FORTINET-NSE123 Practice Test 14 — 15 Questions

Question 1

An administrator needs to verify the hardware sensor status (fans, power supplies, temperatures) of a high-end FortiGate unit. Which command provides this hardware health status?

Accepted Answer

get system hardware status. The get system hardware status command displays sensor readings such as fan speed and temperature.

Answer

execute hardware-test

Answer

diagnose hardware device info

Answer

show system sensor

Question 2

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Accepted Answer

HTTPS. HTTPS and SSH are secure protocols used for web-based GUI and command-line administrative access.

Answer

POP3

Answer

Telnet

Answer

HTTP

Question 3

An administrator wants to flush all current entries from the FortiGate session table to resolve a stubborn state synchronization issue. Which CLI command achieves this?

Accepted Answer

execute clear system session. The execute clear system session command flushes active sessions from the session table.

Answer

flush session table

Answer

diagnose sys session clear

Answer

config system session flush

Question 4

An administrator is troubleshooting a routing and connectivity issue on the FortiGate. Which THREE CLI commands can be used to test network reachability and path characteristics? (Choose three)

Accepted Answer

execute dns-lookup [hostname]. Network connectivity can be tested using execute ping, execute traceroute, and execute dns-lookup.

Answer

show router routing-table

Answer

get system performance status

Question 5

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

Accepted Answer

Administrator username. Creating a local admin account requires specifying an account name, an authentication type (password or certificate), and assigning an administrator access profile.

Answer

Firewall policy source IP object

Answer

DHCP lease pool range

Answer

SSL VPN portal bookmark

Question 6

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

Accepted Answer

Security Profile. Security profiles (grouped under Security Profiles in FortiOS) are attached to firewall policies to apply UTM inspections like Antivirus, Web Filtering, and IPS. Interface addresses, zones, and schedules control routing and timing, not threat inspection.

Answer

Virtual Domain (VDOM)

Answer

Interface Zone

Answer

Firewall Schedule

Question 7

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Accepted Answer

SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.. SSL VPN can operate in web mode (browser-based) or tunnel mode, whereas IPsec VPN requires dedicated client software or OS-level configurations. SSL VPN typically uses standard ports like TCP 443, whereas IPsec VPN uses UDP 500/4500.

Answer

IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.

Answer

SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.

Answer

IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.

Question 8

An enterprise network architect is designing a site-to-site VPN architecture to connect a branch office to headquarters using FortiGate devices. The branch office relies on a dynamic broadband connection with a frequently changing public IP address. Which VPN configuration approach should be implemented?

Accepted Answer

Configure a site-to-site IPsec VPN with the headquarters acting as the dial-up server and the branch acting as the dial-up client.. When one peer has a dynamic IP address, Main Mode IPsec VPNs with dynamic dial-up user settings or Aggressive Mode with dynamic ID peer IDs are typically used. In modern FortiOS, dial-up IPsec VPN configurations allow the dynamically addressed branch to initiate the tunnel to the static headquarters.

Answer

Implement Virtual Domain (VDOM) links to bridge the branch office directly to headquarters across Layer 2.

Answer

Configure static IPsec phase 1 parameters specifying the exact public IP address of the branch office on the headquarters FortiGate.

Answer

Configure an SSL VPN web portal on the branch office FortiGate.

Question 9

An administrator needs to verify whether the FortiGate unit can successfully communicate with the FortiGuard distribution servers for license and signature updates. Which command should be run in the CLI to test this specific connectivity?

Accepted Answer

execute update-now. The update status and connectivity to FortiGuard can be tested using the execute update-now or diagnostic commands for FortiGuard override/servers.

Answer

diagnose sys top

Answer

ping 8.8.8.8

Answer

execute FortiGuard-test

Question 10

Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?

Accepted Answer

FortiView > Destinations. FortiView Destinations provides real-time visibility into top destination IP addresses and domains.

Answer

Log & Report > Destination Summary

Answer

Policy & Objects > Destinations

Answer

Monitor > Routing Table

Question 11

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

Accepted Answer

Bandwidth widget. The Bandwidth widget or Network Interfaces historical graph displays traffic trends over time.

Answer

FortiView Summary

Answer

System > Performance Graphs

Answer

Log & Report > Traffic Graph

Question 12

An administrator notices that configuration changes made via the CLI are not persisting after a device reboot. What is the most likely reason for this behavior?

Accepted Answer

The administrator exited the configuration block using 'abort' instead of 'end'.. FortiGate saves configuration changes to running memory immediately, but they are only written to permanent flash storage when the command completes successfully. If an invalid command or virtual domain (VDOM) context was left incomplete, or if the write failed, changes may be lost. However, standard config changes auto-save. If flash is full or in read-only mode, it fails. Alternatively, failing to enter 'end' properly or making changes in a temporary session can cause loss. Let's look at options regarding manual commit vs auto-save. FortiGate auto-saves upon 'end'.

Answer

The administrator forgot to issue the 'write memory' command.

Answer

The administrator did not issue a 'execute factory-reset' to commit.

Answer

The administrator failed to enable manual commit mode in system settings.

Question 13

When configuring firewall policies on a FortiGate device, an administrator must define matching criteria and actions. Which THREE elements are mandatory components of a standard IPv4 firewall policy in FortiOS? (Choose three.)

Accepted Answer

Source Interface and Destination Interface. An IPv4 firewall policy in FortiOS requires incoming (Source Interface) and outgoing (Destination Interface) interfaces, source and destination address objects, service objects (ports/protocols), and an action (Accept/Deny).

Answer

An active FortiSandbox cloud subscription registration key.

Answer

A mandatory Web Filtering security profile attached directly to the policy.

Question 14

An administrator wants to verify the operational status and packet error rates of a specific physical interface (e.g., port2) via CLI. Which command should be used?

Accepted Answer

get system interface physical [interface-name] or diagnostics hardware deviceinfo nic [interface-name]. The get system interface physical or get system interface transceiver commands display detailed interface statistics and error counters.

Answer

show interface port2 stats

Answer

get system interface port2

Answer

execute interface check port2

Question 15

An administrator is hardening endpoint security using FortiClient and FortiGate integration. Which THREE core security functions can be enforced through this endpoint-to-firewall integration? (Choose three.)

Accepted Answer

Enforcement of compliance posture tags for Zero Trust Network Access (ZTNA).. FortiClient and FortiGate integration supports vulnerability scanning, compliance/posture checks via EMS tags, dynamic ZTNA access control, and automated quarantine of compromised endpoints.

Answer

Direct replacement of core routing protocols such as BGP and OSPF on upstream carrier routers.

Answer

Hardware-level replacement of physical switch port VLAN configurations from the endpoint GUI.