FORTINET-NSE123 Practice Test 19 — 15 Questions

Question 1

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

Accepted Answer

Maintaining secure, immutable, and offline backups of critical data.. Maintaining regular, immutable backups stored offline or in a segmented cloud repository ensures data can be restored without paying a ransom.

Answer

Deploying standard HTTP web proxies without inspection.

Answer

Increasing the corporate internet bandwidth capacity.

Answer

Enabling automatic operating system wallpaper updates.

Question 2

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

Accepted Answer

System Resources. The System Resources widget displays real-time CPU and memory usage, allowing administrators to monitor resource consumption.

Answer

FortiView Sessions

Answer

License Information

Answer

Network Interfaces

Question 3

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

Accepted Answer

Event logs (System Event logs). Event logs contain system-level events, including HA cluster state transitions, configuration changes, and administrator logins.

Answer

Antivirus quarantine logs

Answer

Web filtering browsing logs

Answer

DHCP lease assignment logs

Question 4

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

Accepted Answer

Establish an authorized corporate VPN connection before accessing internal systems.. A Virtual Private Network (VPN) encrypts traffic between the endpoint and the corporate network, protecting data-in-transit from public Wi-Fi sniffing.

Answer

Enable local file sharing to speed up document syncing over public connections.

Answer

Disable the operating system firewall to allow seamless packet routing through the hotspot.

Answer

Configure the web browser to accept all SSL certificates to bypass public portal warnings.

Question 5

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

Accepted Answer

An attacker calls the helpdesk posing as a new executive claiming to have lost their password, requesting a reset.. Pretexting involves an attacker fabricating a scenario or identity to trick a victim into releasing information.

Answer

An attacker installs a keylogger on an unattended physical workstation in an office.

Answer

An attacker floods a web server with synthetic traffic to crash the service.

Answer

An attacker sends mass emails containing a malicious macro-enabled attachment.

Question 6

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

Accepted Answer

By adding the AD user group to the source field of the firewall policy. Firewall policies can include user or user group authentication requirements, allowing the FortiGate to enforce policy rules based on AD credentials.

Answer

By modifying the physical interface speed settings

Answer

By editing the static routing table metrics

Answer

By applying an Antivirus security profile to the interface

Question 7

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

Accepted Answer

Baiting. Baiting involves leaving physical media in places where targets are likely to find them, playing on curiosity or greed.

Answer

Watering hole attack

Answer

Tailgating

Answer

Phishing

Question 8

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

Accepted Answer

Physical security. Physical security controls protect the physical plant, equipment, and media from unauthorized access, theft, or tampering.

Answer

Endpoint compliance

Answer

Network layer security

Answer

Application layer security

Question 9

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

Accepted Answer

Maintaining immutable, offline data backups. Regularly tested backups provide an authoritative recovery copy of data, rendering ransomware extortion ineffective.

Answer

Enforcing mandatory password complexity rules

Answer

Implementing strict egress firewall filtering

Answer

Deploying host-based intrusion detection systems

Question 10

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

Accepted Answer

Conducting regular simulated phishing tests with immediate feedback. Simulated phishing campaigns combined with immediate, contextual training help users recognize real-world tactics safely.

Answer

Blocking all external incoming emails entirely

Answer

Restricting employees from having LinkedIn or social media accounts

Answer

Requiring employees to read a 100-page security policy manual annually

Question 11

Which THREE of the following actions are examples of good physical security practices in an office environment? (Choose three)

Accepted Answer

Locking your workstation screen every time you step away from your desk. Locking unattended screens, wearing ID badges, and challenging unescorted visitors are all fundamental physical security controls.

Answer

Leaving visitor logs and visitor badges unattended on the front reception desk for anyone to take

Answer

Propping open secure exterior fire doors to let fresh air into the building

Question 12

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Accepted Answer

Leave macros disabled unless the source is fully verified and trusted. Users should never enable macros in unsolicited or external documents unless the source is verified and business necessity is confirmed, as macros are a common vector for malware delivery.

Answer

Forward the spreadsheet to all company contacts for collaborative viewing

Answer

Print the spreadsheet immediately to a physical printer

Answer

Enable macros immediately so the file displays properly

Question 13

An administrator suspects that a session is stuck in the FortiGate session table, preventing new connections. Which command allows viewing active sessions matching a specific source IP?

Accepted Answer

diagnose sys session filter src [IP] followed by diagnose sys session list. The diagnose sys session filter command combined with list allows filtering and viewing active sessions.

Answer

show firewall session [IP]

Answer

execute session clear [IP]

Answer

get system session list

Question 14

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

Accepted Answer

Confidentiality across all states of data (transit and rest). Encryption protects data confidentiality during transit and at rest, ensuring unauthorized parties cannot read it.

Answer

Availability and Non-repudiation

Answer

Authenticity and Authorization

Answer

Confidentiality and Integrity

Question 15

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

Accepted Answer

Log & Report > System Events (Admin Login and CLI Command Logs). Event logs record administrative CLI command execution when command auditing is enabled.

Answer

Security Fabric > Audit Logs

Answer

FortiView > Command History

Answer

Log & Report > CLI History