FORTINET-NSE56 · domain
troubleshooting
Practise Fortinet NSE5/NSE6 (Network Security Analyst/Specialist tiers, per-product tracks) (FORTINET-NSE56) troubleshooting practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Focused practice
Practice troubleshooting questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about troubleshooting
troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Common troubleshooting exam traps
- ▸Answering from memory before reading the full scenario.
- ▸Missing a constraint such as cost, availability, security, scope or command context.
- ▸Choosing a broad answer when the question asks for the most specific fix.
- ▸Ignoring why the wrong options are tempting.
Question index
All troubleshooting questions (301)
Click any question to see the full explanation, or start a practice session above.
A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?
Hard2You are configuring FortiWeb in reverse proxy mode. A client is receiving 403 Forbidden errors for legitimate traffic due to a SQL injection false positive. Which feature should you modify to allow this traffic while maintaining security?
Medium3You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?
Hard4Which GUI menu is primarily used for monitoring real-time activity?
Easy5Which TWO of the following are common reasons for a policy installation failure in FortiManager?
Medium6An administrator needs to enforce DMARC 'reject' policy for incoming mail. Where is this enforced in FortiMail?
Hard7You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?
Easy8You are deploying FortiWeb in a cloud environment. You need to ensure the WAF learns legitimate user behavior. Which mode should you start in to avoid blocking legitimate traffic?
Medium9You have multiple FortiADC nodes in a High Availability (HA) cluster. Which synchronization method ensures that the session table is shared between nodes to prevent user disconnects during a failover?
Hard10Which THREE types of dashboards can be viewed in FortiAnalyzer?
Medium11When using 'Log Forwarding', can you filter the logs before they are forwarded?
Hard12Where do you configure the global whitelist to ensure specific email addresses are never blocked by AntiSpam?
Easy13Which of the following is a mandatory step when creating a new ADOM in FortiManager?
Easy14When setting up a 'FortiSoC' playbook to send an email, what must be configured first?
Hard15You need to ensure that the FortiMail doesn't relay spam to external addresses. Which feature should be configured?
Hard16FortiAuthenticator is acting as a SAML Service Provider for a FortiGate. Users are failing to authenticate. Where should you check the logs to determine if the SAML assertion was received and parsed correctly?
Hard17Which TWO protocols are commonly used for external communication with FortiAnalyzer?
Easy18Which tab is used to monitor traffic logs from the managed FortiGates?
Medium19Which feature is essential for protecting against password-based malware in attachments?
Medium20Where do you go to view the real-time logs currently being received by the FortiAnalyzer?
Easy21Which TWO of the following steps are required to integrate FortiAuthenticator with a FortiGate for RADIUS authentication?
Medium22In the context of the Security Fabric, what is a 'root' FortiGate?
Medium23When configuring an Antivirus profile, which option is best to handle password-protected ZIP files?
Hard24What happens when you change an ADOM's version?
Medium25When managing policy packages, what does the 'Policy Package' clone feature do?
Medium26Which THREE items are included in a standard email header for DMARC validation?
Medium27An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?
Medium28What is the primary function of the 'Sender Reputation' service?
Medium29What is the purpose of 'Auto-cache' for reports?
Easy30Which THREE features are available when FortiAnalyzer is configured in 'Analyzer' mode?
Medium31When using FortiSoC playbooks, what is the 'Connector' used for?
Hard32Which service does FortiAuthenticator provide to enable centralized management of user identities?
Easy33Which THREE objects are required to configure a basic load balancing setup in FortiADC?
Medium34Which feature allows FortiMail to perform automatic cleanup of old messages in the quarantine?
Medium35What is the purpose of the 'Relay Host' setting in FortiMail?
Easy36You are experiencing delays in mail delivery. Where is the best place to check for queued messages?
Hard37Which TWO products provide identity-based security within the Fortinet portfolio?
Easy38When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?
Hard39In a FortiWeb high-availability cluster, how are the synchronization settings for SSL certificates managed?
Hard40You have a cluster of FortiWebs. You need to ensure that the session table is shared among members. What is this feature called?
Hard41What is the function of the FortiGate's 'Security Fabric' connector?
Easy42What is the function of the 'Device Manager' in FortiAnalyzer?
Easy43Which THREE of the following are benefits of using ADOMs in FortiManager?
