FORTINET-NSE123 Practice Test 13 — 15 Questions

Question 1

Which TWO of the following are considered 'social engineering' techniques?

Accepted Answer

Baiting a victim with a 'free' USB drive that contains malware.. Baiting a victim with a 'free' USB drive containing malware is a classic social engineering technique because it manipulates human curiosity or greed to trick the victim into physically connecting the malicious device, rather than exploiting a technical flaw. Tailgating into a secure office area by following an authorized employee is also social engineering, as it relies on the human tendency to hold doors open or avoid confrontation to bypass physical access controls. In contrast, using a rainbow table to crack hashed passwords is a technical cryptanalytic attack that exploits precomputed hash values, not human behavior. A denial of service attack on a web server is a technical availability attack that floods resources, and using a vulnerability scanner to find open ports is a technical reconnaissance activity; neither depends on deceiving people.

Answer

Using a rainbow table to crack hashed passwords.

Answer

Performing a denial of service attack on a web server.

Answer

Using a vulnerability scanner to find open ports.

Question 2

Which THREE of the following are recognized signs of a potential phishing attempt?

Accepted Answer

The email uses urgent or threatening language to demand immediate action.. Option B is correct because phishing emails frequently employ urgency or threats (e.g., "your account will be closed in 24 hours") to pressure victims into acting before they verify the request. Option C is correct because a mismatch between the sender's domain and the organization they claim to represent (e.g., support@paypa1-secure.com instead of paypal.com) is a classic spoofing indicator, since legitimate organizations send from their own registered domains. Option D is correct because an unexpected attachment from an unknown sender is a common malware delivery vector, often using weaponized files like .exe, .scr, or macro-enabled Office documents. Option A is not a reliable indicator, since attackers routinely schedule phishing campaigns during business hours to blend in with normal traffic. Option E is also not a sign, because attackers often harvest the recipient's correct first name from social media or breached data to make the message appear more legitimate.

Answer

The email is sent during standard business hours.

Answer

The email is addressed to the employee by their correct first name.

Question 3

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Accepted Answer

Notify the internal IT security or incident response team without delay.. Option D is correct because promptly notifying the internal IT security or incident response team ensures trained personnel can begin containment, triage, and forensic investigation, which is a core step of any incident response process. Option E is correct because immediately disconnecting the laptop from both wired (Ethernet) and wireless (Wi-Fi) network connections isolates the potentially infected host, preventing malware from spreading laterally, exfiltrating data, or communicating with command-and-control servers. Option A is not appropriate because forwarding a suspicious file to external clients could propagate malware and breach confidentiality, rather than containing the incident. Option B is wrong because deleting system logs and temporary files destroys forensic evidence needed for investigation and may violate retention policies. Option C is wrong because downloading and executing unverified registry cleaners from pop-up advertisements is a common malware delivery vector and would likely worsen the compromise.

Answer

Forward the suspicious file to all external clients as a warning alert.

Answer

Delete all system logs and temporary files to clear up disk space for the virus scanner.

Answer

Download and execute unverified registry cleaner utilities from pop-up advertisements.

Question 4

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

Accepted Answer

System > Admin Profiles. Administrator access profiles are defined and edited under System > Admin Profiles in the FortiOS GUI (config system accprofile in the CLI). This is where profiles like 'super_admin', 'prof_admin', and custom profiles are created with granular read/write permissions per functional area (firewall, VPN, system, etc.). Assigning a profile to an admin account controls exactly what that admin can view and modify.

Answer

Security Fabric > Profiles

Answer

System > Administrators > Profiles

Answer

Policy & Objects > Admin Profiles

Question 5

An administrator wants to view a chronological log of security threats and blocked virus events in real-time directly on the FortiGate GUI. Which FortiOS feature provides this live graphical and tabular logging interface?

Accepted Answer

FortiView dashboards. FortiView dashboards in FortiOS provide live, graphical and tabular views of traffic, threats, and blocked events — including virus detections — aggregated in real time on the FortiGate GUI. Administrators can drill into sources, destinations, applications, and threat types without leaving the device. This is the feature designed for at-a-glance real-time security monitoring.

Answer

Firmware upgrade wizards

Answer

HA cluster status monitors

Answer

Static routing summary tables

Question 6

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

Accepted Answer

Administrator username. When creating a new local administrator account, the administrator username (Option A) is a required element because it uniquely identifies the account on the device and is used for authentication and audit logging. The administrator access profile (Option C) is also required/configurable because it defines the permissions and privileges assigned to that account, such as read-only, read-write, or super-admin scope, which is exactly what the scenario demands for 'specific operational privileges.' Options B, D, and E are unrelated to local administrator account creation: a firewall policy source IP object (B) is used in security policy rules, a DHCP lease pool range (D) configures dynamic IP address assignment for clients, and an SSL VPN portal bookmark (E) defines web resources presented to remote VPN users, none of which are part of defining a local admin account's identity or privileges.

Answer

Firewall policy source IP object

Answer

DHCP lease pool range

Answer

SSL VPN portal bookmark

Question 7

An administrator needs to set up log forwarding from the FortiGate to a remote Syslog server. Which menu path in the web-based manager is used to configure remote logging?

