FORTINET-NSE123 Practice Test 15 — 15 Questions

Question 1

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

Accepted Answer

Immediately notify the internal IT security or helpdesk team. Option A is correct because promptly notifying the internal IT security or helpdesk team allows the organization to initiate incident response, such as revoking active sessions, resetting credentials, and checking for lateral movement or persistence mechanisms. Option D is correct because changing the password immediately from a secure, uncompromised device reduces the window in which an attacker can use the stolen credentials, and using a trusted device prevents malware or keyloggers from capturing the new password. Option B is not appropriate because deleting files destroys forensic evidence and does not remediate the credential compromise. Option C is wrong because public social media disclosure can expose sensitive corporate information and does not follow proper incident reporting channels. Option E is wrong because concealing the incident delays response and increases the potential damage and scope of the compromise.

Answer

Delete all files on the computer to erase evidence of the compromise

Answer

Post about the incident on public social media channels to warn friends

Answer

Keep the incident secret to avoid getting in trouble with management

Question 2

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

Accepted Answer

FortiSandbox integration. FortiSandbox is Fortinet's advanced threat detection appliance that runs suspicious files in a secure virtual environment (sandbox) to observe behavior and detect unknown zero-day malware. Integrating FortiSandbox with FortiGate allows files to be submitted for behavioral analysis before being allowed to endpoints. This is exactly the 'secure virtual environment + behavior analysis' requirement.

Answer

Intrusion Prevention System signature matching

Answer

FortiGuard Antivirus signature lookup

Answer

Web filtering URL categorization

Question 3

What is the primary function of FortiSandbox in an enterprise security architecture?

Accepted Answer

To analyze unknown files and zero-day malware in an isolated virtual environment. FortiSandbox is Fortinet's advanced threat detection platform that runs suspicious or unknown files in an isolated virtual environment (sandbox) to observe behavior and detect zero-day malware that signature-based tools miss. It integrates with FortiGate, FortiMail, and FortiWeb to submit files for dynamic analysis and returns verdicts that feed back into the security fabric. Its core purpose is behavioral analysis of unknown files, not URL filtering, log storage, or user authentication.

Answer

To filter web browsing categories and block malicious URLs

Answer

To centralize log storage and generate graphical compliance reports

Answer

To authenticate remote SSL VPN users against Active Directory

Question 4

What is the primary objective of a 'DDoS' attack?

Accepted Answer

To exhaust system resources and render a service unavailable.. A DDoS (Distributed Denial of Service) attack aims to overwhelm a target's resources — bandwidth, CPU, memory, or connection tables — by flooding it with traffic from many distributed sources, making the service unavailable to legitimate users. The primary goal is disruption, not data theft or persistence.

Answer

To steal intellectual property.

Answer

To modify user permissions on the server.

Answer

To install a hidden backdoor for future access.

Question 5

An enterprise network architect is designing a site-to-site VPN architecture to connect a branch office to headquarters using FortiGate devices. The branch office relies on a dynamic broadband connection with a frequently changing public IP address. Which VPN configuration approach should be implemented?

Accepted Answer

Configure a site-to-site IPsec VPN with the headquarters acting as the dial-up server and the branch acting as the dial-up client.. When the branch has a dynamic public IP, the headquarters FortiGate cannot be configured with a fixed remote gateway, so the standard design is a dial-up IPsec VPN: HQ acts as the dial-up server (with a static IP and a dial-up tunnel accepting dynamic peers), and the branch acts as the dial-up client that initiates the tunnel. This lets the branch's changing IP be learned dynamically via IKE, and the tunnel re-establishes automatically when the ISP reassigns an address.

Answer

Implement Virtual Domain (VDOM) links to bridge the branch office directly to headquarters across Layer 2.

Answer

Configure static IPsec phase 1 parameters specifying the exact public IP address of the branch office on the headquarters FortiGate.

Answer

Configure an SSL VPN web portal on the branch office FortiGate.

Question 6

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

Accepted Answer

The principle of least privilege ensures users and accounts are granted only the minimum access needed. Option B is correct because the principle of least privilege dictates that users, processes, and accounts receive only the minimum permissions necessary to perform their required tasks, which limits the blast radius of compromised credentials or insider misuse. Option C is correct because separation of duties splits critical, high-risk functions across multiple people so that no single individual can complete a sensitive action alone, reducing fraud and error risk. Option E is correct because defense in depth layers multiple overlapping controls (for example, firewalls, IDS/IPS, endpoint protection, MFA, and encryption) so that failure of one control does not expose the whole environment. Option A is wrong because sharing a single root password destroys accountability and non-repudiation; each administrator needs a unique, auditable account with sudo or equivalent privilege escalation. Option D is wrong because security through obscurity is a weak supplementary measure, not a primary defense; databases must be protected by strong authentication, encryption, patching, and access controls rather than hidden names or ports.

