FORTINET-NSE123 Practice Test 12 — 15 Questions

Question 1

An administrator wants to ensure that all configuration changes made on a FortiGate are tracked with specific user accountability and revision history. Which Fortinet management tool provides centralized configuration revision control and rollback capabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiManager. FortiManager is Fortinet's centralized management platform that maintains a revision history of all configuration changes pushed to managed FortiGates. It logs each change with the administrator's username, timestamp, and a diff of the modified objects, enabling granular rollback to any previous revision. This directly satisfies the requirement for user accountability and revision control.

Answer

FortiAnalyzer

Answer

FortiClient EMS

Answer

FortiAuthenticator

Question 2

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Accepted Answer

The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.. Option A is correct because social-engineering phishing relies on urgency and threats (e.g., account suspension, legal action, or loss of access) to pressure the recipient into acting before verifying the request. Option C is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are classic spoofing indicators used to impersonate a trusted sender. Options B, D, and E are not indicators: an internal intranet link on the corporate DNS domain, accurate addressing to your real title and department, and legitimate newsletters from an official mailing platform are all consistent with normal, benign email.

Answer

The message includes a link to the corporate intranet home page via the internal DNS domain.

Answer

The email is addressed specifically to your correct full corporate title and department.

Answer

The email contains standard company newsletter updates sent through an official mailing platform.

Question 3

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Accepted Answer

Integrity. Option D (Integrity) is correct because the CIA triad's I stands for Integrity, meaning data must remain accurate, complete, and unaltered by unauthorized parties, whether in storage or in transit. Option E (Confidentiality) is correct because the C in the CIA triad stands for Confidentiality, ensuring information is disclosed only to authorized subjects through mechanisms such as encryption, access controls, and authentication. Together with Availability, these two principles form the three core security objectives of the CIA triad. The unmarked options do not belong: Complexity (A) is a system design characteristic, not a security tenet; Compliance (B) is a regulatory or governance obligation that may support security but is not part of the triad; and Concurrency (C) is a computing property concerning simultaneous operations, unrelated to the CIA triad.

Answer

Complexity

Answer

Compliance

Answer

Concurrency

Question 4

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Accepted Answer

They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes. Option B is correct because social engineering attacks commonly fabricate urgency or panic (e.g., a fake account-lockout or invoice-due warning) to short-circuit a victim's normal verification and critical-thinking process. Option D is correct because attackers routinely spoof authority figures, IT support staff, or well-known brands through phishing emails, vishing calls, or pretexting to make their requests appear legitimate and trusted. Option E is correct because social engineering fundamentally targets human psychology and trust rather than exploiting memory-corruption or code-level flaws, which is why it bypasses many technical controls. Option A is incorrect because kernel-level debugging tools are used for low-level software analysis, not for manipulating people, and social engineering requires no such tooling. Option C is incorrect because a graphics card driver update addresses only a specific hardware/software component and cannot prevent deception-based attacks that operate entirely through human interaction.

Answer

They always require advanced kernel-level debugging tools to execute

Answer

They are entirely preventable by installing a standard graphics card driver update

Question 5

What is the primary purpose of FortiToken in a Fortinet security solution?

Accepted Answer

To provide two-factor authentication (2FA) for secure user logins. FortiToken is Fortinet's hardware or software one-time password (OTP) token that generates time-based codes for two-factor authentication. It integrates with FortiGate and FortiAuthenticator to add a second factor beyond username/password, securing VPN, SSL-VPN, and administrative logins. The token uses TOTP (RFC 6238) or HOTP (RFC 4226) to produce codes that are validated against the FortiGate's token seed, ensuring only the legitimate token holder can authenticate.

Answer

To accelerate encryption performance for IPsec VPN tunnels

Answer

To cache web filtering categories locally on the firewall

Answer

To quarantine infected endpoints automatically

Question 6

An administrator needs to check the status of FortiCare registration and feature licenses. Where in the web-based manager is this license summary displayed?

Accepted Answer

System > FortiGuard. The System > FortiGuard page in the FortiGate web-based manager displays the FortiCare registration status along with the status and expiry of feature licenses such as FortiGuard security services (AV, IPS, Web Filtering, etc.). This is where administrators confirm that support and subscription entitlements are active.

Answer

Policy & Objects > Licenses

Answer

Security Fabric > Registration

Answer

Log & Report > License Audit

Question 7

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

Accepted Answer

Principle of least privilege. The Principle of Least Privilege requires that accounts be granted only the minimum permissions necessary to perform their function. A service account with full administrative rights across multiple disparate systems clearly exceeds its required scope, so least privilege was violated. This over-provisioning is exactly what enabled the attacker to pivot broadly after compromising the account.

