I85PREP
⌘ K
FCP FortiMail study materials
FCP FortiMail study resources

FCP FortiMail practice questions

One question at a time. Build your FCP FortiMail understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment and Initial Configuration

In a FortiMail HA deployment, which mode keeps the primary unit actively processing mail while the secondary continuously synchronizes configuration and monitors the primary?

  1. Standalone gateway mode
  2. Active-active HA
  3. Active-passive HA Correct answer.
  4. Load-balancing cluster mode

Explanation

Active-passive HA is the standard FortiMail high availability topology in which one unit actively receives and processes mail while the other stays synchronized and takes over if the primary fails. Active-active is not the supported FortiMail HA model for mail processing, and standalone mode provides no redundancy at all.

Question 2Deployment and Initial Configuration

Which FortiMail deployment mode is designed to sit in front of an existing mail server and scan inbound and outbound traffic without hosting user mailboxes?

  1. IETF MTA mode
  2. Gateway mode Correct answer.
  3. Server mode
  4. Transparent mode

Explanation

Gateway mode places FortiMail inline between the internet and an existing mail server, so it relays and scans SMTP traffic while the downstream server keeps the mailboxes. Server mode instead hosts mailboxes on FortiMail itself.

Question 3Deployment and Initial Configuration

What is the default management access protocol and port for the FortiMail web-based manager on a newly initialized unit?

  1. Telnet on port 23
  2. HTTPS on port 443 Correct answer.
  3. HTTP on port 80
  4. SSH on port 22

Explanation

The FortiMail GUI is reached by HTTPS on port 443 by default, and administrators commonly connect to the default management interface address after initial setup. HTTP, SSH, and Telnet are separate access methods and are not the web GUI default.

Question 4Deployment and Initial Configuration

When configuring a FortiMail gateway deployment, which DNS record type must the public MX record point to so that inbound mail reaches FortiMail?

  1. A TXT record containing the SPF policy
  2. A CNAME record pointing to the internal mail server
  3. An A record resolving to the FortiMail public IP address Correct answer.
  4. An SRV record for the SMTP service

Explanation

The MX record must resolve to a hostname that ultimately maps to the FortiMail unit's public IP address, typically through an A record, so remote MTAs deliver mail to FortiMail first. A CNAME to the internal server would bypass FortiMail, and TXT and SRV records do not direct SMTP delivery.

Question 5Deployment and Initial Configuration

Which FortiMail interface setting is required so the unit can relay outbound mail from protected clients while still accepting inbound mail for its protected domains?

  1. A recipient verification policy applied to internal clients
  2. An access control rule permitting the protected clients to relay through FortiMail Correct answer.
  3. A disclaimer rule applied to the outbound session
  4. A relay host configured on the outbound profile

Explanation

FortiMail authenticates and authorizes relaying through access control rules that match the client source and allow the relay action for the protected domain. Without such a rule, outbound clients are denied relay even if other profiles exist.

Question 6Deployment and Initial Configuration

An administrator needs FortiMail to accept mail for a protected domain. Which object must be created first so FortiMail recognizes the domain and its recipients?

  1. A protected domain entry Correct answer.
  2. A recipient address group
  3. A relay host entry
  4. A mail routing table entry

Explanation

FortiMail must have a protected domain configured before it will accept and process mail for that domain's recipients. The protected domain defines the domain name and the mail server or recipients FortiMail handles.

Question 7Deployment and Initial Configuration

During initial setup of a FortiMail appliance, which step best describes how the administrator reaches the unit before any configuration exists?

  1. Connect to the default management IP address on the configured management port Correct answer.
  2. Authenticate through an external LDAP server
  3. Use the FortiMail Cloud console to push a base configuration
  4. Connect through the FortiGate's FortiLink interface

Explanation

A factory-default FortiMail has a default management IP address on its management interface, and the administrator connects to that address to run the setup wizard and apply the initial configuration. External services and FortiLink are not used to bootstrap a fresh appliance.

