Courseiva

FORTINET-NSE56 · domain

troubleshooting

Practise Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) (FORTINET-NSE56) troubleshooting practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

301 questions79 easy123 medium99 hard

Focused practice

Practice troubleshooting questions

Scored sessions drawing only from this domain — pick a length below.

Start 20-question practice test →

What this domain covers

What to know about troubleshooting

troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common troubleshooting exam traps

  • Answering from memory before reading the full scenario.
  • Missing a constraint such as cost, availability, security, scope or command context.
  • Choosing a broad answer when the question asks for the most specific fix.
  • Ignoring why the wrong options are tempting.

Question index

All troubleshooting questions (301)

Click any question to see the full explanation, or start a practice session above.

1

A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?

Hard
2

You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?

Medium
3

You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?

Hard
4

Which GUI menu is primarily used for monitoring real-time activity?

Easy
5

Which TWO of the following are common reasons for a policy installation failure in FortiManager?

Medium
6

An administrator needs to enforce DMARC 'reject' policy for incoming mail. Where is this enforced in FortiMail?

Hard
7

You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?

Easy
8

You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?

Medium
9

You have multiple FortiADC nodes in a High Availability (HA) cluster. Which synchronization method ensures that the session table is shared between nodes to prevent user disconnects during a failover?

Hard
10

Which THREE types of dashboards can be viewed in FortiAnalyzer?

Medium
11

When using 'Log Forwarding', can you filter the logs before they are forwarded?

Hard
12

Where do you configure the global whitelist to ensure specific email addresses are never blocked by AntiSpam?

Easy
13

Which of the following is a mandatory step when creating a new ADOM in FortiManager?

Easy
14

When setting up a 'FortiSoC' playbook to send an email, what must be configured first?

Hard
15

You need to ensure that the FortiMail doesn't relay spam to external addresses. Which feature should be configured?

Hard
16

FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?

Hard
17

Which TWO protocols are commonly used for external communication with FortiAnalyzer?

Easy
18

Which tab is used to monitor traffic logs from the managed FortiGates?

Medium
19

Which feature is essential for protecting against password-based malware in attachments?

Medium
20

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

Easy
21

Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?

Medium
22

In the context of the Security Fabric, what is a 'root' FortiGate?

Medium
23

When configuring an Antivirus profile, which option is best to handle password-protected ZIP files?

Hard
24

What happens when you change an ADOM's version?

Medium
25

When managing policy packages, what does the 'Policy Package' clone feature do?

Medium
26

Which THREE items are included in a standard email header for DMARC validation?

Medium
27

An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?

Medium
28

What is the primary function of the 'Sender Reputation' service?

Medium
29

What is the purpose of 'Auto-cache' for reports?

Easy
30

Which THREE features are available when FortiAnalyzer is configured in 'Analyzer' mode?

Medium
31

When using FortiSoC playbooks, what is the 'Connector' used for?

Hard
32

Which service does FortiAuthenticator provide to enable centralized management of user identities?

Easy
33

Which THREE objects are required to configure a basic load balancing setup in FortiADC?

Medium
34

Which feature allows FortiMail to perform automatic cleanup of old messages in the quarantine?

Medium
35

What is the purpose of the 'Relay Host' setting in FortiMail?

Easy
36

You are experiencing delays in mail delivery. Where is the best place to check for queued messages?

Hard
37

Which TWO products provide identity-based security within the Fortinet portfolio?

Easy
38

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Hard
39

In a FortiWeb high-availability cluster, how are the synchronization settings for SSL certificates managed?

Hard
40

You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?

Hard
41

What is the function of the FortiGate's 'Security Fabric' connector?

Easy
42

What is the function of the 'Device Manager' in FortiAnalyzer?

Easy
43

Which THREE of the following are benefits of using ADOMs in FortiManager?

Hard
44

An administrator needs to revert a firewall configuration to a state from two weeks ago. Which feature in FortiManager allows for this recovery?

Easy
45

You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?

Medium
46

When configuring a Recipient Policy, what does the 'Action' field determine?

Medium
47

Which object type allows you to define a single configuration setting that can be applied to multiple FortiGate devices using Provisioning Templates?

