FORTINET-NSE123 Practice Test 12 — 15 Questions

Question 1

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide large autonomous systems into smaller logical hierarchical segments to reduce routing table size, limit link-state update propagation, and optimize convergence.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 2

When configuring an IPsec VPN tunnel between two FortiGate units, what is the purpose of establishing a local ID (Peer ID) in Phase 1?

Accepted Answer

To provide a distinct peer identifier during Phase 1 authentication, particularly useful with dynamic IPs. Local ID allows peers to identify themselves during Phase 1 negotiation, which is especially useful when one or both peers use dynamic IP addresses and need a distinct identifier for authentication matching.

Answer

To assign virtual IP addresses to SSL VPN client workstations

Answer

To encrypt user data payloads using AES-GCM encryption

Answer

To define the static routing administrative distance metric for the VPN tunnel

Question 3

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

Accepted Answer

Endpoint compliance and quarantine enforcement. FortiClient EMS provides endpoint telemetry, vulnerability scanning, and automated quarantine/compliance enforcement.

Answer

Centralized FortiGate firewall policy compilation

Answer

Syslog server log aggregation for routers

Question 4

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Accepted Answer

SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss). Fortinet SD-WAN uses performance SLAs to monitor link health and SD-WAN rules to steer traffic dynamically.

Answer

Telnet remote terminal management protocol

Answer

POP3 email retrieval protocol

Answer

SNMP v1 network monitoring traps

Question 5

An administrator wants to check the operational status of FortiGate HA clustering. Which dashboard widget provides an overview of HA member health and role status?

Accepted Answer

High Availability widget. The High Availability widget displays cluster member status, sync state, and master/slave roles.

Answer

Security Fabric Status

Answer

System Topology

Answer

Cluster Monitor

Question 6

An administrator wants to view a chronological log of security threats and blocked virus events in real-time directly on the FortiGate GUI. Which FortiOS feature provides this live graphical and tabular logging interface?

Accepted Answer

FortiView dashboards. FortiView provides real-time and historical dashboards for monitoring sessions, bandwidth, applications, and security threats.

Answer

Firmware upgrade wizards

Answer

HA cluster status monitors

Answer

Static routing summary tables

Question 7

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

Accepted Answer

FortiClient EMS Device Control profile. FortiClient EMS enforces endpoint security policies, including vulnerability scanning, web filtering, and device control (USB blocking).

Answer

FortiGate Antivirus profile

Answer

FortiSwitch port security settings

Answer

FortiAnalyzer reporting engine

Question 8

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Administrators can create firewall address objects/groups and service objects/groups to organize policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group

Question 9

Within the Fortinet Security Fabric architecture, what is the primary role of an upstream FortiGate device acting as the root node compared to downstream internal segmentation firewalls?

Accepted Answer

To coordinate fabric topology, aggregate fabric information, and distribute top-level security configurations.. The root FortiGate in a Security Fabric orchestrates overall fabric topology, aggregates threat intelligence, and synchronizes settings downward to internal segmentation firewalls (ISF).

Answer

To replace the need for FortiClient endpoints by directly installing VPN clients on user laptops.

Answer

To act exclusively as an offline logging collector without participating in traffic forwarding.

Answer

To handle local domain name resolution (DNS) and DHCP services for the entire enterprise network.

Question 10

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

Accepted Answer

FortiView > Applications. FortiView is the primary monitoring and visualization tool on FortiGate for tracking top applications, sources, destinations, and threats.

Answer

Log & Report > Forward Traffic

Answer

Security Fabric > Topology

Answer

System > FortiGuard

Question 11

An administrator needs to configure an idle timeout for administrative web GUI sessions to enhance security. Where is this setting located?

Accepted Answer

System > Settings > Administrator Idle Timeout. Administrator session idle timeout is configured under System > Settings.

Answer

System > Administrators > Timeout

Answer

Policy & Objects > Global Settings

Answer

Log & Report > Admin Settings

Question 12

An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?

Accepted Answer

Dashboard > System Information widget (System Mode field). System mode (NAT or Transparent) is displayed in the System Information dashboard widget.

Answer

System > Feature Visibility > NAT Mode

Answer

Network > Operation Mode

Answer

Policy & Objects > Mode Settings

Question 13

How can an administrator quickly verify whether the FortiGate unit has a valid and active FortiCare support contract from the GUI?

Accepted Answer

System > FortiGuard. License and support contract status can be verified directly from the System > FortiGuard or Dashboard > License Information widget.

Answer

Network > Interfaces

Answer

Policy & Objects > Objects

Answer

Log & Report > Event Log

Question 14

What is the primary function of FortiSandbox in an enterprise security architecture?

Accepted Answer

To analyze unknown files and zero-day malware in an isolated virtual environment. FortiSandbox runs suspicious, unknown files in an isolated virtual environment to observe their behavior and detect zero-day malware.

Answer

To filter web browsing categories and block malicious URLs

Answer

To centralize log storage and generate graphical compliance reports

Answer

To authenticate remote SSL VPN users against Active Directory

Question 15

Which TWO authentication methods or servers can be integrated with a FortiGate for user identity verification? (Choose two.)

Accepted Answer

LDAP / Active Directory server. FortiGate supports integration with external authentication servers such as LDAP/Active Directory and RADIUS.

Answer

Simple Network Management Protocol (SNMP) agent

Answer

Syslog UDP collector

Answer

Network Time Protocol (NTP) server