Knowledge + Practice

CCNA Nse5 Fortianalyzer Operations Questions

61 questions · Nse5 Fortianalyzer Operations · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?

A.FortiGate log-server configuration

B.Report scheduling

C.FortiView update interval

D.FortiAnalyzer Device registration status

AnswerA

With connectivity and registration confirmed, the FortiGate's log-server configuration determines whether logs are actually directed to FortiAnalyzer. Checking the server address, port and enabled log types satisfies the stem's next-step constraint after transport and registration are verified.

Why this answer

After confirming IP connectivity and that the FortiGate is registered on the FortiAnalyzer, the next logical step is to verify the FortiGate's log-server configuration. This setting defines the FortiAnalyzer's IP address, port, and which log types (traffic, event, etc.) are sent. If the log-server is misconfigured or disabled, logs will not be transmitted even if the device is registered.

Therefore, checking the log-server configuration is the correct next step.

Exam trap

FORTINET-NSE56 often tests the misconception that registration alone guarantees log transmission, when in fact the log-server configuration must also be correct and enabled.

How to eliminate wrong answers

Option B is wrong because report scheduling controls when reports are generated on the FortiAnalyzer, not log reception from FortiGate. Option C is wrong because FortiView update interval affects how often the FortiView dashboard refreshes, not log ingestion. Option D is wrong because the question already states that FortiGate registration status was verified, so checking it again is redundant and not the next step.

Practice this question →

2

Multi-Selectmedium

Which THREE types of dashboards can be viewed in FortiAnalyzer?

Select 3 answers

A.Custom widgets/dashboards

B.FortiView dashboards

C.Firmware update dashboard

D.Report scheduling dashboard

E.System Information

AnswersA, B, E

Custom widgets and dashboards let administrators build bespoke visualisations from logged traffic and event data, satisfying the custom dashboard requirement. FortiAnalyzer supports these alongside FortiView and system information views, giving tailored insight beyond predefined layouts.

Why this answer

FortiAnalyzer supports three dashboard categories: Custom widgets/dashboards (A), which let administrators build personalized layouts by adding and arranging widgets such as top sources, destinations, and threats; FortiView dashboards (B), which provide prebuilt, drill-down visualizations of traffic, applications, threats, and other log data; and System Information (E), which displays device health and status details like CPU, memory, disk usage, and log reception rates. These are the dashboard types exposed in the FortiAnalyzer GUI under the Dashboard and FortiView menus. Firmware update (C) is an administrative task performed via the FortiGuard/System Settings area, not a dashboard type, and report scheduling (D) is configured under Reports, not presented as a dashboard view.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse dashboard types with other FortiAnalyzer features (like firmware updates or report scheduling), leading them to select non-dashboard options.

Practice this question →

3

MCQhard

When using 'Log Forwarding', can you filter the logs before they are forwarded?

A.Only for FortiAnalyzer destinations

B.Yes, using log filters

C.No, all logs are forwarded

D.Only for Syslog

AnswerB

Log filters can be applied to forwarding rules, restricting which logs leave FortiAnalyzer based on severity, device, or log type. This satisfies the filtering requirement by evaluating each log against configured criteria before transmission, so only matching entries reach the external destination.

Why this answer

FortiGate log forwarding supports log filters that allow administrators to selectively forward only specific log types, severity levels, or events to external destinations. This filtering is configured per forwarding destination (e.g., syslog, FortiAnalyzer, CEF) and reduces noise and bandwidth by excluding irrelevant logs. Therefore, yes, logs can be filtered before forwarding using log filters.

Exam trap

FORTINET-NSE56 often tests the misconception that log forwarding is all-or-nothing or destination-specific, when in fact log filters can be applied per destination to selectively forward logs.

How to eliminate wrong answers

Option A is wrong because filtering is not limited to FortiAnalyzer destinations; log filters apply to syslog, CEF, and other forwarding methods as well. Option C is wrong because not all logs are forwarded by default when filters are configured; administrators can restrict what is sent. Option D is wrong because filtering is not exclusive to Syslog; it works across multiple forwarding destination types.

Practice this question →

4

MCQhard

When setting up a 'FortiSoC' playbook to send an email, what must be configured first?

A.The report schedule

B.The SMTP server settings

C.The log forwarder

D.The ADOM mode

AnswerB

SMTP server settings must be defined before the playbook can dispatch email, supplying the relay host, port and authentication details. This satisfies the prerequisite by giving the email action a working transport, without which notification delivery fails regardless of playbook logic.

Why this answer

For a FortiSoC playbook to send an email notification, the SMTP server settings must be configured first so FortiAnalyzer/FortiSoC has a mail relay to use. Without a valid SMTP server, the email action in the playbook cannot deliver messages.

Exam trap

FORTINET-NSE56 often tests the prerequisite chain for automated actions, and candidates may confuse email delivery prerequisites (SMTP) with log flow prerequisites (forwarders) or scheduling (reports).

How to eliminate wrong answers

Option A is wrong because the report schedule controls when reports are generated, not the ability to send emails from a playbook. Option C is wrong because the log forwarder determines where logs are sent (e.g., to syslog), which is unrelated to email delivery for playbook actions. Option D is wrong because ADOM mode (analysis vs. archive) governs log storage behavior, not email configuration.

Practice this question →

5

MCQeasy

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

A.Report module

B.FortiSoC module

C.Device Manager

D.Log View

AnswerD

Log View displays logs as FortiAnalyzer receives them, refreshed in real time, letting administrators monitor live traffic and event data. Other sections such as Log Browse query stored historical logs rather than the incoming stream.

Why this answer

Log View is the FortiAnalyzer module that displays logs as they are received, with real-time refresh and filtering by ADOM, device, log type, and time. It is the direct equivalent of a live log console and is where administrators confirm that logs are actually arriving from a FortiGate. The other modules serve analytics, management, or reporting purposes.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Log View (live raw logs) with FortiView (aggregated analytics) or Device Manager (device status) — the trap is picking Device Manager because it shows connected devices, not the log stream itself.

How to eliminate wrong answers

Option A is wrong because the Report module generates scheduled or on-demand reports from stored logs; it does not show a live log stream. Option B is wrong because FortiSoC is the security operations/incident management module (playbooks, incidents, automation), not a raw log viewer. Option C is wrong because Device Manager manages registered devices and their status; it shows whether a device is connected but not the individual log entries it is sending.

Practice this question →

6

MCQeasy

What is the purpose of 'Auto-cache' for reports?

A.To speed up report generation

B.To compress logs

C.To alert admins

D.To save logs to disk

AnswerA

Auto-cache stores generated report data locally so subsequent requests reuse it instead of re-querying the log database, directly cutting generation time. This satisfies the scenario's need to speed up report generation, particularly for recurring or scheduled reports where identical queries would otherwise repeatedly scan large datasets.

Why this answer

Auto-cache pre-computes and stores report data so that subsequent report generation is significantly faster, avoiding repeated queries against large log datasets. It is a performance optimization that trades disk space for reduced report rendering time, especially valuable for scheduled or frequently-run reports.

Exam trap

NSE56 often tests the confusion between auto-cache (report performance) and log storage/compression features — candidates must recognize that auto-cache is purely a report-generation speed optimization.

How to eliminate wrong answers

Option B is wrong because auto-cache does not compress logs — log compression is handled separately by log rolling and archival settings. Option C is wrong because auto-cache has nothing to do with alerting; alerts are configured through event handlers and notification policies. Option D is wrong because saving logs to disk is the default behavior of the log storage subsystem, not the purpose of auto-cache — auto-cache stores pre-aggregated report data, not raw logs.

Practice this question →

7

MCQhard

When using FortiSoC playbooks, what is the 'Connector' used for?

A.Integrating with external systems

B.Filtering log traffic

C.Managing device firmware

D.Linking logs to reports

AnswerA

Connectors in FortiSOAR playbooks provide pre-built integrations that let automated workflows query and act on external systems, such as firewalls, ticketing platforms or threat intelligence feeds. This satisfies the stem's requirement by enabling playbook steps to exchange data with third-party tools without custom API scripting.

Why this answer

In FortiSOC playbooks, a Connector is a configuration object that defines how the playbook integrates with external systems — such as firewalls, ticketing systems, email servers, or threat intelligence platforms. Connectors provide the credentials, endpoints, and protocol details needed for the playbook to execute actions like blocking an IP on a firewall or creating a ServiceNow ticket.

Exam trap

FORTINET-NSE56 often tests the confusion between Connectors and other FortiSOAR components — candidates pick 'filtering log traffic' or 'linking logs to reports' because they associate playbooks with log processing, but Connectors specifically handle external system integration.

How to eliminate wrong answers

Option B is wrong because filtering log traffic is handled by log filters, sensors, or search queries within FortiSIEM/FortiSOC, not by Connectors. Option C is wrong because managing device firmware is an administrative task performed via FortiManager or device CLI, not through playbook Connectors. Option D is wrong because linking logs to reports is a reporting function within FortiAnalyzer/FortiSIEM, not the role of a Connector in a playbook.

Practice this question →

8

MCQeasy

What is the function of the 'Device Manager' in FortiAnalyzer?

A.To view live threats

B.To create playbooks

C.To manage registered devices

D.To run reports

AnswerC

Device Manager in FortiAnalyzer provides centralised administration of registered devices, letting you add, authorise, group and delete FortiGate and other supported appliances, and push configuration changes to them. It satisfies the stem's requirement by covering device registration and management, rather than log storage, report generation or event correlation.

Why this answer

The Device Manager in FortiAnalyzer is the interface used to manage registered devices — it lists all FortiGates and other Fortinet devices that have been added, shows their status, allows ADOM assignment, and provides actions like authorize, de-authorize, delete, and view device details. It is the central inventory of managed devices.