Question 8Deployment and Initial Configuration

Which FortiMail feature must be enabled on the receiving interface so that SMTP connections from remote senders are accepted?

  1. The syslog service in the interface configuration
  2. The SNMP service in the interface configuration
  3. The IMAP service in the interface configuration
  4. The SMTP service in the interface configuration Correct answer.

Explanation

The SMTP service must be enabled on the interface that faces remote senders so FortiMail listens for inbound SMTP connections on that interface. IMAP, SNMP, and syslog are unrelated services for mailbox access, monitoring, and logging.

Question 9Deployment and Initial Configuration

A gateway-mode FortiMail must forward accepted mail to the internal mail server. Which configuration element defines that downstream destination?

  1. The outbound recipient access control rule
  2. The TLS policy for inbound sessions
  3. The protected domain's mail server or relay host setting Correct answer.
  4. The antispam quarantine settings

Explanation

In gateway mode, the protected domain configuration specifies the mail server or relay host to which FortiMail delivers accepted mail after scanning. Access control rules govern who may relay, and quarantine and TLS settings do not define delivery destinations.

Question 10Deployment and Initial Configuration

Which FortiMail administrator account type has unrestricted access to all configuration and system settings, including deployment mode changes?

  1. The domain administrator profile
  2. The read-only administrator profile
  3. The admin (super administrator) profile Correct answer.
  4. The recipient (mail user) account

Explanation

The super administrator profile grants full access to system-level configuration, including deployment mode and global settings. Domain administrators are scoped to their domains, read-only profiles cannot change configuration, and mail users are end recipients.

Question 11Deployment and Initial Configuration

When FortiMail operates in server mode, which component stores the actual user mailboxes on the unit?

  1. The protected domain's relay host
  2. The external LDAP directory
  3. The built-in mail storage service Correct answer.
  4. The antispam quarantine database

Explanation

In server mode FortiMail hosts user mailboxes using its built-in mail storage service, and users retrieve mail via protocols such as IMAP or POP3. LDAP is used for authentication and recipient lookup, not mailbox storage.

Question 12Deployment and Initial Configuration

Which FortiMail setting controls whether the unit performs recipient address verification against the downstream mail server before accepting a message?

  1. The administrator idle timeout
  2. The outbound relay host configuration
  3. The recipient verification option in the antispam or session settings Correct answer.
  4. The syslog server address

Explanation

Recipient verification settings let FortiMail check whether a recipient exists before accepting the message, reducing directory-harvest and backscatter traffic. Relay host settings, idle timeouts, and syslog addresses are unrelated to verifying recipients.

Question 13Deployment and Initial Configuration

An administrator wants to enable the FortiMail HA pair to synchronize configuration and maintain heartbeat. Which interface role should be assigned to the dedicated HA link?

  1. The management interface shared with the GUI
  2. A dedicated HA heartbeat interface Correct answer.
  3. The public-facing SMTP interface
  4. The quarantine storage interface

Explanation

FortiMail HA uses a dedicated heartbeat interface to exchange synchronization and failover traffic between the primary and secondary. Sharing the public or management interface with heartbeat traffic is not the recommended design and can cause failover issues.

Question 14Deployment and Initial Configuration

Which FortiMail deployment mode allows the unit to be placed inline without changing the IP addressing of the existing mail server, forwarding traffic at the network level?

  1. Server mode
  2. Transparent mode Correct answer.
  3. Gateway mode
  4. HA mode

Explanation

Transparent mode places FortiMail inline in the network path while preserving the existing mail server's addressing, forwarding traffic at the network layer. Gateway mode normally requires MX and routing changes to direct SMTP to FortiMail.

Question 15Deployment and Initial Configuration

Which configuration ensures that outbound mail from authenticated users is scanned for content and antispam rules before leaving the organization?

  1. A recipient verification rule
  2. A relay host entry alone
  3. A quarantine report schedule
  4. An outbound profile and policy applied to the outbound session Correct answer.

Explanation

Outbound scanning is driven by outbound profiles and policies that are applied to sessions identified as outbound. A relay host only forwards mail, and recipient verification and quarantine reports are unrelated to scanning outbound content.

