because rebooting the FortiGate does not address the configuration mismatch and may cause unnecessary downtime. Option D is wrong because re-installing firmware is unrelated to configuration synchronization and is not a recommended first step.

Full explanation →

167

MCQhard

When using the Workflow mode for policy management, what happens immediately after a policy change request is submitted?

A.The policy is pushed to the device automatically.

B.The policy is locked and sent to the approval queue.

C.The device immediately reboots.

D.The policy is applied to the 'Staging' ADOM.

AnswerB

Submitting a change request in Workflow mode immediately locks the policy, preventing concurrent edits, and places it in the approval queue for a designated approver. This satisfies the stem's constraint that the action occurs straight after submission, before any approval or deployment takes place.

Why this answer

In Workflow mode, FortiManager enforces a change-control process: when an administrator submits a policy change request, the policy is locked so no other changes can be made to it, and it is placed into the approval queue. It is not installed on the device until an approver reviews and approves the request. This ensures separation of duties and prevents unauthorized or unreviewed policy changes from reaching production devices.

Exam trap

FORTINET-NSE56 often tests the confusion between Normal mode (immediate install) and Workflow mode (approval queue), tricking candidates into choosing automatic push or a nonexistent staging ADOM.

How to eliminate wrong answers

Option A is wrong because automatic push happens in Normal (direct) mode, not Workflow mode; Workflow mode deliberately inserts an approval step before installation. Option C is wrong because a policy change request never triggers a device reboot — reboots are unrelated to policy workflow. Option D is wrong because there is no 'Staging' ADOM concept in FortiManager workflow; the policy remains in the ADOM's policy package in a locked/pending state, not moved to a separate staging ADOM.

Full explanation →

168

MCQmedium

You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?

A.Configure the Bridge pair and disable IP forwarding.

B.Configure the Bridge pair under Network > Interface.

C.Configure static IP routing on the management interface.

D.Assign a virtual IP to the WAN interface.

AnswerB

Transparent mode requires a bridge pair binding two interfaces, so FortiMail forwards frames at layer 2 without rewriting source or destination IP addresses. This satisfies the constraint that email packets are inspected while their IP headers remain unmodified.

Why this answer

In FortiMail Transparent mode, the mandatory step is to configure a Bridge pair under Network > Interface. The bridge pair binds two interfaces together so FortiMail can inspect email traffic inline without altering IP headers, effectively acting as a Layer 2 bridge. This is the defining configuration for Transparent mode operation.

Exam trap

FORTINET-NSE56 often tests the confusion between Transparent mode's bridge pair requirement and general routing/NAT configurations that belong to Gateway mode.

How to eliminate wrong answers

Option A is wrong because while disabling IP forwarding may be part of transparent behavior, it is not the mandatory configuration step — the bridge pair itself is what enables transparent inspection. Option C is wrong because static IP routing on the management interface is unrelated to transparent traffic inspection and would not achieve header-preserving inspection. Option D is wrong because assigning a virtual IP to the WAN interface is a NAT/routing concept, not applicable to Transparent mode where FortiMail does not route or NAT email traffic.

Full explanation →

169

MCQmedium

Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?

A.Using the Script Manager.

B.Updating the firmware.

C.Manual CLI access to each device.

D.Modifying the Provisioning Template.

AnswerA

Script Manager runs CLI scripts across managed devices in one operation, satisfying the requirement to apply identical commands to 50 FortiGates simultaneously. Scripts are stored centrally and executed per device or device group, eliminating 50 individual SSH sessions. This delivers the efficiency the stem demands, unlike manual per-device configuration.

Why this answer

The Script Manager in FortiManager allows administrators to create and run CLI scripts on multiple managed FortiGate devices simultaneously. It is the most efficient method to apply a specific set of CLI commands to many devices at once, as it supports scheduling, targeting device groups, and executing scripts in parallel. This avoids manual CLI access and is more direct than modifying provisioning templates for ad-hoc changes.

Exam trap

FORTINET-NSE56 often tests the distinction between Script Manager (ad-hoc CLI execution) and Provisioning Templates (baseline configuration), so candidates must recognize that Script Manager is the tool for running specific commands on many devices simultaneously.

How to eliminate wrong answers

Option B is wrong because updating firmware is a separate operation for upgrading device software, not for applying arbitrary CLI commands. Option C is wrong because manual CLI access to each device is time-consuming and error-prone, and does not scale to 50 devices. Option D is wrong because modifying a Provisioning Template is used for baseline system settings and is not the most efficient way to run a specific set of CLI commands on demand; it also requires re-provisioning or re-applying the template.

Full explanation →

170

MCQeasy

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

A.Configure static routing between the devices

B.Enable the Security Fabric connector on the FortiGate

C.Disable all firewall policies

D.Manually create an IPsec tunnel between devices

AnswerB

FortiWeb joins the Security Fabric by connecting to the FortiGate's Fabric connector, so the connector must be enabled on the FortiGate first. Without it, no Fabric authorisation or device discovery occurs, and FortiWeb cannot appear as a Fabric device.

Why this answer

To add a FortiWeb appliance to the Security Fabric, the FortiGate must have the Security Fabric connector enabled. This connector is the mechanism that allows the FortiGate to discover, authorize, and manage Fabric devices including FortiWeb. Without it enabled, the FortiGate will not recognize or accept the FortiWeb as a Fabric member, regardless of network connectivity.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse general network prerequisites (routing, tunnels) with the specific Security Fabric connector requirement on the FortiGate.

How to eliminate wrong answers

Option A is wrong because static routing is a general network reachability concern, not a Security Fabric prerequisite — Fabric devices can be on directly connected or routed networks as long as they can reach the FortiGate. Option C is wrong because disabling firewall policies would break network security and is not required or recommended for Fabric joining. Option D is wrong because an IPsec tunnel is not required for Security Fabric membership; Fabric communication uses the FortiGate's Fabric protocol over existing connectivity, not a dedicated IPsec tunnel.

Full explanation →

171

Multi-Selecthard

Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?

Select 2 answers

A.Modify the sender's IP address.

B.Re-encrypt the message body.

C.Delete the message.

D.Change the recipient's email address.

E.Release the message to the intended recipient.

AnswersC, E

Deleting a message directly from the FortiMail global quarantine satisfies the requirement to action quarantined items without releasing them to recipients. Administrators can permanently remove selected messages, eliminating any delivery risk, which is a core quarantine management capability alongside releasing, previewing and reclassifying stored items.

Why this answer

Option C (Delete the message) is correct because FortiMail's global quarantine management interface allows administrators to permanently remove quarantined items, purging them from the quarantine database so they are never delivered. Option E (Release the message to the intended recipient) is correct because the quarantine's core function is to hold suspicious mail for review, and administrators can release a message, which forwards it to the original recipient's mailbox as if it had been delivered normally. Options A, B, and D are incorrect because the global quarantine does not provide editing of envelope or header data such as the sender's IP address or the recipient's email address, nor does it re-encrypt the message body; those actions would require modifying the message itself, which quarantine management does not support.

Exam trap

The trap is overthinking the available actions and selecting options that sound like message manipulation (changing sender IP, re-encrypting, changing recipient) when FortiMail quarantine only supports delete and release.

Full explanation →

172

MCQmedium

Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?

A.TXT record containing the public key

B.PTR record

C.A record

D.MX record

AnswerA

Publishing a TXT record containing the public key at the selector._domainkey subdomain lets receiving servers retrieve that key and verify the DKIM signature added to outgoing messages. This satisfies the stem's requirement for public DNS publication, since the private key stays on the mail gateway while the public key is exposed for verification.

Why this answer

DKIM (DomainKeys Identified Mail) uses a public key published as a TXT record in DNS, typically at a selector._domainkey.domain.com. The receiving server uses this public key to verify the signature added to outgoing emails. This ensures authenticity and integrity.

Exam trap

The trap is confusing DKIM with SPF or DMARC; candidates might choose MX or PTR, but DKIM specifically requires a TXT record with the public key.

How to eliminate wrong answers

Option B is wrong because a PTR record maps an IP address to a hostname (reverse DNS) and is used for reputation checks, not DKIM. Option C is wrong because an A record maps a hostname to an IP address, unrelated to DKIM. Option D is wrong because an MX record specifies mail servers for a domain, not cryptographic keys.

Full explanation →

173

MCQmedium

When utilizing the 'Install Preview' feature before pushing a policy package, what is the primary benefit to the administrator?

A.To update the FortiManager revision history database.

B.To view the CLI commands that will be pushed to the device.

C.To automatically correct syntax errors in the policy.

D.To bypass the approval workflow.

AnswerB

Install Preview parses the pending policy package and renders the exact CLI syntax FortiManager will push, letting the administrator verify interface names, addresses and ordering before committing. This satisfies the stem's requirement to inspect the change set in advance, catching syntax or object errors without touching the live device.

Why this answer

The Install Preview feature in FortiManager shows the administrator the exact CLI commands that will be pushed to the managed device before committing the policy package. This allows verification of the configuration changes, detection of unintended modifications, and validation that the policy will apply as expected, reducing the risk of service disruption.

Exam trap

The trap is assuming Install Preview performs validation or correction — candidates may pick 'automatically correct syntax errors' because it sounds like a safety feature, but preview is purely informational and does not modify or fix configurations.

How to eliminate wrong answers

Option A is wrong because Install Preview does not update the revision history database — revision history is updated only after an actual install is performed, not during preview. Option C is wrong because Install Preview displays commands but does not automatically correct syntax errors; it is a read-only preview, and syntax issues must be fixed manually in the policy configuration. Option D is wrong because Install Preview does not bypass the approval workflow — if approval is required, it still applies regardless of whether preview was used.