Easy
48

Which TWO of the following are valid options for FortiMail deployment?

Medium
49

You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?

Medium
50

Which setting in the 'System Settings' is used to define the administrator's password policy?

Easy
51

When integrating FortiAuthenticator with a Windows Active Directory, why is it recommended to use a service account with limited privileges?

Hard
52

Which of the following is a symptom of a full quarantine storage?

Easy
53

Which TWO actions are commonly performed within the 'Device Manager' module?

Easy
54

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

Medium
55

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

Medium
56

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

Hard
57

Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?

Hard
58

Which protocol is used for communication between the FortiMail and a remote LDAP server for user authentication?

Medium
59

What is the purpose of the 'Session Limit' setting in an Access Control Rule?

Medium
60

Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?

Medium
61

Which tab in the FortiManager GUI is primarily used for managing firewall policies and objects?

Easy
62

You are troubleshooting a sync issue where a device shows 'Modified' status in the Device Manager. What is the most likely cause?

Medium
63

You are creating a new policy package. You need to ensure that shared objects from the Global ADOM are available. What is the correct workflow?

Medium
64

Which THREE types of logs can be generated by FortiWeb?

Medium
65

What happens when you change the 'Log Policy' to 'Archive only'?

Medium
66

Which TWO tasks are part of the 'Log Management' phase on FortiAnalyzer?

Hard
67

Which THREE of the following are components of the 'Policy Package'?

Hard
68

Which protocol is most secure for retrieving email from the FortiMail server?

Hard
69

Which of the following is true about 'Report Data Masking'?

Hard
70

What is the benefit of using 'FortiGuard' services with FortiMail?

Medium
71

How can you ensure that only encrypted traffic is allowed for webmail access?

Medium
72

When an email is encrypted using FortiMail's Identity-Based Encryption (IBE), what does the recipient receive?

Medium
73

What is the primary function of the FortiAnalyzer 'Log View' page?

Easy
74

Which THREE items are found in the 'System Settings' area?

Medium
75

In which configuration area are 'Content Profiles' created and modified?

Medium
76

What is the primary function of the Security Fabric's 'Automation Stitch' feature?

Easy
77

Which TWO methods can be used to back up FortiAnalyzer configuration?

Hard
78

What is the purpose of 'Revision History' when it comes to policy packages?

Medium
79

A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?

Hard
80

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

Hard
81

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Hard
82

Which THREE steps are required to implement a new firewall policy using the FortiManager workflow mode?

Medium
83

Which TWO of the following are valid log file types supported by FortiAnalyzer?

Hard
84

Which THREE settings are required for successful DKIM signing on outgoing mail?

Hard
85

Which TWO actions can be automated via a FortiGate Automation Stitch?

Easy
86

What is the purpose of the 'Security Fabric' dashboard on the FortiGate?

Easy
87

Where do you check the current status of the FortiMail services?

Easy
88

Which TWO of the following are valid ways to monitor the status of managed FortiGate devices in the Device Manager?

Easy
89

Which THREE components are visible in the 'Log View' interface?

Medium
90

Which TWO conditions must be met to successfully use an 'Install Config' wizard for device-level settings?

Hard
91

When adding a FortiGate to a FortiAnalyzer, which information is required?

Medium
92

In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?

Easy
93

What is the purpose of an 'Event Handler' in FortiAnalyzer?

Medium
94

What is the benefit of using FortiAnalyzer in the Security Fabric?

Easy
95

Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?

Hard
96

Which component of FortiAnalyzer is used to identify top talkers on the network?

Easy
97

Which TWO types of logs can be generated by FortiMail?

Easy
98

Which configuration file format is used for importing user lists?

Medium
99

You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?

Hard
100

Where do you configure the email server settings for FortiManager alert notifications?

Easy
101

Which THREE actions are available in the 'DLP' section of a policy?

Hard
102

A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?

Hard
103

Which FortiMail feature helps to prevent 'backscatter' when dealing with spam?

Hard
104

You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?

Hard
105

When using 'Install Wizard', what does the 'Auto-update' check-box do?

Hard
106

If an administrator needs to ensure that a specific set of CLI commands is always applied during the deployment of a new device, which tool should be used?

