FORTINET-NSE123 Practice Test 11 — 15 Questions

Question 1

An administrator is examining the FortiGate routing table via the CLI. Which THREE types of routes can appear in the active routing table? (Choose three)

Accepted Answer

Dynamic routes (learned via protocols such as OSPF, BGP, or RIP). The FortiGate active routing table (viewed with 'get router info routing-table all' or 'database') contains three fundamental route sources. Option A is correct because dynamic routes learned through routing protocols such as OSPF, BGP, or RIP are installed in the routing table and marked with their protocol code (O, B, R). Option D is correct because connected routes represent directly attached subnets on FortiGate interfaces and appear automatically with the C code. Option E is correct because static routes manually configured by the administrator are installed in the routing table and marked with the S code. Options B and C are incorrect because firewall policy objects and Security Fabric telemetry do not generate routing table entries; firewall policies control traffic forwarding decisions but are not routes, and Security Fabric telemetry is a logging/visibility feature, not a routing source.

Answer

Firewall policy object routes

Answer

Security Fabric telemetry routes

Question 2

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

Accepted Answer

Implementing network segmentation to restrict lateral movement between departments. Option B is correct because network segmentation (e.g., VLANs, subnets, or microsegmentation) limits lateral movement so that a compromised host in one department cannot freely reach systems in another, adding an internal control layer beyond the perimeter. Option C is correct because requiring multi-factor authentication for all remote and privileged access enforces an additional identity-verification factor (something you know plus something you have/are), directly mitigating credential theft and unauthorized privileged use. These measures align with Defense in Depth by layering preventive controls across network and identity domains rather than trusting a single boundary. Option A is wrong because relying solely on one perimeter firewall creates a single point of failure and ignores insider threats and internal lateral movement. Option D is wrong because deleting logs and monitoring destroys detection, auditing, and incident-response capabilities. Option E is wrong because disabling endpoint antivirus removes a critical host-level control and exposes systems to malware.

Answer

Relying entirely on a single powerful perimeter firewall with no internal security controls

Answer

Eliminating all system logs and monitoring to maximize user privacy

Answer

Disabling all endpoint antivirus solutions to improve computer processing speed

Question 3

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

Accepted Answer

Physical security. The scenario describes tampering with a badge reader and attaching an unauthorized recording device — both are attacks against the physical access control infrastructure of a building. Physical security encompasses the controls (badge readers, locks, cameras, guards) that protect facilities and hardware from unauthorized physical access. Since the threat targets the badge reader itself rather than any network, endpoint, or application component, it falls squarely under physical security.

Answer

Endpoint compliance

Answer

Network layer security

Answer

Application layer security

Question 4

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

Accepted Answer

Configure remote logging to FortiAnalyzer or Syslog server and enable log overwriting. The correct action is to configure remote logging to FortiAnalyzer or a Syslog server and enable log overwriting. Offloading logs to a remote server frees local disk space while preserving historical logs for analysis and compliance. Enabling log overwriting ensures that when the local disk reaches its configured threshold, the oldest logs are automatically deleted, preventing a full disk condition. This approach maintains continuous logging without manual intervention.

Answer

Disable all firewall policy rule logging permanently

Answer

Lower the physical interface MTU size across all WAN ports

Answer

Switch the FortiGate from NAT mode to Transparent mode

Question 5

Which of the following scenarios describes a 'pretexting' social engineering attack?

Accepted Answer

An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.. Pretexting is a social-engineering technique where the attacker invents a believable scenario or false identity (a pretext) to manipulate a victim into divulging information or performing an action. Posing as an auditor to convince an employee to disclose sensitive internal procedures is a textbook pretexting attack because it relies on a fabricated role and story to gain trust.

Answer

An attacker leaves a malicious USB drive in the lobby.

Answer

An attacker uses automated software to guess passwords.

Answer

An attacker shoulder-surfs to capture a password.

Question 6

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

Accepted Answer

FortiManager configured as a local FortiGuard distribution server. FortiManager can be configured as a local FortiGuard distribution server to provide signature updates to FortiGates that lack direct internet access. It downloads updates from FortiGuard and then serves them to managed devices on the isolated network. This allows offline updates for antivirus, IPS, and other security services.

Answer

FortiClient EMS deployment server

Answer

FortiAuthenticator user database server

Answer

FortiWeb application firewall

Question 7

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?

Accepted Answer

FortiAuthenticator. FortiAuthenticator is Fortinet's dedicated identity and access management appliance, designed to integrate with external directories such as Microsoft Active Directory via LDAP/RADIUS. It synchronizes user credentials and can act as an SSO (Single Sign-On) provider, issuing tokens and supporting protocols like SAML, Kerberos, and RADIUS for SSL VPN authentication. This makes it the correct component for authenticating remote SSL VPN users against AD with SSO.