Full explanation →

174

MCQmedium

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

A.It enables hardware acceleration on FortiWeb

B.It bypasses the need for WAF policies

C.It provides centralized logging and advanced analytics

D.It allows FortiWeb to perform SSL offloading

AnswerC

FortiWeb forwards traffic and attack logs to FortiAnalyzer, which aggregates them with other Security Fabric devices for correlation, dashboards, and reporting. This satisfies the integration's purpose: centralised visibility and advanced analytics across the fabric rather than local, device-only logging.

Why this answer

Integrating FortiWeb with FortiAnalyzer in the Security Fabric provides centralized logging and advanced analytics — FortiWeb forwards its WAF logs (attacks, violations, traffic) to FortiAnalyzer, where they are correlated with logs from FortiGate, FortiSandbox, and other Fabric devices. This enables unified dashboards, compliance reports, and threat correlation that would be impossible with FortiWeb's local logs alone.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse the roles of Fabric components — the trap is attributing a function like SSL offloading or hardware acceleration to FortiAnalyzer integration when those are native FortiWeb capabilities unrelated to logging integration.

How to eliminate wrong answers

Option A is wrong because hardware acceleration is a function of FortiWeb's own hardware/ASIC and configuration, not something enabled by FortiAnalyzer integration. Option B is wrong because WAF policies are always required for FortiWeb to inspect and protect web applications — FortiAnalyzer integration does not bypass or replace policy enforcement. Option D is wrong because SSL offloading is performed by FortiWeb itself (or a load balancer) using its own certificates and processing; FortiAnalyzer is a logging/analytics platform and does not perform SSL offloading.

Full explanation →

175

Multi-Selectmedium

Which TWO of the following are valid methods to back up a FortiManager configuration?

Select 2 answers

A.Copying files via USB drive.

B.Manual backup via the System Settings GUI.

C.Using the 'Backup' button on the FortiGate.

D.Scheduled backup to an FTP or SCP server.

E.Automatic cloud sync to FortiCloud.

AnswersB, D

FortiManager's System Settings GUI includes a backup function that exports the full configuration database to a local file, satisfying the requirement for a valid backup method. This manual export captures device manager settings, policy packages and ADOM configuration, making it a legitimate, supported approach alongside scheduled backups.

Why this answer

Option B is correct because FortiManager's System Settings GUI includes a Backup/Restore page where an administrator can manually export the full configuration (including ADOMs and device databases) to a local file. Option D is correct because FortiManager supports scheduled backups that push configuration backups to an FTP, SFTP, or SCP server via the 'set backup-mode' and related CLI/GUI scheduling settings. Option A is not a native FortiManager backup method, as USB copy is not a supported configuration backup mechanism on FortiManager.

Option C is wrong because the Backup button belongs to FortiGate, not FortiManager. Option E is wrong because FortiManager does not perform automatic cloud sync of its configuration to FortiCloud.

Exam trap

The trap is mixing up FortiGate backup methods with FortiManager backup methods; candidates may think the FortiGate's backup button or USB backup applies to FortiManager, but they are distinct.

Full explanation →

176

MCQhard

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

A.The AD domain controller's disk space

B.The FortiGate session table

C.FortiAuthenticator Authentication Logs

D.The WAF policy on FortiWeb

AnswerC

The authentication logs record each attempt's result, matched policy, and failure reason, so they immediately reveal whether the denial stems from group mismatch, token failure, or policy ordering. Checking them first satisfies the need to diagnose the cause rather than guessing at AD or network configuration.

Why this answer

When a user is denied access through a FortiAuthenticator-backed portal, the FortiAuthenticator Authentication Logs are the authoritative source because they record the full RADIUS/LDAP exchange, including whether the user was found, whether group membership was evaluated, and the exact rejection reason. Since the user exists in the mapped AD group, the failure is likely in the authentication flow itself (bind failure, group filter mismatch, or policy mapping), all of which are visible in these logs. Checking logs first follows the standard troubleshooting methodology of gathering evidence before changing configuration.

Exam trap

FORTINET-NSE56 often tests the troubleshooting instinct to check infrastructure (disk, sessions, WAF) instead of the identity component's own logs, which is where authentication failures are actually recorded.

How to eliminate wrong answers

Option A is wrong because AD domain controller disk space has no bearing on a single user's authentication failure and would affect all users system-wide, not one portal login. Option B is wrong because the FortiGate session table only shows active traffic flows and would not reveal why FortiAuthenticator rejected an authentication attempt. Option D is wrong because FortiWeb WAF policies protect web applications from attacks and are unrelated to FortiAuthenticator portal authentication.

Full explanation →

177

MCQhard

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

A.The total number of logs

B.The number of matches

C.The priority of the alert

D.The time window in seconds

AnswerB

Within an Event Handler threshold, Count specifies how many matching log entries must occur before the handler triggers. It counts matches, not time elapsed, so it defines the volume threshold rather than the evaluation window.

Why this answer

In a FortiAnalyzer Event Handler, the Threshold defines the trigger condition and the Count field specifies how many matching log entries must occur within the configured time window before the handler fires. In other words, Count is the number of matches, not the total logs received or a priority value. This lets administrators say 'alert me when 10 failed logins occur in 5 minutes' by setting Count=10 and the time window accordingly.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse the Count field (number of matches) with the time window (duration) — the trap is reading 'Count' as a time value or as total log volume.

How to eliminate wrong answers

Option A is wrong because Count is not the total number of logs the FortiAnalyzer has received — that is a device/ADOM statistic, not a threshold parameter. Option C is wrong because priority/severity is a separate attribute of the alert (e.g., critical, high, medium) and is not what Count represents. Option D is wrong because the time window is a distinct field in the Event Handler configuration (often labeled 'Time Period' or similar); Count is the number of matches within that window, not the window itself.

Full explanation →

178

MCQhard

Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?

A.ping <IP>

B.arp -a

C.traceroute <IP>

D.telnet <IP> 25

AnswerD

Using telnet to the remote server on port 25 opens a raw TCP connection, directly confirming SMTP reachability and any firewall or routing block between FortiMail and the destination. It satisfies the stem's requirement to verify port-level connectivity, unlike ping, which only tests ICMP and cannot validate that TCP port 25 is open.

Why this answer

The telnet command (D) allows you to test TCP connectivity to a specific port, such as port 25 for SMTP. By running 'telnet <IP> 25', you can verify if the remote mail server is reachable and accepting connections on that port. This is a standard network troubleshooting step.

Exam trap

The trap is confusing ping (ICMP) with TCP port testing; candidates may choose ping thinking it verifies mail server reachability, but it doesn't check port 25.

How to eliminate wrong answers

Option A is wrong because ping only tests ICMP reachability, not TCP port availability; a server can respond to ping but have port 25 blocked. Option B is wrong because arp -a displays the local ARP cache, which is irrelevant for testing remote connectivity. Option C is wrong because traceroute shows the path packets take but does not confirm if a specific port is open; it uses ICMP or UDP and may not reflect TCP port status.

Full explanation →

179

MCQmedium

When scheduling a report, what is the purpose of the 'Output Profile'?

A.Configuring data retention

B.Defining report formats and destinations

C.Setting the report time range

D.Adding user permissions

AnswerB

The Output Profile specifies both the file format (such as PDF, CSV or HTML) and the delivery destination (email, FTP or local storage) applied when the scheduled report runs. This satisfies the stem's requirement by binding format and destination together into one reusable profile, so each schedule produces output in the required form.

Why this answer

In FortiAnalyzer/FortiManager report scheduling, the Output Profile defines how the finished report is rendered and where it is delivered — for example PDF, CSV, or XML format, and whether it is emailed, saved to a share, or uploaded to a remote server. It is the delivery/formatting layer of the report job, separate from the data selection and time window.

Exam trap

The trap here is conflating the Output Profile with the schedule's time range or with log retention — candidates assume 'output' means 'what data comes out' rather than 'how and where the finished report is delivered'.

How to eliminate wrong answers

Option A is wrong because data retention is governed by log storage policies and the FortiAnalyzer 'log retention' settings, not by the report Output Profile. Option C is wrong because the report time range is set in the schedule's time period field (e.g., last 7 days, previous week), not in the Output Profile. Option D is wrong because user permissions are controlled by admin profiles and ADOM assignments, not by the report output configuration.

Full explanation →

180

MCQmedium

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

A.The ADOM contains devices

B.The ADOM is set to 'Read-Only'

C.The ADOM has log data

D.The administrator lacks super_admin rights

AnswerA

An ADOM can only be deleted once it holds no managed devices, so the greyed-out option directly reflects that constraint. FortiManager blocks removal while device objects remain assigned, meaning you must first move or delete every firewall and FortiGate in that ADOM before the delete action becomes available.

Why this answer

An ADOM cannot be deleted while it still contains devices; the delete option is greyed out until all devices (and their associated objects) are removed or moved to another ADOM. This is a built-in safeguard to prevent accidental loss of device configurations and log data. Read-only mode, log data, and admin rights do not cause the delete option to be greyed out in the same way.

Exam trap

FORTINET-NSE56 often tests the misconception that read-only mode or log data blocks ADOM deletion, when the actual blocker is the presence of devices in the ADOM.

How to eliminate wrong answers

Option B is wrong because setting an ADOM to read-only does not grey out the delete option; read-only affects configuration changes, not ADOM deletion. Option C is wrong because log data alone does not prevent deletion; logs are typically purged or the ADOM can be deleted with logs if no devices are present. Option D is wrong because lacking super_admin rights would typically hide the option entirely or return a permission error, not grey it out specifically due to ADOM contents.

Full explanation →

181

MCQeasy

What is the purpose of the 'Add Device' wizard?

A.To update the FortiGate firmware.

B.To register a new device to be managed by FortiManager.

C.To migrate policies.

D.To configure VPN tunnels.

AnswerB

The Add Device wizard registers a FortiGate or other supported device with FortiManager, adding it to the device manager so it can be centrally managed. It does not configure interfaces or install policy; it only establishes the management relationship.

