FORTINET-NSE123 Practice Test 10 — 10 Questions

Question 1

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

USB baiting exploiting human curiosity and physical media.. The scenario describes a USB flash drive deliberately left in a parking lot with an enticing label ('Q4 Salary Adjustments') to lure a curious employee into plugging it into a corporate laptop. This is the textbook definition of USB baiting — a physical social-engineering attack that exploits human curiosity and removable media to deliver malware or gain access.

Answer

Man-in-the-middle interception of wireless frames.

Answer

Cross-site scripting executed within a browser session.

Answer

Watering hole attack targeting web browsing habits.

Question 2

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

Accepted Answer

Inadequate identity and access lifecycle offboarding procedures. The exposure stems from a failure in identity and access lifecycle management — specifically, offboarding procedures that should have disabled or deleted the former employee's credentials immediately upon departure. Active credentials weeks after termination indicate the offboarding process was not executed or not enforced.

Answer

Failure to implement adequate endpoint antivirus software

Answer

Absence of hardware token multi-factor authentication

Answer

Lack of network segmentation between departments

Question 3

An administrator wants to check the operational status of FortiGate HA clustering. Which dashboard widget provides an overview of HA member health and role status?

Accepted Answer

High Availability widget. The High Availability widget on the FortiGate dashboard is the dedicated pane that shows HA cluster membership, each member's role (primary/secondary), and health indicators such as heartbeat status and uptime. It gives administrators an at-a-glance view of cluster health without navigating to system HA status pages.

Answer

Security Fabric Status

Answer

System Topology

Answer

Cluster Monitor

Question 4

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

Accepted Answer

Confidentiality, because data in transit can be intercepted by third parties.. Confidentiality is compromised because data transmitted over an unsecured public Wi-Fi network without a VPN can be intercepted by third parties (e.g., via packet sniffing or man-in-the-middle attacks). The lack of encryption means sensitive corporate information is exposed to unauthorized observers.

Answer

Availability, because public networks are prone to high latency and packet loss.

Answer

Non-repudiation, because transactions cannot be cryptographically verified.

Answer

Integrity, because unauthorized users can modify corporate files in transit.

Question 5

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

Accepted Answer

Administrative access settings (e.g., enabling HTTPS and ping for management). Option D is correct because every physical interface that will carry traffic must have an IP address and subnet mask assigned so the FortiGate can participate in the network and route packets between its interfaces before any firewall policy can meaningfully match traffic. Option B is correct because administrative access settings on an interface (for example enabling HTTPS, SSH, or ping for management) determine how the administrator can reach and manage the FortiGate, which is a basic interface-level configuration typically done during initial setup. Option A is incorrect because explicit proxy authentication realms are an advanced web-proxy feature configured under proxy settings, not a prerequisite interface parameter for firewall policies. Option C is incorrect because BGP AS numbers and neighbor peer groups are dynamic routing configurations that are optional and only needed in environments using BGP, not part of basic interface setup. Option E is incorrect because SSL VPN client certificate revocation lists relate to VPN authentication and are configured later, not as a basic physical interface setting.

Answer

Explicit proxy authentication realms

Answer

BGP AS number and neighbor peer groups

Answer

SSL VPN client certificate revocation lists

Question 6

An administrator is troubleshooting a packet loss issue and needs to inspect the kernel buffer drops and interface error counters. Which CLI command provides a summary of interface drop statistics?

Accepted Answer

diagnose hardware deviceinfo nic [interface]. The correct CLI command to inspect kernel buffer drops and interface error counters is 'diagnose hardware deviceinfo nic [interface]'. This command provides detailed NIC-level statistics including RX/TX errors, drops, and buffer-related counters for the specified interface.

Answer

execute interface-test drops

Answer

show interface drops

Answer

get system drop-stats

Question 7

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

Accepted Answer

A tech support scam. A tech support scam is a social engineering attack where a fake pop-up or alert claims the user's system is infected and urges them to call a toll-free number, where scammers then charge for fake 'fixes' or steal remote access. The scenario describes exactly this: a browser pop-up warning of infection with an urgent phone number. No exploitation of code, traffic flooding, or legitimate telemetry is involved — the threat is deception targeting the user.

Answer

A SQL injection exploit

Answer

A distributed denial-of-service attack

Answer

A legitimate endpoint telemetry notification

Question 8

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

Accepted Answer

Recognize the social engineering attempt and use the organization's phishing reporting tool.. The email is a classic business email compromise (BEC) or gift card scam, a form of social engineering. The user should recognize the attempt and report it via the organization's phishing reporting tool, which alerts security teams and helps prevent similar attacks.

Answer

Forward the email to all colleagues as a warning, including the live clickable link.

Answer

Reply to the sender asking for clarification using the reply button.

Answer

Treat it as an urgent executive request and fulfill the purchase immediately.

Question 9

An administrator is investigating a network routing issue on the FortiGate and needs to see the current active kernel routing table entries. Which CLI command provides this information?

Accepted Answer

get router info routing-table all. The command 'get router info routing-table all' displays the complete active kernel routing table on a FortiGate, including all routes (connected, static, dynamic) with their attributes. It is the standard CLI method for verifying routing entries and troubleshooting routing issues.

Answer

execute traceroute

Answer

get system interface

Answer

diagnose firewall IP-antibot list

Question 10

What is the primary function of a FortiGate firewall policy action set to 'Accept'?

Accepted Answer

To permit matching traffic to traverse the FortiGate. In FortiOS, a firewall policy action of 'Accept' (shown as ACCEPT in the GUI) permits matching traffic to pass through the FortiGate after all UTM profiles and security inspections are applied. It is the fundamental allow action, and without it no traffic traverses the device. The other common action is DENY, which drops the traffic.

Answer

To redirect the user browser to a captive portal authentication page

Answer

To encapsulate the packet inside an IPsec VPN tunnel

Answer

To drop the matching packet silently without logging