Exam trap

FORTINET-NSE56 often tests the functional boundaries between FortiAnalyzer modules — candidates confuse Device Manager (inventory/administration) with FortiView (analytics) or Reports (reporting), picking a plausible-sounding but incorrect module.

How to eliminate wrong answers

Option A is wrong because live threat viewing is handled by FortiView or the Incidents & Events section, not Device Manager — Device Manager is about device inventory and administration, not real-time threat monitoring. Option B is wrong because playbooks are created in the Automation or Playbook module (or SOAR features), which is separate from Device Manager. Option D is wrong because report generation is handled by the Reports module, where you create, schedule, and run reports — Device Manager does not generate reports.

Practice this question →

9

Multi-Selecteasy

Which TWO actions are commonly performed within the 'Device Manager' module?

Select 2 answers

A.Creating custom reports

B.Archiving old log files

C.Monitoring device connection status

D.Configuring event handlers

E.Registering new FortiGate devices

AnswersC, E

Device Manager in FortiClient EMS displays enrolled endpoints with real-time connectivity state, showing whether each device is currently online or offline. This directly satisfies the stem's requirement for a common action, since administrators routinely monitor connection status to verify endpoint reachability and licence compliance across managed devices.

Why this answer

Option C is correct because the Device Manager module in FortiManager provides real-time visibility into managed devices, letting administrators monitor each FortiGate's connection status (up/down) and other health indicators. Option E is correct because Device Manager is where administrators add and register new FortiGate devices to FortiManager, either individually or via discovery, so they can be centrally managed. The remaining options do not belong: creating custom reports (A) is done in the Reports module, archiving old log files (B) is handled through Log & Report/log settings rather than Device Manager, and configuring event handlers (D) is performed in the Event Management or automation/trigger configuration area, not in Device Manager.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse FortiManager modules — mixing up Device Manager (device registration/status) with Reports, Log View, or Event Management, which handle reporting, log archiving, and event handlers respectively.

Practice this question →

10

MCQmedium

What happens when you change the 'Log Policy' to 'Archive only'?

A.Logs are deleted

B.The system reboots

C.Real-time analysis stops

D.The system automatically upgrades

AnswerC

Setting 'Archive only' halts real-time inspection, so traffic is logged without live analysis. This satisfies the stem's constraint by confirming that archive mode disables the immediate scanning and alerting performed during active logging, leaving only stored records for later review rather than instantaneous threat detection.

Why this answer

In FortiAnalyzer, the 'Log Policy' setting controls how logs are processed. When set to 'Archive only', logs are stored but not analyzed in real time. This means that features like real-time log correlation, alerting, and reporting that depend on immediate analysis are disabled.

The logs are still available for later retrieval and offline analysis.

Exam trap

The trap here is confusing 'Archive only' with log deletion or system changes, when it actually disables real-time analysis.

How to eliminate wrong answers

Option A is wrong because changing the log policy to 'Archive only' does not delete logs; it simply changes how they are handled. Option B is wrong because the system does not reboot when altering log policy settings. Option D is wrong because the system does not automatically upgrade; log policy changes are unrelated to firmware upgrades.

Practice this question →

11

Multi-Selecthard

Which TWO tasks are part of the 'Log Management' phase on FortiAnalyzer?

Select 2 answers

A.Defining report schedules

B.Configuring playbook triggers

C.Log ingestion and indexing

D.Pushing firmware to FGT

E.Log archiving and cleanup

AnswersC, E

Log ingestion receives raw syslog or FortiGate logs, then indexing builds the searchable database that analytics and reports query. This satisfies the Log Management phase's requirement to collect and organise logs before analysis, distinct from the later FortiView and reporting functions.

Why this answer

The 'Log Management' phase on FortiAnalyzer centers on receiving, storing, and maintaining log data, so option C (Log ingestion and indexing) is correct because FortiAnalyzer must collect logs from registered devices and build indexes that make them searchable for analysis and reports. Option E (Log archiving and cleanup) is also correct because retention management—archiving older logs and purging data per retention policy—is a core part of the log management lifecycle to control storage usage. Option A (Defining report schedules) belongs to the reporting/analysis phase rather than log management itself, since it governs when reports are generated, not how logs are stored.

Option B (Configuring playbook triggers) relates to automation and incident response (SOAR) functionality, not log storage management. Option D (Pushing firmware to FGT) is a device-management task, typically handled by FortiManager, and has nothing to do with FortiAnalyzer log management.

Exam trap

The trap is confusing adjacent FortiAnalyzer phases — candidates may pick report scheduling or playbook triggers because they involve logs, but those belong to Reporting and Automation, not Log Management.

Practice this question →

12

MCQhard

Which of the following is true about 'Report Data Masking'?

A.It masks sensitive information

B.It encrypts the report file

C.It deletes the logs

D.It hides the entire report

AnswerA

Report Data Masking conceals sensitive fields, such as credentials or personal data, within generated reports so that viewers without the required privileges cannot read them. This satisfies the stem's requirement for a true statement about the feature: masking is applied to report content itself, preserving analytical value while preventing disclosure of confidential information.

Why this answer

Report Data Masking in FortiAnalyzer/FortiManager replaces sensitive data (such as usernames, IP addresses, or other PII) in generated reports with masked values, protecting privacy while still allowing report distribution. It does not alter the underlying logs or encrypt the report file — it only obscures specific fields in the report output.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse masking (obscuring fields in reports) with encryption (protecting the file) or log deletion (removing data).

How to eliminate wrong answers

Option B is wrong because data masking does not encrypt the report file; encryption is a separate function (e.g., PDF password protection or secure delivery). Option C is wrong because masking does not delete logs — logs remain intact in the log database; only the report display is altered. Option D is wrong because masking hides specific sensitive fields, not the entire report; the report is still generated and viewable.

Practice this question →

13

MCQeasy

What is the primary function of the FortiAnalyzer 'Log View' page?

A.Configuring device passwords

B.Creating SOC playbooks

C.Generating PDF reports

D.Viewing raw log data

AnswerD

Log View displays raw, unparsed log entries exactly as received, letting analysts inspect original fields and values. This satisfies the primary function by presenting source log data directly, rather than aggregated reports or dashboards built from parsed and indexed content.

Why this answer

The Log View page in FortiAnalyzer is designed for real-time or historical inspection of raw log entries received from managed devices. It allows administrators to filter, search, and drill into individual log fields (source IP, destination, action, etc.) without generating a formatted report. This is the primary interface for forensic log analysis and troubleshooting.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Log View (raw log inspection) with Reports (formatted output) or with configuration/management pages.

How to eliminate wrong answers

Option A is wrong because device password configuration is performed under Device Manager, not Log View. Option B is wrong because SOC playbooks are created in the Incident Response or Automation sections of FortiAnalyzer, not in Log View. Option C is wrong because PDF report generation is handled by the Reports module (Report > Create New), which aggregates and formats data rather than displaying raw logs.

Practice this question →

14

Multi-Selectmedium

Which THREE items are found in the 'System Settings' area?

Select 3 answers

A.Administrators

B.Report templates

C.Mail Server settings

D.FortiView widget configuration

E.Disk maintenance

AnswersA, C, E

Administrators appear under System Settings because that area governs device-wide configuration, including admin accounts, rather than per-policy security profiles. The stem asks which items reside in System Settings, and administrator management is a system-level function, satisfying that constraint directly.

Why this answer

In the System Settings area, option A 'Administrators' is correct because administrator accounts, profiles, and their access permissions are configured there. Option C 'Mail Server settings' is correct because the SMTP server used for alert emails and notifications is defined under System Settings. Option E 'Disk maintenance' is correct because disk-related tasks such as formatting, logging, and disk usage are managed in System Settings.

Option B 'Report templates' is not part of System Settings; report templates are configured in the Reports section. Option D 'FortiView widget configuration' is not part of System Settings; FortiView widgets are configured in the FortiView/dashboard area.

Exam trap

FORTINET-NSE56 often tests the boundary between System Settings and feature-specific areas — candidates incorrectly include reporting or FortiView items that live in their own menus.

Practice this question →

15

MCQhard

An analyst notices that a FortiAnalyzer appliance is not archiving logs to a configured remote storage server, even though the local disk still has free space. The administrator confirms the archive schedule is enabled and the remote server is reachable. Which setting should the analyst verify first?

A.The log archive filters, to confirm the log types and severity levels selected actually match the logs being generated.

B.The ADOM operating mode, to confirm it is set to Advanced rather than Normal.

C.The FortiAnalyzer RAID level, to confirm it provides enough redundancy for archive operations.

D.The administrator's profile, to confirm it includes the log archive permission.

AnswerA

Log archiving applies a filter that determines which logs are copied to the remote server. If the filter selects only certain log types or severity levels that the FortiGates are not producing, the archive job runs but transfers nothing, which exactly matches the symptom of an idle archive with healthy connectivity.

Why this answer

Archive jobs are driven by a filter that specifies log types, devices, and severity. When connectivity and scheduling are correct but nothing arrives, the filter is the usual culprit because it can exclude every log the sources actually emit, leaving the job successful yet empty.

Exam trap

The trap here is focusing on connectivity or disk space while overlooking that archive filters decide which logs are actually sent.

Practice this question →

16

Multi-Selecthard

Which TWO methods can be used to back up FortiAnalyzer configuration?

Select 2 answers

A.Scheduled backup to FTP/SCP

B.FortiView snapshots

C.Log archiving

D.Device provisioning

E.Manual backup via CLI/GUI

AnswersA, E

Scheduled backups push configuration archives to FTP or SCP servers automatically, satisfying FortiAnalyzer's requirement for recurring, off-box configuration protection without manual intervention. The scheduler executes at defined intervals, transferring the encrypted configuration file to the remote host, which preserves recovery capability if the appliance fails.

