FORTINET-NSE123 Practice Test 18 — 15 Questions

Question 1

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

Accepted Answer

The host is infected with malware and participating in a botnet.. The combination of a slow workstation, large volumes of encrypted outbound traffic to an unknown external IP, and no legitimate business justification is a textbook indicator of malware command-and-control (C2) beaconing or botnet participation. Malware commonly encrypts its traffic (TLS/custom crypto) to evade deep packet inspection and blends into normal HTTPS flows. The host is likely part of a botnet performing DDoS, spam relay, or crypto-mining tasks, which explains both the CPU/performance degradation and the sustained encrypted egress.

Answer

The user installed a legitimate browser extension.

Answer

The user's local firewall is performing a full system scan.

Answer

The system is performing a routine background update.

Question 2

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Accepted Answer

Disabling automatic connection to open Wi-Fi networks on your mobile device. Option B is correct because disabling automatic connection to open Wi-Fi networks prevents a mobile device from silently joining rogue or evil-twin hotspots that spoof a legitimate SSID, thereby removing an attacker's opportunity to intercept traffic. Option D is correct because a trusted corporate VPN establishes an encrypted tunnel (e.g., IPsec or TLS-based) that protects all internet traffic from eavesdropping and man-in-the-middle manipulation on an untrusted hotspot. Option E is correct because restricting access to highly sensitive corporate accounts to situations where an encrypted tunnel is active ensures credentials and session data are never exposed over the open, unencrypted wireless medium. Option A is not safe because banking without verifying HTTPS or using a VPN exposes credentials and session cookies to interception. Option C is not safe because accepting unknown certificate warnings enables man-in-the-middle attacks by trusting a fraudulent certificate.

Answer

Conducting personal online banking without checking for HTTPS or using a VPN

Answer

Accepting all unknown certificate warnings when browsing on public hotspots

Question 3

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Accepted Answer

FortiAnalyzer. FortiGate (E) is correct because it is the foundational security appliance of the Fortinet Security Fabric, providing the firewall, IPS, and other security functions that anchor the fabric's core. FortiAnalyzer (C) is correct because it is a native Fortinet component that collects, correlates, and analyzes logs and events from fabric devices, delivering the visibility and reporting layer of the architecture. VMware ESXi (A) is a third-party hypervisor that can host virtual FortiGate instances but is not itself a Security Fabric component. Microsoft Active Directory (B) is an external directory service used for authentication integration, not a core fabric element. Cisco Catalyst Switch (D) is third-party networking hardware that can be integrated via Fabric Connectors but is not part of the Fortinet Security Fabric architecture.

Answer

VMware ESXi hypervisor

Answer

Microsoft Active Directory

Answer

Cisco Catalyst Switch

Question 4

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is Fortinet's centralized log management, analytics, and reporting appliance (physical or VM) that aggregates logs from FortiGate, FortiMail, FortiWeb, and other Fortinet devices. It provides dashboards, compliance reports, and forensic search across the enterprise.

Answer

FortiSandbox

Answer

FortiAuthenticator

Answer

FortiWeb

Question 5

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

Accepted Answer

Inside an IPv4 firewall policy matching the traffic. In FortiOS, security profiles such as antivirus, IPS, web filter, and application control are enforced only when referenced inside a firewall policy that matches the traffic. The policy is the enforcement point where inspection profiles are attached and applied to flows traversing the FortiGate. Applying a profile anywhere else (interface, routing, global settings) does not trigger inspection of matching sessions.

Answer

Directly under the physical interface configuration

Answer

Inside the static routing table configuration

Answer

Under the Global System Settings menu

Question 6

An administrator is configuring a FortiGate firewall and needs to ensure that packets matching an explicit allow policy are also logged. Where should the administrator enable logging for this specific policy?

