Fortinet · Free Practice Questions · Last reviewed May 2026
18 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?
System > Settings > Maintenance
Click the administrator profile name at the top right of the GUI > Configuration > Backup
Clicking the administrator profile name at the top right exposes the Configuration submenu, where Backup exports the running configuration to a local encrypted file. This satisfies the requirement to save the FortiGate configuration securely for backup, since the GUI's profile menu is the only path offering the Backup action.
Security Fabric > Settings > Export
Log & Report > Backup Settings
Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?
Log & Report > System Events
System Events aggregates FortiGate's administrative and system-level messages, including alerts, warnings and admin activity. This dashboard sits under Log & Report, giving administrators a single view of device health and configuration events rather than traffic or security logs.
Security Fabric > Audit
System > Advanced
Monitor > Routing Monitor
An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?
FortiView Sessions
System Resources
The System Resources widget displays real-time CPU and memory utilisation directly on the FortiGate dashboard, satisfying the requirement to check performance from the web-based manager. It is enabled by default, unlike other widgets that require manual addition, so the administrator gains immediate visibility without further configuration.
License Information
Network Interfaces
An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?
FortiView > Applications
FortiView > Applications aggregates traffic by application identity, using FortiGate's application control signatures to rank top bandwidth consumers. This directly satisfies the requirement for aggregated application visibility on the dashboard, showing which applications consume the most bandwidth across the network.
Log & Report > Forward Traffic
Security Fabric > Topology
System > FortiGuard
An administrator is investigating a network routing issue on the FortiGate and needs to see the current active kernel routing table entries. Which CLI command provides this information?
execute traceroute
get system interface
get router info routing-table all
`get router info routing-table all` queries the FortiGate's active kernel routing table directly, dumping every installed route rather than filtering by protocol or prefix. This satisfies the administrator's requirement to view current active entries, unlike configuration-oriented commands that display static route definitions without confirming which routes the kernel actually selected.
diagnose firewall IP-antibot list
An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?
Dashboard > System Information widget
The System Information widget on the dashboard displays the running firmware version, hostname, serial number and uptime immediately after login, satisfying the requirement to verify the current firmware version without navigating to separate configuration menus or running CLI commands.
Log & Report > System Events
Policy & Objects > Addresses
Network > Interfaces
Want more Nse 3 Fortigate Operational Fundamentals practice?
Practice this domainAn attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?
Baiting
Baiting exploits curiosity by leaving physical media such as branded USB drives for victims to plug in, delivering malware once connected. The salary-themed labels entice employees, matching the baiting definition rather than phishing or tailgating.
Watering hole attack
Tailgating
Phishing
An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?
Endpoint compliance
Network layer security
Physical security
Tampered badge readers and covert recording devices directly compromise the physical control layer protecting the entrance, enabling badge cloning or unauthorised entry. This satisfies the stem's constraint: the threat vector targets physical access mechanisms, not logical controls such as Microsoft Entra ID authentication or network-based defences.
Application layer security
During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?
Separation of duties
Defense in depth
Security through obscurity
Principle of least privilege
The service account held administrative rights across multiple disparate systems, far beyond its routine function, directly breaching least privilege. This principle demands granting only the minimum access necessary for a defined task, so excessive standing privileges enabled the attacker's broad compromise.
An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?
A SQL injection exploit
A distributed denial-of-service attack
A legitimate endpoint telemetry notification
A tech support scam
The pop-up fabricates an infection and pushes a toll-free number, relying on fear and urgency to make the victim call and hand over payment or remote access. That social-engineering mechanism, not actual malware, defines a tech support scam.
A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?
It ensures that compromised credentials alone are insufficient for an attacker to gain access
Requiring a password plus a push notification means a stolen or phished password alone cannot grant access; the attacker must also control the registered mobile device. This satisfies the stem's multi-factor constraint, where knowledge-based credentials are combined with a possession factor, directly mitigating credential-compromise attacks.
It guarantees complete encryption of all local workstation files
It prevents all forms of social engineering attacks against remote workers
It entirely eliminates the need for strong passwords on corporate accounts
A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?
Enforcing mandatory password complexity rules
Implementing strict egress firewall filtering
Deploying host-based intrusion detection systems
Maintaining immutable, offline data backups
Immutable, offline backups keep a clean copy of data beyond the ransomware's reach, so encrypted production systems can be rebuilt from unaffected media. This satisfies the recovery-without-ransom outcome, since restoration does not depend on the attacker's decryption key.
Want more Nse 1 Foundational Cybersecurity Concepts practice?
Practice this domainA security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?
FortiSandbox
FortiAnalyzer
FortiManager
FortiClient EMS
FortiClient EMS centrally manages endpoint compliance and synchronises telemetry with the Security Fabric, so the FortiGate can verify an active, up-to-date FortiClient before granting access. This satisfies the stem's requirement for compliance checking and Fabric synchronisation.
An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?
IPS sensor
An IPS sensor inspects traffic against signature and anomaly databases, detecting and blocking known vulnerability exploits and attack signatures. Applied in the firewall policy, it satisfies the administrator's requirement to protect internal servers from known exploits traversing the network.
Web Filtering profile
Application Control profile
Data Loss Prevention (DLP) sensor
A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?
Directly under the physical interface configuration
Inside an IPv4 firewall policy matching the traffic
Security profiles only act on traffic matched by a firewall policy; the profile is attached within that policy, not globally. Applying it inside the IPv4 policy satisfies the stem's requirement that inspection actually take effect on the passing web traffic.
Inside the static routing table configuration
Under the Global System Settings menu
An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?
DNS Filter profile
Web Filtering profile
A web filtering profile inspects HTTP and HTTPS requests and blocks them by URL category, so social media categories can be denied during work hours. It is the FortiGate feature that classifies and controls access to specific website categories.
IPS sensor
Antivirus profile
What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?
Proxy-based inspection
Flow-based inspection
Flow-based inspection examines packet headers at Layers 3 and 4 and forwards packets without reassembling application streams, unlike proxy-based inspection. This satisfies the stated constraint of processing headers only, delivering higher throughput with less latency.
Deep SSL decryption inspection
Sandbox isolation inspection
An administrator is setting up a new FortiGate firewall and needs to configure basic access control between the internal corporate network and the external public network. Which object type should the administrator create first to group internal IP addresses for policy creation?
Application Control signature
Virtual IP object
Firewall Address object
Firewall Address objects group internal IP addresses or subnets into named, reusable entities. Policies then reference these objects rather than raw addresses, satisfying the requirement to group internal IPs before building access control between the corporate and public networks.
Traffic Shaper object
Want more Nse 2 Technical Introduction TO Fortinet Security practice?
Practice this domainThe vendor does not publish an exact question count for the FORTINET-NSE123. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 3 domains: Nse 3 Fortigate Operational Fundamentals, Nse 1 Foundational Cybersecurity Concepts, Nse 2 Technical Introduction TO Fortinet Security. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Fortinet FORTINET-NSE123 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.