Medium
107

How can you restrict management access to the FortiMail GUI to only specific IP addresses?

Hard
108

In FortiSoC, what is the purpose of the 'Playbook Trigger'?

Hard
109

Which THREE of the following are features of the FortiManager 'Global Settings'?

Hard
110

Which dashboard provides a 'Threat Map'?

Medium
111

Which TWO settings are configurable in a 'Recipient Policy'?

Medium
112

What is a 'Playbook' in the context of FortiSoC?

Easy
113

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Hard
114

Which TWO of the following are components of the FortiMail AntiSpam framework?

Medium
115

You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?

Easy
116

In the context of FortiAuthenticator, what does 'SSO' stand for?

Easy
117

In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?

Medium
118

What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?

Hard
119

Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?

Easy
120

Which TWO of the following are valid states for a device in FortiManager?

Medium
121

Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?

Medium
122

Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?

Hard
123

Which of the following is a valid method for importing a FortiGate configuration into FortiManager?

Medium
124

Which protocol is utilized for log forwarding between FortiAnalyzer units?

Medium
125

Which dashboard shows the health status of all registered devices?

Easy
126

Which THREE actions can be performed on a policy package within the Policy & Objects tab?

Hard
127

In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?

Hard
128

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

Hard
129

Which THREE actions can be taken by a DLP filter when a match is found?

Hard
130

Which THREE features are provided by the FortiADC when acting as an application delivery controller?

Hard
131

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

Medium
132

You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?

Hard
133

What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?

Medium
134

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Easy
135

Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?

Easy
136

You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?

Medium
137

Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?

Medium
138

Which component of the FortiADC performs the translation between the virtual IP and the real server IP?

Medium
139

When using FortiMail in Server Mode, how does the appliance handle incoming mail?

Medium
140

Which THREE items are checked by the AntiSpam profile during email processing?

Hard
141

Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?

Medium
142

You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?

Hard
143

When configuring DMARC on FortiMail, which THREE components are required to successfully implement a 'reject' policy?

Medium
144

A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?

Medium
145

An administrator is using the 'Policy Lookup' tool in FortiManager. What does this tool provide?

Hard
146

Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?

Hard
147

Which TWO of the following are valid methods to initiate a configuration backup of a managed FortiGate device from FortiManager?

Medium
148

Which TWO actions can be triggered by a FortiSoC Playbook?

Hard
149

An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?

Medium
150

Which TWO actions occur during the FortiMail inspection process before an email is delivered?

Medium
151

What is the primary function of the 'FortiToken'?

Easy
152

What does the 'Auto-Link' feature in the 'Policy & Objects' tab do?

Medium
153

Which THREE elements are essential to define a user in FortiAuthenticator?

Medium
154

What is the primary function of the 'Object' menu within the Policy & Objects tab?

Easy
155

On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?

Medium
156

Which THREE elements are part of the Event Handler configuration?

Medium
157

When integrating FortiWeb with FortiAnalyzer, which information is passed to FortiAnalyzer?

Medium
158

What should you do to ensure that an encrypted email sent via IBE reaches the recipient correctly?

Hard
159

What is the primary benefit of using a 'Device Group' in FortiManager?

Medium
160

How can you disable the 'Greylisting' feature for a specific, trusted sender?

Hard
161

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

Hard
162

Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?

Medium
163

Which interface mode is best suited for high-availability setups where you need to minimize configuration changes on existing infrastructure?

Easy
164

Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?

Easy
165

What is the purpose of 'Report Templates'?

Medium
166

What is the purpose of 'Policy Package' import?

Medium
167

An administrator needs to quickly distribute a CLI command to fifty managed FortiGate devices. Which feature should they use to automate this task efficiently?

Easy
168

In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?

Easy
169

If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?

Hard
170

Which 'Install Wizard' option ensures that configuration changes on the FortiManager are synchronized back to the device's configuration file?

Medium
171

An administrator wants to ensure that a specific policy is always included in all policy packages within an ADOM. What feature should be used?

Hard
172

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Easy
173

Which TWO items are required to configure log forwarding to a remote FortiAnalyzer?

