FORTINET-NSE123 Practice Test 1 — 10 Questions

Question 1

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment. Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 2

What is the primary function of a FortiAuthenticator device?

Accepted Answer

To centralize user authentication, identity services, and token management. FortiAuthenticator is Fortinet's dedicated identity and access management (IAM) appliance. Its core purpose is to centralize authentication (via RADIUS, LDAP, SAML, etc.), provide identity services such as user identification and group mapping, and manage tokens for two-factor authentication (2FA) and one-time passwords (OTP). It acts as a central point for enforcing authentication policies across the Fortinet Security Fabric and third-party devices. Unlike firewalls or sandboxes, it does not inspect traffic for threats or manage network infrastructure.

Answer

To scan incoming network traffic for virus signatures

Answer

To manage physical switch ports and VLANs via FortiLink

Answer

To analyze zero-day files in an isolated virtual sandbox

Question 3

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Accepted Answer

Rearrange existing widgets by dragging and dropping them into preferred positions.. Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget. Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Answer

Convert the dashboard into a command-line terminal emulator.

Answer

Delete physical firewall ports from the dashboard interface view.

Answer

Modify core FortiOS kernel code directly from the dashboard widget settings.

Question 4

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide a routing domain into a two-level hierarchy (backbone Area 0 and other areas) to reduce routing overhead. By summarizing routes at area boundaries, OSPF limits the scope of link-state advertisements (LSAs), reducing CPU, memory, and bandwidth consumption on routers.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 5

An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?

Accepted Answer

Dashboard > System Information widget (System Mode field). The operational mode (NAT vs. Transparent) is displayed in the Dashboard > System Information widget under the System Mode field. The System Information widget on the default dashboard shows key device details including hostname, firmware version, serial number, and the current system mode, making it the correct place to verify whether the FortiGate is in NAT or Transparent mode.

Answer

System > Feature Visibility > NAT Mode

Answer

Network > Operation Mode

Answer

Policy & Objects > Mode Settings

Question 6

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

Accepted Answer

Establish an authorized corporate VPN connection before accessing internal systems.. A corporate VPN creates an encrypted tunnel (typically IPsec or TLS) between the employee's device and the corporate gateway, so any data traversing the untrusted coffee shop Wi-Fi is protected from eavesdropping. Without this encryption layer, an attacker on the same hotspot can capture credentials, session tokens, and sensitive traffic using tools like Wireshark or a rogue AP. The VPN must be established before any internal resource is accessed so that no cleartext traffic leaks onto the public network.

Answer

Enable local file sharing to speed up document syncing over public connections.

Answer

Disable the operating system firewall to allow seamless packet routing through the hotspot.

Answer

Configure the web browser to accept all SSL certificates to bypass public portal warnings.

Question 7

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. FortiGate allows administrators to encrypt the configuration backup file with a password during export from the GUI. This ensures that the configuration file, which contains sensitive information like passwords and keys, is protected if intercepted or stored insecurely. The option to encrypt with a password is available when performing a backup via System > Config > Backup.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP

Question 8

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

Accepted Answer

A long passphrase consisting of random unrelated words and special characters. A long passphrase made of random unrelated words plus special characters maximizes length and entropy while remaining memorable, which is the strongest practice among the options. Length is the primary defense against brute-force and dictionary attacks, and random unrelated words defeat predictable patterns. This aligns with modern guidance from NIST SP 800-63B, which emphasizes length over complexity.

Answer

A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

Answer

A password reused from personal social media accounts to ensure easy recall

Answer

A short word combined with the current year, such as 'Summer2026!'

Question 9

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard Distribution Network (FDN) is Fortinet's global threat intelligence infrastructure that pushes real-time updates — antivirus signatures, IPS signatures, web filter categories, and other security content — to FortiGate, FortiMail, FortiClient, and other Fortinet devices. It ensures devices have current protection against emerging threats without manual intervention.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 10

An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?

Accepted Answer

It aborts the connection immediately and displays a replacement message to the user. In flow-based inspection mode, when the FortiGate detects an infected file, it aborts the connection immediately and displays a replacement message to the user. This is because flow-based inspection does not buffer the entire file; it scans as data streams and can terminate the session upon detection. The replacement message informs the user why the download failed.

Answer

It drops the packet silently without notifying the user or generating a log

Answer

It buffers the entire file to disk, cleans the file, and then emails the cleaned file to the user

Answer

It allows the download to complete and then quarantines the file locally on the client endpoint