Why this answer

Option A (Scheduled backup to FTP/SCP) is correct because FortiAnalyzer supports scheduled configuration backups that are transferred to a remote FTP or SCP server, allowing automated, off-box protection of the configuration. Option E (Manual backup via CLI/GUI) is correct because administrators can trigger an on-demand configuration backup through the GUI (System Settings > Dashboard > Backup) or the CLI using the 'execute backup config' command. The other options do not belong: FortiView snapshots (B) are visual reports of traffic/log data, not configuration backups; log archiving (C) stores log data rather than the FortiAnalyzer configuration; and device provisioning (D) is a management feature for onboarding and configuring managed devices, not for backing up FortiAnalyzer itself.

Exam trap

The trap is confusing configuration backup with log archiving or FortiView snapshots — candidates who see 'backup' and 'archive' as synonyms pick the wrong option, but only manual and scheduled FTP/SCP backups preserve the configuration.

Practice this question →

17

MCQhard

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

A.The FortiGate is powered off

B.The report is still running

C.The FortiAnalyzer is too slow

D.The ADOM selection is incorrect

AnswerD

FortiView displays logs scoped to the currently selected ADOM, so an incorrect ADOM selection hides the target device's data. This satisfies the scenario's symptom of missing data for one device, since the logs exist but fall outside the active ADOM view.

Why this answer

FortiView data is scoped to an ADOM, so if the administrator is viewing the wrong ADOM, the specific device's data will not appear even though logs exist. Selecting the correct ADOM (the one containing the device and its logs) is required before FortiView can display that device's traffic, applications, or threats. This makes an incorrect ADOM selection the most likely cause of missing FortiView data.

Exam trap

FORTINET-NSE56 often tests ADOM scoping — candidates forget that FortiView, reports, and logs are all filtered by the currently selected ADOM, so a wrong ADOM looks like missing data.

How to eliminate wrong answers

Option A is wrong because if the FortiGate were powered off, the administrator would see broader connectivity or logging failures, not just missing data for one device in FortiView. Option B is wrong because FortiView is a real-time/near-real-time analytics view, not a scheduled report — there is no 'report still running' state that would hide a single device. Option C is wrong because a slow FortiAnalyzer would cause delays or timeouts across the board, not selectively hide one device's data.

Practice this question →

18

MCQhard

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

A.Run a manual report

B.Use the 'Test' button in the Event Handler definition

C.Rebuild the SQL database

D.Check the FortiAnalyzer system logs

AnswerB

The Test button evaluates the handler's filter against existing logs and reports matches immediately, confirming whether criteria align with real log entries. This satisfies the troubleshooting need by isolating filter mismatch from trigger or delivery faults without waiting for live events.

Why this answer

The 'Test' button in the Event Handler definition allows the administrator to run the handler's filter against existing logs and see which entries match, without waiting for a real-time trigger. This directly validates whether the filter criteria (log type, severity, field conditions) are correctly defined and whether any logs in the current dataset satisfy them. It is the fastest and most precise troubleshooting step.

Exam trap

FORTINET-NSE56 often tests whether candidates know the built-in 'Test' function for Event Handlers, versus assuming they must wait for a live trigger or dig through unrelated system logs.

How to eliminate wrong answers

Option A is wrong because running a manual report shows aggregated output, not whether the event handler's specific filter matches individual logs. Option C is wrong because rebuilding the SQL database is a heavy, disruptive operation that does not validate filter logic and is unrelated to handler triggering. Option D is wrong because FortiAnalyzer system logs record appliance-level events (login, config changes), not whether a user-defined event handler's filter matched incoming device logs.

Practice this question →

19

Multi-Selecthard

Which TWO of the following are valid log file types supported by FortiAnalyzer?

Select 2 answers

A.PDF reports

B.Event logs

C.HTML dashboards

D.Firmware images

E.Traffic logs

AnswersB, E

Event logs are a native FortiAnalyzer log type, capturing system, administrative and security events forwarded from FortiGate and other Fortinet devices. This satisfies the stem's requirement for valid supported log file types, alongside traffic, security, anomaly and VoIP logs. FortiAnalyzer parses and indexes them for reporting and compliance.

Why this answer

FortiAnalyzer natively stores and indexes log types such as Event logs (B) and Traffic logs (E), which correspond to the standard log categories generated by FortiGate and other Fortinet devices (traffic, event, security, anomaly, VoIP, etc.). Event logs (B) capture system, administrative, and user activity events, while Traffic logs (E) record session-level connection details, and both are core log types FortiAnalyzer is designed to receive, archive, and analyze. PDF reports (A) are generated output artifacts, not log file types, and HTML dashboards (C) are visualization interfaces rather than logs.

Firmware images (D) are OS binaries for devices, not log data, so they are not supported log file types in FortiAnalyzer.

Exam trap

FORTINET-NSE56 often tests the confusion between log file types (Traffic, Event, Security, etc.) and non-log artifacts like PDF reports, dashboards, or firmware images that candidates may mistakenly select.

Practice this question →

20

Multi-Selectmedium

Which THREE components are visible in the 'Log View' interface?

Select 3 answers

A.Log table (raw data)

B.Playbook builder

C.Device provisioning templates

D.Log search bar

E.Time period selection

AnswersA, D, E

The Log View interface presents the log table, which displays the raw log entries themselves, letting administrators inspect individual fields and events. This raw data component is one of the three visible elements of the Log View layout.

Why this answer

The Log View interface is designed for inspecting and querying collected log data, so it exposes the Log table (raw data) (A), which displays the actual log entries received from monitored devices, and the Log search bar (D), which lets analysts filter and query those entries using search syntax. It also includes the Time period selection (E), which scopes the displayed logs to a specific time window so results are relevant and performant. The Playbook builder (B) belongs to the automation/response workflow area rather than the log inspection view, and Device provisioning templates (C) are part of onboarding/configuration management, so neither is rendered within Log View.

Exam trap

FORTINET-NSE56 often tests the confusion between log-viewing components and adjacent FortiAnalyzer features like playbooks or provisioning, so candidates must distinguish what is actually rendered in the Log View pane versus other modules.

Practice this question →

21

MCQmedium

When adding a FortiGate to a FortiAnalyzer, which information is required?

A.Device serial number

B.The admin password of the FortiAnalyzer

C.The SQL database password

D.The log file format

AnswerA

The FortiGate's serial number uniquely identifies the device during registration, satisfying FortiAnalyzer's requirement to bind the correct appliance to its logging database. FortiAnalyzer matches this serial against the device record, so no IP address or pre-shared key is needed for the initial add.

Why this answer

When adding a FortiGate to FortiAnalyzer, the device serial number is required because FortiAnalyzer uses it as the unique identifier to authenticate and authorize the device for log storage and management. The serial number ensures that only the correct FortiGate can send logs and receive configuration from the FortiAnalyzer, preventing unauthorized devices from registering. This is part of the initial device authorization process, where the FortiAnalyzer admin adds the serial number and then the FortiGate is configured to point to the FortiAnalyzer.

Exam trap

FORTINET-NSE56 often tests the misconception that administrative credentials are needed to add a device, confusing the FortiAnalyzer's own admin login with the device authorization process, which relies on the FortiGate's serial number.

How to eliminate wrong answers

Option B is wrong because the admin password of the FortiAnalyzer is not required on the FortiGate; authentication is typically done via the FortiGate's serial number and a pre-shared key or certificate, not the FortiAnalyzer admin credentials. Option C is wrong because the SQL database password is an internal FortiAnalyzer setting for its database, not something needed when adding a FortiGate. Option D is wrong because the log file format (e.g., syslog, CEF) is a configuration choice for log forwarding, not a required piece of information for adding the device to FortiAnalyzer.

Practice this question →

22

MCQmedium

What is the purpose of an 'Event Handler' in FortiAnalyzer?

A.To generate alerts

B.To push firmware

C.To store logs

D.To clear disk space

AnswerA

An Event Handler runs scheduled or real-time queries against log data and triggers notifications when defined conditions match, such as threshold breaches or specific log patterns. This satisfies the requirement to generate alerts automatically rather than merely storing or correlating raw logs.

Why this answer

An Event Handler in FortiAnalyzer is a mechanism that monitors incoming log data against user-defined filters and triggers automated actions when specific conditions are met. Its primary purpose is to generate alerts (e.g., email, SNMP traps, syslog messages) to notify administrators of critical events, such as security breaches or system failures. This enables proactive incident response by correlating and reacting to log patterns in real time.

Exam trap

FORTINET-NSE56 often tests the distinction between FortiAnalyzer and FortiManager functionalities, causing candidates to confuse log storage with alert generation or misattribute firmware management to FortiAnalyzer.

How to eliminate wrong answers

Option B is wrong because pushing firmware is a function of FortiManager, not FortiAnalyzer; FortiAnalyzer focuses on log analysis and reporting, not device configuration management. Option C is wrong because storing logs is the core function of FortiAnalyzer's log repository, not the specific role of an Event Handler; the handler processes logs but does not store them. Option D is wrong because clearing disk space is a maintenance task typically handled by log retention policies or manual deletion, not by an Event Handler, which is designed for alerting and automated responses.

Practice this question →

23

MCQeasy

Which component of FortiAnalyzer is used to identify top talkers on the network?

A.System Dashboard

B.Log View

C.FortiView

D.Event Handler

AnswerC

FortiView aggregates and visualises log data from managed FortiGate devices, ranking traffic by source, destination, application and bandwidth. This directly satisfies the stem's requirement to identify top talkers, since its drill-down dashboards surface the highest-volume hosts and sessions without manual log queries.