Accepted Answer

Inside the specific firewall policy rule settings under Log Allowed Traffic. Logging for traffic that matches a firewall policy is enabled per-policy inside the policy's settings, specifically by enabling the 'Log Allowed Traffic' option and choosing whether to log All Sessions or only Security Events. This ensures every packet permitted by that explicit allow rule generates a log entry for auditing and troubleshooting. The setting is scoped to the individual policy, so it does not affect other rules on the FortiGate.

Answer

Inside the static route next-hop configuration

Answer

Within the physical interface administrative access profile

Answer

Under the global system time zone and NTP settings

Question 7

Where can an administrator view real-time bandwidth consumption per interface on the FortiGate dashboard?

Accepted Answer

Network Interfaces widget on the Dashboard. The Network Interfaces widget on the FortiGate dashboard displays real-time bandwidth consumption per interface, showing throughput in and out for each physical or logical interface. This widget is specifically designed to provide a quick view of interface utilization directly on the dashboard. It is the correct location for monitoring per-interface bandwidth in real time.

Answer

FortiView > Interfaces

Answer

System > Network > Performance

Answer

Log & Report > Bandwidth Monitor

Question 8

An administrator is reviewing log storage and management settings on the FortiGate. Which THREE storage options or destinations are supported for logging on a FortiGate? (Choose three)

Accepted Answer

Local disk (internal hard drive or flash storage). Option A (Local disk, internal hard drive or flash storage) is correct because FortiGates with an internal disk or flash can store logs locally, configured under config log disk setting and viewed via Log & Report. Option B (FortiAnalyzer) is correct because FortiAnalyzer is Fortinet's dedicated centralized log collection, analysis, and reporting appliance, configured on the FortiGate under config log fortianalyzer setting. Option E (Syslog server) is correct because the FortiGate supports sending logs to external syslog servers over UDP/TCP port 514 (or 6514 for reliable/TLS), configured under config log syslogd setting. Option C (Bluetooth pairing with a mobile phone) is not a supported log destination; Bluetooth is used only for initial FortiExplorer setup, not log storage. Option D (Local printer connected via USB) is not supported, as FortiGate USB ports are used for modem or storage functions, not direct printer logging.

Answer

Bluetooth pairing with a mobile phone

Answer

Local printer connected via USB

Question 9

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

Accepted Answer

Promptly installing operating system and application security patches.. Option B is correct because promptly installing operating system and application security patches closes known vulnerabilities (e.g., CVEs) that attackers actively exploit, making patch management a core endpoint hygiene practice. Option D is correct because verifying software legitimacy before downloading and installing third-party applications prevents malware, trojans, and supply-chain compromises introduced via untrusted or spoofed sources. Option E is correct because locking the workstation screen whenever stepping away enforces access control, preventing unauthorized physical use of an authenticated session and mitigating insider or walk-by threats. Option A is not acceptable hygiene because storing master credentials in plain text on the desktop exposes them to any local user or malware, violating secure credential handling. Option C is not acceptable because disabling endpoint antivirus agents removes malware detection and response capabilities, trading essential protection for marginal performance gains.

Answer

Storing master credentials in a plain-text document on the desktop for quick reference.

Answer

Disabling endpoint antivirus agents to maximize system performance during video calls.

Question 10

An administrator wants to view top talkers by bandwidth usage over the past hour. Which FortiView view should be accessed?

Accepted Answer

FortiView > Sources. FortiView > Sources is the correct location because FortiView aggregates traffic logs and ranks source IP addresses by bandwidth, sessions, or applications. Selecting the Sources view and setting the time range to the past hour gives exactly the 'top talkers by bandwidth' report the administrator wants. It is a built-in analytics view, not a policy or log-report screen.

Answer

Policy & Objects > Sources

Answer

Monitor > Top Talkers

Answer

Log & Report > Traffic Sources

Question 11

When configuring an IPsec VPN tunnel between two FortiGate units, what is the function of Dead Peer Detection (DPD)?