Why this answer

The 'Add Device' wizard in FortiManager is specifically designed to add and register a new FortiGate or other supported device so that it can be centrally managed by FortiManager. This process involves specifying the device's serial number, IP address, and credentials, after which FortiManager can push configuration, policies, and firmware updates to the device. It is the initial step to bring a device under FortiManager's management umbrella.

Exam trap

FORTINET-NSE56 often tests the distinction between initial device onboarding and subsequent management tasks, so candidates may confuse the 'Add Device' wizard with other wizards like firmware upgrade or policy import.

How to eliminate wrong answers

Option A is wrong because updating FortiGate firmware is done through the 'Firmware Upgrade' feature or via FortiManager's firmware management, not the 'Add Device' wizard. Option C is wrong because policy migration is typically handled through the 'Policy & Objects' section or using the 'Import Policy' wizard, not the 'Add Device' wizard. Option D is wrong because VPN tunnel configuration is performed within the FortiGate's VPN settings or via FortiManager's VPN Manager, not through the 'Add Device' wizard.

Full explanation →

182

MCQhard

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

A.The Shared Secret

B.The RADIUS accounting port

C.The NAS-IP-Address

D.The VSA Vendor ID

AnswerA

RADIUS authenticates requests using a shared secret hashed with the packet; both the FortiAuthenticator and the third-party VPN gateway must hold the identical secret or every request is silently discarded. Matching this value is therefore mandatory for successful authentication.

Why this answer

The Shared Secret is the pre-shared key used to secure RADIUS communication between the FortiAuthenticator (RADIUS server) and the third-party VPN gateway (RADIUS client). Both devices must be configured with the identical shared secret; otherwise, RADIUS authentication requests will be rejected due to message integrity check failures. The other settings are either optional or not required to match for basic authentication.

Exam trap

FORTINET-NSE56 often tests the fundamental requirement that the RADIUS shared secret must match on both the server and client, while distracting with other parameters like ports or NAS-IP that are not symmetric requirements.

How to eliminate wrong answers

Option B is wrong because the RADIUS accounting port (typically 1813) is only used for accounting messages, not authentication, and it does not need to match between devices for authentication to work; the authentication port (1812) is what matters, and even that can be changed but must be consistent. Option C is wrong because the NAS-IP-Address is an attribute sent by the RADIUS client to identify itself; it does not need to match a setting on the server, though the server may use it for policy decisions. Option D is wrong because the VSA (Vendor-Specific Attribute) Vendor ID is used for vendor-specific extensions and is not required to match for standard RADIUS authentication; it only matters if vendor-specific attributes are being used and even then, the server must recognize the vendor ID, but it is not a symmetric setting.

Full explanation →

183

MCQmedium

A security team stores logs from several FortiGate devices in a single ADOM on their FortiAnalyzer appliance. They need to run a report that includes data from only two of those devices while excluding all others. What is the most appropriate way to accomplish this on FortiAnalyzer?

A.Apply a log filter on the Log View page that matches the two devices, then export the filtered view as the report.

B.Create a device group containing the two FortiGates and select that group as the report data source.

C.Delete the logs of the excluded devices from the ADOM before running the report.

D.Move the two FortiGates into a dedicated ADOM and generate the report from that ADOM.

AnswerB

FortiAnalyzer lets you build device groups inside an ADOM and then scope report generation to that group, so only the selected FortiGates contribute data. This directly satisfies the requirement of including two devices while excluding the rest, without moving logs or altering ADOM structure.

Why this answer

Device groups within an ADOM are the supported way to aggregate a subset of managed devices for reporting and analysis. Selecting the group as the report source limits the output to those FortiGates while leaving the other devices and their logs untouched in the same ADOM.

Exam trap

The trap here is assuming that report scoping requires a separate ADOM rather than a device group inside the existing ADOM.

Full explanation →

184

MCQhard

You are configuring a Security Fabric with a root FortiGate and a downstream FortiGate. You want to ensure that if the root FortiGate fails, the downstream FortiGate can still provide security services and maintain Fabric connectivity. Which configuration should you implement?

A.Enable Fabric HA on the root FortiGate and configure the downstream FortiGate as a secondary root.

B.Enable FortiGate Clustering Protocol (FGCP) between the root and downstream FortiGates.

C.Configure a backup root FortiGate in the Security Fabric.

D.Configure the downstream FortiGate as a standalone device.

AnswerC

Configuring a backup root FortiGate allows the Fabric to continue functioning if the primary root fails. The backup root takes over the root role, maintaining Fabric connectivity and management. This is the recommended way to provide high availability for the Security Fabric root.

Why this answer

To ensure Fabric resilience, you should configure a backup root FortiGate. This allows the Fabric to fail over to the backup root if the primary root becomes unavailable, preserving Fabric connectivity and centralized management. The other options either remove the device from the Fabric, use incorrect terminology, or apply an unsuitable HA method.

Exam trap

The trap here is confusing FortiGate Clustering Protocol (FGCP) with the Security Fabric's backup root feature; FGCP is for HA clustering, not Fabric root redundancy.

Full explanation →

185

MCQeasy

Which menu path is used to create a new Administrator account?

A.Device Manager

B.System Settings > Admin

C.Report Settings

D.FortiSoC

AnswerB

System Settings > Admin is where FortiGate holds local administrator definitions, so new accounts are created there. The stem asks only for the menu path, and this location satisfies that constraint directly, unlike policy, network or log menus that never contain administrator objects.

Why this answer

In the FortiGate GUI, administrator accounts are created under System Settings > Admin, where you define the username, password, admin profile, and trusted hosts. This is the standard location for local admin management on FortiOS.

Exam trap

The trap is that candidates may confuse admin account creation with authentication server configuration (LDAP/RADIUS) or with FortiAuthenticator, and pick a plausible-sounding but incorrect menu path.

How to eliminate wrong answers

Option A is wrong because Device Manager is not a FortiGate GUI menu path for admin creation — it is a generic term that does not correspond to the FortiOS navigation. Option C is wrong because Report Settings relates to logging and reporting configuration, not administrator accounts. Option D is wrong because FortiSoC is a Fortinet SOC product/console concept, not a menu path for creating local admins on a FortiGate.

Full explanation →

186

MCQmedium

Which configuration is required to allow external users to access the Webmail portal?

A.An AntiSpam profile.

B.An Access Control rule.

C.A relay host.

D.A static route.

AnswerB

Webmail access from external networks traverses a FortiGate interface, so an Access Control rule must explicitly permit that inbound traffic to the Webmail portal. Without a matching rule, the firewall's implicit deny blocks external users before they reach the portal.

Why this answer

Access Control rules in FortiMail define which source IP addresses or networks are permitted to reach specific services, including the Webmail portal. To allow external users to access Webmail, an administrator must create an access control rule that permits the relevant source addresses to connect to the Webmail service on the appropriate interface. Without this rule, connections are denied by default.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse mail-flow policies (relay, antispam) with access control rules that govern which clients can reach specific FortiMail services like Webmail.

How to eliminate wrong answers

Option A is wrong because an AntiSpam profile filters message content and has no bearing on whether a user can reach the Webmail HTTP/HTTPS interface. Option C is wrong because a relay host is used for outbound mail routing, not for controlling inbound access to web services. Option D is wrong because a static route only determines packet forwarding paths; it does not grant or deny access to the Webmail service.

Full explanation →

187

MCQeasy

A compliance officer needs FortiAnalyzer to alert the security team by email whenever an administrator logs in to the FortiGate at a branch office outside business hours. Which FortiAnalyzer capability should be configured to satisfy this requirement?

A.A log-based alert with a schedule and event filter that triggers on administrator login events from that device.

B.A real-time log forwarding rule that relays all branch logs to an external SIEM for correlation.

C.A report schedule that emails a summary of administrator activity once per day.

D.A dashboard widget that displays recent administrator logins across all managed devices.

AnswerA

FortiAnalyzer can raise alerts on matching log events, and alert rules can incorporate a time schedule so notifications fire only outside defined hours. Filtering on administrator login events from the branch FortiGate targets exactly the activity in question and delivers the email through the configured mail server.

Why this answer

Event-driven alerting with a time schedule is the mechanism that turns matching log entries into timely email notifications. Scoping the filter to administrator logins from the branch FortiGate keeps the alert precise and avoids notifying on unrelated activity.

Exam trap

The trap here is choosing periodic reporting when the requirement is immediate, event-driven notification.

Full explanation →

188

MCQeasy

How are Revision Histories primarily used in FortiManager when a device configuration has been modified locally on the FortiGate?

A.To automatically roll back local changes without user input.

B.To perform a diff between the current device configuration and stored revisions.

C.To create new ADOMs.

D.To schedule daily firmware upgrades.

AnswerB

Revision Histories capture configuration snapshots each time FortiManager retrieves an updated configuration from the managed FortiGate, so after local edits you can diff the current device configuration against any stored revision. This satisfies the scenario's need to identify exactly which local changes were made before restoring or reconciling them.

Why this answer

Revision History in FortiManager stores snapshots of device configuration each time a change is made, whether pushed from FortiManager or detected from the FortiGate. When a device has been modified locally, the administrator can use Revision History to run a diff between the current running configuration and any stored revision, revealing exactly what changed out-of-band. This is the primary diagnostic use of the feature.

Exam trap

FORTINET-NSE56 often tests whether candidates assume Revision History performs automatic rollback — it does not; it is a comparison and manual-restore tool, and the diff is the key diagnostic capability.

How to eliminate wrong answers

Option A is wrong because Revision History does not automatically roll back local changes — rollback is a manual action an administrator must initiate after reviewing the diff. Option C is wrong because ADOMs are administrative containers created via System Settings > All ADOMs, not through Revision History. Option D is wrong because firmware upgrade scheduling is handled by FortiManager's firmware management or upgrade tools, not by Revision History.