Why this answer

FortiView is FortiAnalyzer's analytics module that aggregates logs into visual dashboards showing top talkers, top applications, top destinations, and threat activity. It is specifically designed to answer 'who is using the most bandwidth or generating the most sessions' by ranking sources, destinations, and applications. The other modules are for raw log inspection, device management, or automated alerting.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Log View (raw log browsing) with FortiView (aggregated analytics) — the trap is choosing Log View because it 'shows logs' without recognizing the aggregation requirement.

How to eliminate wrong answers

Option A is wrong because the System Dashboard shows FortiAnalyzer's own health (disk, CPU, log rate, license status), not network top talkers. Option B is wrong because Log View displays raw or filtered log entries one line at a time — it can be searched but does not rank or visualize top talkers. Option D is wrong because Event Handler is a rules engine that triggers alerts or actions when log patterns match thresholds; it does not produce top-talker analytics.

Practice this question →

24

MCQmedium

Which dashboard provides a 'Threat Map'?

A.Report module

B.Device Manager

C.Log View

D.FortiView

AnswerD

FortiView aggregates live traffic and security logs into visual dashboards, including a geolocation-based Threat Map plotting attack sources and destinations. This satisfies the stem's requirement for a dashboard presenting threat activity geographically, unlike log or policy views that lack that visual, map-based threat representation.

Why this answer

FortiView is the FortiGate dashboard module that includes the Threat Map, a geographic visualization of attacks and threats detected by the device. It aggregates log data into interactive widgets showing top threats, sources, and destinations on a world map. The Threat Map is accessed from FortiView, not from the Report, Device Manager, or Log View modules.

Exam trap

FORTINET-NSE56 often tests the confusion between FortiView (interactive dashboards including Threat Map) and the Report module (scheduled reports) — candidates pick Report because it sounds like the place for visualizations.

How to eliminate wrong answers

Option A is wrong because the Report module generates scheduled or on-demand reports (PDF/HTML) and does not host the interactive Threat Map. Option B is wrong because Device Manager is for managing FortiAPs, FortiSwitches, and other managed devices — it has no threat visualization. Option C is wrong because Log View is for browsing raw and filtered log entries (traffic, event, security) and does not provide the geographic Threat Map widget.

Practice this question →

25

MCQeasy

What is a 'Playbook' in the context of FortiSoC?

A.A report template

B.A device registration script

C.A log storage policy

D.An automated incident response workflow

AnswerD

A FortiSoC playbook is an automated incident response workflow, executing predefined actions such as isolating endpoints or blocking indicators when triggers fire. This satisfies the scenario's requirement for consistent, machine-speed containment without analyst intervention, distinguishing it from static runbooks or manual ticketing procedures.

Why this answer

In FortiSOC, a Playbook is a predefined, automated sequence of actions that orchestrates incident response. It combines triggers, conditions, and tasks—such as isolating an endpoint, blocking an IP, or notifying a team—to reduce manual effort and response time. This aligns with the SOAR (Security Orchestration, Automation, and Response) capabilities of FortiSOC, where playbooks are central to automating workflows across integrated security tools.

Exam trap

The trap here is confusing FortiSOC playbooks with other SOC artifacts like reports, scripts, or policies; candidates may pick a familiar term without recognizing that 'playbook' specifically denotes an automated incident response workflow in FortiSOC.

How to eliminate wrong answers

Option A is wrong because a report template defines the layout and content of generated reports, not an automated response workflow. Option B is wrong because a device registration script is used to onboard or enroll devices into management, not to orchestrate incident response actions. Option C is wrong because a log storage policy governs retention, rotation, and archiving of logs, not the automated handling of security incidents.

Practice this question →

26

MCQhard

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

A.Device manager logs

B.System logs

C.Playbook Execution logs

D.FortiView

AnswerC

Playbook Execution logs record each action's run status, timestamps and error output, directly satisfying the requirement to view execution history. Unlike general audit or system event logs, they capture per-step playbook detail, letting you pinpoint why the FortiGate action failed.

Why this answer

FortiSOAR (and FortiGate's automation stitches) maintain dedicated Playbook Execution logs that record each playbook run, the actions executed, their results, and any errors. When a playbook fails to execute an action, the Playbook Execution logs are the correct place to inspect the execution history and diagnose the failure.

Exam trap

FORTINET-NSE56 often tests whether candidates default to generic 'System logs' for any troubleshooting question, when the specific subsystem (playbooks) has its own dedicated execution log.

How to eliminate wrong answers

Option A is wrong because Device Manager logs track device management events (configuration changes, admin logins), not playbook action execution. Option B is wrong because System logs capture general system events (interface up/down, HA changes, admin activity) but not the granular step-by-step playbook execution trace. Option D is wrong because FortiView is a traffic and threat analytics dashboard that visualizes network activity, not automation/playbook execution history.

Practice this question →

27

MCQmedium

Which protocol is utilized for log forwarding between FortiAnalyzer units?

A.OFTP

B.SNMP

C.Syslog

D.HTTPS

AnswerA

OFTP (Optimised Fabric Transfer Protocol) is Fortinet's proprietary transport for log forwarding between FortiAnalyzer units, enabling efficient, reliable delivery of logs across the fabric. It satisfies the scenario's requirement for the specific protocol used in FortiAnalyzer-to-FortiAnalyzer log transfer.

Why this answer

FortiAnalyzer uses the proprietary OFTP protocol to securely forward logs between devices.

Practice this question →

28

MCQeasy

Which dashboard shows the health status of all registered devices?

A.FortiView

B.Reports

C.Event Handler

D.Device Manager

AnswerD

Device Manager provides a centralised inventory listing every registered endpoint with its current health status, satisfying the requirement to view all devices at once. Unlike endpoint compliance or vulnerability dashboards, it aggregates registration state and health per device, giving the complete fleet-wide view the question demands.

Why this answer

The Device Manager dashboard in FortiManager provides a consolidated view of all registered/managed devices, including their health, connectivity, and status indicators. It is the primary pane for monitoring device up/down state and synchronization status. This makes it the correct place to check the health of all registered devices at a glance.

Exam trap

The trap is conflating monitoring dashboards — candidates may pick FortiView because it sounds like a status view, but FortiView is log/traffic analytics, not device health inventory.

How to eliminate wrong answers

Option A is wrong because FortiView is a log analytics and visualization tool for traffic and threat data, not a device health inventory. Option B is wrong because Reports generates scheduled or on-demand report documents, not a live health dashboard. Option C is wrong because Event Handler is used to define automated actions triggered by events, not to display device health status.

Practice this question →

29

MCQmedium

What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?

A.The FortiGate blocks all traffic

B.They are moved to a USB drive

C.The FortiAnalyzer reboots

D.They are overwritten (by default)

AnswerD

FortiAnalyzer rolls over the oldest logs once the Maximum Storage limit is reached, overwriting them to admit new entries. This default behaviour satisfies the stem's constraint: no archival or external offload is configured, so retention is bounded by local disk capacity rather than indefinite preservation.

Why this answer

By default, when a FortiAnalyzer reaches its configured Maximum Storage limit, it overwrites the oldest logs to make room for new ones, ensuring continuous log ingestion. This behavior is controlled by the 'Log file management' setting, which can be configured to overwrite or to stop logging when full, but the default is overwrite.

Exam trap

FORTINET-NSE56 often tests the default behavior of FortiAnalyzer storage management — candidates who assume logging stops or the device reboots when full will miss that the default is to overwrite the oldest logs.

How to eliminate wrong answers

Option A is wrong because FortiAnalyzer storage limits do not affect FortiGate traffic forwarding — the FortiGate continues to process traffic regardless of FortiAnalyzer disk state. Option B is wrong because FortiAnalyzer does not automatically offload logs to USB drives; archival requires manual configuration or integration with external storage. Option C is wrong because FortiAnalyzer does not reboot when storage is full — it simply manages log retention according to policy.

Practice this question →

30

MCQeasy

Which FortiView tool allows you to see traffic patterns based on geographical origin?

A.Sources (Map View)

B.Event Handler

C.Reports

D.Log View

AnswerA

Sources (Map View) plots traffic by geographic origin on a world map, aggregating sessions by source country. This satisfies the requirement to see traffic patterns based on geographical origin, which other FortiView tools such as Destinations or Applications cannot show.

Why this answer

FortiView's Sources view includes a Map View that plots traffic by geographic origin, letting administrators visualize which countries or regions are generating traffic. This is the tool designed for geographic traffic pattern analysis.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse FortiView's visualization tools (Sources Map View) with log-processing tools (Event Handler, Log View) — all live under the same Log & Report menu, so the distinction is easy to blur.

How to eliminate wrong answers

Option B is wrong because Event Handler is a FortiAnalyzer/FortiGate feature for triggering automated actions (email, syslog, SNMP) when log events match criteria — it does not visualize geography. Option C is wrong because Reports generates scheduled or on-demand summary documents, not interactive geographic traffic maps. Option D is wrong because Log View is a raw, filterable log browser showing individual log entries, with no map or geographic aggregation.

Practice this question →

31

Multi-Selecteasy

Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?

Select 2 answers

A.FTP

B.DHCP

C.LDAP

D.Syslog

E.Local authentication

AnswersC, E

LDAP lets FortiAnalyzer bind administrative logins to an external directory server, so credentials and group membership are validated remotely rather than stored locally. This satisfies the requirement for an external authentication method for admin users, alongside RADIUS, TACACS+ and Microsoft Entra ID, without duplicating accounts on the appliance.

