Nse6 Fortimail Secure Email Gateway practice questions

A custom antispam filter for all emails.

Why it fails: DMARC reject enforcement relies on the domain's published policy, a DKIM or SPF alignment mechanism, and FortiMail's DMARC profile — not a blanket antispam filter. A custom filter is tempting for blocking spoofed mail broadly, but it cannot evaluate DMARC alignment or honour p=reject.

An LDAP server for user authentication.

Why it fails: LDAP authentication validates mailbox users; DMARC reject enforcement instead needs the published DMARC record, DKIM or SPF alignment, and a FortiMail DMARC profile. LDAP is tempting where recipient verification is required, but DMARC evaluates sending-domain alignment, not user credentials.

Disable the Antispam engine globally.

Why it fails: Disabling Antispam stops all spam filtering, so trusted senders are no longer distinguished from untrusted ones and the false positives disappear only by removing protection entirely. Disabling is intended for troubleshooting or when another gateway performs filtering.

Add the sender to the Global Whitelist in the Antispam Profile.

Why it fails: Whitelisting in the profile bypasses all checks, including antivirus.

Modify the recipient's personal whitelist.

Why it fails: A personal whitelist applies only to one recipient's mailbox, so other users still receive false positives from the same sender. Personal whitelists are intended for individual exceptions, whereas the scenario needs a domain-wide trusted-sender entry that preserves virus scanning for everyone.

AntiSpam profile block list

Why it fails: The block list rejects matching senders, so adding a legitimate address there increases quarantining rather than preventing it. A per-user whitelist belongs in the AntiSpam profile's allow list, or in a per-recipient setting. The option tempts because both lists hold addresses, but their actions are opposite.

Recipient policy whitelist

Why it fails: A recipient policy whitelist applies to all recipients matched by that policy, so it cannot scope the exemption to the single reporting user. The correct placement is a per-user whitelist in the user's personal quarantine or preference settings. Recipient policies suit domain-wide or group-wide allow lists instead.

System global whitelist

Why it fails: A system global whitelist exempts the sender for every recipient on the FortiMail unit, not just the affected user. The correct placement is the per-user whitelist in that user's quarantine preferences. Global whitelists suit organisation-wide trusted senders where no per-recipient scoping is required.

Proxy mode

Why it fails: Proxy mode is a FortiGate inspection mode, not a FortiMail deployment option. FortiMail runs as a gateway, server or transparent device; proxy operation belongs to FortiGate's security profiles. It tempts because both products process email, but the deployment axis here is FortiMail's gateway/server/transparent roles.

NAT mode

Why it fails: NAT mode describes FortiGate interface addressing, not a FortiMail deployment role. FortiMail deploys as gateway, server or transparent; NAT is an interface-level routing setting. It tempts because FortiMail gateways commonly sit behind NAT, but that is network placement, not a supported deployment mode.

Endpoint mode

Why it fails: Endpoint mode is a FortiClient deployment concept, not a FortiMail one. FortiMail is deployed as gateway, server or transparent device; endpoint agents run on hosts. It tempts because FortiMail can scan endpoint-submitted mail, but no endpoint deployment mode exists in FortiMail's documented options.

Modify sender

Why it fails: DLP filters act on the message or its delivery, not on rewriting the envelope sender. Available actions include block, quarantine, exempt and archive; modifying sender identity is not among them. It tempts because sender-based policies exist elsewhere, but DLP matches content, and altering the From address would break SMTP authentication and delivery.

Route to another interface

Why it fails: DLP filter actions govern message disposition — block, quarantine, exempt, archive — not interface-level routing. Route-to-interface is a policy or SD-WAN function, not a DLP response. It tempts because DLP policies attach to firewall policies that do route traffic, but the filter itself cannot redirect a matched message to another interface.

User profile logs

Why it fails: Not a standard category.

Packet capture files

Why it fails: These are diagnostic files, not logs.

Hardware logs

Why it fails: This is not a standard log category.

Email body content

Why it fails: Reputation focuses on the sender's IP/network, not body content.

TLS version

Why it fails: TLS version is not a reputation factor.

Access Control rules

Why it fails: Access Control rules govern connection and relay permissions by IP or authentication, not sender address whitelisting. It is tempting because both filter mail, but the global whitelist is configured under the AntiSpam settings, not Access Control.

System network settings

Why it fails: System network settings hold interface, routing and DNS parameters, not recipient address exemptions; the global whitelist lives under the AntiSpam configuration. It tempts because network-level settings do govern traffic flow, but that layer never inspects sender addresses for spam exemption.