Hard44An administrator needs to revert a firewall configuration to a state from two weeks ago. Which feature in FortiManager allows for this recovery?
Easy45You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?
Medium46When configuring a Recipient Policy, what does the 'Action' field determine?
Medium47Which object type allows you to define a single configuration setting that can be applied to multiple FortiGate devices using Provisioning Templates?
Easy48Which TWO of the following are valid options for FortiMail deployment?
Medium49You are deploying FortiWeb in 'Reverse Proxy' mode. Where should the default gateway of the backend web servers point?
Medium50Which setting in the 'System Settings' is used to define the administrator's password policy?
Easy51When integrating FortiAuthenticator with a Windows Active Directory, why is it recommended to use a service account with limited privileges?
Hard52Which of the following is a symptom of a full quarantine storage?
Easy53Which TWO actions are commonly performed within the 'Device Manager' module?
Easy54You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?
Medium55Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?
Medium56You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?
Hard57Which TWO of the following are true regarding FortiADC's ability to perform Layer 7 load balancing?
Hard58Which protocol is used for communication between the FortiMail and a remote LDAP server for user authentication?
Medium59What is the purpose of the 'Session Limit' setting in an Access Control Rule?
Medium60Which TWO methods can be used to authenticate users for access to the FortiMail quarantine portal?
Medium61Which tab in the FortiManager GUI is primarily used for managing firewall policies and objects?
Easy62You are troubleshooting a sync issue where a device shows 'Modified' status in the Device Manager. What is the most likely cause?
Medium63You are creating a new policy package. You need to ensure that shared objects from the Global ADOM are available. What is the correct workflow?
Medium64Which THREE types of logs can be generated by FortiWeb?
Medium65What happens when you change the 'Log Policy' to 'Archive only'?
Medium66Which TWO tasks are part of the 'Log Management' phase on FortiAnalyzer?
Hard67Which THREE of the following are components of the 'Policy Package'?
Hard68Which protocol is most secure for retrieving email from the FortiMail server?
Hard69Which of the following is true about 'Report Data Masking'?
Hard70What is the benefit of using 'FortiGuard' services with FortiMail?
Medium71How can you ensure that only encrypted traffic is allowed for webmail access?
Medium72When an email is encrypted using FortiMail's Identity-Based Encryption (IBE), what does the recipient receive?
Medium73What is the primary function of the FortiAnalyzer 'Log View' page?
Easy74Which THREE items are found in the 'System Settings' area?
Medium75In which configuration area are 'Content Profiles' created and modified?
Medium76What is the primary function of the Security Fabric's 'Automation Stitch' feature?
Easy77Which TWO methods can be used to back up FortiAnalyzer configuration?
Hard78What is the purpose of 'Revision History' when it comes to policy packages?
Medium79A FortiADC is deployed to load balance SMTP traffic. Which health check type should be used?
Hard80A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?
Hard81You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?
Hard82Which THREE steps are required to implement a new firewall policy using the FortiManager workflow mode?
Medium83Which TWO of the following are valid log file types supported by FortiAnalyzer?
Hard84Which THREE settings are required for successful DKIM signing on outgoing mail?
Hard85Which TWO actions can be automated via a FortiGate Automation Stitch?
Easy86What is the purpose of the 'Security Fabric' dashboard on the FortiGate?
Easy87Where do you check the current status of the FortiMail services?
Easy88Which TWO of the following are valid ways to monitor the status of managed FortiGate devices in the Device Manager?
Easy89Which THREE components are visible in the 'Log View' interface?
Medium90Which TWO conditions must be met to successfully use an 'Install Config' wizard for device-level settings?
Hard91When adding a FortiGate to a FortiAnalyzer, which information is required?
Medium92In Gateway mode, what is the default behavior when FortiMail receives an email for an unknown recipient?
Easy93What is the purpose of an 'Event Handler' in FortiAnalyzer?
Medium94What is the benefit of using FortiAnalyzer in the Security Fabric?
Easy95Which THREE options are available for the 'Action' setting in a FortiWeb WAF policy?
Hard96Which component of FortiAnalyzer is used to identify top talkers on the network?
Easy97Which TWO types of logs can be generated by FortiMail?
Easy98Which configuration file format is used for importing user lists?
Medium99You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?
Hard100Where do you configure the email server settings for FortiManager alert notifications?
Easy101Which THREE actions are available in the 'DLP' section of a policy?