Why this answer

LDAP (option C) is correct because FortiAnalyzer supports external authentication of administrative users against an LDAP directory server, allowing admins to log in with their directory credentials. Local authentication (option E) is also correct because FortiAnalyzer maintains a local administrator database where admin accounts and passwords can be created and used to log in directly. FTP (option A) is a file-transfer protocol and provides no user authentication mechanism for administrative login.

DHCP (option B) is used for dynamic IP address assignment, not for authenticating admin users. Syslog (option D) is a logging/event transport protocol and cannot authenticate administrative users on FortiAnalyzer.

Exam trap

NSE 5 often tests whether candidates confuse log-transport protocols (Syslog, FTP) with authentication protocols — the trap is selecting any protocol that 'sounds like it connects to something' rather than the two that actually validate admin identity.

Practice this question →

32

Multi-Selecthard

Which TWO actions can be triggered by a FortiSoC Playbook?

Select 2 answers

A.Deleting the ADOM

B.Sending an email notification

C.Changing system time

D.Rebooting the FortiAnalyzer

E.Updating a firewall address object

AnswersB, E

FortiSoC playbooks execute automated response actions, and email notification is a supported action type, dispatched through the configured mail connector or SMTP relay. This satisfies the stem's requirement for a triggerable playbook action, letting analysts receive alerts without manual monitoring.

Why this answer

Option B is correct because FortiSoC playbooks can include notification actions that send email alerts to administrators or stakeholders when a trigger condition is met, using configured SMTP/mail server settings. Option E is correct because playbooks can execute remediation actions against integrated devices, including updating firewall address objects (for example, adding a malicious IP to a blocklist address object) via the FortiGate/FortiManager connector. Option A is not a valid playbook action because deleting an ADOM is an administrative configuration task performed in FortiManager/FortiAnalyzer, not an automated response action.

Option C is incorrect because changing system time is an administrative system setting, not a playbook-triggered response. Option D is incorrect because rebooting the FortiAnalyzer is a maintenance operation, not a typical automated playbook action.

Exam trap

FORTINET-NSE56 often tests the boundary between administrative FortiManager/FortiAnalyzer operations and playbook-eligible response actions — candidates pick destructive admin tasks that playbooks cannot perform.

Practice this question →

33

Multi-Selectmedium

Which THREE elements are part of the Event Handler configuration?

Select 3 answers

A.Alert action (email/SNMP)

B.Report output profile

C.Firmware update schedule

D.Log filter

E.Threshold (count/time)

AnswersA, D, E

Alert action defines how the Event Handler responds once its trigger conditions match, supporting email or SNMP notification delivery. This satisfies the stem's requirement for a configuration element, since the handler must specify an output action alongside trigger and schedule. Email and SNMP are the two supported action types in FortiAnalyzer's event handler.

Why this answer

In an Event Handler configuration, the three required elements are the Alert action (A), which defines how notifications are delivered via email or SNMP traps when the event fires; the Log filter (D), which specifies which log messages or event patterns the handler monitors; and the Threshold (E), which sets the count and/or time window that must be met before the handler triggers. These three components work together: the log filter selects the events, the threshold determines when enough events have occurred, and the alert action defines the resulting notification. Report output profiles (B) belong to reporting configuration, not event handling, and firmware update schedules (C) are managed under system maintenance or update settings, so neither is part of an Event Handler configuration.

Exam trap

FORTINET-NSE56 often tests the exact components of an Event Handler — candidates confuse it with report scheduling and incorrectly include 'report output profile' as a component.

Practice this question →

34

MCQmedium

What is the purpose of 'Report Templates'?

A.To update firmware

B.To filter logs

C.To provide consistent report formats

D.To configure alerts

AnswerC

Report Templates standardise layout, sections and branding across scheduled and on-demand outputs, so every generated report follows the same predefined structure without manual reformatting. This directly satisfies the stem's requirement for consistency, since templates are applied automatically at generation time rather than being rebuilt per report.

Why this answer

Report Templates in FortiAnalyzer/FortiManager define the layout, sections, charts, and formatting used when generating reports, so that recurring reports share a uniform structure and appearance. They are reusable blueprints that administrators attach to report schedules, ensuring every generated PDF/HTML report follows the same corporate or compliance format. This is why the correct answer is 'to provide consistent report formats' rather than any operational function like firmware, filtering, or alerting.

Exam trap

The trap here is confusing report presentation with report data collection — candidates may pick 'filter logs' because reports contain logs, but templates only shape output, they don't filter or store logs.

How to eliminate wrong answers

Option A is wrong because firmware updates are handled through FortiGuard/device management functions, not Report Templates. Option B is wrong because log filtering is performed by log filters, event handlers, or log view queries — templates only control report presentation. Option D is wrong because alert configuration is done via Event Handlers or alert settings, not through report templates.

Practice this question →

35

MCQhard

If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?

A.Log encryption

B.ADOM mode switching

C.Trusted hosts

D.Report scheduling

AnswerC

Trusted hosts restrict GUI and administrative access to specified source IP addresses or subnets, so only administrators connecting from approved networks can reach the FortiAnalyzer interface. This satisfies the requirement that only authorised administrators gain GUI access.

Why this answer

Trusted hosts is a FortiAnalyzer (and FortiGate) feature that restricts GUI and administrative access to a specified list of source IP addresses or subnets. By configuring trusted hosts on administrator accounts, only connections originating from those authorized addresses can reach the GUI, effectively ensuring that only authorized administrators can access it. The other options do not provide this access restriction.

Exam trap

FORTINET-NSE56 often tests the difference between access control features (trusted hosts) and data protection features (log encryption), causing candidates to select encryption when the question asks about restricting GUI access.

How to eliminate wrong answers

Option A is wrong because log encryption protects log data at rest or in transit, not GUI access. Option B is wrong because ADOM mode switching changes the operational mode of an ADOM (e.g., normal vs. backup), not administrator access control. Option D is wrong because report scheduling automates report generation, not GUI access restriction.

Practice this question →

36

MCQmedium

How can you verify that a FortiGate is sending logs to the FortiAnalyzer?

A.By checking the interface status

B.By looking at the routing table

C.By running a report

D.By checking the log status in Device Manager

AnswerD

Checking the log status in Device Manager shows the live connection state between the FortiGate and FortiAnalyzer, confirming whether log transmission is active. This directly satisfies the stem's requirement to verify that logs are actually being sent, rather than merely confirming configuration exists.

Why this answer

The correct method is to check the log status in Device Manager on the FortiAnalyzer. In FortiAnalyzer, navigating to Device Manager shows the list of managed devices, and the log status column indicates whether logs are actively being received from each FortiGate. A green checkmark or 'Connected' status confirms that the FortiGate is successfully sending logs, while a disconnected or unknown status indicates a problem.

Exam trap

FORTINET-NSE56 often tests the confusion between verifying log transmission versus verifying network connectivity or report generation, leading candidates to choose interface status or routing table instead of the specific log status indicator in Device Manager.

How to eliminate wrong answers

Option A is wrong because checking the interface status on the FortiGate only verifies that the network interface is up and passing traffic; it does not confirm that logs are being generated, queued, or successfully transmitted to FortiAnalyzer. Option B is wrong because the routing table only shows paths to destinations; it does not indicate whether log packets are actually being sent or received by FortiAnalyzer. Option C is wrong because running a report on FortiAnalyzer shows analyzed data from logs that have already been received, but it does not directly verify the current log transmission status from a specific FortiGate; logs could be missing or delayed, and a report might still generate from old data.

Practice this question →

37

Multi-Selecteasy

Which TWO types of report formats can be generated by FortiAnalyzer?

Select 2 answers

A.CSV

B.EXE

C.ISO

D.PDF

E.MP4

AnswersA, D

CSV is a supported FortiAnalyzer report output format, exporting tabular report data for spreadsheet or external processing. It satisfies the question's requirement for one of the two valid report formats, alongside PDF for formatted presentation output.

Why this answer

FortiAnalyzer can generate reports in CSV format (Option A), which exports raw log and analytics data into comma-separated values for further processing in spreadsheets or SIEM tools, and in PDF format (Option D), which produces formatted, presentation-ready reports with charts and tables for management review. These are the two standard output formats supported by FortiAnalyzer's report engine, alongside XML and HTML in some versions, but CSV and PDF are the recognized report formats tested here. The other options do not belong: EXE (Option B) is a Windows executable, ISO (Option C) is a disk image, and MP4 (Option E) is a video container — none of which are report output formats produced by FortiAnalyzer.

Exam trap

The trap is being distracted by unusual format options (EXE, ISO, MP4) and second-guessing whether FortiAnalyzer supports exotic exports — candidates should anchor on the two well-known report formats, CSV and PDF.

Practice this question →

38

MCQeasy

Which dashboard widget provides a high-level summary of system resource usage?

A.System Information

B.Report Settings

C.Log View

D.FortiView Threats

AnswerA

The System Information widget aggregates CPU, memory, disk and session counts into a single high-level summary panel, giving administrators an at-a-glance overview of overall system resource usage rather than the detailed per-resource graphs shown elsewhere.

Why this answer

The System Information dashboard widget in FortiGate displays a high-level summary of system resource usage, including CPU utilization, memory usage, disk usage, and session counts. It provides administrators with an at-a-glance view of the device's health and performance metrics directly on the dashboard.

Exam trap

FORTINET-NSE56 often tests widget-purpose mapping — candidates confuse FortiView (threat/analytics visualization) with System Information (resource metrics) because both appear on the dashboard and sound like monitoring tools.

How to eliminate wrong answers

Option B is wrong because Report Settings is a configuration menu for defining scheduled reports and their delivery, not a dashboard widget showing resource usage. Option C is wrong because Log View displays raw or filtered log entries (traffic, event, security logs) and does not summarize system resource metrics. Option D is wrong because FortiView Threats is a visualization tool for threat analytics and attack patterns, not a system resource usage summary.