Answer

Separation of duties

Answer

Defense in depth

Answer

Security through obscurity

Question 8

An administrator needs to verify the status of certificate inspection and CA certificates installed on the FortiGate. Where are SSL/SSH inspection profiles and local certificates managed in the web-based manager?

Accepted Answer

Policy & Objects > SSL/SSH Inspection and System > Certificates. SSL/SSH inspection profiles are configured under Policy & Objects > SSL/SSH Inspection, where you define which traffic is deep-inspected, which categories are exempt, and which CA certificate is used for re-signing. Local CA and server certificates, along with their private keys, are managed under System > Certificates. Together these two locations cover the full certificate inspection workflow on a FortiGate.

Answer

Log & Report > Certificate Logs

Answer

VPN > Certificate Manager

Answer

Security Fabric > Inspection Settings

Question 9

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

Accepted Answer

An attacker calls the helpdesk posing as a new executive claiming to have lost their password, requesting a reset.. Pretexting is a social engineering technique where the attacker invents a believable scenario (the pretext) to manipulate a victim into divulging information or performing an action. The helpdesk call impersonating a new executive who lost their password is a classic pretext — the attacker leverages authority and urgency to obtain a password reset. This relies on human trust and process gaps rather than technical exploits.

Answer

An attacker installs a keylogger on an unattended physical workstation in an office.

Answer

An attacker floods a web server with synthetic traffic to crash the service.

Answer

An attacker sends mass emails containing a malicious macro-enabled attachment.

Question 10

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

Accepted Answer

Confidentiality across all states of data (transit and rest). Encrypting data in transit (e.g., TLS during upload) and at rest (e.g., AES-256 on storage) directly satisfies the Confidentiality pillar of the CIA triad by ensuring unauthorized parties cannot read the data in either state. The measure does not address Integrity (tamper detection), Availability (uptime/access), or Non-repudiation (proof of origin), so Confidentiality is the primary pillar satisfied.

Answer

Availability and Non-repudiation

Answer

Authenticity and Authorization

Answer

Confidentiality and Integrity

Question 11

What is the primary function of a FortiSwitch unit when integrated into the Fortinet Security Fabric?

Accepted Answer

To provide secure Layer 2 network access managed directly from the FortiGate. When a FortiSwitch is integrated into the Fortinet Security Fabric, it is managed directly by the FortiGate, which acts as the Fabric's central controller. The FortiSwitch provides secure Layer 2 network access for wired clients, with the FortiGate pushing VLAN, port, and security policies down to the switch. This tight integration allows the FortiGate to enforce unified security and network policies across both wired and wireless edges, eliminating the need for separate switch management.

Answer

To act as an external DNS and DHCP server for client workstations

Answer

To scan inbound email attachments for spam and phishing attacks

Answer

To provide SSL VPN portal access for remote mobile workers

Question 12

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

Accepted Answer

A man-in-the-middle attack intercepting and modifying transit data.. A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, intercepting and potentially altering traffic while each side believes they are talking directly to the other. The scenario describes exactly this: interception plus modification plus mutual impersonation. This is the defining triad of MITM — confidentiality and integrity of the session are both compromised.

Answer

A distributed denial-of-service attack flooding servers.

Answer

A zero-day exploit leveraging unpatched software code.

Answer

A brute-force attack guessing login credentials.

Question 13

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the governance control that splits a high-risk process across multiple roles so no single administrator can both author and approve/deploy a change. By requiring a different person to approve firewall rule changes than the one who drafts them, the organization prevents unilateral, unchecked authority. This is a foundational ITIL/COBIT and ISO 27001 control for change management.

Answer

Mandatory access control labeling

Answer

Single sign-on federation

Answer

Role-based access auditing

Question 14

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

Accepted Answer

To negotiate the security parameters and encryption algorithms used to protect user data packets (IPsec SAs). IPsec Phase 2 negotiation establishes the IPsec Security Associations (SAs) that define how user data packets are encrypted and authenticated. It negotiates parameters like encryption algorithms (AES, 3DES), integrity algorithms (SHA-256), and Perfect Forward Secrecy (PFS) settings, creating the actual tunnel used for data transport.

Answer

To assign dynamic IP addresses to remote dial-up users via DHCP relay

Answer

To verify the administrator credentials attempting to log into the FortiGate GUI

Answer

To establish the initial IKE handshake and peer authentication identity

Question 15

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

Accepted Answer

It adds a layer of defense even if the primary password is stolen.. MFA requires a second factor beyond the password, so even if an attacker steals or guesses the password through phishing, credential stuffing, or a breach, they still cannot authenticate without the additional factor. This directly mitigates the impact of password compromise, which is the most common initial access vector.

Answer

It prevents all forms of social engineering.

Answer

It eliminates the need for strong password policies.

Answer

It automatically encrypts all outgoing email traffic.