Hard102A FortiADC is reporting 'Server Busy' for a pool member. What does this indicate?
Hard103Which FortiMail feature helps to prevent 'backscatter' when dealing with spam?
Hard104You are configuring DKIM signing on FortiMail. The administrator has generated the public/private key pair. Where must the public key be published to ensure the receiving MTA validates the email correctly?
Hard105When using 'Install Wizard', what does the 'Auto-update' check-box do?
Hard106If an administrator needs to ensure that a specific set of CLI commands is always applied during the deployment of a new device, which tool should be used?
Medium107How can you restrict management access to the FortiMail GUI to only specific IP addresses?
Hard108In FortiSoC, what is the purpose of the 'Playbook Trigger'?
Hard109Which THREE of the following are features of the FortiManager 'Global Settings'?
Hard110Which dashboard provides a 'Threat Map'?
Medium111Which TWO settings are configurable in a 'Recipient Policy'?
Medium112What is a 'Playbook' in the context of FortiSoC?
Easy113A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?
Hard114Which TWO of the following are components of the FortiMail AntiSpam framework?
Medium115You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?
Easy116In the context of FortiAuthenticator, what does 'SSO' stand for?
Easy117In a FortiADC deployment, you need to ensure that the load balancer terminates SSL connections from clients and initiates a new connection to the backend server. Which feature should you configure?
Medium118What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?
Hard119Which THREE of the following are components of the Fortinet Security Fabric that can provide telemetry or data to the FortiGate?
Easy120Which TWO of the following are valid states for a device in FortiManager?
Medium121Which identity provider type is most recommended for multi-factor authentication (MFA) within FortiAuthenticator?
Medium122Which TWO are common causes for a 'Security Fabric' connection failure between FortiGate and FortiAnalyzer?
Hard123Which of the following is a valid method for importing a FortiGate configuration into FortiManager?
Medium124Which protocol is utilized for log forwarding between FortiAnalyzer units?
Medium125Which dashboard shows the health status of all registered devices?
Easy126Which THREE actions can be performed on a policy package within the Policy & Objects tab?
Hard127In a FortiADC environment, you are implementing a Layer 7 load balancing rule. You need to rewrite the HTTP request header 'X-Forwarded-For' to include the client IP address. Which tool should you use?
Hard128You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?
Hard129Which THREE actions can be taken by a DLP filter when a match is found?
Hard130Which THREE features are provided by the FortiADC when acting as an application delivery controller?
Hard131When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?
Medium132You are integrating FortiAuthenticator with a FortiGate to provide SSO for VPN users. The users are successfully authenticating against AD, but they are not being assigned the correct group-based firewall policies. What is the most likely cause?
Hard133What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?
Medium134Which FortiView tool allows you to see traffic patterns based on geographical origin?
Easy135Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?
Easy136You need to implement a persistence method in FortiADC where the user is tied to the server based on the cookie provided by the backend application. Which method do you choose?
Medium137Which TWO of the following are valid ways for FortiAuthenticator to receive user authentication requests?
Medium138Which component of the FortiADC performs the translation between the virtual IP and the real server IP?
Medium139When using FortiMail in Server Mode, how does the appliance handle incoming mail?
Medium140Which THREE items are checked by the AntiSpam profile during email processing?
Hard141Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?
Medium142You are configuring a FortiADC virtual server with SSL offloading. The backend servers require the original client IP to be preserved. What feature do you enable?
Hard143When configuring DMARC on FortiMail, which THREE components are required to successfully implement a 'reject' policy?
Medium144A developer wants to use a REST API to configure FortiADC objects. Where can you find the documentation and schema for the FortiADC API?
Medium145An administrator is using the 'Policy Lookup' tool in FortiManager. What does this tool provide?
Hard146Which TWO parameters must match between the FortiAuthenticator and the FortiGate when configuring RADIUS authentication?
Hard147Which TWO of the following are valid methods to initiate a configuration backup of a managed FortiGate device from FortiManager?
Medium148Which TWO actions can be triggered by a FortiSoC Playbook?
Hard149An administrator wants to prevent email spoofing by verifying the sender's domain. Which policy should be configured to check the DNS TXT record of the sending domain?
Medium150Which TWO actions occur during the FortiMail inspection process before an email is delivered?
Medium151What is the primary function of the 'FortiToken'?