Easy
174

How can you verify that a FortiGate is sending logs to the FortiAnalyzer?

Medium
175

How can you view the current number of emails in the quarantine?

Easy
176

FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?

Hard
177

What is the primary role of the 'Administrator' profile?

Easy
178

Which TWO types of report formats can be generated by FortiAnalyzer?

Easy
179

In FortiManager, what is the result of using the 'Re-install Policy' option instead of the 'Install Wizard'?

Hard
180

You notice that the FortiMail system time is incorrect, causing issues with SSL/TLS certificate validation. How do you correct this?

Hard
181

You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?

Easy
182

You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?

Easy
183

Which THREE settings are part of an ADOM's configuration?

Medium
184

When using 'VPN Manager', what is the main benefit compared to manual VPN configuration?

Hard
185

Where do you configure the expiration period for messages in the quarantine?

Hard
186

Which THREE of the following are key steps in the 'Policy Install Workflow'?

Hard
187

What is the purpose of the 'License' section in the FortiMail menu?

Easy
188

Which TWO of the following are allowed in an ADOM?

Medium
189

You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?

Hard
190

Which of these is a legitimate reason to place a sender on the 'Block' list in the AntiSpam profile?

Easy
191

When using 'Provisioning Templates', which setting allows you to automatically apply CLI commands to new devices as soon as they are added to the FortiManager?

Medium
192

You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?

Hard
193

Which TWO FortiAnalyzer tools help in troubleshooting connection issues?

Easy
194

An administrator is attempting to move a device from one ADOM to another. Which condition must be met for this to succeed?

Hard
195

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Hard
196

Which dashboard widget provides a high-level summary of system resource usage?

Easy
197

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

Easy
198

An administrator notices that the 'Device Manager' status is 'Unsynchronized'. What is the recommended first step to resolve this?

Medium
199

What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?

Medium
200

When using the Workflow mode for policy management, what happens immediately after a policy change request is submitted?

Hard
201

You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?

Medium
202

Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?

Medium
203

When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?

Easy
204

Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?

Hard
205

Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?

Medium
206

When utilizing the 'Install Preview' feature before pushing a policy package, what is the primary benefit to the administrator?

Medium
207

A FortiManager administrator needs to migrate an existing local FortiGate policy into a shared policy package. Which process must be followed?

Hard
208

You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?

Medium
209

Which TWO of the following are valid methods to back up a FortiManager configuration?

Medium
210

A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?

Hard
211

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Hard
212

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Hard
213

Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?

Hard
214

When scheduling a report, what is the purpose of the 'Output Profile'?

Medium
215

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

Medium
216

What is the purpose of the 'Add Device' wizard?

Easy
217

If a user is locked out of the FortiAnalyzer GUI, which command is used to unlock the account?

Hard
218

When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?

Hard
219

An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?

Easy
220

Which menu path is used to create a new Administrator account?

Easy
221

Which THREE factors are used by the FortiMail sender reputation service to evaluate an IP address?

Hard
222

Which configuration is required to allow external users to access the Webmail portal?

Medium
223

How are Revision Histories primarily used in FortiManager when a device configuration has been modified locally on the FortiGate?

Easy
224

Which THREE of the following are true regarding 'Revision History'?

Hard
225

Which component manages the 'Daily Report' schedule?

Easy
226

What is the primary function of the FortiMail 'Quarantine' feature?

Easy
227

Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?

Hard
228

Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?

Medium
229

An administrator sees a large volume of '451 4.7.1' errors in the logs. What does this indicate?

Hard
230

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Hard
231

Which TWO of the following are true about 'Scripts' in FortiManager?

Medium
232

Which component in FortiManager is responsible for managing the logical grouping of multiple FortiGate devices that share the same policy package?

Easy
233

When should you use 'Log Archive' instead of 'Log Database'?

Medium
234

Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?

Easy
235

You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?

Medium
236

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

Hard
237

Which TWO actions can be taken when an event handler triggers?

Hard
238

What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?

Easy
239

Which type of scan should be enabled to detect known malware in email attachments?

Medium
240

What does the 'Heuristic' score measure in the AntiSpam engine?

Medium
241

If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?