Full explanation →

189

Multi-Selecthard

Which THREE of the following are true regarding 'Revision History'?

Select 3 answers

A.It restricts administrative access.

B.It automatically deletes old logs.

C.It stores snapshots of device configurations.

D.It facilitates reverting to a known-good state.

E.It allows comparing two different configurations.

AnswersC, D, E

Revision History retains configuration snapshots of managed devices, allowing administrators to review or revert to earlier states. This satisfies the stem's requirement for a true statement, as each revision captures the device configuration at that point.

Why this answer

Option C is correct because Revision History stores snapshots of device configurations, capturing the full configuration state at each revision so changes are preserved over time. Option D is correct because those stored snapshots enable reverting to a known-good state, letting an administrator roll back to a prior working configuration if a change causes problems. Option E is correct because Revision History supports comparing two different configurations, allowing an admin to diff revisions and identify exactly what changed between them.

Options A and B are not correct: Revision History is not an administrative access-control mechanism (that is the role of role-based access control or admin accounts), and it does not automatically delete old logs — it retains configuration revisions rather than managing or purging log data.

Exam trap

The trap is confusing Revision History with access control or log retention — candidates may pick 'restricts administrative access' or 'automatically deletes old logs' because those sound like management features, but revision history is specifically about configuration snapshots, comparison, and rollback.

Full explanation →

190

MCQeasy

Which component manages the 'Daily Report' schedule?

A.Access control rules.

B.Quarantine settings.

C.Report settings.

D.System logs.

AnswerC

The Daily Report schedule is governed centrally under Report settings, where the administrator defines the generation time, delivery recipients and recurrence interval. Configuring the schedule there satisfies the requirement, rather than through log or email settings, which control storage and transport only.

Why this answer

The Daily Report schedule in FortiMail is managed under Report settings. This area lets administrators configure when reports are generated, what data they include, and who receives them. Report settings is the dedicated configuration section for all report-related scheduling and delivery parameters.

Exam trap

FORTINET-NSE56 often tests the distinction between where reports are scheduled (Report settings) versus where the underlying log data is stored (System logs), causing candidates to pick the log area.

How to eliminate wrong answers

Option A is wrong because access control rules determine which messages are accepted, rejected, or quarantined — they do not manage report schedules. Option B is wrong because quarantine settings control how quarantined messages are stored, released, and expired, not when reports are generated. Option D is wrong because system logs record events for auditing and troubleshooting; they are the data source reports may draw from, but they do not manage the report schedule itself.

Full explanation →

191

MCQeasy

What is the primary function of the FortiMail 'Quarantine' feature?

A.To provide long-term email archiving.

B.To compress outgoing attachments.

C.To bypass SMTP authentication.

D.To hold emails identified as spam or viruses for review.

AnswerD

Quarantine stores messages flagged as spam or containing viruses in a holding area rather than delivering or deleting them, enabling later review. This directly satisfies the stem's requirement to hold such emails, distinguishing it from outright rejection or silent discard.

Why this answer

FortiMail's Quarantine feature holds messages flagged as spam, virus-infected, or otherwise suspicious so they are not delivered to end users' inboxes but remain available for review, release, or deletion. It acts as a safety net that prevents false positives from being permanently lost while blocking threats.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse quarantine (temporary holding of suspicious mail) with archiving (long-term compliance retention), since both involve storing messages outside the normal inbox.

How to eliminate wrong answers

Option A is wrong because long-term email archiving is a separate function (FortiMail's archiving feature) designed for compliance retention and eDiscovery, not for holding suspicious mail temporarily. Option B is wrong because compressing outgoing attachments is not a FortiMail quarantine function — quarantine deals with inbound/outbound message disposition, not attachment optimization. Option C is wrong because bypassing SMTP authentication is unrelated to quarantine; SMTP auth is controlled by access receive rules and authentication profiles, and quarantine never bypasses security controls.

Full explanation →

192

Multi-Selecthard

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

Select 3 answers

A.Automatically patch the server vulnerability

B.Log the request details

C.Redirect the client to a block page

D.Increase the backend server CPU

E.Drop the connection (Reset)

AnswersB, C, E

Logging records the offending request's details, including source, URL and matched signature, without interrupting the transaction. This satisfies the requirement to capture evidence of the violation for auditing and later forensic review while allowing the request to continue to the backend server.

Why this answer

Option B is correct because FortiWeb can log the full details of a violating request (source IP, URL, matched signature/rule, and action taken) to its attack, traffic, and event logs for auditing and forensic analysis. Option C is correct because FortiWeb supports a redirect action that sends the offending client to a customizable block page (for example, an HTML page hosted on FortiWeb) instead of returning the protected application's content. Option E is correct because FortiWeb can drop or reset the connection, terminating the TCP session (RST) so the malicious request never reaches the backend server.

Option A is not a FortiWeb function: FortiWeb is a WAF and does not patch vulnerabilities on backend servers; patching is an administrative task on the server itself. Option D is also outside FortiWeb's role, since it cannot increase backend server CPU resources; that would be handled by the server or virtualization/cloud platform.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse FortiWeb's enforcement actions with remediation actions — FortiWeb can block, log, redirect, or reset, but it cannot patch, upgrade, or modify the protected server itself.

Full explanation →

193

Multi-Selecthard

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Select 2 answers

A.Remote server IP address

B.Log filter criteria

C.Enable compression for all logs

D.Syslog server port

E.Include device hostname in logs

AnswersA, D

The remote Syslog server IP address is the destination FortiAnalyzer forwards logs to; without it, packets cannot be addressed and the server never receives them. This satisfies the requirement that the remote server accepts forwarded logs.

Why this answer

Option A (Remote server IP address) is correct because FortiAnalyzer must know the destination address of the remote Syslog server to open the connection and forward logs to it; without a valid IP/FQDN the logs cannot be delivered. Option D (Syslog server port) is correct because the remote Syslog daemon listens on a specific port (typically UDP/TCP 514, or 6514 for TLS), and FortiAnalyzer must use the matching port or the server will not accept the forwarded logs. Option B (Log filter criteria) only determines which logs are sent, not whether the server accepts them, so it is not required for acceptance.

Option C (Enable compression for all logs) is an optional transport optimization and not needed for the server to accept logs. Option E (Include device hostname in logs) affects log content/formatting but is not a connectivity parameter required for the remote server to accept the logs.

Exam trap

FORTINET-NSE56 often tests the distinction between mandatory connectivity parameters (IP and port) and optional formatting or filtering settings, causing candidates to select features that enhance log content but are not required for the server to accept logs.

Full explanation →

194

Multi-Selectmedium

Which TWO of the following are true about 'Scripts' in FortiManager?

Select 2 answers

A.They can only be run once.

B.They can be scheduled to run at specific times.

C.They automatically convert to policies.

D.They require a separate license.

E.They can be run on multiple devices simultaneously.

AnswersB, E

FortiManager script scheduling satisfies the requirement to run scripts at defined times without manual intervention. The scheduler executes scripts against managed FortiGate devices at configured intervals or fixed times, enabling automated configuration changes and compliance enforcement across device groups. This directly matches the stem's constraint of time-based execution.

Why this answer

Option B is correct because FortiManager scripts support scheduling, allowing an administrator to define when a script executes (for example, a one-time run at a future date/time or a recurring schedule) rather than only running it manually on demand. Option E is correct because FortiManager scripts can be executed against multiple managed FortiGate devices at once, either by selecting several devices or by targeting a device group, which is a core benefit of centralized script management. Option A is wrong because scripts are not limited to a single execution; they can be run repeatedly and can also be scheduled.

Option C is wrong because scripts execute CLI commands or configuration snippets on devices and do not automatically transform into policy objects or policy packages. Option D is wrong because scripting is a built-in FortiManager feature and does not require a separate add-on license.

Exam trap

The trap is assuming scripts are one-time or require extra licensing; candidates may confuse scripts with other features like policies or think they are limited, but they are flexible automation tools.

Full explanation →

195

MCQmedium

When should you use 'Log Archive' instead of 'Log Database'?

A.For real-time traffic analysis

B.For long-term storage

C.For triggering alerts

D.For generating daily reports

AnswerB

Log Archive stores logs in compressed form for retention rather than active querying, making it suited to long-term storage. This satisfies the stem by distinguishing archive's retention purpose from the Log Database's indexed, searchable analytics role.

Why this answer

Log Archive is designed for long-term storage and compliance retention, storing logs in a compressed format that is not indexed for fast querying. Log Database, by contrast, is optimized for real-time analysis and fast searches. Therefore, Log Archive should be used when the primary requirement is long-term retention rather than immediate analytics.

Exam trap

FORTINET-NSE56 often tests the trade-off between performance (database) and retention (archive), and candidates mistakenly associate 'archive' with analysis or reporting because both involve stored logs.

How to eliminate wrong answers

Option A is wrong because real-time traffic analysis requires the indexed, query-optimized Log Database, not the compressed archive format. Option C is wrong because triggering alerts depends on real-time log processing and correlation, which is a function of the analysis database, not the archive. Option D is wrong because generating daily reports requires querying indexed logs, which is the role of the Log Database; archive logs are not designed for report generation.

Full explanation →

196

Multi-Selecteasy

Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?

Select 2 answers

A.Managing local user account provisioning

B.Performing deep packet inspection for malware on email attachments

C.Offloading SSL/TLS processing from backend servers

D.Routing static IP traffic between subnets

E.Protecting against SQL injection and XSS

AnswersC, E

FortiWeb terminates client TLS sessions and forwards decrypted traffic to backend servers, removing certificate and cipher processing from those servers. This offload reduces backend CPU load and centralises certificate management, a primary WAF function alongside application-layer attack inspection.

