FORTINET-NSE123 Practice Test 17 — 15 Questions

Question 1

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Firewall Schedule object. A Firewall Schedule object is used in a firewall policy to define specific time periods during which the policy is active. By adding a schedule to the policy, the administrator can enforce that internal users can only access the internet during non-work hours. The schedule can be one-time or recurring, and it directly controls when the policy matches traffic.

Answer

Virtual IP (VIP) object

Answer

Application Control signature

Answer

Traffic Shaper object

Question 2

An administrator needs to ensure that administrative sessions to the FortiGate GUI automatically terminate after 15 minutes of inactivity. Where is this idle timeout setting configured?

Accepted Answer

Under System Global settings (Administrator Idle Timeout). The administrator idle timeout is a global system setting configured under System > Settings (System Global) in the FortiGate GUI, or via the CLI with 'config system global' then 'set admintimeout <minutes>'. It applies to all administrative sessions (GUI, SSH, Telnet, console) and defaults to 5 minutes on most FortiOS versions.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the DHCP server IP lease settings

Answer

Within the static routing table configuration

Question 3

An administrator wants to verify the amount of free space available on the system log disk. Which dashboard widget displays this metric?

Accepted Answer

Log Disk widget. The Log Disk widget on the FortiGate dashboard displays the current usage and free space of the log disk (local storage used for logs). It shows a graphical representation of disk consumption, making it the correct widget for verifying free space on the system log disk.

Answer

Storage Usage widget

Answer

System Resources

Answer

Hard Drive Status

Question 4

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

Accepted Answer

The FortiGate CA certificate has not been installed in the trusted root certificate store of the client endpoints.. When FortiGate performs deep inspection of HTTPS traffic, it acts as a man-in-the-middle and re-signs the server's certificate with its own FortiGate CA certificate. For browsers to trust this re-signed certificate without warnings, the FortiGate CA certificate must be installed in the trusted root certificate store of each client endpoint. Without it, browsers flag the certificate as untrusted, producing security warnings.

Answer

The Web Filtering license on the FortiGate has expired, causing HTTPS inspection to fail open.

Answer

The firewall policy is configured with proxy-based inspection instead of flow-based inspection.

Answer

The Antivirus database update failed, preventing the FortiGate from decrypting TLS 1.3 handshakes.

Question 5

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

Accepted Answer

Confidentiality is violated; remediation involves migrating to encrypted management protocols like SSH and HTTPS.. Telnet and HTTP transmit data — including credentials and management commands — in clear text, meaning anyone with network visibility (packet capture, span port, MITM) can read them. This directly violates confidentiality, the security principle ensuring data is only accessible to authorized parties. The correct remediation is migrating to encrypted equivalents: SSH replaces Telnet, and HTTPS (TLS) replaces HTTP.

Answer

Integrity is violated; remediation involves enabling packet checksum validation on all switches.

Answer

Non-repudiation is violated; remediation involves implementing digital signatures on email traffic.

Answer

Availability is violated; remediation involves upgrading uplink port speeds to 10Gbps.

Question 6

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

Accepted Answer

Dynamic URL filtering with reputation-based feeds.. Dynamic URL filtering with reputation-based feeds queries real-time threat intelligence databases (such as FortiGuard web filter rating service) to classify URLs and block malicious sites as they are identified. This provides up-to-date protection against newly discovered malicious domains, unlike static lists. Local static IP filtering and MAC filtering cannot keep pace with rapidly changing malicious URLs.

Answer

MAC address filtering on the local switch.

Answer

Local static IP filtering.

Answer

Disabling cookies in the browser.

Question 7

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

Accepted Answer

It sends a real-time rating query to the FortiGuard servers to classify the URL. When a FortiGate encounters a URL whose category is unknown, it sends a real-time rating query to FortiGuard servers to obtain the category. This is part of the FortiGuard Web Filtering service, which maintains a vast database of URLs and their categories. The FortiGate then applies the appropriate action based on the web filter profile.

Answer

It forwards the page to FortiSandbox for zero-day file execution

Answer

It automatically blocks the website as a high-risk security threat

Answer

It quarantines the user's workstation inside FortiClient EMS

Question 8

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

Accepted Answer

Vishing (Voice Phishing). Vishing (voice phishing) is the correct answer because the attack is delivered over a phone call, where the attacker impersonates IT staff and uses urgency to extract credentials. This is a social-engineering technique that exploits human trust rather than a technical vulnerability. The phone channel is the defining characteristic that separates vishing from email-based phishing.

Answer

Drive-by download

Answer

Denial of service

Answer

Phishing via email

Question 9

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Accepted Answer

Implementing account lockout policies after a threshold of failed login attempts.. Option C is correct because an account lockout policy that triggers after a defined threshold of failed login attempts (e.g., 5 attempts) blocks automated brute-force and credential-stuffing tools from making unlimited password guesses, throttling the attack and protecting the account. Option D is correct because enforcing Multi-Factor Authentication (MFA) across all authentication portals adds a second verification factor beyond the password, so even valid credentials obtained from credential stuffing or brute-forcing cannot alone grant access. Option A is wrong because permitting HTTP plaintext transmission exposes credentials to interception and does not defend against credential-based attacks. Option B is wrong because allowing identical shared passwords increases the blast radius of credential stuffing and worsens password fatigue risks. Option E is wrong because disabling logging removes the audit trail needed to detect and respond to brute-force or credential-stuffing attempts.