Easy152What does the 'Auto-Link' feature in the 'Policy & Objects' tab do?
Medium153Which THREE elements are essential to define a user in FortiAuthenticator?
Medium154What is the primary function of the 'Object' menu within the Policy & Objects tab?
Easy155On FortiWeb, which component is used to inspect traffic for protocol-specific attacks like HTTP Request Smuggling?
Medium156Which THREE elements are part of the Event Handler configuration?
Medium157When integrating FortiWeb with FortiAnalyzer, which information is passed to FortiAnalyzer?
Medium158What should you do to ensure that an encrypted email sent via IBE reaches the recipient correctly?
Hard159What is the primary benefit of using a 'Device Group' in FortiManager?
Medium160How can you disable the 'Greylisting' feature for a specific, trusted sender?
Hard161What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?
Hard162Which FortiWeb feature is best used to detect 'Brute Force' attacks against a login page?
Medium163Which interface mode is best suited for high-availability setups where you need to minimize configuration changes on existing infrastructure?
Easy164Which FortiAuthenticator feature allows you to map LDAP groups to local FortiAuthenticator groups for administrative access?
Easy165What is the purpose of 'Report Templates'?
Medium166What is the purpose of 'Policy Package' import?
Medium167An administrator needs to quickly distribute a CLI command to fifty managed FortiGate devices. Which feature should they use to automate this task efficiently?
Easy168In the Security Fabric, which protocol is primarily used for communication between the FortiGate and the FortiAnalyzer?
Easy169If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?
Hard170Which 'Install Wizard' option ensures that configuration changes on the FortiManager are synchronized back to the device's configuration file?
Medium171An administrator wants to ensure that a specific policy is always included in all policy packages within an ADOM. What feature should be used?
Hard172Which protocol does FortiManager use to communicate with managed FortiGate devices?
Easy173Which TWO items are required to configure log forwarding to a remote FortiAnalyzer?
Easy174How can you verify that a FortiGate is sending logs to the FortiAnalyzer?
Medium175How can you view the current number of emails in the quarantine?
Easy176FortiADC is configured with a Layer 7 policy. You notice that the persistence is failing for a specific application. Which persistence method is most appropriate for a cookie-based application?
Hard177What is the primary role of the 'Administrator' profile?
Easy178Which TWO types of report formats can be generated by FortiAnalyzer?
Easy179In FortiManager, what is the result of using the 'Re-install Policy' option instead of the 'Install Wizard'?
Hard180You notice that the FortiMail system time is incorrect, causing issues with SSL/TLS certificate validation. How do you correct this?
Hard181You are configuring a FortiWeb WAF policy to protect a web application. Which inspection mode is most effective for blocking SQL injection attacks while minimizing false positives in a production environment?
Easy182You are deploying FortiMail in Transparent Mode. Which network configuration requirement is mandatory for this deployment?
Easy183Which THREE settings are part of an ADOM's configuration?
Medium184When using 'VPN Manager', what is the main benefit compared to manual VPN configuration?
Hard185Where do you configure the expiration period for messages in the quarantine?
Hard186Which THREE of the following are key steps in the 'Policy Install Workflow'?
Hard187What is the purpose of the 'License' section in the FortiMail menu?
Easy188Which TWO of the following are allowed in an ADOM?
Medium189You need to export logs from FortiAuthenticator to a remote syslog server. Which configuration path allows you to define this destination?
Hard190Which of these is a legitimate reason to place a sender on the 'Block' list in the AntiSpam profile?
Easy191When using 'Provisioning Templates', which setting allows you to automatically apply CLI commands to new devices as soon as they are added to the FortiManager?
Medium192You are configuring DLP to block emails containing credit card numbers. Which component must be configured to define the pattern matching for the card numbers?
Hard193Which TWO FortiAnalyzer tools help in troubleshooting connection issues?
Easy194An administrator is attempting to move a device from one ADOM to another. Which condition must be met for this to succeed?
Hard195An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?
Hard196Which dashboard widget provides a high-level summary of system resource usage?
Easy197What is the purpose of 'Log Forwarding' in FortiAnalyzer?
Easy198An administrator notices that the 'Device Manager' status is 'Unsynchronized'. What is the recommended first step to resolve this?
Medium199What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?
Medium200When using the Workflow mode for policy management, what happens immediately after a policy change request is submitted?