Answer

System administrators should always share a single root account password to ensure accountability

Answer

Security through obscurity should be used as the primary defense mechanism for databases

Question 7

Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)

Accepted Answer

Generic greetings like 'Dear Customer' instead of the recipient's actual name. Option A is correct because phishing messages frequently use impersonal, generic salutations such as 'Dear Customer' or 'Dear User' since attackers mass-mail victims without knowing their real names, which is a classic social-engineering red flag. Option C is correct because typosquatting or look-alike sender domains (e.g., 'micros0ft.com' or 'paypa1.com') are a hallmark of phishing, used to impersonate a trusted organization while evading simple domain blocklists. Option B is not an indicator of phishing because a legitimate newsletter from an approved corporate marketing platform with functioning unsubscribe links reflects proper bulk-email practices. Option D is not an indicator because perfect grammar, consistent formatting, and absence of urgency describe well-crafted legitimate mail, not the errors and pressure tactics typical of phishing. Option E is not an indicator because a valid digital signature from an internal PKI certificate actually verifies sender authenticity and integrity, which is the opposite of a phishing trait.

Answer

A standard newsletter sent via an officially approved corporate marketing platform with working unsubscribe links

Answer

Content written with perfect grammar, standard company formatting, and no sense of urgency

Answer

An email digitally signed with a valid corporate PKI certificate issued by the internal IT department

Question 8

Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)

Accepted Answer

Exercising caution when clicking links or downloading files from untrusted sources. Option A is correct because user caution against clicking links or downloading files from untrusted sources directly reduces the most common initial infection vectors, such as phishing emails, malicious attachments, and drive-by downloads. Option B is correct because reputable, centralized endpoint security software (antivirus/EDR) detects, blocks, and remediates malware, and central management ensures consistent policy enforcement and timely signature/behavioral updates across all endpoints. Option E is correct because keeping operating systems and applications patched and up to date closes known vulnerabilities that malware and attackers actively exploit, including remote code execution and privilege escalation flaws. Option C is not correct because cracked software and keygens from peer-to-peer networks are a well-known malware delivery method and directly increase compromise risk. Option D is not correct because disabling firewall rules and network logging removes preventive and detective controls, weakening endpoint protection and hindering incident response.

Answer

Downloading cracked software and keygens from peer-to-peer file-sharing networks

Answer

Disabling all firewall rules and network logging to maximize system performance

Question 9

Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)

Accepted Answer

Service objects (ports and protocols like HTTP or SSH). Option A is correct because FortiGate firewall policies match traffic using service objects, which define the destination port and protocol (for example TCP/80 for HTTP or TCP/22 for SSH), allowing the policy to control traffic by application service. Option C is correct because firewall policies match on source and destination IP addresses, typically referenced through address objects (host, subnet, or range), which is a fundamental match criterion for permitting or denying traffic between networks. Option B is incorrect because the FortiGuard signature version number identifies the installed IPS/AV database revision, not a per-policy traffic match field. Option D is incorrect because FortiASIC CPU utilization is a hardware performance metric, not a policy matching criterion. Option E is incorrect because the administrator GUI idle timeout is an administrative session setting, not a firewall policy match condition.

Answer

FortiGuard signature version number

Answer

CPU utilization percentage of FortiASIC chips

Answer

Administrator GUI idle timeout threshold

Question 10

Which TWO authentication methods or servers can be integrated with a FortiGate for user identity verification? (Choose two.)

Accepted Answer

LDAP / Active Directory server. Option B (LDAP / Active Directory server) is correct because FortiGate natively supports LDAP as a remote authentication method, allowing it to query an LDAP directory such as Microsoft Active Directory to verify user credentials and retrieve group membership for identity-based policies. Option C (RADIUS authentication server) is correct because FortiGate can be configured as a RADIUS client that forwards user authentication requests to an external RADIUS server, commonly used for two-factor authentication and centralized user verification. Option A (SNMP agent) is incorrect because SNMP is used for monitoring and management of network devices, not for authenticating user identities. Option D (Syslog UDP collector) is incorrect because syslog is a logging and event-forwarding protocol, not an authentication mechanism. Option E (NTP server) is incorrect because NTP only synchronizes system time across devices and plays no role in verifying user identity.

Answer

Simple Network Management Protocol (SNMP) agent

Answer

Syslog UDP collector

Answer

Network Time Protocol (NTP) server

Question 11

Which TWO actions should an end-user take to protect their physical workstation security?