Mail Server settings

Why it fails: Mail Server settings define relay, authentication and TLS behaviour for mail delivery, not per-sender AntiSpam exemptions. It tempts because mail server configuration sounds adjacent to spam handling, yet the global whitelist is configured in the AntiSpam policy area, not the mail server profile.

show log traffic

Why it fails: 'show log traffic' displays stored traffic log entries, not live packet contents, so it cannot reveal SMTP dialogue in real time. It tempts because it is a legitimate CLI diagnostic for historical traffic. Live SMTP inspection requires the packet-capture tool with a filter, which streams frames as they traverse the interface.

execute telnet

Why it fails: 'execute telnet' opens an outbound Telnet session from FortiMail to a remote host; it does not capture or display passing SMTP packets. It tempts because Telnet can manually test SMTP connectivity to a server. Real-time SMTP traffic viewing needs the packet-capture command with an SMTP filter applied to the interface.

get system status

Why it fails: Displays FortiMail's system status, such as uptime and resource usage, not SMTP packet contents. It is tempting because it is a genuine CLI diagnostic command, but the correct tool for real-time SMTP inspection is a packet sniffer such as diagnose sniffer packet.

Force decryption.

Why it fails: FortiMail cannot decrypt unknown archives.

Allow all.

Why it fails: This is a security risk.

Always ignore.

Why it fails: This is a security risk.

DMARC.

Why it fails: DMARC uses SPF/DKIM results.

DKIM.

Why it fails: DKIM is for signing.

RBL.

Why it fails: RBL is for IP reputation.

The recipient domain is invalid.

Why it fails: 451 4.7.1 signals a temporary greylisting or policy rejection, prompting the sender to retry later; an invalid recipient domain returns a permanent 5xx error such as 550. It tempts because both concern delivery failure, but 4.7.1 is transient and retryable, not a domain-validity verdict.

The email has a virus.

Why it fails: 451 4.7.1 is a transient greylisting or policy deferral, not virus detection; infected mail is quarantined or rejected with content-filter verdicts. It tempts because administrators associate error logs with threats, but this code concerns temporary delivery deferral, and virus handling produces different log actions entirely.

The server is down.

Why it fails: A 451 4.7.1 SMTP reply is a temporary greylisting deferral, not a server outage; the receiving MTA is asking the sender to retry later. It tempts because 4xx codes do signal transient conditions, so a genuinely unreachable or stopped mail server would produce connection failures rather than this specific deferral response.

Attachment name

Why it fails: An attachment's filename sits in the message body structure, not the header, so it plays no part in DMARC validation, which reads the RFC 5322 header fields. It tempts because attachment names are inspected by content filters and sandboxing tools, making them relevant to malware analysis rather than sender authentication.

User password

Why it fails: A user password never appears in an email header; DMARC validation examines the RFC 5322 header fields — From, Return-Path and DKIM-Signature — to verify domain alignment and authentication results. Passwords are tempting because email security discussions often involve credential theft, but password handling belongs to authentication protocols such as SMTP AUTH, not header inspection.

By attachment type

Why it fails: Attachments are not a factor.

By recipient password

Why it fails: Passwords are not a factor.

By email subject

Why it fails: Subjects are not used for greylisting.

Disable antivirus.

Why it fails: Disabling antivirus removes scanning of the encrypted message and its attachments, so delivery problems caused by filtering persist while security is lost. It is tempting when scanning appears to block mail. The correct action is registering the recipient's IBE identity so the message can be decrypted and delivered.

Increase the disk space.

Why it fails: IBE delivery failures stem from the recipient's identity not being registered or the portal key being unavailable, not from storage exhaustion. Increasing disk space is tempting because mailbox and quarantine issues often trace to capacity. The correct action is ensuring the recipient is enrolled so the encrypted message can be retrieved.

Remove the sender from the whitelist.

Why it fails: Whitelisting the sender affects spam filtering, not IBE decryption or key retrieval, so removing it cannot fix delivery. It is tempting because whitelist changes often resolve blocked-mail complaints. The correct action is registering the recipient's identity in the IBE service so the encrypted message reaches them.

Disable the 'Sender Domain Check' in the session profile used for outbound mail.

Why it fails: The Sender Domain Check verifies that the envelope sender domain resolves in DNS, but the error described is about authorization, not DNS resolution. Disabling it would not address the specific 550 rejection for unauthorized sender domains, and it would reduce anti-spoofing protection for outbound mail. This is not the correct setting to modify for this scenario.

Enable 'SMTP Authentication' on the FortiMail for the internal mail server and configure the mail server to authenticate before sending.