Hard201You are deploying FortiMail in Transparent mode. Which configuration step is mandatory to ensure traffic is inspected without modifying the IP headers of the email packets?
Medium202Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?
Medium203When adding a FortiWeb appliance to the Security Fabric, what is the primary prerequisite that must be met on the FortiGate?
Easy204Which TWO actions can be performed on items currently residing in the FortiMail global quarantine?
Hard205Which DNS record must be published in the public DNS to enable DKIM signing for outgoing mail?
Medium206When utilizing the 'Install Preview' feature before pushing a policy package, what is the primary benefit to the administrator?
Medium207A FortiManager administrator needs to migrate an existing local FortiGate policy into a shared policy package. Which process must be followed?
Hard208You are integrating FortiWeb with FortiAnalyzer. What is the benefit of this integration in a Security Fabric context?
Medium209Which TWO of the following are valid methods to back up a FortiManager configuration?
Medium210A user is attempting to authenticate via a FortiAuthenticator-backed portal but receives an 'Access Denied' message. The user exists in the AD group mapped to the policy. What should you check first?
Hard211You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?
Hard212When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?
Hard213Which command allows you to verify if the FortiMail can reach a remote mail server on port 25?
Hard214When scheduling a report, what is the purpose of the 'Output Profile'?
Medium215You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?
Medium216What is the purpose of the 'Add Device' wizard?
Easy217If a user is locked out of the FortiAnalyzer GUI, which command is used to unlock the account?
Hard218When using FortiAuthenticator to provide RADIUS authentication for a third-party VPN gateway, which setting must match between the two devices?
Hard219An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?
Easy220Which menu path is used to create a new Administrator account?
Easy221Which THREE factors are used by the FortiMail sender reputation service to evaluate an IP address?
Hard222Which configuration is required to allow external users to access the Webmail portal?
Medium223How are Revision Histories primarily used in FortiManager when a device configuration has been modified locally on the FortiGate?
Easy224Which THREE of the following are true regarding 'Revision History'?
Hard225Which component manages the 'Daily Report' schedule?
Easy226What is the primary function of the FortiMail 'Quarantine' feature?
Easy227Which THREE actions can be performed by a FortiWeb appliance when it detects a violation in a web request?
Hard228Which TWO of the following are valid methods for FortiAuthenticator to receive user information from an external source?
Medium229An administrator sees a large volume of '451 4.7.1' errors in the logs. What does this indicate?
Hard230When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?
Hard231Which TWO of the following are true about 'Scripts' in FortiManager?
Medium232Which component in FortiManager is responsible for managing the logical grouping of multiple FortiGate devices that share the same policy package?
Easy233When should you use 'Log Archive' instead of 'Log Database'?
Medium234Which TWO of the following are primary functions of a Web Application Firewall (WAF) like FortiWeb?
Easy235You are implementing a WAF policy for a web application. Which profile should you use to prevent the disclosure of sensitive server-side information in error messages?
Medium236A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?
Hard237Which TWO actions can be taken when an event handler triggers?
Hard238What is the primary benefit of the Security Fabric's 'Automation Stitch' feature?
Easy239Which type of scan should be enabled to detect known malware in email attachments?
Medium240What does the 'Heuristic' score measure in the AntiSpam engine?
Medium241If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?
Medium242A customer is experiencing false positives with the FortiMail Antispam engine. Which feature should be configured to allow trusted sender domains while still performing virus scanning?
Medium243When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?
Medium244Which TWO of the following protocols does FortiMail support for mail retrieval?
Medium245A FortiADC deployment is experiencing high latency for HTTPS traffic. You suspect the SSL handshake is the bottleneck. Which tool in FortiADC is best suited to verify the SSL negotiation time?
Hard246Which TWO components can be included in a 'Provisioning Template' to manage device settings?
Medium247Which TWO methods are used to share user group information in the Security Fabric?
Medium248A user reports that legitimate emails are being quarantined due to a high spam score. You want to add the sender's email address to a whitelist. Where should this be configured to be effective for the specific user?
Hard249What is the default port for SMTP communication?
Easy250If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?
Hard251You are configuring a FortiWeb policy to protect a web application. You need to ensure that the WAF blocks SQL injection attempts while allowing legitimate traffic. Which operational mode should you configure in the server policy?
Medium252What is the default port used for log transmission from FortiGate to FortiAnalyzer?
Easy253What is the maximum number of ADOMs supported on a FortiAnalyzer?
