FORTINET-NSE123 Practice Test 16 — 15 Questions

Question 1

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Accepted Answer

Installing a kernel-level rootkit that hooks into core operating system processes.. Option C is correct because a kernel-level rootkit loads at boot, hooks into core OS processes, and hides itself from normal detection, giving the attacker durable privileged access that survives reboots. Option E is correct because modifying startup registry keys (e.g., Run/RunOnce keys) or creating scheduled tasks causes attacker code to execute automatically each time the system starts or a trigger fires, a classic persistence technique. Option A is not persistence: an incognito browser tab is temporary and isolated, and closing the browser or rebooting destroys it. Option B is not persistence: a legitimate manufacturer diagnostic tool is a benign utility, not an attacker mechanism. Option D is not persistence: clearing the browser cache and recycle bin removes data and does not create any recurring execution or access.

Answer

Running a temporary calculation script inside an isolated browser incognito tab.

Answer

Running an optional software update diagnostic tool provided by the hardware manufacturer.

Answer

Clearing the system browser cache and emptying the local operating system recycle bin.

Question 2

Which THREE actions can a FortiGate Web Filtering profile take when a user attempts to access a website belonging to a blocked category? (Choose three.)

Accepted Answer

Block the request and display a customizable replacement message page. Option B is correct because a FortiGate web filtering profile can block the request and return a customizable replacement message page (configured under System > Replacement Messages) to inform the user the site is blocked. Option D is correct because the profile action can be set to 'Monitor' (or 'Allow' with logging), which logs the access event to the traffic/log database without blocking the connection. Option E is correct because the 'Warning' action allows the request but first presents an interstitial warning page the user must acknowledge/click past before proceeding. Option A is not a web filtering profile action; quarantining an endpoint is performed via FortiClient EMS/automation stitches, not the web filter profile itself. Option C is incorrect because web filtering does not encapsulate HTTP packets in an IPsec VPN tunnel; that is a function of VPN/IPsec configuration, not a web filter action.

Answer

Automatically quarantine the user workstation inside FortiClient EMS

Answer

Encapsulate all HTTP packets inside an IPsec VPN tunnel

Question 3

Which TWO logging destinations can receive log data from a FortiGate firewall? (Choose two.)

Accepted Answer

External Syslog server. Option B (External Syslog server) is correct because FortiGate supports configuring remote logging to external syslog servers under Log & Report > Log Settings, sending logs in syslog format over UDP/TCP port 514 (or TLS 6514). Option E (FortiAnalyzer) is correct because FortiAnalyzer is Fortinet's dedicated log collection, analysis, and reporting appliance, and FortiGate natively supports sending logs to it via the FortiAnalyzer/FortiManager log protocol (often over port 514 or 443 with OFTP). Option A is incorrect because FortiAuthenticator is an authentication/token/CA server, not a log destination for FortiGate logs. Option C is incorrect because FortiClient EMS manages endpoints and receives telemetry from FortiClient agents, not FortiGate log data. Option D is incorrect because a Microsoft Active Directory domain controller handles authentication and directory services, not syslog or FortiGate log ingestion.

Answer

FortiAuthenticator token server

Answer

FortiClient EMS endpoint agent

Answer

Microsoft Active Directory domain controller

Question 4

Which TWO threat intelligence services or features are delivered dynamically by the FortiGuard network? (Choose two.)

Accepted Answer

Web Filtering URL categorization database. Option B is correct because the FortiGuard network dynamically delivers the Web Filtering URL categorization database, which FortiGate devices query in real time (or via locally cached ratings) to classify websites and enforce web filter policies. Option D is correct because FortiGuard also dynamically pushes Antivirus and IPS signature update feeds, allowing FortiGate/FortiClient to receive the latest malware and intrusion prevention signatures without manual intervention. Option A is not delivered by FortiGuard; FortiClient EMS installation binaries are obtained from Fortinet support/EMS deployment packages, not as a dynamic FortiGuard threat intelligence service. Option C is unrelated, as VLAN assignment maps are configured locally on switches or via management platforms, not provided by FortiGuard. Option E is also unrelated, since Active Directory group membership is provided by on-premises or cloud AD services, not by the FortiGuard network.