Practice this question →

39

MCQeasy

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

A.To backup the configuration

B.To increase report speed

C.To reduce CPU usage

D.To send logs to external systems

AnswerD

Log Forwarding transmits collected logs to external destinations such as syslog servers, SIEM platforms or other FortiAnalyzers. It satisfies the stated purpose by relaying log data off-box for centralised correlation, long-term retention or third-party analysis beyond FortiAnalyzer's own storage.

Why this answer

Log Forwarding in FortiAnalyzer enables the appliance to relay received logs to external destinations such as syslog servers, CEF collectors, or another FortiAnalyzer. This is essential for integrating FortiAnalyzer into a broader SIEM ecosystem (e.g., Splunk, ArcSight) or for long-term archival on external storage. The feature does not alter local storage, CPU, or configuration backup behavior — it simply duplicates/forwards log streams to configured remote endpoints.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Log Forwarding (external relay) with local log storage, backup, or performance tuning — the misconception that forwarding somehow optimizes the FortiAnalyzer itself.

How to eliminate wrong answers

Option A is wrong because configuration backup is handled via 'execute backup' commands or the System Settings > Backup page, not Log Forwarding. Option B is wrong because Log Forwarding adds outbound network traffic and processing overhead; it does not accelerate report generation. Option C is wrong because forwarding logs consumes CPU and bandwidth rather than reducing them — local log processing still occurs.

Practice this question →

40

MCQhard

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

A.The total number of logs

B.The number of matches

C.The priority of the alert

D.The time window in seconds

AnswerB

Within an Event Handler threshold, Count specifies how many matching log entries must occur before the handler triggers. It counts matches, not time elapsed, so it defines the volume threshold rather than the evaluation window.

Why this answer

In a FortiAnalyzer Event Handler, the Threshold defines the trigger condition and the Count field specifies how many matching log entries must occur within the configured time window before the handler fires. In other words, Count is the number of matches, not the total logs received or a priority value. This lets administrators say 'alert me when 10 failed logins occur in 5 minutes' by setting Count=10 and the time window accordingly.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse the Count field (number of matches) with the time window (duration) — the trap is reading 'Count' as a time value or as total log volume.

How to eliminate wrong answers

Option A is wrong because Count is not the total number of logs the FortiAnalyzer has received — that is a device/ADOM statistic, not a threshold parameter. Option C is wrong because priority/severity is a separate attribute of the alert (e.g., critical, high, medium) and is not what Count represents. Option D is wrong because the time window is a distinct field in the Event Handler configuration (often labeled 'Time Period' or similar); Count is the number of matches within that window, not the window itself.

Practice this question →

41

MCQmedium

When scheduling a report, what is the purpose of the 'Output Profile'?

A.Configuring data retention

B.Defining report formats and destinations

C.Setting the report time range

D.Adding user permissions

AnswerB

The Output Profile specifies both the file format (such as PDF, CSV or HTML) and the delivery destination (email, FTP or local storage) applied when the scheduled report runs. This satisfies the stem's requirement by binding format and destination together into one reusable profile, so each schedule produces output in the required form.

Why this answer

In FortiAnalyzer/FortiManager report scheduling, the Output Profile defines how the finished report is rendered and where it is delivered — for example PDF, CSV, or XML format, and whether it is emailed, saved to a share, or uploaded to a remote server. It is the delivery/formatting layer of the report job, separate from the data selection and time window.

Exam trap

The trap here is conflating the Output Profile with the schedule's time range or with log retention — candidates assume 'output' means 'what data comes out' rather than 'how and where the finished report is delivered'.

How to eliminate wrong answers

Option A is wrong because data retention is governed by log storage policies and the FortiAnalyzer 'log retention' settings, not by the report Output Profile. Option C is wrong because the report time range is set in the schedule's time period field (e.g., last 7 days, previous week), not in the Output Profile. Option D is wrong because user permissions are controlled by admin profiles and ADOM assignments, not by the report output configuration.

Practice this question →

42

MCQmedium

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

A.The ADOM contains devices

B.The ADOM is set to 'Read-Only'

C.The ADOM has log data

D.The administrator lacks super_admin rights

AnswerA

An ADOM can only be deleted once it holds no managed devices, so the greyed-out option directly reflects that constraint. FortiManager blocks removal while device objects remain assigned, meaning you must first move or delete every firewall and FortiGate in that ADOM before the delete action becomes available.

Why this answer

An ADOM cannot be deleted while it still contains devices; the delete option is greyed out until all devices (and their associated objects) are removed or moved to another ADOM. This is a built-in safeguard to prevent accidental loss of device configurations and log data. Read-only mode, log data, and admin rights do not cause the delete option to be greyed out in the same way.

Exam trap

FORTINET-NSE56 often tests the misconception that read-only mode or log data blocks ADOM deletion, when the actual blocker is the presence of devices in the ADOM.

How to eliminate wrong answers

Option B is wrong because setting an ADOM to read-only does not grey out the delete option; read-only affects configuration changes, not ADOM deletion. Option C is wrong because log data alone does not prevent deletion; logs are typically purged or the ADOM can be deleted with logs if no devices are present. Option D is wrong because lacking super_admin rights would typically hide the option entirely or return a permission error, not grey it out specifically due to ADOM contents.

Practice this question →

43

MCQmedium

A security team stores logs from several FortiGate devices in a single ADOM on their FortiAnalyzer appliance. They need to run a report that includes data from only two of those devices while excluding all others. What is the most appropriate way to accomplish this on FortiAnalyzer?

A.Apply a log filter on the Log View page that matches the two devices, then export the filtered view as the report.

B.Create a device group containing the two FortiGates and select that group as the report data source.

C.Delete the logs of the excluded devices from the ADOM before running the report.

D.Move the two FortiGates into a dedicated ADOM and generate the report from that ADOM.

AnswerB

FortiAnalyzer lets you build device groups inside an ADOM and then scope report generation to that group, so only the selected FortiGates contribute data. This directly satisfies the requirement of including two devices while excluding the rest, without moving logs or altering ADOM structure.

Why this answer

Device groups within an ADOM are the supported way to aggregate a subset of managed devices for reporting and analysis. Selecting the group as the report source limits the output to those FortiGates while leaving the other devices and their logs untouched in the same ADOM.

Exam trap

The trap here is assuming that report scoping requires a separate ADOM rather than a device group inside the existing ADOM.

Practice this question →

44

MCQeasy

Which menu path is used to create a new Administrator account?

A.Device Manager

B.System Settings > Admin

C.Report Settings

D.FortiSoC

AnswerB

System Settings > Admin is where FortiGate holds local administrator definitions, so new accounts are created there. The stem asks only for the menu path, and this location satisfies that constraint directly, unlike policy, network or log menus that never contain administrator objects.

Why this answer

In the FortiGate GUI, administrator accounts are created under System Settings > Admin, where you define the username, password, admin profile, and trusted hosts. This is the standard location for local admin management on FortiOS.

Exam trap

The trap is that candidates may confuse admin account creation with authentication server configuration (LDAP/RADIUS) or with FortiAuthenticator, and pick a plausible-sounding but incorrect menu path.

How to eliminate wrong answers

Option A is wrong because Device Manager is not a FortiGate GUI menu path for admin creation — it is a generic term that does not correspond to the FortiOS navigation. Option C is wrong because Report Settings relates to logging and reporting configuration, not administrator accounts. Option D is wrong because FortiSoC is a Fortinet SOC product/console concept, not a menu path for creating local admins on a FortiGate.

Practice this question →

45

MCQeasy

A compliance officer needs FortiAnalyzer to alert the security team by email whenever an administrator logs in to the FortiGate at a branch office outside business hours. Which FortiAnalyzer capability should be configured to satisfy this requirement?

A.A log-based alert with a schedule and event filter that triggers on administrator login events from that device.

B.A real-time log forwarding rule that relays all branch logs to an external SIEM for correlation.

C.A report schedule that emails a summary of administrator activity once per day.

D.A dashboard widget that displays recent administrator logins across all managed devices.

AnswerA

FortiAnalyzer can raise alerts on matching log events, and alert rules can incorporate a time schedule so notifications fire only outside defined hours. Filtering on administrator login events from the branch FortiGate targets exactly the activity in question and delivers the email through the configured mail server.

Why this answer

Event-driven alerting with a time schedule is the mechanism that turns matching log entries into timely email notifications. Scoping the filter to administrator logins from the branch FortiGate keeps the alert precise and avoids notifying on unrelated activity.

Exam trap

The trap here is choosing periodic reporting when the requirement is immediate, event-driven notification.

Practice this question →

46

Multi-Selecthard

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Select 2 answers

A.Remote server IP address

B.Log filter criteria

C.Enable compression for all logs

D.Syslog server port

E.Include device hostname in logs

AnswersA, D

The remote Syslog server IP address is the destination FortiAnalyzer forwards logs to; without it, packets cannot be addressed and the server never receives them. This satisfies the requirement that the remote server accepts forwarded logs.

Why this answer

Option A (Remote server IP address) is correct because FortiAnalyzer must know the destination address of the remote Syslog server to open the connection and forward logs to it; without a valid IP/FQDN the logs cannot be delivered. Option D (Syslog server port) is correct because the remote Syslog daemon listens on a specific port (typically UDP/TCP 514, or 6514 for TLS), and FortiAnalyzer must use the matching port or the server will not accept the forwarded logs. Option B (Log filter criteria) only determines which logs are sent, not whether the server accepts them, so it is not required for acceptance.

Option C (Enable compression for all logs) is an optional transport optimization and not needed for the server to accept logs. Option E (Include device hostname in logs) affects log content/formatting but is not a connectivity parameter required for the remote server to accept the logs.