Medium254Which object in FortiWeb is used to define the specific web server or virtual host that the WAF should inspect?
Easy255Which TWO factors impact the performance of report generation?
Hard256What is the primary purpose of using 'Provisioning Templates' in FortiManager?
Medium257Which THREE of the following are core components of the Fortinet Security Fabric?
Easy258What is the function of the 'Check for Updates' feature in FortiManager's FortiGuard settings?
Medium259You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?
Medium260Which THREE items are required to successfully integrate a FortiAuthenticator with an Active Directory (AD) environment for identity-based policies?
Medium261You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?
Medium262Which administrative account type has full access to all ADOMs and system settings?
Easy263What does the 'FortiView' module provide?
Easy264If an administrator wants to perform a 'Config Check' to see what changes will be deployed during an installation, which option should they select in the 'Install Wizard'?
Medium265You are configuring a FortiWeb WAF policy for a web application. You need to ensure that the WAF blocks requests that contain SQL injection patterns. Which feature should you enable in the WAF profile?
Medium266Which component of the FortiAuthenticator is responsible for the self-service portal where users can manage their own two-factor authentication tokens?
Easy267A FortiADC is load balancing an HTTPS application. You need to offload SSL processing to the ADC to reduce server load. What is the correct object to configure for this?
Medium268What is the consequence of deleting a device from an ADOM in FortiManager?
Medium269Which THREE are key benefits of using FortiWeb to protect web applications?
Easy270A user authenticated via FortiAuthenticator is unable to access a resource protected by a FortiGate policy. The policy uses the user's LDAP group. What is the most likely cause?
Hard271Which TWO features in FortiMail help prevent email spoofing?
Medium272An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?
Medium273Which FortiWeb feature allows you to block traffic based on the geographic origin of the IP address?
Medium274When configuring 'Global Objects' in FortiManager, what happens to the specific objects in the ADOM-level database?
Hard275Which THREE components are required to create a functional FortiSoC Playbook?
Medium276When modifying a policy package, what does 'Lock' indicate?
Medium277Which of the following is a component of the Fortinet Security Fabric?
Easy278When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?
Hard279In the Security Fabric, which feature allows the FortiGate to automatically quarantine a host that is identified as compromised by another Fabric device?
Easy280What happens if a message matches multiple policies?
Medium281Which THREE features are provided by FortiAuthenticator when integrated into a Security Fabric to enforce identity-based access?
Hard282Which TWO conditions must be met for a report to run successfully?
Hard283You are debugging a SAML authentication issue where FortiAuthenticator is the IDP. The logs show 'Assertion expired'. What is the most likely cause?
Hard284How does FortiMail identify the policy to apply to an incoming email?
Medium285If you need to change the log storage retention period for a specific ADOM, where is this setting located?
Hard286A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?
Medium287Which THREE types of information are displayed in the System Information widget?
Medium288Which protocol does FortiAnalyzer primarily use for Web UI access?
Easy289You are setting up a FortiGate Security Fabric. How do you authorize a downstream FortiSwitch to be managed by the FortiGate?
Medium290An administrator wants to perform a 'Re-install Policy' on a subset of devices without changing their current configuration settings. Which install option should be selected?
Hard291What is the primary function of the 'AntiSpam' profile?
Easy292Which TWO methods can be used to perform 'Greylisting' in FortiMail?
Hard293What is the primary difference between a Gateway and a Server mode deployment?
Medium294Which of these is a benefit of 'Transparent' mode?
Medium295How can you view the 'Total' number of policies in a specific policy package?
Medium296What is the primary benefit of deploying FortiMail in a cluster?
Easy297Which TWO of these are valid administrative roles in FortiAnalyzer?
Easy298What is the main advantage of using the FortiMail 'Quarantine' portal for end-users?
Easy299An administrator wants to ensure that all outgoing emails are archived to a secondary server. Where is this configured?
Hard300You are performing a packet capture on FortiMail. Which command-line tool is most effective for viewing SMTP traffic in real-time?
Hard301Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?
MediumOther domains
All FORTINET-NSE56 exam domains
Frequently asked questions
- What does the troubleshooting domain cover on the FORTINET-NSE56 exam?
- troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
- How many questions are in this domain?
- This page lists all 301 troubleshooting questions in the FORTINET-NSE56 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only troubleshooting questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.