Answer

FortiClient EMS endpoint installation binaries

Answer

Physical switch port VLAN assignment maps

Answer

Microsoft Active Directory user group membership

Question 5

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

Accepted Answer

Interface IP address and subnet mask. Option A is correct because every FortiGate interface that will carry traffic needs an IP address and subnet mask (configured via config system interface, e.g., set ip 192.168.1.99 255.255.255.0) to participate in IP networking at all. Option B is correct because DNS server IPs (config system dns, set primary/secondary) are required for the FortiGate to resolve hostnames for FortiGuard updates, NTP, and other name-based lookups. Option D is correct because a default static route (config router static, destination 0.0.0.0/0 with a gateway) is needed so the FortiGate can forward traffic to destinations outside its directly connected subnets, including the internet. Option C is not required for basic connectivity since BGP is an advanced dynamic routing protocol only needed in specific multi-router topologies. Option E is not a basic network parameter; SSL VPN portal customization is an optional remote-access feature configured later, not part of initial connectivity.

Answer

BGP routing peer AS number

Answer

SSL VPN portal customization

Question 6

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Accepted Answer

Conducting regular security awareness training and simulated phishing tests for all staff.. Option A is correct because regular security awareness training combined with simulated phishing tests conditions staff to recognize pretexting and phishing lures, report suspicious messages, and avoid handing over credentials or sensitive data, directly reducing the human factor these attacks exploit. Option B is correct because MFA adds a second authentication factor beyond the password, so even if a phishing or pretexting attack captures valid credentials, the attacker cannot complete login without the additional factor (e.g., TOTP code, push approval, or FIDO2 key), breaking account takeover. Option C is wrong because unrestricted, unscanned personal USB drives enable malware introduction and data exfiltration, increasing rather than defending against social-engineering-driven compromise. Option D is wrong because blindly complying with urgent executive requests via personal email is exactly the pretexting behavior attackers exploit; such requests must be verified through out-of-band channels. Option E is wrong because disabling spam and email filtering removes a key technical control that blocks phishing messages, making users more exposed to social engineering.

Answer

Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.

Answer

Instructing employees to comply immediately with any urgent executive request received via personal email.

Answer

Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.

Question 7

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

Accepted Answer

Whaling attack. A whaling attack is a highly targeted spear-phishing variant aimed specifically at senior executives ('big fish') such as CEOs, CFOs, or other high-ranking officials. The attacker here bypassed perimeter defenses by sending a weaponized PDF directly to the executive's personal email, which is a hallmark of whaling — personalized targeting of a high-value individual rather than mass distribution. The personal-account vector and executive target confirm this is whaling, not generic phishing or spam.

Answer

Mass spam campaign

Answer

MAC spoofing attack

Answer

Structured query language injection

Question 8

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

Accepted Answer

diagnose sniffer packet. The FortiGate CLI command 'diagnose sniffer packet' captures live packets on a specified interface, allowing administrators to inspect traffic in real time. It supports filters, verbosity levels, and interface selection, making it the correct tool for troubleshooting intermittent latency at the packet level.

Answer

execute ping-packet

Answer

execute trace-route

Answer

get system interface traffic

Question 9

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

Accepted Answer

Grant read-only access to specific tables only for employees whose roles explicitly require that data.. Option B correctly implements the Principle of Least Privilege by granting only the minimum necessary access—read-only permissions to specific tables—and restricting it to employees whose roles explicitly require that data. This ensures users have no more privileges than needed to perform their job functions, reducing the attack surface and potential for data misuse. The granularity (specific tables) and read-only nature further limit exposure, aligning with the principle's core tenet of minimal rights.

Answer

Share a single high-privileged service account credential among the entire team.

Answer

Assign all department members permanent administrative rights to ensure uninterrupted workflow.

Answer

Provide full database access to all employees during onboarding, revoking it after one year.

