FORTINET-NSE123 Practice Test 14 — 15 Questions

Question 1

An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web Filtering profile. A Web Filtering profile on the FortiGate allows administrators to block or allow access to specific website categories, such as social media, based on FortiGuard categories or custom URL lists. It is the correct feature to enforce acceptable use policies and restrict unauthorized browsing.

Answer

DNS Filter profile

Answer

IPS sensor

Answer

Antivirus profile

Question 2

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

Accepted Answer

Lock the workstation screen. Locking the workstation screen (e.g., via Windows+L or Ctrl+Alt+Del) immediately prevents unauthorized physical access to the session while the user is away. It is the fastest, most critical action to protect sensitive data and maintain accountability, and it does not disrupt ongoing work or network connectivity.

Answer

Unplug the Ethernet network cable

Answer

Power down the computer completely

Answer

Minimize all open web browser windows

Question 3

An administrator is setting up a new FortiGate firewall and needs to configure basic access control between the internal corporate network and the external public network. Which object type should the administrator create first to group internal IP addresses for policy creation?

Accepted Answer

Firewall Address object. Firewall Address objects are the fundamental building blocks used to define IP addresses, subnets, or ranges (such as the internal corporate network) that are then referenced in firewall policies. Grouping internal IPs into an address object (or address group) allows the administrator to reference that object as the source in a policy, which is the standard first step before creating access control rules. Application Control signatures, Virtual IPs, and Traffic Shapers serve entirely different purposes and cannot group internal subnets for policy matching.

Answer

Application Control signature

Answer

Virtual IP object

Answer

Traffic Shaper object

Question 4

When configuring an IPsec VPN tunnel between two FortiGate units using pre-shared keys (PSK), what is required for successful Phase 1 authentication?

Accepted Answer

Both peers must match on Phase 1 encryption, hash algorithms, DH group, and identical pre-shared keys. IPsec Phase 1 (IKE SA) negotiation requires both peers to agree on matching parameters: encryption algorithm, hash/integrity algorithm, Diffie-Hellman group, authentication method, and the pre-shared key value. If any of these differ, the IKE SA cannot be established and Phase 2 never begins. Identical PSKs on both peers are mandatory for PSK-based authentication.

Answer

The pre-shared key must be configured in Phase 2 rather than Phase 1

Answer

Both peers must use dynamic IP addresses assigned by DHCP

Answer

Both peers must run different firmware versions to ensure cryptographic compatibility

Question 5

An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?

Accepted Answer

Click the administrator profile name at the top right of the GUI > Configuration > Backup. In the FortiGate web-based manager, the configuration backup option is accessed by clicking the administrator profile name at the top-right of the GUI and then selecting Configuration > Backup. This opens the backup page where the administrator can choose to encrypt the file with a password and download it locally. The other menu paths do not contain the configuration backup function.

Answer

System > Settings > Maintenance

Answer

Security Fabric > Settings > Export

Answer

Log & Report > Backup Settings

Question 6

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

Accepted Answer

Conducting regular simulated phishing tests with immediate feedback. Regular simulated phishing tests with immediate feedback build practical resilience by exposing employees to realistic lures and teaching them in the moment how to recognize and report them. This active, repetitive training reinforces behavior better than passive reading. Spear-phishing uses personalized details, so hands-on practice with similar scenarios is the most effective way to develop skepticism and verification habits.

Answer

Blocking all external incoming emails entirely

Answer

Restricting employees from having LinkedIn or social media accounts

Answer

Requiring employees to read a 100-page security policy manual annually

Question 7

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

Accepted Answer

FortiManager. FortiManager is Fortinet's centralized management platform that provides a single pane of glass for provisioning, configuring, updating, and monitoring multiple FortiGate devices and their policies. It supports ADOMs to segment management domains and pushes policy packages to managed devices. This matches the described requirement exactly.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiSandbox

Question 8

When configuring an IPsec VPN tunnel between two FortiGate devices, what is the specific role of Phase 1 negotiation?

Accepted Answer

To authenticate the two VPN peers and establish a secure management channel (ISAKMP SA). IPsec Phase 1 (IKE Phase 1) negotiates and authenticates the two VPN peers, establishing the ISAKMP Security Association (SA) that protects subsequent Phase 2 negotiations. It uses main mode or aggressive mode to agree on encryption/hashing algorithms, perform authentication (pre-shared key or certificates), and derive keys for the management tunnel. Only after Phase 1 succeeds can Phase 2 build the actual IPsec SAs for data.

Answer

To assign dynamic virtual IP addresses to remote SSL VPN client workstations

Answer

To encrypt actual user data packets traversing the VPN using IPsec ESP protocols

Answer

To perform DNS name resolution for remote peer public IP addresses

Question 9

An administrator needs to test whether a specific TCP port is open on a remote server directly from the FortiGate CLI. Which command can be used to test TCP connectivity?