Why this answer

Option C is correct because a WAF such as FortiWeb commonly performs SSL/TLS offloading, terminating HTTPS connections and decrypting traffic so backend web servers do not have to handle the cryptographic processing, which reduces their load and centralizes certificate management. Option E is correct because a core WAF function is inspecting HTTP/HTTPS requests and blocking application-layer attacks such as SQL injection and cross-site scripting (XSS) using signatures and behavioral rules. Option A is incorrect because local user account provisioning is an identity and access management function, not a WAF role.

Option B is incorrect because scanning email attachments for malware is the job of an email security gateway or antivirus, not a WAF, which focuses on web traffic. Option D is incorrect because routing static IP traffic between subnets is a Layer 3 routing function performed by routers or firewalls, not a WAF's primary purpose.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse WAF functions with email security, identity management, or routing functions, so knowing the WAF's Layer 7 scope is essential.

Full explanation →

197

MCQhard

A FortiMail appliance is deployed in gateway mode as an outbound relay for an internal application server. The application sends notification emails to external customers using the envelope sender notifications@corp.example.com, but the messages are being rejected by several recipient mail servers with SPF failures. The network team confirms the FortiMail's public IP is 203.0.113.45, and the SPF record for corp.example.com is 'v=spf1 mx -all'. The MX record for corp.example.com points to 198.51.100.20, which is the inbound FortiMail cluster. Which FortiMail configuration change will resolve the SPF failures for outbound mail sent through this relay?

A.Disable SPF checking on the outbound session profile in FortiMail so that outbound messages are not subjected to SPF validation before they leave the gateway.

B.Configure a sender-dependent outbound relay rule that rewrites the envelope sender to notifications@relay.corp.example.com, where relay.corp.example.com has an SPF record authorizing 203.0.113.45.

C.Enable the 'Use Sender Domain as Envelope From' option under the outbound session profile so FortiMail rewrites the envelope sender to match the authenticated user's domain.

D.Add 203.0.113.45 to the SPF record for corp.example.com, for example 'v=spf1 mx ip4:203.0.113.45 -all', so the outbound relay's public IP is authorized to send on behalf of the domain.

AnswerD

SPF validates the sending IP against the domain in the envelope sender. Because FortiMail relays outbound mail from 203.0.113.45 while the SPF record only authorizes the MX host 198.51.100.20, receivers see a mismatch. Adding the relay's public IP to the SPF record explicitly authorizes that host, resolving the SPF failures without altering sender identity or message routing.

Why this answer

SPF authorizes specific sending IP addresses for a domain. In this deployment, FortiMail relays outbound mail from 203.0.113.45, but the domain's SPF record only lists its MX host at 198.51.100.20, so external receivers reject the messages. Publishing the relay's public IP in the SPF record aligns the sending IP with the domain's authorized senders, which directly resolves the failures without changing sender identity or disabling security controls.

Exam trap

The trap here is assuming that a local FortiMail outbound SPF check or envelope sender rewrite can influence how remote receivers evaluate SPF, when the authoritative decision is made by the recipient querying the sender domain's published DNS record.

Full explanation →

198

MCQmedium

You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?

A.XSS profile

B.SQL Injection profile

C.Data Leak Prevention profile

D.Cookie security profile

AnswerC

The Data Leak Prevention profile inspects outbound responses and masks or blocks patterns such as stack traces, database errors and internal paths, preventing sensitive server-side information from reaching clients. It directly satisfies the requirement to stop error-message disclosure.

Why this answer

The Data Leak Prevention profile in FortiWeb is designed to inspect outbound HTTP responses for patterns that match sensitive information, such as credit card numbers, social security numbers, or internal server details. When an application generates an error message that includes stack traces, database queries, or file paths, this profile can detect and mask or block that data before it reaches the client. This directly prevents the disclosure of sensitive server-side information, which is the goal stated in the question.

Exam trap

The trap here is confusing input validation profiles (XSS, SQL Injection) with output inspection profiles (DLP), as candidates may assume that preventing attacks also prevents information disclosure, but only DLP is designed to scan responses for sensitive data.

How to eliminate wrong answers

Option A is wrong because the XSS profile focuses on detecting and blocking cross-site scripting attacks by inspecting input and output for malicious scripts, not on preventing information leakage in error messages. Option B is wrong because the SQL Injection profile detects SQL injection attempts in requests, but it does not analyze outbound error messages for sensitive data disclosure. Option D is wrong because the Cookie security profile enforces attributes like HttpOnly and Secure on cookies to protect session data, but it does not address server-side information leakage in error responses.

Full explanation →

199

MCQhard

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

A.Device Manager > Revision History

B.System Settings > Event Log

C.Policy & Objects > Task Monitor

D.Policy & Objects > Installation Targets

AnswerC

Policy & Objects > Task Monitor records installation tasks and exposes the detailed conflict reason, such as which object clashed and on which device. This satisfies the stem's requirement to view the specific failure cause after a policy package install fails, rather than only a generic error summary.

Why this answer

FortiManager logs all policy installation tasks in the Task Monitor, accessible under Policy & Objects > Task Monitor. When an installation fails due to an object conflict or any other reason, the Task Monitor shows the task status, the affected device, and a detailed log with the specific error message (e.g., which object conflicted and why). This is the primary place to diagnose installation failures.

Exam trap

The trap is confusing the Task Monitor (which shows installation task details) with Revision History or Event Log — candidates often pick Revision History because it sounds like it would contain change details, but it does not show install errors.

How to eliminate wrong answers

Option A is wrong because Device Manager > Revision History shows configuration revision history for a device, not the detailed error log of a failed installation task. Option B is wrong because System Settings > Event Log records system-level events (admin logins, system changes), not policy installation task details. Option D is wrong because Policy & Objects > Installation Targets only shows which devices a policy package is assigned to — it does not display installation error details.

Full explanation →

200

MCQeasy

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

A.Improving log compression

B.Increasing bandwidth

C.Automating incident response actions

D.Updating firmware

AnswerC

Automation Stitch chains triggers to response actions across Security Fabric devices, executing remediation such as quarantining a compromised host without manual intervention. This satisfies the stem's requirement for the primary benefit, namely automated incident response rather than simple alerting.

Why this answer

Automation Stitches in the Security Fabric let you define trigger-action workflows that automatically respond to security events, such as quarantining a compromised endpoint or blocking an IP. The primary benefit is automating incident response actions across Fabric-connected devices. This reduces response time and manual effort.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Automation Stitches (incident response automation) with unrelated functions like firmware management or log compression.

How to eliminate wrong answers

Option A is wrong because log compression is a storage/transport optimization, not the purpose of Automation Stitches. Option B is wrong because increasing bandwidth is a network capacity concern, unrelated to automation workflows. Option D is wrong because firmware updates are handled by FortiManager/device management, not by Automation Stitches.

Full explanation →

201

MCQmedium

Which type of scan should be enabled to detect known malware in email attachments?

A.Spam scanning.

B.Antivirus scanning.

C.Reputation scanning.

D.Content scanning.

AnswerB

Antivirus scanning inspects email attachment content against signature and heuristic databases, detecting known malware before delivery. This satisfies the stem's requirement to detect known malware in attachments, unlike other scan types that address spam, content, or reputation rather than file-borne threats.

Why this answer

Antivirus scanning is the scan type that inspects email attachments for known malware by matching file content against virus signatures and heuristic patterns. It is specifically designed to detect and block malicious payloads in attachments.

Exam trap

The trap is conflating spam, reputation, and content scanning with malware detection — the exam tests whether you know only antivirus scanning inspects attachment content for known malware signatures.

How to eliminate wrong answers

Option A is wrong because spam scanning filters unwanted bulk email based on sender reputation, content keywords, and spam heuristics — it does not detect malware in attachments. Option C is wrong because reputation scanning evaluates the reputation of senders, URLs, or IP addresses, not the binary content of attachments. Option D is wrong because content scanning (content filtering) enforces policy on message content — for example, blocking profanity or confidential data patterns — but does not identify malware signatures.

Full explanation →

202

MCQmedium

What does the 'Heuristic' score measure in the AntiSpam engine?

A.The probability that the email content is spam.

B.The sender's reputation.

C.The attachment size.

D.The speed of the sender.

AnswerA

The Heuristic score quantifies how strongly the message's content, structure and keywords match known spam patterns, producing a probability that the email is spam. This lets the AntiSpam engine assign a numeric likelihood rather than a binary verdict, which the configured threshold then acts upon.

Why this answer

The Heuristic score in FortiMail's AntiSpam engine is a computed probability (0–100) that a message's content exhibits spam-like characteristics, based on rules analyzing headers, body text, and structure. It is a content-based score, not a reputation or metadata metric. Administrators set thresholds to tag or quarantine messages above a given score.

Exam trap

The trap is conflating content-based heuristic scoring with sender reputation scoring — candidates pick 'sender's reputation' because both feed the overall spam verdict, but only the heuristic score measures content probability.

How to eliminate wrong answers

Option B is wrong because sender reputation is handled by separate mechanisms (IP/domain reputation, DNSBL, FortiGuard antispam databases), not the Heuristic score. Option C is wrong because attachment size is a message attribute checked by content/attachment filters, not the heuristic content analysis. Option D is wrong because sender speed (sending rate) relates to rate limiting or anomaly detection, not the heuristic spam probability.

Full explanation →

203

MCQmedium

If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?

A.It forces a firmware downgrade.

B.It automatically creates a new ADOM.

C.It deletes all existing policies in the ADOM.

D.It merges the FortiGate policies into the FortiManager policy package.

AnswerD

Import Policy pulls the FortiGate's existing policy set into the ADOM's policy package, merging those rules rather than replacing the package wholesale. This satisfies the scenario where existing FortiManager objects and the device's policies must coexist after import.