Why it fails: SMTP authentication is used to allow clients to relay mail through FortiMail, but the internal mail server is already authorized to relay. The error is about sender domain authorization, not authentication. Enabling SMTP authentication would not fix the 550 error and would add unnecessary configuration complexity without addressing the root cause.

Add the internal mail server's IP address to the trusted MTA list in the outbound session profile and enable 'Bypass' for sender domain authorization.

Why it fails: Adding the IP to a trusted MTA list may bypass some checks, but FortiMail's sender domain authorization is controlled by the 'Sender Domain Check' and 'Bounce Address Tag Validation' settings, not a trusted MTA list. This option does not directly resolve the 550 authorization error and could weaken security by bypassing legitimate checks.

A wildcard pattern such as '*@*.domain.com' will match recipients in any subdomain of domain.com.

Why it fails: FortiMail does not support wildcards in the domain portion of the pattern in the same way as in the local part. The pattern '*@*.domain.com' is not valid syntax for matching subdomains. To match subdomains, administrators must create separate policies or use a regex pattern if supported. This option misrepresents FortiMail's wildcard capabilities.

Wildcard patterns in recipient policies are case-sensitive and must match the exact case of the email address.

Why it fails: Email addresses are generally case-insensitive, and FortiMail treats recipient patterns as case-insensitive by default. The local part of an email address may be case-sensitive in theory, but in practice, most systems treat it as case-insensitive. This option incorrectly states that wildcard patterns are case-sensitive, which is not true for FortiMail recipient policies.

A wildcard pattern can be used to match all recipients in a domain and its subdomains by using the format '*@domain.com'.

Why it fails: The pattern '*@domain.com' matches only recipients at the exact domain 'domain.com', not its subdomains. Subdomains like 'sub.domain.com' would not match this pattern. To match subdomains, a different pattern or multiple policies are needed. This is a common misconception about wildcard behavior in FortiMail recipient policies.

The 'Trusted IPs' list under the antispam profile settings.

Why it fails: FortiMail does not have a 'Trusted IPs' list specifically within antispam profile settings. Trusted IPs are typically configured in access control lists or session profiles to bypass certain checks. However, the scenario requires ensuring that SMTP connections are not exempted from antispam scanning, which is controlled by session profile settings, not a separate antispam trusted list.

The 'Antispam Exemption' list under the global antispam settings.

Why it fails: FortiMail does not have a global 'Antispam Exemption' list. Antispam exemptions are typically configured per session profile or access control rule. Checking global settings would not reveal if specific IPs are bypassing antispam scanning. The correct location is the session profile's bypass options.

The 'SMTP Access Control' rules that allow connections from certain IPs without scanning.

Why it fails: SMTP access control rules in FortiMail determine which IPs can connect and may apply session profiles, but they do not directly exempt connections from antispam scanning. The bypass settings are within the session profile, not the access control rule itself. While access control rules are related, the specific bypass is configured in the session profile.

DKIM verification

Why it fails: DKIM validates a cryptographic signature in the message headers, not the sender domain's DNS TXT record. It tempts because DKIM also uses DNS, but SPF is the mechanism that publishes authorised sending hosts in a TXT record for domain verification.

DMARC policy

Why it fails: DMARC builds on SPF and DKIM alignment and directs handling of failing mail, but it does not itself query the sending domain's DNS TXT record for verification. It is tempting because DMARC publishes policy in a TXT record, yet SPF is the mechanism that performs the TXT lookup against the envelope sender.

Sender Reputation

Why it fails: Sender reputation scores sending IPs from prior traffic and blocklist data; it performs no DNS TXT lookup of the sending domain, so spoofed mail from an unlisted IP can pass. It is tempting because reputation does filter abusive senders, and would be chosen where IP-based throttling or blocklisting is the requirement.

On the SMTP server of the recipient's domain.

Why it fails: DKIM public keys are published in DNS as a TXT record under the selector name, so receiving MTAs can retrieve and verify signatures. Placing it on the recipient's SMTP server does not make it discoverable via DNS lookup. The recipient server is tempting as the verifying party, but verification relies on DNS publication.

In the FortiMail's relay host configuration.

Why it fails: A relay host is FortiMail's outbound SMTP smarthost for routing mail, not a DNS publication point. DKIM validation requires the public key in a TXT record under selector._domainkey in the signing domain's DNS zone, which receiving MTAs query directly.

On the FortiMail server's local certificate store.

Why it fails: A local certificate store holds TLS certificates and private keys for FortiMail's own services; it is not queried by remote MTAs. DKIM verification depends on the public key being retrievable via DNS TXT at selector._domainkey.domain, so storing it locally leaves receivers unable to validate.