Question 10

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

Accepted Answer

Utilize a secure VPN tunnel to the corporate network.. A secure VPN tunnel encrypts all traffic between the remote worker and the corporate network, protecting it from interception on an untrusted public Wi-Fi hotspot. This ensures confidentiality and integrity of company data even if the Wi-Fi network is compromised. The other options either do not provide encryption or actively weaken security.

Answer

Enable browser-based spell check.

Answer

Ensure the laptop firewall is turned off to allow easier connectivity.

Answer

Use an unencrypted FTP connection for file transfers.

Question 11

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

Accepted Answer

Man-in-the-Middle attack. A Man-in-the-Middle (MitM) attack occurs when an adversary secretly intercepts and relays communications between two parties who believe they are communicating directly. The attacker can eavesdrop, modify, or inject data while remaining undetected, often by exploiting ARP spoofing, DNS poisoning, or rogue Wi-Fi access points. This matches the scenario of relaying and modifying messages between two hosts.

Answer

MAC flooding attack

Answer

Distributed denial of service

Answer

SQL injection exploit

Question 12

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

Accepted Answer

Flow-based inspection. Flow-based inspection (C) is correct because FortiGate processes traffic using a single-pass, stream-based engine that scans packets as they flow through the firewall, applying UTM profiles with lower latency and higher throughput. Proxy-based inspection (D) is also correct because FortiGate can buffer and fully reassemble traffic at the application layer, allowing deeper content inspection, file scanning, and protocol validation. These two modes are the standard UTM inspection modes configured in FortiOS security profiles and firewall policies. The other options do not belong: NAT routing inspection (A) and static gateway inspection (E) are not FortiGate UTM inspection modes, and transparent bridging inspection (B) describes a deployment/interface mode rather than a UTM processing mode.

Answer

NAT routing inspection

Answer

Transparent bridging inspection

Answer

Static gateway inspection

Question 13

What is the primary function of a FortiGate hardware acceleration processor (FortiASIC)?

Accepted Answer

To offload firewall session processing and cryptographic operations, accelerating performance. FortiASIC is Fortinet's custom silicon designed to offload computationally expensive operations — firewall session lookup, IPsec encryption/decryption, SSL inspection, and pattern matching — from the main CPU. This hardware acceleration dramatically increases throughput and reduces latency, which is why FortiGate appliances with FortiASIC can achieve multi-gigabit firewall and VPN performance.

Answer

To manage user identities and generate FortiToken push notifications

Answer

To provide wireless access point controller management via CAPWAP

Answer

To act as an external database for storing FortiAnalyzer log archives

Question 14

An administrator needs to restrict administrative access to the FortiGate CLI and GUI so that management connections are only accepted from a specific trusted internal management workstation subnet. Where is this source IP restriction configured?

Accepted Answer

On the administrator user account configuration (Trusted Hosts). Administrative source IP restriction is configured on the administrator account itself using the 'Trusted Hosts' field (config system admin, set trusthost1/2/3). This limits which source subnets can authenticate to the FortiGate via HTTPS, SSH, Telnet, or FortiToken-based GUI/CLI access. Only connections originating from the listed trusted hosts are accepted, providing a strong first line of defense against brute-force and unauthorized management access.

Answer

Within the FortiGuard subscription server list

Answer

Inside the DHCP server IP pool range

Answer

Inside the global DNS server settings

Question 15

An administrator suspects that a session is stuck in the FortiGate session table, preventing new connections. Which command allows viewing active sessions matching a specific source IP?

Accepted Answer

diagnose sys session filter src [IP] followed by diagnose sys session list. The correct approach is to apply a session filter with 'diagnose sys session filter src <IP>' and then run 'diagnose sys session list' to display only sessions matching that source. This is the standard FortiOS diagnostic workflow for isolating stuck or problematic sessions without dumping the entire session table. The filter persists until cleared with 'diagnose sys session filter clear' or the session is closed.

Answer

show firewall session [IP]

Answer

execute session clear [IP]

Answer

get system session list