Accepted Answer

execute telnet [server-IP] [port]. The FortiGate CLI command 'execute telnet [server-IP] [port]' initiates a TCP connection to the specified IP and port, allowing the administrator to test whether that TCP port is reachable and open. If the connection succeeds, the port is open; if it fails or times out, the port is blocked or the service is down. This is the standard CLI method for TCP port testing on FortiGate.

Answer

diagnose tcp-test [server-IP] [port]

Answer

ping -p [port] [server-IP]

Answer

traceroute -port [port] [server-IP]

Question 10

When configuring a FortiGate interface to connect to an external ISP network that utilizes dynamic IP assignment via DHCP, which setting must be enabled on the interface parameters?

Accepted Answer

Set Addressing Mode to DHCP. When a FortiGate interface connects to an ISP that assigns IP addresses dynamically via DHCP, the interface's Addressing Mode must be set to DHCP. This enables the FortiGate to act as a DHCP client, automatically obtaining an IP address, subnet mask, default gateway, and DNS servers from the ISP's DHCP server. Without this setting, the interface would use a static IP and fail to obtain the dynamic address.

Answer

Enable Secondary IP addressing

Answer

Configure a Static Virtual IP (VIP) mapping

Answer

Enable PPPoE client emulation mode

Question 11

An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?

Accepted Answer

FortiGate Clustering Protocol (FGCP) Active-Passive mode. FortiGate Clustering Protocol (FGCP) in Active-Passive mode is the native Fortinet HA mechanism that synchronizes sessions, configuration, and routing state between cluster members. The primary unit handles all traffic while the secondary remains in standby, ready to take over seamlessly upon failure. FGCP uses heartbeat interfaces and hello packets to detect failures and trigger failover within seconds, preserving established sessions.

Answer

Dynamic Multicast Routing Protocol (PIM-SM)

Answer

Virtual Router Redundancy Protocol (VRRP) active-active balancing

Answer

Border Gateway Protocol (BGP) Multipath clustering

Question 12

An administrator needs to change the management IP address of the internal interface (e.g., port1) via the CLI. Which sequence of configuration commands is correct?

Accepted Answer

config system interface > edit port1 > set ip [IP] [netmask] > end. The correct sequence is 'config system interface > edit port1 > set ip [IP] [netmask] > end'. This enters the system interface configuration context, selects the port1 interface, sets the IP address and netmask, and saves the configuration. This is the standard FortiOS CLI syntax for changing an interface IP.

Answer

config router interface > edit port1 > set address [IP] > end

Answer

set interface port1 ip [IP] > save

Answer

execute set ip port1 [IP]

Question 13

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?

Accepted Answer

Risk mitigation, deploying technical controls to lower the probability and impact of threats.. The organization is implementing technical controls—firewall rules, IPS, and encryption—specifically to reduce the likelihood (via prevention) and impact (via protection) of a cyber attack. This is the definition of risk mitigation, which focuses on lowering risk to an acceptable level rather than eliminating it entirely or shifting it to another party. Risk mitigation is the most common strategy in cybersecurity because it balances security with business needs.

Answer

Risk transfer, purchasing cyber insurance to shift financial liability to a third party.

Answer

Risk acceptance, choosing to absorb the financial impact if an incident occurs.

Answer

Risk avoidance, eliminating the business activity entirely to prevent exposure.

Question 14

An administrator wants to check the status of HA (High Availability) synchronization between primary and secondary FortiGate units. Which CLI command should be used?

Accepted Answer

get system ha status. The correct CLI command to check HA synchronization status between primary and secondary FortiGate units is 'get system ha status'. This command displays the HA cluster status, including the primary unit, synchronization state, and member information.

Answer

diagnose ha group list

Answer

show HA cluster

Answer

get system status HA

Question 15

An administrator wants to verify the operational status and packet error rates of a specific physical interface (e.g., port2) via CLI. Which command should be used?

Accepted Answer

get system interface physical [interface-name] or diagnostics hardware deviceinfo nic [interface-name]. The correct command to verify operational status and packet error rates of a physical interface in FortiOS is 'get system interface physical [interface-name]' or 'diagnostics hardware deviceinfo nic [interface-name]'. The first command provides a summary of physical interface status, including link state, speed, duplex, and error counters. The second command gives detailed NIC-level statistics, including packet errors, drops, and other hardware-level counters. These are the standard FortiGate CLI commands for physical interface diagnostics.

Answer

show interface port2 stats

Answer

get system interface port2

Answer

execute interface check port2