Medium
242

A customer is experiencing false positives with the FortiMail Antispam engine. Which feature should be configured to allow trusted sender domains while still performing virus scanning?

Medium
243

When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?

Medium
244

Which TWO of the following protocols does FortiMail support for mail retrieval?

Medium
245

A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?

Hard
246

Which TWO components can be included in a 'Provisioning Template' to manage device settings?

Medium
247

Which TWO methods are used to share user group information in the Security Fabric?

Medium
248

A user reports that legitimate emails are being quarantined due to a high spam score. You want to add the sender's email address to a whitelist. Where should this be configured to be effective for the specific user?

Hard
249

What is the default port for SMTP communication?

Easy
250

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

Hard
251

You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?

Medium
252

What is the default port used for log transmission from FortiGate to FortiAnalyzer?

Easy
253

What is the maximum number of ADOMs supported on a FortiAnalyzer?

Medium
254

Which object in FortiWeb is used to define the specific web server or virtual host that the WAF should inspect?

Easy
255

Which TWO factors impact the performance of report generation?

Hard
256

What is the primary purpose of using 'Provisioning Templates' in FortiManager?

Medium
257

Which THREE of the following are core components of the Fortinet Security Fabric?

Easy
258

What is the function of the 'Check for Updates' feature in FortiManager's FortiGuard settings?

Medium
259

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

Medium
260

Which THREE items are required to successfully integrate a FortiAuthenticator with an Active Directory (AD) environment for identity-based policies?

Medium
261

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

Medium
262

Which administrative account type has full access to all ADOMs and system settings?

Easy
263

What does the 'FortiView' module provide?

Easy
264

If an administrator wants to perform a 'Config Check' to see what changes will be deployed during an installation, which option should they select in the 'Install Wizard'?

Medium
265

You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?

Medium
266

Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?

Easy
267

A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?

Medium
268

What is the consequence of deleting a device from an ADOM in FortiManager?

Medium
269

Which THREE are key benefits of using FortiWeb to protect web applications?

Easy
270

A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?

Hard
271

Which TWO features in FortiMail help prevent email spoofing?

Medium
272

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

Medium
273

Which FortiWeb feature allows you to block traffic based on the geographic origin of the IP address?

Medium
274

When configuring 'Global Objects' in FortiManager, what happens to the specific objects in the ADOM-level database?

Hard
275

Which THREE components are required to create a functional FortiSoC Playbook?

Medium
276

When modifying a policy package, what does 'Lock' indicate?

Medium
277

Which of the following is a component of the Fortinet Security Fabric?

Easy
278

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

Hard
279

In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?

Easy
280

What happens if a message matches multiple policies?

Medium
281

Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?

Hard
282

Which TWO conditions must be met for a report to run successfully?

Hard
283

You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?

Hard
284

How does FortiMail identify the policy to apply to an incoming email?

Medium
285

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

Hard
286

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Medium
287

Which THREE types of information are displayed in the System Information widget?

Medium
288

Which protocol does FortiAnalyzer primarily use for Web UI access?

Easy
289

You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?

Medium
290

An administrator wants to perform a 'Re-install Policy' on a subset of devices without changing their current configuration settings. Which install option should be selected?

Hard
291

What is the primary function of the 'AntiSpam' profile?

Easy
292

Which TWO methods can be used to perform 'Greylisting' in FortiMail?

Hard
293

What is the primary difference between a Gateway and a Server mode deployment?

Medium
294

Which of these is a benefit of 'Transparent' mode?

Medium
295

How can you view the 'Total' number of policies in a specific policy package?

Medium
296

What is the primary benefit of deploying FortiMail in a cluster?

Easy
297

Which TWO of these are valid administrative roles in FortiAnalyzer?

Easy
298

What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?

Easy
299

An administrator wants to ensure that all outgoing emails are archived to a secondary server. Where is this configured?

Hard
300

You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?

Hard
301

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Medium

Frequently asked questions

What does the troubleshooting domain cover on the FORTINET-NSE56 exam?
troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
How many questions are in this domain?
This page lists all 301 troubleshooting questions in the FORTINET-NSE56 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?
Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only troubleshooting questions?
Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.