Fortinet Certified Professional - FortiMail 7.4 Administrator Free Sample Questions

FortiMail applies IBE encryption through policies. For outbound mail, an outbound recipient policy must be matched, and that policy must have a content profile that specifies the IBE encryption action. If the content profile with the IBE action is not linked to the outbound policy, encryption will not be triggered, even if the IBE service is active.

Deploying an active-passive HA cluster is the primary method for providing redundancy. If the active unit fails, the passive unit takes over all processing, ensuring continuous email inspection and delivery.

Fail-to-wire (also known as fail-open or bypass mode) is a hardware feature on certain FortiMail models. If the appliance loses power or fails critically, the ports create a direct physical connection, allowing traffic to pass through uninspected but without interrupting the mail flow. This is a crucial last-resort mechanism for maintaining connectivity.

In gateway mode, the FortiMail unit acts as an inbound and outbound mail relay. To ensure that all incoming email for the protected domain is first processed by FortiMail, the public Mail Exchanger (MX) DNS records must be updated to point to the FortiMail appliance. This directs all external mail servers to deliver email to FortiMail instead of directly to the organization's mail server.

FortiMail provides a specific exemption list for bounce address tag validation. By adding the trusted partner's domain to this list, their DSNs will be accepted without a valid BATV tag, resolving the issue without disabling the feature globally or creating overly permissive IP whitelists.

In Microsoft Active Directory, the 'memberOf' attribute is a multi-valued attribute on a user object that lists the distinguished names of the groups to which the user belongs. FortiMail uses this attribute to determine group membership for policy matching.

In FortiMail's server mode, a wildcard user alias (*) can be created to act as a catch-all. When recipient verification fails to find a specific user, it checks for a matching alias. The wildcard alias will match any non-existent user in the domain and redirect the email to the specified destination, in this case, '[email protected]'.

Greylisting works by temporarily rejecting an email from an unknown combination of IP/sender/recipient. A compliant Mail Transfer Agent (MTA) will attempt to redeliver the email after a short period. If the sending server does not retry, the message will remain deferred and eventually time out.

Greylisting is a feature configured within a session profile. That profile must then be applied to a policy (either IP-based or recipient-based) that matches the incoming email session for the greylisting action to be triggered.

Once the initial greylist period has passed, FortiMail will recognize the retried attempt from the same IP/sender/recipient tuple and accept the connection, delivering the email. The tuple is then whitelisted for a configurable period.

The DKIM standard specifies that the public key must be published in the public DNS system as a TXT record. The record is located at a specific subdomain indicated by the selector in the DKIM signature header. Receiving servers query this DNS record to retrieve the public key and verify the signature's authenticity.

Administrator access profiles are used to create custom, role-based access control (RBAC) policies. An administrator can create a profile for each team, granting read/write or read-only access to specific areas of the GUI and CLI. These profiles are then assigned to the respective administrator accounts.