Why this answer

The 'Import Policy' function in FortiManager retrieves the policy configuration from a managed FortiGate and merges it into the FortiManager policy package for that device or ADOM. This is used when a FortiGate has been configured locally and the administrator wants FortiManager's database to reflect the device's actual policy set, enabling centralized management going forward.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse 'Import Policy' (pull device config into FortiManager) with 'Install' (push FortiManager config to device) — the direction of the operation is the key distinction.

How to eliminate wrong answers

Option A is wrong because Import Policy has no effect on firmware versions — firmware management is a separate FortiManager function. Option B is wrong because Import Policy does not create a new ADOM; ADOMs are created manually or during device onboarding, and Import Policy operates within an existing ADOM. Option C is wrong because Import Policy does not delete existing policies — it merges or adds the device's policies into the policy package, preserving existing entries unless the administrator explicitly chooses to overwrite.

Full explanation →

204

MCQmedium

When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?

A.It displays the device firmware version.

B.It indicates if the package is in sync with the device.

C.It shows the last modified date.

D.It shows the number of policies in the package.

AnswerB

The Policy Package Status column compares the policy package's revision against the revision currently installed on the target device, flagging whether they match. This satisfies the stem's requirement by showing, before installation proceeds, which packages are already in sync and which require deployment to bring the device up to date.

Why this answer

In the Install Wizard, the Policy Package Status column shows whether the policy package currently installed on the target device matches the version in FortiManager — i.e., whether the device is in sync or out of sync. This lets the administrator see at a glance which devices need a policy install. A green/consistent status means no changes are pending; a modified status means the FortiManager copy differs from the device.

Exam trap

FORTINET-NSE56 often tests whether candidates know the Install Wizard's status column reflects configuration sync state, not metadata like firmware, dates, or policy counts.

How to eliminate wrong answers

Option A is wrong because firmware version is displayed in Device Manager or the device dashboard, not in the Policy Package Status column of the Install Wizard. Option C is wrong because last-modified timestamps appear in the policy package list, not as the status column's purpose. Option D is wrong because the number of policies is shown in the policy package details, not in the status column, which reflects sync state.

Full explanation →

205

Multi-Selectmedium

Which TWO of the following protocols does FortiMail support for mail retrieval?

Select 2 answers

A.POP3

B.FTP

C.IMAP

D.HTTP

E.DNS

AnswersA, C

POP3 is a standard mail retrieval protocol, and FortiMail supports it so clients can download messages from its mail store. This satisfies the scenario's requirement for supported retrieval protocols, alongside IMAP, distinguishing retrieval from sending protocols such as SMTP.

Why this answer

FortiMail supports POP3 (option A) for mail retrieval, allowing clients to download messages from the FortiMail mail store to their local mail client, which is a standard retrieval protocol for receiving email. FortiMail also supports IMAP (option C), which enables clients to access and manage mail on the server without downloading everything locally, and is commonly used for webmail and mobile synchronization. FTP (option B) is a file transfer protocol and is not used for retrieving email messages.

HTTP (option D) is used for web browsing and webmail interfaces, not as a mail retrieval protocol in this context. DNS (option E) resolves domain names to IP addresses and does not retrieve mail.

Exam trap

The trap is mixing transport protocols (SMTP) with retrieval protocols, or picking HTTP because webmail is common — candidates must recall that POP3 and IMAP are the two standard mailbox retrieval protocols.

Full explanation →

206

MCQhard

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

A.Packet Capture (sniffer)

B.Traffic Monitor / SSL Dashboard

C.Log Access

D.System Health Monitor

AnswerB

The SSL Dashboard reports handshake timing metrics, including negotiation duration per virtual server, directly exposing whether TLS setup inflates HTTPS latency. Unlike packet captures, which require manual decryption and reassembly, it isolates the SSL negotiation phase the stem suspects, confirming the handshake bottleneck without additional tooling.

Why this answer

The Traffic Monitor / SSL Dashboard in FortiADC provides real-time visibility into SSL handshake times, including metrics like SSL negotiation duration. This tool is specifically designed to monitor SSL/TLS performance and identify bottlenecks in the handshake process.

Exam trap

The trap is selecting Packet Capture for performance analysis; while it can show handshake packets, it doesn't provide the aggregated timing metrics that the SSL Dashboard does.

How to eliminate wrong answers

Option A is wrong because Packet Capture (sniffer) captures raw packets but does not directly measure SSL negotiation time; it requires manual analysis of timestamps. Option C is wrong because Log Access provides historical logs, not real-time performance metrics for SSL handshakes. Option D is wrong because System Health Monitor shows overall system resource usage (CPU, memory), not detailed SSL handshake timing.

Full explanation →

207

Multi-Selectmedium

Which TWO components can be included in a 'Provisioning Template' to manage device settings?

Select 2 answers

A.System Templates

B.ADOM Variables

C.CLI Templates

D.Firewall Policies

E.Firmware Images

AnswersA, C

System Templates are a provisioning component that carries system-level settings, such as DNS, NTP and administrative configuration, into a Provisioning Template. This satisfies the requirement for a component that manages device settings, complementing the other included template type.

Why this answer

In FortiManager, a Provisioning Template is used to preconfigure devices before or during onboarding, and it can contain two types of components: System Templates (option A) and CLI Templates (option C). System Templates (A) are correct because they define standardized system-level settings such as DNS, NTP, SNMP, and administrative parameters that can be applied to managed devices. CLI Templates (C) are correct because they let you push raw FortiOS CLI configuration snippets to devices, allowing granular or vendor-specific settings that system templates do not cover.

ADOM Variables (B) are not standalone provisioning template components; they are variables referenced within templates and policies, not a template type themselves. Firewall Policies (D) are managed through policy packages, not provisioning templates. Firmware Images (E) are handled via firmware management tasks or upgrade tools, not as provisioning template components.

Exam trap

FORTINET-NSE56 often tests whether candidates can distinguish between the two valid template types (System and CLI) and unrelated FortiManager features like ADOM Variables, Policy Packages, and Firmware management that sound related but serve different purposes.

Full explanation →

208

MCQeasy

What is the default port for SMTP communication?

A.110

B.25

C.80

D.443

AnswerB

Port 25 is the IANA-assigned default for SMTP relay between mail servers, so FortiMail listens there for inbound mail delivery. This satisfies the stem's constraint, distinguishing it from submission port 587 and SMTPS port 465.

Why this answer

SMTP (Simple Mail Transfer Protocol) uses TCP port 25 by default for message transfer between mail servers. This is defined in RFC 5321 and remains the standard port for SMTP relay and server-to-server communication. Port 25 is the well-known port assigned to SMTP by IANA.

Exam trap

The trap is confusing SMTP's default port (25) with other email-related ports like POP3 (110) or secure submission ports (587/465) — candidates must remember that port 25 is the canonical SMTP port for server-to-server relay.

How to eliminate wrong answers

Option A is wrong because port 110 is used by POP3 (Post Office Protocol version 3) for retrieving email from a mail server, not for SMTP sending. Option C is wrong because port 80 is used by HTTP for web traffic, not email. Option D is wrong because port 443 is used by HTTPS for secure web traffic, not SMTP — secure SMTP submission uses port 587 (STARTTLS) or 465 (SMTPS), not 443.

Full explanation →

209

MCQhard

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

A.It cannot forward logs

B.It cannot store logs

C.It cannot run reports

D.It cannot receive logs from FortiGate

AnswerC

Collector mode forwards logs to a downstream analyser and stores them only in an archive/forwarding capacity, so the local reporting engine is unavailable. Reports require the analyser role, which indexes logs into a searchable database; a collector lacks that indexing, so it cannot generate reports itself.

Why this answer

In FortiAnalyzer, 'Collector' mode is designed purely for high-volume log collection and forwarding/storage — it does not include the analytics and reporting engine. As a result, a FortiAnalyzer operating in Collector mode cannot generate reports, run log-based analytics, or provide the full GUI reporting features available in Analyzer mode. This mode is typically used in large distributed environments where a dedicated collector forwards logs to a central analyzer.

Exam trap

FORTINET-NSE56 often tests the confusion between Collector and Analyzer modes, tricking candidates into thinking Collector mode cannot store or forward logs when the real limitation is the absence of reporting/analytics.

How to eliminate wrong answers

Option A is wrong because Collector mode is specifically built to receive and forward logs to another FortiAnalyzer or syslog destination — forwarding is a core function, not a limitation. Option B is wrong because Collector mode does store logs locally (or on remote storage) as part of its collection role. Option D is wrong because receiving logs from FortiGate (or other devices) is the primary purpose of Collector mode, so it is not a limitation.

Full explanation →

210

MCQmedium

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

A.Prevention mode

B.Transparent mode

C.Learning mode

D.Detection mode

AnswerA

Prevention mode actively inspects requests and drops those matching SQL injection signatures, satisfying the requirement to block attacks rather than merely log them. Unlike detection or monitor modes, which only alert, prevention enforces the WAF policy inline, allowing legitimate traffic through while terminating malicious requests before they reach the backend application.

Why this answer

Prevention mode in a FortiWeb server policy actively blocks detected attacks such as SQL injection while allowing legitimate traffic to pass. This is the operational mode that enforces the WAF's security rules and takes action against malicious requests. Detection mode only logs, and learning mode builds a baseline without blocking.

Exam trap

FORTINET-NSE56 often tests the difference between Detection and Prevention modes — candidates may pick Detection thinking it blocks, but the trap is that Detection only logs, while Prevention actively blocks.

How to eliminate wrong answers

Option B is wrong because Transparent mode in FortiWeb refers to a deployment mode (bridge) rather than an enforcement mode; it does not determine whether attacks are blocked. Option C is wrong because Learning mode is used to build a behavioral baseline for anomaly detection and does not block attacks. Option D is wrong because Detection mode only logs violations without blocking, which would not satisfy the requirement to block SQL injection.

Full explanation →

211

MCQmedium

What is the maximum number of ADOMs supported on a FortiAnalyzer?