Question 16Deployment and Initial Configuration

When a FortiMail unit is configured with a private IP address behind a NAT device, which setting should reflect the public IP or hostname so that SMTP greetings and headers are consistent?

  1. The syslog server port
  2. The unit's system hostname and the SMTP greeting/HELO configuration Correct answer.
  3. The quarantine storage path
  4. The admin idle timeout

Explanation

Behind NAT, the system hostname and SMTP greeting or HELO settings should reflect the public identity of the unit so remote servers and headers see a consistent name. Idle timeouts, syslog ports, and storage paths do not affect SMTP identity.

Question 17Deployment and Initial Configuration

An administrator deploys FortiMail in gateway mode and finds inbound mail is being rejected by the downstream server for unknown recipients. Which FortiMail configuration most directly addresses this?

  1. Disable the SMTP service on the public interface
  2. Change the deployment mode to transparent
  3. Enable recipient verification against the downstream server Correct answer.
  4. Remove the protected domain entry

Explanation

Recipient verification lets FortiMail query the downstream server and reject unknown recipients at the edge instead of forwarding them and generating backscatter. Disabling SMTP, changing modes, or removing the protected domain would break inbound delivery rather than resolve the rejection.

Question 18Deployment and Initial Configuration

Which FortiMail HA behavior occurs when the primary unit fails and the secondary takes over?

  1. Both units process mail simultaneously in active-active mode
  2. The secondary stops accepting SMTP until the primary is repaired
  3. The secondary assumes the primary's mail-processing role using the synchronized configuration Correct answer.
  4. The secondary reverts to factory defaults until manually reconfigured

Explanation

On failover, the secondary promotes itself to the active role and continues processing mail using the configuration and state synchronized from the primary. It does not revert to defaults, run active-active, or stop accepting mail.

Question 19Deployment and Initial Configuration

Which FortiMail configuration object maps an email address or pattern to a local mailbox or destination for mail routing within server mode?

  1. An interface service entry
  2. A relay host entry
  3. A TLS profile
  4. A recipient entry Correct answer.

Explanation

Recipient entries define mailboxes and address mappings so FortiMail can route mail to the correct local destination in server mode. Relay hosts, interface services, and TLS profiles serve forwarding, network listening, and encryption roles respectively.

Question 20Deployment and Initial Configuration

Which FortiMail setting should be configured to permit only authorized internal subnets to use the unit as an SMTP relay while denying unknown external sources?

  1. An open recipient verification policy
  2. A catch-all relay host
  3. Access control rules matching the internal subnets Correct answer.
  4. A permissive TLS profile

Explanation

Access control rules identify which clients may relay mail, so rules matching only the authorized internal subnets prevent unauthorized external sources from using FortiMail as an open relay. A catch-all relay host, open verification policy, or permissive TLS profile does not restrict relay clients.

Question 21Deployment and Initial Configuration

Which FortiMail deployment consideration makes transparent mode preferable to gateway mode for an existing mail server?

  1. It eliminates the need for antispam scanning
  2. It avoids changing the existing mail server's IP address and MX records Correct answer.
  3. It requires no network path to the mail server
  4. It provides built-in mailbox storage for all users

Explanation

Transparent mode lets FortiMail sit inline without re-addressing the existing mail server or repointing MX records, which minimizes disruption during deployment. It does not add mailbox storage, remove scanning, or eliminate the need for a network path.

Question 22Deployment and Initial Configuration

Which FortiMail initial configuration step defines the local time zone and system hostname that appear in logs and mail headers?

  1. The quarantine report settings
  2. The antispam profile settings
  3. The recipient address group settings
  4. The system settings in the initial setup wizard Correct answer.

Explanation

System settings such as hostname and time zone are configured during initial setup and determine how the unit identifies itself and timestamps events in logs and headers. Antispam, address group, and quarantine report settings do not set system identity or time.