Answer

Permitting HTTP plaintext transmission for login forms to speed up authentication.

Answer

Allowing users to share identical passwords to reduce password fatigue.

Answer

Disabling logging mechanisms to prevent server storage bloat.

Question 10

An administrator needs to ensure that internal network users cannot bypass corporate security policies by using unauthorized peer-to-peer file sharing or gaming applications. Which FortiGate security feature is specifically designed to identify and take action against these types of network protocols?

Accepted Answer

Application Control. FortiGate's Application Control feature is specifically designed to identify and control applications and protocols, including peer-to-peer file sharing, gaming, and other non-business traffic. It uses deep packet inspection and application signatures to detect applications regardless of port or encryption, and can then allow, block, or shape that traffic. This directly addresses the requirement to prevent users from bypassing security policies via unauthorized applications.

Answer

Antivirus Profile

Answer

NAT IP Pool

Answer

Static Route Table

Question 11

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

Accepted Answer

Session synchronization and session pickup settings. Option A is correct because FGCP HA relies on session synchronization and session pickup to replicate firewall and NAT session state between cluster members, so that a failover preserves existing connections. Option D is correct because FGCP uses heartbeat keepalive packets and hello messages over the HA link to detect member liveness and negotiate cluster state. Option E is correct because FortiGate HA clusters use dedicated HA heartbeat interfaces (physical or VLAN) to carry FGCP heartbeats and synchronization traffic, isolating it from production data. Option B is not required, since BGP is an exterior routing protocol and FGCP HA does not depend on BGP peer autonomous systems. Option C is not required, since RADIUS authentication token polling is unrelated to FGCP cluster formation or maintenance.

Answer

BGP exterior routing protocol peer autonomous systems

Answer

RADIUS authentication server token polling

Question 12

An administrator wants to view historical web filtering and traffic logs on the FortiGate. Which TWO methods can be used to search and analyze stored logs? (Choose two)

Accepted Answer

Log & Report menu in the web-based manager with filter and search options. Option A is correct because the FortiGate GUI's Log & Report menu provides built-in filter and search controls that let an administrator query historical web filtering and traffic logs stored locally or on a disk. Option D is correct because FortiAnalyzer integration centralizes and indexes logs for advanced search and analysis, while the local log viewer filters also allow searching stored logs directly on the FortiGate. Option B is incorrect because restarting the routing daemon (gated) affects routing processes and does not provide any log search or analysis capability. Option C is incorrect because editing FortiOS kernel source code is neither supported nor related to viewing historical logs. Option E is incorrect because 'execute factory-reset' erases the configuration and does not help search or analyze stored logs.

Answer

Restarting the routing daemon (gated)

Answer

Editing the FortiOS kernel source code directly

Answer

Running execute factory-reset

Question 13

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

Accepted Answer

Active-active distributes session processing across multiple cluster units, whereas active-passive processes all traffic on a single primary unit. In FortiGate FGCP active-active HA, all cluster members actively process traffic, and sessions are distributed across units using load-balancing algorithms (such as source-destination IP hashing or weighted distribution). Session synchronization ensures that session state is shared between members so that any unit can handle the traffic if another fails. Active-passive, by contrast, has only the primary unit processing all traffic while the subordinate(s) remain on standby, ready to take over on failover.

Answer

Active-active requires manual administrator failover, while active-passive is fully automated

Answer

Active-active disables all firewall security profiles to maximize raw throughput

Answer

Active-active eliminates the need for heartbeat cables between cluster units

Question 14

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Accepted Answer

Implicit Deny. FortiGate firewall policies have an implicit deny at the end of the policy list. If traffic does not match any configured policy, it is dropped by default. This is a fundamental security principle and cannot be overridden unless you explicitly create a permit-all policy.

Answer

Drop and send ICMP destination unreachable

Answer

Redirect to Captive Portal

Answer

Implicit Accept

Question 15

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

Accepted Answer

Refrain from opening files with double extensions like .pdf.exe or unexpected script formats. Option C is correct because files with double extensions such as .pdf.exe or unexpected script formats (.js, .vbs, .ps1) are classic malware-delivery tricks that exploit Windows' hiding of known file extensions, so refraining from opening them prevents execution of a disguised payload. Option D is correct because verifying the attachment's legitimacy via an independent, trusted channel (e.g., a phone call or a separate known email address) confirms the sender actually intended to send the file and defeats spoofed or compromised-account attacks. Option A is wrong because forwarding suspicious attachments to coworkers propagates potential malware and phishing to others instead of reporting it to IT/security. Option B is wrong because opening .exe attachments directly executes untrusted code, which is exactly how ransomware and trojans are installed. Option E is wrong because disabling antivirus removes a key detection layer and increases the risk that the malicious file is downloaded and run.

Answer

Forward suspicious attachments to all coworkers to see if anyone recognizes them

Answer

Immediately open executable attachments (.exe) to check what program they run

Answer

Disable your antivirus software temporarily so it does not block the file download