A.50

B.Depends on the model

C.10

D.Infinite

AnswerB

FortiAnalyzer ADOM capacity is not a fixed global figure; it varies by appliance or VM model, since each platform has different licensed limits. The answer therefore depends on the model, satisfying the question's constraint that no single universal maximum exists.

Why this answer

The maximum number of ADOMs (Administrative Domains) on a FortiAnalyzer is not a fixed number — it depends on the FortiAnalyzer hardware model or VM license tier. Entry-level appliances support fewer ADOMs, while high-end models and larger VM licenses support many more, so 'Depends on the model' is the correct answer.

Exam trap

FORTINET-NSE56 often tests whether candidates assume a hard-coded maximum for FortiAnalyzer features — the trap is picking a specific number (10 or 50) when the correct answer is that limits are model/license-dependent, a pattern that recurs across Fortinet product questions.

How to eliminate wrong answers

Option A is wrong because 50 is not a universal cap — some models support fewer and some support more. Option C is wrong because 10 is far too low and is not a documented FortiAnalyzer ADOM limit. Option D is wrong because FortiAnalyzer ADOM counts are bounded by model/license; they are not infinite, and exceeding the limit requires upgrading hardware or licensing.

Full explanation →

212

Multi-Selecthard

Which TWO factors impact the performance of report generation?

Select 2 answers

A.The number of registered devices

B.The firmware version of the devices

C.Whether report caching is enabled

D.The size of the log data

E.The CPU temperature

AnswersC, D

Enabling report caching stores previously generated report data, so subsequent requests reuse it instead of re-querying logs and rebuilding aggregates. This directly reduces generation time and resource load, satisfying the performance factor the question asks about.

Why this answer

Option C is correct because enabling report caching allows previously generated report results to be reused instead of recomputed, directly reducing the time and resource load required for each report generation. Option D is correct because the size of the log data determines how much data must be queried, aggregated, and rendered, so larger log volumes increase processing time and can slow report generation. The number of registered devices (A) and firmware version (B) may affect the environment but are not direct determinants of report-generation performance, and CPU temperature (E) is a hardware/environmental symptom rather than a defined performance factor for report generation.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse device count or firmware version with the actual performance factors of report caching and log data size.

Full explanation →

213

MCQmedium

What is the primary purpose of using 'Provisioning Templates' in FortiManager?

A.To manage FortiClient endpoints.

B.To create firewall policies across all devices.

C.To generate performance reports.

D.To standardize system settings like NTP, DNS, and logging on multiple devices.

AnswerD

Provisioning Templates in FortiManager push consistent system-level configuration—NTP, DNS, and logging—to managed FortiGate devices, satisfying the requirement to standardise these settings across multiple devices simultaneously. Unlike policy packages, which handle firewall rules, they target device-wide parameters, ensuring uniform baseline configuration without manual repetition per device.

Why this answer

Provisioning Templates in FortiManager are used to standardize and automate the configuration of system-level settings such as NTP, DNS, logging, and other device-wide parameters across multiple FortiGate devices. They ensure consistency and reduce manual configuration errors when onboarding or managing many devices. They are not used for firewall policies, endpoint management, or reporting.

Exam trap

FORTINET-NSE56 often tests the confusion between Provisioning Templates (system settings) and Policy Packages (firewall policies), so candidates must distinguish device-level baseline configuration from security policy management.

How to eliminate wrong answers

Option A is wrong because FortiClient endpoint management is handled by FortiClient EMS, not FortiManager Provisioning Templates. Option B is wrong because firewall policies are created and managed through Policy Packages, not Provisioning Templates. Option C is wrong because performance reports are generated by FortiAnalyzer or FortiManager's reporting features, not by Provisioning Templates.

Full explanation →

214

Multi-Selecteasy

Which THREE of the following are core components of the Fortinet Security Fabric?

Select 3 answers

A.FortiGate

B.Standard Web Browser

C.Third-party printer

D.FortiAnalyzer

E.FortiManager

AnswersA, D, E

FortiGate is the foundational Security Fabric component, providing firewall, IPS, and policy enforcement at the network edge. It anchors the Fabric's core, connecting other devices and enabling the broad, integrated visibility the Fabric architecture requires.

Why this answer

FortiGate (A) is correct because it is the foundational next-generation firewall (NGFW) that serves as the core security enforcement point of the Fortinet Security Fabric, providing firewall, IPS, antivirus, and other security functions. FortiAnalyzer (D) is correct because it is a core Fabric component for centralized logging, analytics, and reporting, collecting and correlating security events from Fabric devices. FortiManager (E) is correct because it is the central management platform for the Fabric, enabling single-pane-of-glass configuration and policy orchestration across FortiGate and other Fortinet devices.

A standard web browser (B) is not a Fabric component; it is merely a client used to access management GUIs. A third-party printer (C) is not a Fabric component either, as it is an unrelated network endpoint device.

Exam trap

FORTINET-NSE56 often tests whether candidates can distinguish actual Fortinet Security Fabric products from generic IT components (browsers, printers) that merely interact with the network.

Full explanation →

215

MCQmedium

What is the function of the 'Check for Updates' feature in FortiManager's FortiGuard settings?

A.To check for new FortiGate hardware models.

B.To update antivirus, IPS, and application control signatures.

C.To verify the license key.

D.To update the FortiManager firmware.

AnswerB

Check for Updates pulls the latest FortiGuard antivirus, IPS and application control signature packages from the distribution server into FortiManager, which then pushes them to managed devices. This satisfies the stem's question about the feature's function.

Why this answer

The 'Check for Updates' feature in FortiManager's FortiGuard settings queries the FortiGuard Distribution Network (FDN) to retrieve the latest antivirus, IPS, application control, web filter, and other security service signature packages. These signatures are then distributed to managed FortiGate devices so their security profiles can detect current threats. It does not touch hardware inventory, licensing, or FortiManager's own firmware.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse FortiGuard signature updates with firmware upgrades or license checks — the trap is picking 'update the FortiManager firmware' because the word 'update' appears in the feature name.

How to eliminate wrong answers

Option A is wrong because FortiGate hardware model discovery is handled through device discovery/adding devices, not FortiGuard signature updates. Option C is wrong because license validation is performed via FortiCare registration and license status checks, not the FortiGuard 'Check for Updates' button. Option D is wrong because FortiManager firmware upgrades are performed through the System Settings > Firmware Upgrade path, not through FortiGuard settings.

Full explanation →

216

MCQmedium

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

A.Change their password

B.Create a log filter

C.Assign to a specific ADOM

D.Enable 2FA

AnswerC

Assigning the administrator directly to a specific ADOM scopes their permissions to that ADOM alone, so they can view its reports without accessing others. This satisfies the stem's constraint of restricting the admin to a single ADOM, since FortiManager ties admin visibility to ADOM membership rather than global profile rights.

Why this answer

In FortiManager, administrative access is scoped by ADOM (Administrative Domain). To restrict an administrator to only view reports for a specific ADOM, you must assign that administrator to the desired ADOM and configure their permission profile to allow read-only access to reports within that ADOM. This ensures the admin can only see data and reports from that ADOM, not others.

Options like changing password, creating a log filter, or enabling 2FA do not affect ADOM-level access control.

Exam trap

The trap here is confusing authentication mechanisms (password, 2FA) or log filtering with authorization scoping; candidates might think a log filter restricts report visibility, but only ADOM assignment controls which ADOMs an admin can access.

How to eliminate wrong answers

Option A is wrong because changing a password only affects authentication credentials, not authorization or ADOM scope. Option B is wrong because a log filter controls which logs are displayed or stored, but does not restrict an administrator's access to specific ADOMs. Option D is wrong because enabling two-factor authentication adds an authentication layer but does not limit which ADOMs an administrator can view.

Full explanation →

217

MCQmedium

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

A.Log aggregation

B.Event rate limiting

C.Database auto-delete

D.Log forwarding filter

AnswerB

Event rate limiting suppresses duplicate alerts triggered by the same event within a defined window, so repeated failed logins from one source IP generate a single notification. This satisfies the stem's requirement to avoid alert flooding during a short duration.

Why this answer

Event rate limiting in FortiAnalyzer's Event Handler configuration sets a threshold on how many times a matching event can trigger alerts within a specified time window. This prevents alert fatigue by suppressing duplicate notifications for the same source IP or event type in a short period. It is the specific control designed to throttle repetitive alerts.

Exam trap

FORTINET-NSE56 often tests the distinction between log storage/retention features (aggregation, auto-delete) and alert-throttling features, causing candidates to choose a storage-related option when the question asks about reducing alert volume.

How to eliminate wrong answers

Option A is wrong because log aggregation combines multiple log entries into a single record for storage efficiency, but it does not limit the number of alerts generated for repeated events. Option C is wrong because database auto-delete manages retention by purging old logs, which has no effect on the frequency of real-time alerts. Option D is wrong because a log forwarding filter determines which logs are sent to external systems (e.g., syslog), not how often alerts fire for a given condition.

Full explanation →

218

MCQeasy

Which administrative account type has full access to all ADOMs and system settings?

A.Report Admin

B.Log Admin

C.Super_User

D.Restricted Admin

AnswerC

Super_User is the only administrative profile granting unrestricted access across every ADOM plus all system-level settings, including global configuration. Other profiles are scoped to specific ADOMs or restricted feature sets, so they cannot satisfy the requirement for full access to all ADOMs and system settings.

Why this answer

The Super_User administrative profile in FortiManager/FortiAnalyzer has full read-write access to all ADOMs and all system settings, including device management, policy packages, and system configuration. It is the highest-privilege built-in account type and is not restricted to any single ADOM or functional area. This is why Super_User is the correct answer for full access across ADOMs and system settings.

Exam trap

The trap is conflating profile permissions with ADOM scope — candidates may think any admin can access all ADOMs, but only Super_User (or a custom profile with equivalent rights) has full cross-ADOM access.