Question 23Deployment and Initial Configuration

An administrator must allow IMAP clients to retrieve mail from a FortiMail server-mode unit. Which interface service must be enabled on the interface facing the clients?

  1. Syslog
  2. IMAP Correct answer.
  3. SNMP
  4. SMTP

Explanation

Enabling the IMAP service on the client-facing interface lets users retrieve their mailboxes from FortiMail in server mode. SMTP carries mail transport, while SNMP and syslog are monitoring and logging services.

Question 24Deployment and Initial Configuration

Which FortiMail HA requirement must be satisfied before the secondary unit can take over mail processing?

  1. The secondary must be in server mode while the primary is in gateway mode
  2. The secondary must use a separate public IP address for SMTP
  3. The secondary must have a synchronized configuration and an active heartbeat with the primary Correct answer.
  4. The secondary must have a different protected domain list

Explanation

HA failover depends on the secondary receiving synchronized configuration and maintaining heartbeat communication with the primary. Differing domain lists, mismatched deployment modes, or separate public SMTP addresses would prevent a clean takeover.

Question 25Deployment and Initial Configuration

Which FortiMail configuration determines the maximum message size accepted during an SMTP session?

  1. The TLS profile cipher list
  2. The syslog server port
  3. The mail size limit in the system or profile settings Correct answer.
  4. The admin idle timeout

Explanation

A mail size limit setting defines the largest message FortiMail accepts during an SMTP session, protecting the unit and downstream servers from oversized messages. Idle timeouts, syslog ports, and TLS cipher lists do not govern message size.

Question 26Deployment and Initial Configuration

A FortiMail unit is being prepared for its first production deployment. Which task belongs to the initial system configuration rather than to later policy tuning?

  1. Assigning the management IP address and default gateway on the port used for administration Correct answer.
  2. Creating per-user quarantine release rules
  3. Building recipient address maps for each protected domain
  4. Defining the administrator's preferred antispam score thresholds

Explanation

Initial configuration establishes Layer 3 reachability so the administrator can reach the GUI or CLI: interface IP addressing, default route, and administrative access services. Antispam thresholds, quarantine rules, and address maps are mail-processing objects configured after the unit is reachable and licensed.

Question 27Deployment and Initial Configuration

An administrator is installing a FortiMail appliance in a new data center and wants the unit to use the correct local time in logs, quarantine timestamps, and message headers. Which initial configuration element should be set?

  1. The default mail queue lifetime
  2. The administrator password complexity policy
  3. The system time zone and NTP server Correct answer.
  4. The SMTP greeting banner text

Explanation

FortiMail derives local time from the configured time zone, and synchronizing with NTP keeps log and quarantine timestamps consistent across the deployment. The greeting banner, queue lifetime, and password policy affect other behaviors and do not set the clock or time zone.

Question 28Deployment and Initial Configuration

A FortiMail unit will be placed in front of an existing internal mail server without changing the internal server's IP address or MX records. Which deployment mode should the administrator select?

  1. HA mode, because it requires a virtual IP shared with the internal server
  2. Server mode, because it hosts mailboxes locally
  3. Transparent mode, because it forwards SMTP sessions without requiring the downstream server to be re-addressed Correct answer.
  4. Gateway mode, because it always rewrites the envelope recipient

Explanation

Transparent mode inserts FortiMail inline while the downstream mail server keeps its existing address and remains the MX target, so no re-addressing is required. Server mode hosts local mailboxes, gateway mode is typically used when FortiMail itself is the MX and relays to a protected server, and HA mode is a redundancy arrangement rather than a mail-flow mode.

Question 29Deployment and Initial Configuration

An administrator is configuring a FortiMail gateway deployment and must ensure that mail for the protected domain is accepted only when the recipient is a known valid address. Which configuration object should be reviewed?

  1. The system DNS forwarder list
  2. The recipient address verification setting for the protected domain Correct answer.
  3. The outbound relay host entry
  4. The SMTP client authentication profile

Explanation

Recipient address verification controls whether FortiMail checks an incoming envelope recipient against the known addresses for the protected domain before accepting the message. Relay host settings affect outbound delivery, client authentication affects submission, and DNS forwarders affect name resolution rather than recipient validity.