Accepted Answer

To detect unresponsive VPN peers and tear down dead security associations. Dead Peer Detection (DPD) is a mechanism in IPsec VPN that detects when a peer is no longer responsive. It sends periodic hello messages (R-U-THERE) and if no response is received after a certain number of retries, it tears down the security association (SA) and can trigger a new tunnel negotiation. This ensures that dead tunnels are not left active, which could cause traffic blackholing.

Answer

To authenticate administrators logging into the FortiGate GUI via RADIUS

Answer

To balance outbound traffic across multiple WAN interfaces using SD-WAN

Answer

To encrypt user data payloads using AES-256 algorithms

Question 12

An administrator wants to ensure that administrative access to the FortiGate GUI is restricted to secure HTTPS connections only, while disabling insecure HTTP access. Where is this administrative access protocol configured on the FortiGate?

Accepted Answer

Under the physical or logical interface settings (Administrative Access). Administrative access protocols on a FortiGate are configured under the interface settings, specifically in the 'Administrative Access' section where you can enable or disable protocols like HTTPS, HTTP, SSH, Telnet, etc. This allows granular control per interface. Disabling HTTP and enabling HTTPS there restricts GUI access to secure connections only.

Answer

Inside the firewall policy table rules

Answer

Inside the static routing table configuration

Answer

Within the FortiGuard update subscription settings

Question 13

An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?

Accepted Answer

execute ping . Option D (execute ping ) is correct because it verifies basic IP reachability to the remote syslog server from the FortiGate, confirming that routing and Layer 3 connectivity to the destination exist before investigating higher-layer log delivery issues. Option E (diagnose sniffer packet any 'port 514' 4) is correct because it captures live packets on UDP/TCP port 514 (the standard syslog port) with verbose interface-level detail, allowing the administrator to confirm whether log packets are actually being transmitted to and received from the syslog server. Option A (diagnose debug flow filter) is not correct here because debug flow only sets filters for the flow trace and does not itself display connectivity or log transmission; it must be paired with 'diagnose debug flow trace start' and is aimed at session/forwarding analysis rather than syslog verification. Option B (execute factory-reset) is not correct because it erases the configuration and reboots the device, which is destructive and unrelated to troubleshooting log delivery. Option C (get system arps) is not correct because it only displays the ARP table and cannot verify end-to-end connectivity or syslog packet transmission.

Answer

diagnose debug flow filter

Answer

execute factory-reset

Answer

get system arps

Question 14

An administrator needs to verify the current date and time settings on the FortiGate to ensure log timestamps are accurate. Which menu path in the web-based manager is used to configure system time and NTP settings?

Accepted Answer

System > Settings. In the FortiGate web-based manager (GUI), system time and NTP configuration are located under System > Settings. This page allows the administrator to set the system time manually or configure NTP servers to synchronize the FortiGate's clock. Accurate time is critical for log timestamps, certificate validation, and scheduled tasks.

Answer

System > FortiGuard

Answer

Monitor > System Time

Answer

Log & Report > Log Settings

Question 15

An administrator needs to back up the FortiGate configuration and ensure that sensitive passwords are protected. Which TWO statements regarding FortiGate configuration backups are correct? (Choose two)

Accepted Answer

Backups can be encrypted with a password to protect sensitive information such as VPN pre-shared keys and user passwords.. Option C is correct because FortiGate configuration backups can be password-encrypted, which protects sensitive data such as VPN pre-shared keys, user passwords, and other credentials stored in the configuration. Option D is correct because administrators can export the configuration either through the GUI (System > Configuration > Backup) or via CLI commands such as 'execute backup config', making both methods valid. Option A is incorrect because, while FortiGate configuration files are text-based, they can be encrypted with a password, so the claim that they cannot be encrypted is false. Option B is incorrect because console access is not the only way to perform backups; GUI and CLI over network connections are supported. Option E is incorrect because configuration backups do not automatically include historical log databases by default; logs are backed up separately.

Answer

Configuration files are saved in plain text XML format that cannot be encrypted.

Answer

Configuration backups can only be performed by connecting a console cable.

Answer

Backups automatically include historical log databases by default.