Exam trap

FORTINET-NSE56 often tests the distinction between mandatory connectivity parameters (IP and port) and optional formatting or filtering settings, causing candidates to select features that enhance log content but are not required for the server to accept logs.

Practice this question →

47

MCQmedium

When should you use 'Log Archive' instead of 'Log Database'?

A.For real-time traffic analysis

B.For long-term storage

C.For triggering alerts

D.For generating daily reports

AnswerB

Log Archive stores logs in compressed form for retention rather than active querying, making it suited to long-term storage. This satisfies the stem by distinguishing archive's retention purpose from the Log Database's indexed, searchable analytics role.

Why this answer

Log Archive is designed for long-term storage and compliance retention, storing logs in a compressed format that is not indexed for fast querying. Log Database, by contrast, is optimized for real-time analysis and fast searches. Therefore, Log Archive should be used when the primary requirement is long-term retention rather than immediate analytics.

Exam trap

FORTINET-NSE56 often tests the trade-off between performance (database) and retention (archive), and candidates mistakenly associate 'archive' with analysis or reporting because both involve stored logs.

How to eliminate wrong answers

Option A is wrong because real-time traffic analysis requires the indexed, query-optimized Log Database, not the compressed archive format. Option C is wrong because triggering alerts depends on real-time log processing and correlation, which is a function of the analysis database, not the archive. Option D is wrong because generating daily reports requires querying indexed logs, which is the role of the Log Database; archive logs are not designed for report generation.

Practice this question →

48

MCQhard

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

A.It cannot forward logs

B.It cannot store logs

C.It cannot run reports

D.It cannot receive logs from FortiGate

AnswerC

Collector mode forwards logs to a downstream analyser and stores them only in an archive/forwarding capacity, so the local reporting engine is unavailable. Reports require the analyser role, which indexes logs into a searchable database; a collector lacks that indexing, so it cannot generate reports itself.

Why this answer

In FortiAnalyzer, 'Collector' mode is designed purely for high-volume log collection and forwarding/storage — it does not include the analytics and reporting engine. As a result, a FortiAnalyzer operating in Collector mode cannot generate reports, run log-based analytics, or provide the full GUI reporting features available in Analyzer mode. This mode is typically used in large distributed environments where a dedicated collector forwards logs to a central analyzer.

Exam trap

FORTINET-NSE56 often tests the confusion between Collector and Analyzer modes, tricking candidates into thinking Collector mode cannot store or forward logs when the real limitation is the absence of reporting/analytics.

How to eliminate wrong answers

Option A is wrong because Collector mode is specifically built to receive and forward logs to another FortiAnalyzer or syslog destination — forwarding is a core function, not a limitation. Option B is wrong because Collector mode does store logs locally (or on remote storage) as part of its collection role. Option D is wrong because receiving logs from FortiGate (or other devices) is the primary purpose of Collector mode, so it is not a limitation.

Practice this question →

49

MCQmedium

What is the maximum number of ADOMs supported on a FortiAnalyzer?

A.50

B.Depends on the model

C.10

D.Infinite

AnswerB

FortiAnalyzer ADOM capacity is not a fixed global figure; it varies by appliance or VM model, since each platform has different licensed limits. The answer therefore depends on the model, satisfying the question's constraint that no single universal maximum exists.

Why this answer

The maximum number of ADOMs (Administrative Domains) on a FortiAnalyzer is not a fixed number — it depends on the FortiAnalyzer hardware model or VM license tier. Entry-level appliances support fewer ADOMs, while high-end models and larger VM licenses support many more, so 'Depends on the model' is the correct answer.

Exam trap

FORTINET-NSE56 often tests whether candidates assume a hard-coded maximum for FortiAnalyzer features — the trap is picking a specific number (10 or 50) when the correct answer is that limits are model/license-dependent, a pattern that recurs across Fortinet product questions.

How to eliminate wrong answers

Option A is wrong because 50 is not a universal cap — some models support fewer and some support more. Option C is wrong because 10 is far too low and is not a documented FortiAnalyzer ADOM limit. Option D is wrong because FortiAnalyzer ADOM counts are bounded by model/license; they are not infinite, and exceeding the limit requires upgrading hardware or licensing.

Practice this question →

50

Multi-Selecthard

Which TWO factors impact the performance of report generation?

Select 2 answers

A.The number of registered devices

B.The firmware version of the devices

C.Whether report caching is enabled

D.The size of the log data

E.The CPU temperature

AnswersC, D

Enabling report caching stores previously generated report data, so subsequent requests reuse it instead of re-querying logs and rebuilding aggregates. This directly reduces generation time and resource load, satisfying the performance factor the question asks about.

Why this answer

Option C is correct because enabling report caching allows previously generated report results to be reused instead of recomputed, directly reducing the time and resource load required for each report generation. Option D is correct because the size of the log data determines how much data must be queried, aggregated, and rendered, so larger log volumes increase processing time and can slow report generation. The number of registered devices (A) and firmware version (B) may affect the environment but are not direct determinants of report-generation performance, and CPU temperature (E) is a hardware/environmental symptom rather than a defined performance factor for report generation.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse device count or firmware version with the actual performance factors of report caching and log data size.

Practice this question →

51

MCQmedium

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

A.Change their password

B.Create a log filter

C.Assign to a specific ADOM

D.Enable 2FA

AnswerC

Assigning the administrator directly to a specific ADOM scopes their permissions to that ADOM alone, so they can view its reports without accessing others. This satisfies the stem's constraint of restricting the admin to a single ADOM, since FortiManager ties admin visibility to ADOM membership rather than global profile rights.

Why this answer

In FortiManager, administrative access is scoped by ADOM (Administrative Domain). To restrict an administrator to only view reports for a specific ADOM, you must assign that administrator to the desired ADOM and configure their permission profile to allow read-only access to reports within that ADOM. This ensures the admin can only see data and reports from that ADOM, not others.

Options like changing password, creating a log filter, or enabling 2FA do not affect ADOM-level access control.

Exam trap

The trap here is confusing authentication mechanisms (password, 2FA) or log filtering with authorization scoping; candidates might think a log filter restricts report visibility, but only ADOM assignment controls which ADOMs an admin can access.

How to eliminate wrong answers

Option A is wrong because changing a password only affects authentication credentials, not authorization or ADOM scope. Option B is wrong because a log filter controls which logs are displayed or stored, but does not restrict an administrator's access to specific ADOMs. Option D is wrong because enabling two-factor authentication adds an authentication layer but does not limit which ADOMs an administrator can view.

Practice this question →

52

MCQmedium

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

A.Log aggregation

B.Event rate limiting

C.Database auto-delete

D.Log forwarding filter

AnswerB

Event rate limiting suppresses duplicate alerts triggered by the same event within a defined window, so repeated failed logins from one source IP generate a single notification. This satisfies the stem's requirement to avoid alert flooding during a short duration.

Why this answer

Event rate limiting in FortiAnalyzer's Event Handler configuration sets a threshold on how many times a matching event can trigger alerts within a specified time window. This prevents alert fatigue by suppressing duplicate notifications for the same source IP or event type in a short period. It is the specific control designed to throttle repetitive alerts.

Exam trap

FORTINET-NSE56 often tests the distinction between log storage/retention features (aggregation, auto-delete) and alert-throttling features, causing candidates to choose a storage-related option when the question asks about reducing alert volume.

How to eliminate wrong answers

Option A is wrong because log aggregation combines multiple log entries into a single record for storage efficiency, but it does not limit the number of alerts generated for repeated events. Option C is wrong because database auto-delete manages retention by purging old logs, which has no effect on the frequency of real-time alerts. Option D is wrong because a log forwarding filter determines which logs are sent to external systems (e.g., syslog), not how often alerts fire for a given condition.

Practice this question →

53

MCQeasy

Which administrative account type has full access to all ADOMs and system settings?

A.Report Admin

B.Log Admin

C.Super_User

D.Restricted Admin

AnswerC

Super_User is the only administrative profile granting unrestricted access across every ADOM plus all system-level settings, including global configuration. Other profiles are scoped to specific ADOMs or restricted feature sets, so they cannot satisfy the requirement for full access to all ADOMs and system settings.

Why this answer

The Super_User administrative profile in FortiManager/FortiAnalyzer has full read-write access to all ADOMs and all system settings, including device management, policy packages, and system configuration. It is the highest-privilege built-in account type and is not restricted to any single ADOM or functional area. This is why Super_User is the correct answer for full access across ADOMs and system settings.

Exam trap

The trap is conflating profile permissions with ADOM scope — candidates may think any admin can access all ADOMs, but only Super_User (or a custom profile with equivalent rights) has full cross-ADOM access.

How to eliminate wrong answers

Option A is wrong because a Report Admin profile is limited to report generation and related objects, not system-wide settings or all ADOMs. Option B is wrong because a Log Admin profile is scoped to log viewing, log browsing, and log-related configuration, not full system administration. Option D is wrong because a Restricted Admin is by definition limited to specific ADOMs or permissions, which contradicts the 'full access to all ADOMs' requirement.

Practice this question →

54

MCQeasy

What does the 'FortiView' module provide?

A.Configuration templates

B.Raw log data

C.Visual traffic analytics

D.Firmware management

AnswerC

FortiView aggregates and correlates log data into dashboards, charts and drill-down views, delivering visual traffic analytics across the network. This satisfies the stem's question about the module's purpose by presenting analysed traffic patterns graphically rather than as raw logs.

Why this answer

FortiView is FortiAnalyzer's visual analytics module that provides dashboards, drill-down charts, and interactive views of traffic, threats, applications, and user activity. It transforms raw log data into visual traffic analytics, allowing administrators to quickly identify top talkers, threat patterns, and bandwidth consumers without writing queries.