Question 30Deployment and Initial Configuration

A FortiMail administrator is planning an HA pair and wants the secondary unit to assume mail processing if the primary fails. Which condition must be satisfied for the takeover to work as intended?

  1. The secondary unit must have a different FortiMail firmware version so it can detect the failure
  2. The secondary unit must be placed in server mode while the primary runs in gateway mode
  3. The secondary unit must use a separate protected domain database that is not synchronized
  4. The secondary unit must be licensed and configured with matching HA settings and a reachable heartbeat path Correct answer.

Explanation

An HA pair requires both members to be properly licensed, configured with compatible HA parameters, and able to exchange heartbeats over the designated interface so the secondary can detect primary failure and take over. Mismatched firmware, mixed deployment modes, or unsynchronized configuration prevent reliable failover.

Question 31Email Routing and Delivery

On FortiMail, which component is responsible for accepting inbound SMTP connections from the internet and applying recipient verification before content inspection?

  1. The DNS forwarder configured in the system settings
  2. The inbound SMTP proxy service on the receiving mail gateway Correct answer.
  3. The webmail component running on the administrative port
  4. The antivirus quarantine repository on the system disk

Explanation

FortiMail processes inbound mail through its SMTP proxy, which terminates the SMTP session, performs recipient verification against the configured LDAP or local user database, and then passes accepted messages to the antispam and antivirus stages. Quarantine storage and DNS forwarding are supporting services and do not accept inbound SMTP sessions themselves.

Question 32Email Routing and Delivery

An administrator wants a FortiMail gateway to relay outbound mail from internal users directly to the internet. Which setting must be enabled on the protected domain or IP policy so the appliance accepts and relays those messages?

  1. SMTP authentication for inbound recipients only
  2. TLS enforcement for inbound sessions
  3. Allow outbound relay for the matching sender pattern Correct answer.
  4. Recipient address verification with LDAP bind

Explanation

Outbound relay must be explicitly permitted for the sender or client pattern, otherwise FortiMail rejects or queues the message as unauthorized relay. Recipient verification and TLS enforcement affect inbound session handling but do not authorize outbound relaying.

Question 33Email Routing and Delivery

Which FortiMail profile type determines how the appliance handles messages that match a recipient policy, including actions such as quarantine or discard?

  1. Content profile
  2. Antivirus profile
  3. Session profile
  4. Recipient policy Correct answer.

Explanation

Recipient policies bind sender and recipient patterns to an action and a content profile, so they decide whether a message is delivered, quarantined, or discarded. Session profiles control SMTP-level behavior such as authentication and TLS, and antivirus profiles only define scanning behavior.

Question 34Email Routing and Delivery

A FortiMail unit is deployed in gateway mode in front of an existing mail server. What is the default behavior for messages destined to a protected domain after they pass all inspections?

  1. They are relayed to the configured mail host for that domain. Correct answer.
  2. They are stored in the local user mailbox on FortiMail.
  3. They are returned to the sender with a 5xx temporary failure.
  4. They are always quarantined for administrator review.

Explanation

In gateway mode FortiMail acts as an SMTP relay in front of the real mail server, so accepted messages are forwarded to the mail host defined for the protected domain. Local mailbox storage applies to server mode, and unconditional quarantine is not the default disposition.

Question 35Email Routing and Delivery

Which FortiMail feature lets an administrator route mail for a specific recipient domain through a designated relay host instead of direct DNS delivery?

  1. A bounce address verification rule
  2. An SMTP greeting banner override
  3. A relay host entry in the protected domain settings Correct answer.
  4. A recipient access control list

Explanation

Protected domain settings include a relay host or mail host field that directs delivery for that domain to a specified next hop. Access control lists and greeting banners affect session handling and do not change the outbound route.

Question 36Email Routing and Delivery

What does FortiMail use to look up the destination mail exchanger for a remote domain when direct delivery is configured?