Accepted Answer

Log & Report > Log Settings. Remote Syslog forwarding on FortiGate is configured under Log & Report > Log Settings, where the administrator enables 'Send logs to Syslog' and specifies the Syslog server IP, port, and facility. This is the standard GUI path for configuring remote logging destinations including Syslog, FortiAnalyzer, and FortiManager.

Answer

System > Syslog Server

Answer

Policy & Objects > Logging

Answer

Security Fabric > Log Forwarding

Question 8

An administrator wants to view active VPN tunnels and connected remote users on the dashboard. Which widget is designed for this purpose?

Accepted Answer

IPsec & SSL VPN widget. The IPsec & SSL VPN widget on the FortiGate dashboard is specifically designed to display active VPN tunnels and connected remote users. It shows both IPsec and SSL VPN connections, including user names, assigned IPs, and tunnel status. This directly matches the administrator's requirement.

Answer

Remote Access Monitor

Answer

User Monitor

Answer

Network Interfaces

Question 9

An administrator wants to secure administrative access to the FortiGate. Which THREE best practices should be implemented?

Accepted Answer

Configure trusted hosts for administrator accounts to limit access to specific IP ranges.. Option C is correct because configuring trusted hosts on administrator accounts restricts login attempts to specified source IP addresses or subnets, blocking brute-force and unauthorized access from untrusted networks. Option D is correct because HTTP transmits credentials and session data in cleartext, so disabling HTTP administrative access and enforcing HTTPS (TLS-encrypted GUI access) protects management traffic from eavesdropping and tampering. Option E is correct because Telnet sends CLI credentials and commands unencrypted, whereas SSH provides an encrypted channel for secure CLI management. Option A is wrong because an unlimited idle timeout leaves authenticated sessions open indefinitely, inviting session hijacking; best practice is a short idle timeout (e.g., 5-15 minutes). Option B is wrong because default admin credentials are publicly known and must be changed immediately, with unique strong passwords per device.

Answer

Set the administrative idle timeout to unlimited for convenience.

Answer

Use default admin credentials across all deployed firewalls.

Question 10

An administrator needs to modify the hostname of the FortiGate via the CLI. Which configuration context and command are used?

Accepted Answer

config system global > set hostname [name] > end. The hostname of a FortiGate is configured under the system global configuration context. The correct sequence is to enter 'config system global', then use 'set hostname [name]', and finally 'end' to apply the change. This is the standard method for setting the device's hostname via the CLI, as documented in Fortinet's administration guide.

Answer

config system settings > set name [name] > end

Answer

set hostname [name]

Answer

execute hostname [name]

Question 11

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

Accepted Answer

To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers. NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams (typically UDP port 4500) so they can pass through NAT devices that would otherwise drop or mangle ESP traffic. This allows IPsec VPN peers behind NAT to establish and maintain tunnels.

Answer

To assign dynamic DHCP addresses to SSL VPN mobile clients

Answer

To translate internal private web server IP addresses to public IPs for inbound users

Answer

To balance VPN traffic across multiple high availability cluster members

Question 12

An administrator is troubleshooting a DHCP server issue on the FortiGate and needs to see active IP address leases assigned by the built-in DHCP server. Which CLI command provides this information?

Accepted Answer

execute dhcp lease-list. The correct command is `execute dhcp lease-list`. This command is part of FortiOS's `execute` command tree, which contains operational commands for viewing dynamic runtime information. It queries the built-in DHCP server's lease database and displays active leases, including IP address, MAC address, hostname, lease expiry, and interface. It is the standard, documented way to verify DHCP assignments on a FortiGate without needing to inspect individual client devices.

Answer

diagnose system dhcp list

Answer

get router info dhcp

Answer

get system dhcp-server lease

Question 13

What is the primary function of a FortiSwitch port configured with FortiLink?

Accepted Answer

To establish a secure management and data connection between a FortiGate and a FortiSwitch. FortiLink is a protocol that enables a FortiGate to manage and control a FortiSwitch, providing a secure management and data connection between the two devices. It allows the FortiGate to push VLAN, policy, and security configurations to the FortiSwitch, effectively making the switch an extension of the FortiGate's security fabric.

Answer

To connect external ISP routers via PPPoE authentication

Answer

To scan emails for spam and phishing attachments

Answer

To tunnel remote worker traffic via IPsec site-to-site protocols

Question 14

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

Accepted Answer

Confidentiality. Encrypting communication protocols like HTTPS and SSH ensures that data in transit is protected from unauthorized eavesdropping. This directly addresses the security principle of confidentiality, which ensures that information is not disclosed to unauthorized individuals. By encrypting traffic, even if an attacker sniffs the shared network segment, they cannot read the contents.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 15

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

Accepted Answer

It ensures that compromised credentials alone are insufficient for an attacker to gain access. Multi-factor authentication (MFA) combines something the user knows (password) with something the user possesses (mobile push token), so a stolen or phished password alone cannot grant access. The push notification acts as a second independent factor that an attacker would also need to compromise, defeating credential-stuffing and password-reuse attacks. This is the core security benefit of the dual-step approach.

Answer

It guarantees complete encryption of all local workstation files

Answer

It prevents all forms of social engineering attacks against remote workers

Answer

It entirely eliminates the need for strong passwords on corporate accounts