Accepted Answer

Store sensitive documents in a locked drawer when not in use.. Option B is correct because physically securing sensitive documents in a locked drawer when they are not in use prevents unauthorized individuals from reading, photographing, or removing confidential information, which is a core element of physical workstation security. Option E is correct because locking the computer screen before walking away (e.g., via Windows+L or Ctrl+Alt+L on Linux) enforces access control at the session level, ensuring that an unattended workstation cannot be used by someone passing by. The unmarked options do not belong: disabling the screensaver (A) leaves the display exposed and removes a basic lock trigger, leaving the workstation unlocked during lunch (C) invites unauthorized access, and writing the BIOS password on a post-it note on the monitor (D) directly defeats the purpose of that password by exposing it to anyone nearby.

Answer

Disable the screensaver to ensure the system is always visible.

Answer

Leave the workstation unlocked during lunch breaks to save time.

Answer

Write the BIOS password on a post-it note attached to the monitor.

Question 12

Which TWO dashboard widgets are commonly used to monitor system performance and health on a FortiGate?

Accepted Answer

System Information. The System Information widget is correct because it displays core health data such as CPU usage, memory usage, uptime, and session count on the FortiGate dashboard. The System Resources widget is also correct because it provides real-time graphs of CPU, memory, and session usage, which are key indicators of system performance and health. FortiView Source IPv4 is not correct because it is a traffic-analysis view showing top source IPs, not a system health monitor. IPsec Monitor is not correct because it tracks VPN tunnel status rather than overall system performance. DHCP Leases is not correct because it lists assigned DHCP addresses, which is a service detail, not a performance/health metric.

Answer

FortiView Source IPv4

Answer

IPsec Monitor

Answer

DHCP Leases

Question 13

An administrator wants to verify high availability (HA) cluster status and member synchronization. Which TWO commands or dashboard widgets provide this HA status? (Choose two)

Accepted Answer

get system ha status. Option A, 'get system ha status', is correct because this FortiGate CLI command directly reports HA cluster health, including the HA mode, the primary/standby role of each member, and the synchronization (sync) status between cluster units. Option D, the 'High Availability dashboard widget', is correct because it is the GUI equivalent that displays HA cluster status, member roles, and configuration synchronization state at a glance. Option B, 'get system interface physical', only shows physical interface link and speed information and does not report HA membership or sync state. Option C, 'FortiView > HA Traffic', is not a valid HA status widget and does not verify cluster synchronization. Option E, 'Policy & Objects > HA Rules', is not a real FortiGate HA status location; HA-related settings live under System > HA, not Policy & Objects.

Answer

get system interface physical

Answer

FortiView > HA Traffic

Answer

Policy & Objects > HA Rules

Question 14

An administrator needs to perform a firmware upgrade on a standalone FortiGate. Which TWO best practices should be followed before initiating the upgrade? (Choose two)

Accepted Answer

Back up the current FortiGate configuration file.. Option A is correct because backing up the current FortiGate configuration file before a firmware upgrade preserves all settings and allows restoration if the upgrade fails or introduces issues. Option C is correct because reviewing the official FortiOS release notes and verified upgrade paths ensures compatibility, identifies known issues, and confirms the proper sequence for moving between firmware versions. Option B is incorrect because a factory reset immediately after upgrading without saving configurations would erase the existing configuration and is not a recommended pre-upgrade best practice. Option D is incorrect because unplugging all physical network interfaces is unnecessary and could disrupt management access needed to perform and verify the upgrade. Option E is incorrect because downgrading the FortiGuard license contract is unrelated to preparing for a firmware upgrade and would not support the process.

Answer

Perform a factory reset immediately after upgrading without saving configurations.

Answer

Unplug all physical network interfaces during the upgrade.

Answer

Downgrade the FortiGuard license contract.

Question 15

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

Accepted Answer

Endpoint compliance and quarantine enforcement. Option A is correct because FortiClient EMS acts as the endpoint management server that evaluates endpoints against compliance profiles (for example, antivirus, patch, and OS requirements) and can trigger quarantine actions—such as dynamic address group assignment or restricted access—when an endpoint fails compliance. Option D is correct because FortiClient EMS provides endpoint vulnerability scanning, using FortiClient's vulnerability scan engine to detect missing patches and vulnerable software on managed endpoints and report those findings to the EMS console. Option E is correct because, when integrated into the Fortinet Security Fabric, FortiClient EMS shares endpoint telemetry (identity, compliance status, and threat information) with FortiGate and other Fabric devices via the Fabric connector, enabling coordinated enforcement and visibility. Option B is not correct because firewall policy compilation is performed locally by FortiGate (or centrally via FortiManager), not by FortiClient EMS. Option C is not correct because syslog aggregation for routers is a logging function typically handled by FortiAnalyzer or a dedicated syslog server, not by FortiClient EMS.

Answer

Centralized FortiGate firewall policy compilation

Answer

Syslog server log aggregation for routers