Answer

FortiWeb application firewall

Answer

FortiAnalyzer reporting engine

Answer

FortiManager policy server

Question 8

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

Accepted Answer

Encryption and hashing algorithms (e.g., AES-256 and SHA-256). In IPsec Phase 1 (IKE SA negotiation), both peers must agree on the encryption and hashing algorithms (e.g., AES-256 and SHA-256), so option B is correct because mismatched proposals cause the IKE negotiation to fail. Option C is correct because the authentication method (pre-shared key or certificates) and the matching PSK/certificate credentials must be identical or mutually trusted on both peers for authentication to succeed. Option D is correct because the Diffie-Hellman group determines the key exchange parameters and must match on both sides to derive the shared secret. Option A is not required because IKE uses timestamps/anti-replay windows rather than requiring identical time zone offsets, and option E is irrelevant since the FortiGate administrator username is a local management credential, not an IPsec Phase 1 parameter.

Answer

System time zone offset in hours

Answer

FortiGate administrator username

Question 9

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

Accepted Answer

Use a password manager to generate and store unique, strong passwords for each site.. Credential stuffing succeeds when attackers replay username/password pairs leaked from one breach against other sites, so the defense is to ensure no two accounts share a password. A password manager generates and stores a unique, high-entropy password per site, which breaks the reuse chain that credential stuffing depends on. This is the single most effective user-side control against the attack.

Answer

Change passwords only when forced by the system administrator.

Answer

Write passwords on a physical sticky note hidden under the keyboard.

Answer

Use the same password for all work-related accounts to ensure memory efficiency.

Question 10

Where can an administrator view a summary of detected security threats, such as blocked malware and intrusion prevention events, in the FortiGate web-based manager?

Accepted Answer

Log & Report > Security Logs. In the FortiGate web-based manager (GUI), security threat summaries—including blocked malware, IPS events, and other UTM logs—are found under Log & Report > Security Logs. This section aggregates logs from all security profiles (antivirus, IPS, web filter, etc.) and provides filtering, drill-down, and visualization of detected threats. It is the central location for reviewing security events in real time or historically.

Answer

System > FortiGuard

Answer

Dashboard > Threat Map

Answer

Policy & Objects > Security Profiles

Question 11

Which dashboard widget displays the current status and capacity of local storage (hard drive or log disk) on the FortiGate?

Accepted Answer

Log Disk. The Log Disk widget on the FortiGate dashboard displays the current status and capacity of local storage used for logs (hard drive or log disk). It shows used versus total space, making it the correct widget for monitoring local storage capacity.

Answer

System Resources

Answer

Storage Manager

Answer

Hardware Status

Question 12

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Accepted Answer

HTTPS. Option D (HTTPS) is correct because it encrypts administrative GUI/API traffic to the FortiGate interface using TLS on port 443, protecting credentials and session data from eavesdropping. Option E (SSH) is correct because it provides an encrypted CLI management channel, typically on TCP port 22, for secure administrative access. The other options do not belong: POP3 (A) is a mail retrieval protocol, not a management protocol; Telnet (B) is a management protocol but sends credentials and data in cleartext, so it is not secure; and HTTP (C) is an unencrypted web protocol, so it also fails the secure-access requirement.

Answer

POP3

Answer

Telnet

Answer

HTTP

Question 13

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

Accepted Answer

To transform employees into an active defense layer capable of recognizing social engineering.. Security awareness training's primary goal is to turn employees into a human sensor layer — teaching them to recognize phishing, pretexting, and other social engineering attacks and to report them. Since attackers frequently target people to bypass technical controls, an aware workforce is a critical defense layer. This is the core purpose of such programs for non-technical staff.

Answer

To ensure all personnel understand how to compile source code securely.

Answer

To replace automated endpoint detection and response software with human monitoring.

Answer

To train every staff member to write advanced firewall configuration scripts.

Question 14

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

Accepted Answer

FortiClient EMS Device Control profile. FortiClient EMS (Enterprise Management Server) delivers endpoint management profiles, including Device Control profiles that define which USB and removable storage classes are allowed, blocked, or read-only on managed endpoints. The profile is pushed to FortiClient agents on corporate laptops, enforcing the policy at the endpoint.

Answer

FortiGate Antivirus profile

Answer

FortiSwitch port security settings

Answer

FortiAnalyzer reporting engine

Question 15

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Accepted Answer

Storing passwords in an encrypted password manager application. Option C is correct because an encrypted password manager securely stores credentials using strong encryption (e.g., AES-256) behind a single master passphrase, enabling users to maintain many distinct, high-entropy passwords without memorizing them or writing them in plaintext. Option E is correct because using a unique, complex password for every account prevents credential-stuffing and lateral movement: if one site is breached, the reused secret cannot unlock other systems, which is a foundational habit for both personal and corporate security. Option A is not recommended because a written notepad, even in a locked drawer, stores passwords in plaintext and is vulnerable to physical access, theft, or insider snooping. Option B is wrong because reusing one master password across banking and work systems creates a single point of failure, so one breach compromises every account. Option D is wrong because arbitrary weekly rotation without evidence of compromise encourages weaker, predictable passwords and is not aligned with modern guidance (e.g., NIST) that favors unique credentials and rotation only on suspected compromise.

Answer

Writing passwords on a physical notepad kept inside a locked desk drawer

Answer

Reusing the same strong master password across all banking and work systems for ease of recall

Answer

Changing passwords every single week regardless of whether a compromise is suspected