  1. A static hosts file compiled at boot
  2. DNS MX record queries Correct answer.
  3. The antivirus signature database
  4. The local LDAP directory schema

Explanation

For direct delivery FortiMail resolves the destination domain's MX records through its configured DNS servers to find the receiving mail exchanger. Static hosts files, LDAP, and antivirus signatures do not provide mail exchanger information.

Question 37Email Routing and Delivery

An administrator configures an IP policy to bypass authentication for a trusted internal subnet. Which result is expected for clients in that subnet?

  1. They are blocked from relaying to external domains.
  2. They must authenticate before any SMTP command is accepted.
  3. They are treated as trusted and may relay without SMTP authentication. Correct answer.
  4. They are forced into the recipient verification quarantine.

Explanation

IP policies match clients by source address and can grant trusted status, allowing relay without SMTP AUTH for known internal hosts. Requiring authentication or blocking relay would contradict the trusted policy.

Question 38Email Routing and Delivery

Which FortiMail mail setting controls the maximum message size accepted during an inbound SMTP session?

  1. The quarantine disk retention period
  2. The SMTP maximum message size setting Correct answer.
  3. The LDAP bind timeout
  4. The per-domain mailbox quota

Explanation

The SMTP maximum message size setting caps the size of a message during the SMTP transaction, causing larger messages to be rejected. Mailbox quotas limit stored mail, and retention or LDAP timeouts do not affect SMTP size acceptance.

Question 39Email Routing and Delivery

A FortiMail gateway receives a message for a protected domain user that does not exist in the LDAP directory. Recipient verification is enabled. What is the typical FortiMail response during the SMTP session?

  1. Accept the message and forward it to the catch-all mailbox
  2. Accept the message and quarantine it silently
  3. Reject the recipient with a 5xx SMTP reply Correct answer.
  4. Accept the message and strip the recipient header

Explanation

When recipient verification is enabled and the address is not found, FortiMail rejects the envelope recipient with an SMTP error so the sending server can generate a bounce. Silent quarantine or header stripping would hide the invalid address from the sender.

Question 40Email Routing and Delivery

An organization wants FortiMail to deliver mail for its protected domain to an internal Exchange server using a specific TCP port other than 25. Which configuration accomplishes this?

  1. Set the SMTP service port on the IP policy to the alternate port
  2. Set the quarantine port to the alternate port
  3. Define the mail host with the alternate port in the protected domain settings Correct answer.
  4. Change the administrative HTTPS port to the alternate port

Explanation

The protected domain's mail host entry can include a port number, so FortiMail connects to the downstream server on that port. The IP policy port field governs the port FortiMail listens on, not the destination port used for relay.

Question 41Email Routing and Delivery

A FortiMail administrator wants outbound messages from authenticated users to be scanned and then sent directly to recipient MX records. Which two elements must be in place? (Choose the best single answer.)

  1. An inbound IP policy and a TLS profile applied to the session
  2. An outbound relay permission for the sender pattern and direct delivery enabled Correct answer.
  3. SMTP authentication disabled and a catch-all mailbox configured
  4. A recipient policy with quarantine action and a relay host defined

Explanation

Outbound relay must be authorized for the sender or client, and the delivery method must be direct DNS rather than relay through a smarthost. Quarantine actions or missing authentication would prevent normal outbound delivery.

Question 42Email Routing and Delivery

Mail for a protected domain is looping between FortiMail and the downstream mail server. Which configuration issue most commonly causes this in gateway mode?

  1. The SMTP greeting delay is set too high
  2. The FortiMail antivirus signature set is out of date
  3. The recipient verification LDAP query is slow
  4. The downstream server is configured to forward the domain back to FortiMail Correct answer.

Explanation

A mail loop occurs when the downstream server treats FortiMail as its smart host for the same domain, so each hop returns the message. Signature age, LDAP latency, and greeting delay affect performance or scanning but do not create routing loops.

Question 43Email Routing and Delivery

Which FortiMail object associates a sender pattern, a recipient pattern, and an action to control message flow through the appliance?