How to eliminate wrong answers

Option A is wrong because a Report Admin profile is limited to report generation and related objects, not system-wide settings or all ADOMs. Option B is wrong because a Log Admin profile is scoped to log viewing, log browsing, and log-related configuration, not full system administration. Option D is wrong because a Restricted Admin is by definition limited to specific ADOMs or permissions, which contradicts the 'full access to all ADOMs' requirement.

Full explanation →

219

MCQeasy

What does the 'FortiView' module provide?

A.Configuration templates

B.Raw log data

C.Visual traffic analytics

D.Firmware management

AnswerC

FortiView aggregates and correlates log data into dashboards, charts and drill-down views, delivering visual traffic analytics across the network. This satisfies the stem's question about the module's purpose by presenting analysed traffic patterns graphically rather than as raw logs.

Why this answer

FortiView is FortiAnalyzer's visual analytics module that provides dashboards, drill-down charts, and interactive views of traffic, threats, applications, and user activity. It transforms raw log data into visual traffic analytics, allowing administrators to quickly identify top talkers, threat patterns, and bandwidth consumers without writing queries.

Exam trap

FORTINET-NSE56 often tests the distinction between raw log viewing (Log View) and aggregated analytics (FortiView) — candidates pick 'raw log data' because both deal with logs, but FortiView is specifically the visualization layer.

How to eliminate wrong answers

Option A is wrong because configuration templates are managed under the Device Manager or Provisioning section, not FortiView — FortiView is purely an analytics and visualization layer. Option B is wrong because raw log data is accessed through Log View, which shows the unprocessed log entries; FortiView presents aggregated, visualized analytics derived from those logs. Option D is wrong because firmware management is handled through the Device Manager or FortiGuard services, not FortiView, which has no role in firmware deployment.

Full explanation →

220

MCQmedium

If an administrator wants to perform a 'Config Check' to see what changes will be deployed during an installation, which option should they select in the 'Install Wizard'?

A.Policy Check

B.Install Config

C.Install Preview

D.Sync Device

AnswerC

Install Preview runs a dry-run comparison between the running configuration and the pending policy package, listing exactly which objects and rules would change without committing them. This satisfies the administrator's requirement to see what changes will be deployed during installation, before any actual deployment occurs.

Why this answer

The 'Install Preview' option in the FortiManager Install Wizard generates a diff showing exactly what configuration changes will be pushed to the target device before the install actually runs. This lets administrators review the delta and catch unintended changes before deployment.

Exam trap

The trap is confusing 'Policy Check' (semantic validation) with 'Install Preview' (config diff) — both are pre-install steps, but only one shows the actual changes to be deployed.

How to eliminate wrong answers

Option A is wrong because 'Policy Check' validates policy consistency and conflicts but does not show the full config diff that will be deployed. Option B is wrong because 'Install Config' actually performs the installation rather than previewing it. Option D is wrong because 'Sync Device' is not the preview function — it relates to synchronizing device state, not showing a pre-install diff.

Full explanation →

221

MCQmedium

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

A.Enable SQL Injection in the WAF profile

B.Enable Buffer Overflow protection

C.Enable HTTP Protocol Validation

D.Enable Cross-site Scripting protection

AnswerA

SQL Injection signatures in the WAF profile inspect request parameters and payloads for malicious SQL syntax, blocking injection attempts before they reach the application. Enabling this signature set directly satisfies the requirement to block requests containing SQL injection patterns.

Why this answer

FortiWeb's WAF profile includes a specific signature set for SQL injection (SQLi) detection, which matches patterns like ' OR 1=1, UNION SELECT, and other database query manipulations. Enabling SQL Injection in the WAF profile activates these signatures and applies them to incoming requests. This directly addresses the requirement to block SQL injection patterns.

Other protections target different attack types and would not cover SQLi.

Exam trap

FORTINET-NSE56 often tests the confusion between different WAF protections, leading candidates to select a related but incorrect feature like XSS or Buffer Overflow when the question specifically asks about SQL injection.

How to eliminate wrong answers

Option B is wrong because Buffer Overflow protection in FortiWeb detects and blocks attempts to overflow memory buffers, typically via overly long input or specific patterns, but it does not parse SQL syntax or recognize SQL injection payloads. Option C is wrong because HTTP Protocol Validation enforces RFC compliance for HTTP requests (e.g., valid methods, headers, and formatting) and does not inspect for SQL injection patterns. Option D is wrong because Cross-site Scripting protection targets XSS payloads (e.g., <script> tags, JavaScript events) and is unrelated to SQL injection detection.

Full explanation →

222

MCQeasy

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

A.AD Connector

B.Admin GUI

C.RADIUS Server

D.User Portal

AnswerD

The User Portal provides the self-service interface where users enrol, provision and manage their own two-factor tokens, including FortiToken activation and replacement. This directly satisfies the stem's requirement for user-driven token management, unlike administrative or RADIUS-facing components such as the Admin Portal or authentication server, which handle configuration and verification rather than self-service.

Why this answer

The User Portal component of FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens. It provides a web interface for users to enroll tokens, reset passwords, and manage their profiles. This offloads administrative tasks and empowers users.

Exam trap

FORTINET-NSE56 often tests FortiAuthenticator components; candidates might confuse the Admin GUI with the User Portal, but the key is 'self-service' for end-users, which is the User Portal.

How to eliminate wrong answers

Option A is wrong because the AD Connector is used to integrate FortiAuthenticator with Active Directory for user authentication and synchronization; it does not provide a self-service portal. Option B is wrong because the Admin GUI is for administrators to configure FortiAuthenticator, not for end-user self-service. Option C is wrong because the RADIUS Server handles authentication requests, not user self-service token management.

Full explanation →

223

MCQmedium

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

A.Content Routing Policy

B.Client SSL Profile

C.Server SSL Profile

D.Layer 7 Persistence Rule

AnswerB

The Client SSL Profile holds the certificate and key used to terminate TLS on the virtual server, so the FortiADC decrypts incoming HTTPS connections and forwards plaintext to backend servers. This offloads the CPU-intensive handshake and encryption work the scenario demands.

Why this answer

SSL offloading on FortiADC is configured via the Client SSL Profile, which holds the server certificate, private key, and TLS parameters used to terminate client-side HTTPS connections on the ADC. Once terminated, the ADC can inspect and load-balance the decrypted traffic before re-encrypting to backends if needed. This is the object that performs the offload.

Exam trap

The trap is confusing Client SSL Profile (client-side termination/offload) with Server SSL Profile (backend re-encryption) — candidates pick the Server profile thinking 'SSL' means the same thing on both sides.

How to eliminate wrong answers

Option A is wrong because a Content Routing Policy matches on HTTP content (URL, header, etc.) to route requests — it does not handle TLS termination. Option C is wrong because the Server SSL Profile governs the ADC's outbound TLS connection to backend servers (re-encryption), not the client-facing offload. Option D is wrong because a Layer 7 Persistence Rule maintains session stickiness based on application-layer attributes; it has no role in SSL processing.

Full explanation →

224

MCQmedium

What is the consequence of deleting a device from an ADOM in FortiManager?

A.The FortiGate is automatically rebooted.

B.The FortiGate will stop passing traffic.

C.The FortiGate configuration is wiped.

D.The FortiGate is no longer managed by that ADOM.

AnswerD

Deleting a device removes its entry from the ADOM's device list, so FortiManager stops pushing policy packages and configuration to it. The FortiGate keeps running its last-installed configuration, but that ADOM no longer manages it, satisfying the scenario's consequence.

Why this answer

Deleting a device from an ADOM in FortiManager only removes the management association between that FortiGate and the ADOM. The FortiGate itself keeps running with its current configuration and continues passing traffic; it simply is no longer managed within that ADOM.

Exam trap

The trap is assuming FortiManager deletion has a destructive effect on the FortiGate — candidates may pick 'configuration wiped' or 'stops passing traffic,' but the correct answer is simply loss of management association.

How to eliminate wrong answers

Option A is wrong because FortiManager does not reboot managed FortiGates when they are removed from an ADOM. Option B is wrong because removing management does not stop the FortiGate from forwarding traffic — its local config remains active. Option C is wrong because FortiManager does not wipe the FortiGate configuration on ADOM removal; the device retains its running config.

Full explanation →

225

Multi-Selecteasy

Which THREE are key benefits of using FortiWeb to protect web applications?

Select 3 answers

A.Replacing the ISP

B.Physical security of the server room

C.Protection against SQL Injection

D.SSL Offloading

E.Regulatory compliance reporting

AnswersC, D, E

FortiWeb inspects HTTP requests and applies signatures and parameter validation to block SQL injection payloads before they reach the backend database. This directly protects the web application layer, matching the stem's requirement for defending published applications against injection attacks.

Why this answer

Option C is correct because FortiWeb is a web application firewall (WAF) that inspects HTTP/HTTPS traffic and uses signatures and anomaly detection to block SQL Injection attacks against web applications. Option D is correct because FortiWeb can terminate TLS/SSL sessions, performing SSL offloading so backend web servers are freed from encryption/decryption overhead while FortiWeb inspects the decrypted traffic. Option E is correct because FortiWeb provides logging, reporting, and compliance-oriented dashboards that help organizations demonstrate adherence to regulations such as PCI DSS.

Option A is not a FortiWeb function, since replacing an ISP is a connectivity/business decision unrelated to application security. Option B is also unrelated, as physical security of the server room is handled by facility controls, not by a WAF.

Exam trap

FORTINET-NSE56 often includes obviously out-of-scope distractors (ISP replacement, physical security) to test whether candidates understand that a WAF operates strictly at the application layer and does not replace network or physical controls.

Full explanation →

Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) (FORTINET-NSE56) (FORTINET-NSE56) — Questions 151–225