Exam trap

FORTINET-NSE56 often tests the distinction between raw log viewing (Log View) and aggregated analytics (FortiView) — candidates pick 'raw log data' because both deal with logs, but FortiView is specifically the visualization layer.

How to eliminate wrong answers

Option A is wrong because configuration templates are managed under the Device Manager or Provisioning section, not FortiView — FortiView is purely an analytics and visualization layer. Option B is wrong because raw log data is accessed through Log View, which shows the unprocessed log entries; FortiView presents aggregated, visualized analytics derived from those logs. Option D is wrong because firmware management is handled through the Device Manager or FortiGuard services, not FortiView, which has no role in firmware deployment.

Practice this question →

55

MCQmedium

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

A.FortiView Applications

B.Log View

C.FortiView Sources

D.FortiView Destinations

E.Reports

AnswerA

FortiView Applications aggregates traffic by application identity, ranking each by total bandwidth consumed. This directly satisfies the administrator's need to identify the top bandwidth consumer, presenting ranked results rather than raw per-session data. The visual ranking makes the heaviest application immediately apparent without manual correlation.

Why this answer

FortiView Applications aggregates traffic by application identity, showing which applications consume the most bandwidth in a visual, ranked format. This directly answers the administrator's need to identify the top bandwidth consumer efficiently. The other FortiView views focus on sources, destinations, or logs rather than application-level bandwidth breakdown.

Exam trap

FORTINET-NSE56 often tests the specific purpose of each FortiView view — candidates may pick 'FortiView Sources' because they think source IP is the fastest way, but the question asks for application-level bandwidth, so the trap is confusing the aggregation dimension.

How to eliminate wrong answers

Option B is wrong because Log View provides raw or filtered log entries, not a visual bandwidth ranking by application. Option C is wrong because FortiView Sources shows traffic by source IP or user, not by application. Option D is wrong because FortiView Destinations shows traffic by destination, not by application.

Option E is wrong because Reports are scheduled or on-demand summaries that may include bandwidth data but are not the most efficient real-time visual representation for identifying a single top application.

Practice this question →

56

Multi-Selectmedium

Which THREE components are required to create a functional FortiSoC Playbook?

Select 3 answers

A.Workflow Actions

B.Report Template

C.Log retention policy

D.Target Connector/Device

E.Playbook Trigger

AnswersA, D, E

Workflow Actions supply the executable steps the playbook performs, such as enrichment, notification or remediation tasks. Without at least one action, the playbook has no operational behaviour, so it cannot satisfy the requirement for a functional FortiSoC Playbook alongside a trigger and a target connector.

Why this answer

A FortiSoC playbook requires Workflow Actions (A), which are the individual executable steps such as running a CLI command, querying a log, or sending a notification that define what the playbook actually does. It also requires a Target Connector/Device (D), which specifies the endpoint, firewall, or integrated tool where those actions are executed, providing the connection and credentials needed for the workflow to run. Finally, a Playbook Trigger (E) is mandatory because it defines the event or condition (for example, an alert, incident, or manual invocation) that starts the playbook; without a trigger the workflow would never execute.

A Report Template (B) is only used for generating formatted reports and is not a playbook building block, and a Log retention policy (C) governs how long log data is stored rather than how a playbook is constructed or launched.

Exam trap

FORTINET-NSE56 often tests the three-component triad by mixing in plausible-sounding FortiAnalyzer features (reports, retention policies) that are real but not part of playbook construction.

Practice this question →

57

Multi-Selecthard

Which TWO conditions must be met for a report to run successfully?

Select 2 answers

A.Report queries must be valid

B.All logs must be archived

C.Logs must be in the database

D.The system must be in collector mode

E.The FortiGate must be offline

AnswersA, C

Report queries must be syntactically and logically valid so FortiAnalyzer can execute them against the log database without error. This satisfies the scenario's requirement for successful report generation, since an invalid query aborts the report regardless of log availability.

Why this answer

Option A is correct because a report is generated by executing its underlying queries against the log data, so those queries must be syntactically and logically valid or the report generation will fail. Option C is correct because the logs the report draws on must actually reside in the database (the log store the report engine queries); if the relevant logs are not in the database, the report has no data source and cannot run successfully. The remaining options do not belong: archiving all logs (B) is not required for a report to run, collector mode (D) is a FortiAnalyzer operating mode rather than a prerequisite for report execution, and the FortiGate being offline (E) is irrelevant since reports are built from stored logs, not from a live device connection.

Exam trap

FORTINET-NSE56 often tests the distinction between 'logs must be in the database' and 'logs must be archived', causing candidates to select archiving as a requirement when it is not.

Practice this question →

58

MCQhard

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

A.FortiView Filters

B.Report Settings

C.Global System Settings

D.ADOM Log Policy

AnswerD

The ADOM Log Policy defines retention settings scoped to that ADOM, including duration before logs are purged. This satisfies the requirement to change retention for a specific ADOM rather than globally, since the setting applies per administrative domain.

Why this answer

In FortiAnalyzer, log retention is configured per ADOM under the ADOM's Log Policy settings (ADOM Log Policy), where you define the retention period, disk quota, and log rollover behavior for that specific ADOM. This allows different ADOMs to have different retention windows based on compliance or operational needs.

Exam trap

FORTINET-NSE56 often tests the distinction between global settings and ADOM-scoped settings — candidates pick Global System Settings because retention sounds like a system-wide concern, missing that FortiAnalyzer scopes it per ADOM.

How to eliminate wrong answers

Option A is wrong because FortiView Filters control what data is displayed in the FortiView dashboards (drill-down filters, time ranges, severity filters) — they do not affect how long logs are stored. Option B is wrong because Report Settings govern scheduled report generation, templates, and output formats, not log storage duration. Option C is wrong because Global System Settings apply instance-wide defaults (admin, HA, mail server, etc.) and do not provide per-ADOM log retention control — retention is intentionally scoped at the ADOM level.

Practice this question →

59

MCQmedium

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

A.Log Forwarding

B.Device Manager

C.FortiView

D.Report Settings

AnswerA

Log Forwarding is configured on FortiAnalyzer under Log View, Log Config, Log Forwarding, where you define the remote Syslog server and select which log types to offload. This directly satisfies the stem's requirement to send logs from FortiAnalyzer to a remote Syslog server.

Why this answer

Log Forwarding is the FortiAnalyzer feature that sends logs to an external syslog server, CEF server, or another FortiAnalyzer. It is configured under the Log Forwarding section, where you define the remote server address, port, protocol, and which log types to forward. This is the standard way to offload logs for long-term retention or third-party SIEM ingestion.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse inbound device management (Device Manager) with outbound log offloading (Log Forwarding) — the trap is picking Device Manager because it 'deals with devices and logs'.

How to eliminate wrong answers

Option B is wrong because Device Manager is where you add, authorize, and manage FortiGate devices sending logs to FortiAnalyzer — it does not configure outbound log forwarding. Option C is wrong because FortiView is an analytics/visualization module for viewing aggregated logs, not a forwarding configuration screen. Option D is wrong because Report Settings controls report scheduling, templates, and output formats, not log offloading to external servers.

Practice this question →

60

MCQeasy

Which protocol does FortiAnalyzer primarily use for Web UI access?

A.SSH

B.HTTPS

C.FTP

D.HTTP

AnswerB

HTTPS encrypts browser sessions to FortiAnalyzer's administrative interface, satisfying the requirement for secure Web UI access. FortiAnalyzer serves its GUI over TLS by default on port 443, protecting credentials and configuration data in transit. Plain HTTP is not offered for management, so HTTPS is the protocol the appliance primarily uses.

Why this answer

FortiAnalyzer's Web UI is accessed over HTTPS (TCP 443) by default, providing encrypted administrative access to the GUI. Administrators browse to the FortiAnalyzer management IP or hostname using https:// to log in and manage reports, logs, and settings. HTTPS ensures credentials and session data are protected in transit.

Exam trap

FORTINET-NSE56 often tests basic protocol-to-service mapping — candidates confuse SSH (CLI) with HTTPS (Web UI) or assume HTTP is the default GUI protocol.

How to eliminate wrong answers

Option A is wrong because SSH (TCP 22) is used for CLI access to FortiAnalyzer, not for the Web UI. Option C is wrong because FTP is an insecure file-transfer protocol and is not used for FortiAnalyzer Web UI access. Option D is wrong because plain HTTP is not the primary Web UI protocol — FortiAnalyzer redirects or requires HTTPS for secure GUI access.

Practice this question →

61

MCQmedium

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

A.Provisioning Templates

B.Log Forwarding

C.Report scheduling

D.ADOM grouping

AnswerA

Provisioning Templates in FortiManager's Device Manager let you define a reusable configuration baseline and assign it to many FortiGates simultaneously, satisfying the requirement to push changes to multiple devices at once. Unlike per-device installation, the template applies shared settings across all assigned devices in a single operation.

Why this answer

Provisioning Templates in FortiManager's Device Manager let you define reusable configuration templates (e.g., system settings, interface configs, firewall objects) and apply them to multiple FortiGate devices or device groups at once. This is the intended feature for bulk-pushing configuration changes across many devices.

Exam trap

The trap is confusing policy packages with provisioning templates — both push config, but templates handle device-level settings while policy packages handle firewall policy.

How to eliminate wrong answers

Option B is wrong because Log Forwarding configures where logs are sent; it does not push configuration changes to devices. Option C is wrong because Report Scheduling controls when reports are generated, not device configuration. Option D is wrong because ADOM grouping is a logical organization of devices, not a mechanism for pushing config changes.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse5 Fortianalyzer Operations questions.

Start 20-question session