  1. Session profile
  2. Recipient policy Correct answer.
  3. Access control list
  4. TLS profile

Explanation

A recipient policy combines sender and recipient matching with an action and content profile to determine message handling. Access control lists and session or TLS profiles operate at the SMTP session layer without defining message disposition.

Question 44Email Routing and Delivery

An administrator needs FortiMail to accept mail for two different domains and route each to a separate downstream server. What is the recommended configuration?

  1. Two protected domains, each with its own mail host Correct answer.
  2. One protected domain with two relay hosts
  3. A single IP policy with two destination ports
  4. One recipient policy with two recipient patterns

Explanation

Each protected domain carries its own mail host, so separate domains destined for different servers require separate protected domain entries. A single domain can hold only one mail host, and IP or recipient policies do not define the downstream server.

Question 45Email Routing and Delivery

What is the purpose of the FortiMail access control list (ACL) evaluated at connection time?

  1. To select the LDAP server for recipient lookup
  2. To scan message attachments for malware
  3. To determine the quarantine retention period
  4. To decide whether to accept, reject, or authenticate the SMTP client Correct answer.

Explanation

Access control lists match client IP addresses and decide whether a connection is accepted, rejected, or challenged for authentication before SMTP commands proceed. Attachment scanning, retention, and LDAP selection are handled elsewhere.

Question 46Email Routing and Delivery

A FortiMail administrator wants messages that fail recipient verification to be accepted and quarantined rather than rejected, because the upstream provider retries aggressively. Which approach supports this?

  1. Disable recipient verification and rely on a catch-all recipient policy with quarantine action Correct answer.
  2. Set the SMTP greeting delay to zero
  3. Disable the SMTP proxy and enable webmail only
  4. Remove the protected domain entry

Explanation

Turning off hard verification and using a catch-all policy with a quarantine action lets FortiMail accept unknown recipients and hold the mail for review. Removing the domain or disabling the proxy would break mail flow entirely.

Question 47Email Routing and Delivery

Which setting on FortiMail determines the hostname announced in the SMTP greeting banner, which remote servers may use for identification?

  1. The administrative hostname
  2. The SMTP greeting hostname or local hostname setting Correct answer.
  3. The quarantine repository name
  4. The LDAP server name

Explanation

FortiMail announces a configurable local hostname in its SMTP greeting, and remote servers may use that name for identification or policy checks. Administrative hostname, LDAP server name, and repository names do not appear in the SMTP banner.

Question 48Email Routing and Delivery

An administrator observes that outbound mail from a protected domain is being rejected by remote servers for failing SPF. Which FortiMail configuration most directly addresses this?

  1. Enable TLS enforcement for inbound sessions
  2. Add the FortiMail sending IP or hostname to the domain's SPF record Correct answer.
  3. Increase the maximum message size
  4. Enable recipient verification on the protected domain

Explanation

SPF authorizes specific sending hosts, so the FortiMail egress address must be included in the domain's published SPF record. Recipient verification, message size, and inbound TLS do not affect SPF evaluation by remote servers.

Question 49Email Routing and Delivery

A FortiMail unit in server mode must deliver mail to external domains. Which delivery method does it use by default when no relay host is configured?

  1. It forwards all mail to the first protected domain
  2. It returns the message with a permanent failure
  3. It stores the message until an administrator releases it
  4. It performs direct DNS MX delivery to the recipient domain Correct answer.

Explanation

Without a relay host, FortiMail resolves MX records and delivers directly to the recipient domain's mail exchangers. It does not hold all external mail for manual release or bounce it by default.

Question 50Email Routing and Delivery

Which FortiMail configuration element specifies the IP address and port that FortiMail uses to connect to a downstream mail server for a protected domain?

  1. The IP policy source address
  2. The mail host entry in the protected domain Correct answer.
  3. The session profile client limit
  4. The recipient policy sender pattern

Explanation

The protected domain's mail host entry defines the downstream server address and optional port used for relay. IP policies, sender patterns, and session limits govern connection handling rather than the relay destination.