FORTINET-NSE123 Practice Test 19 — 15 Questions

Question 1

An organization is deploying FortiClient Endpoint Management Server (EMS) alongside FortiGate to enforce Zero Trust Network Access (ZTNA). A remote user's laptop connects to an unsecured public Wi-Fi hotspot. How does the Fortinet ZTNA solution ensure secure application access for this user without establishing a traditional full-tunnel VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

By dynamically checking endpoint posture tags supplied by FortiClient EMS and applying proxy-based access control per application.. Fortinet ZTNA uses FortiClient EMS to continuously assess endpoint posture (e.g., OS patch level, AV status, domain membership) and publish posture tags to FortiGate. FortiGate then enforces per-application access via proxy-based policies that check those tags, so a remote user on an untrusted Wi-Fi hotspot gets granular, identity- and posture-aware access to specific applications without a full-tunnel VPN.

Answer

By forcing all local Wi-Fi traffic through a hardware-based Layer 2 bridge established via FortiExtender.

Answer

By translating all internal server IP addresses into public routable IPs via Static NAT on the endpoint.

Answer

By establishing a permanent IPsec tunnel that encapsulates all endpoint traffic regardless of destination.

Question 2

Within the Fortinet Security Fabric architecture, what is the primary role of an upstream FortiGate device acting as the root node compared to downstream internal segmentation firewalls?

Accepted Answer

To coordinate fabric topology, aggregate fabric information, and distribute top-level security configurations.. The upstream FortiGate acting as the Security Fabric root node is responsible for coordinating fabric topology, aggregating telemetry from downstream devices, and pushing top-level security configurations (such as fabric-wide policies and profiles) to the fabric. Downstream internal segmentation firewalls enforce local policy but report up to the root.

Answer

To replace the need for FortiClient endpoints by directly installing VPN clients on user laptops.

Answer

To act exclusively as an offline logging collector without participating in traffic forwarding.

Answer

To handle local domain name resolution (DNS) and DHCP services for the entire enterprise network.

Question 3

An administrator is hardening endpoint security using FortiClient and FortiGate integration. Which THREE core security functions can be enforced through this endpoint-to-firewall integration? (Choose three.)

Accepted Answer

Enforcement of compliance posture tags for Zero Trust Network Access (ZTNA).. Option B is correct because FortiClient shares endpoint compliance posture (such as AV, patch, and firewall status) with FortiGate via the Security Fabric, and FortiGate can use those posture tags to permit or deny ZTNA access based on device trust. Option C is correct because FortiClient's Vulnerability Scan feature detects missing OS patches and vulnerable software and reports those findings to FortiGate/FortiManager for compliance enforcement and remediation visibility. Option E is correct because FortiGate can automatically quarantine an endpoint through the Security Fabric when FortiClient or FortiSandbox/FortiGate detects an infection, isolating the device at the network level until it is cleaned. Option A is incorrect because FortiClient/FortiGate integration does not replace carrier-grade routing protocols like BGP or OSPF on upstream routers. Option D is incorrect because FortiClient cannot rewrite physical switch port VLAN assignments from the endpoint GUI; VLAN changes are made on the switch or via FortiSwitch management, not by endpoint integration.

Answer

Direct replacement of core routing protocols such as BGP and OSPF on upstream carrier routers.

Answer

Hardware-level replacement of physical switch port VLAN configurations from the endpoint GUI.

Question 4

Which TWO characteristics describe effective password management principles? (Choose two.)

Accepted Answer

Using a password manager to generate and store complex, unique passwords securely.. Option C is correct because a password manager generates high-entropy, unique credentials for every account and stores them in an encrypted vault, eliminating password reuse and reducing the burden of memorization. Option E is correct because long passphrases built from multiple random words provide high entropy (each additional word multiplies the search space) while remaining memorable, making them resistant to brute-force and dictionary attacks. Option A is wrong because forced weekly rotation without evidence of compromise leads to weaker, predictable passwords and is no longer recommended by standards such as NIST SP 800-63B. Option B is wrong because writing administrator passwords on sticky notes exposes credentials to anyone with physical or visual access, defeating confidentiality. Option D is wrong because reusing one password across accounts enables credential-stuffing attacks, where a single breach compromises every account sharing that password.

Answer

Changing passwords every single week regardless of whether any compromise indicators exist.

Answer

Writing down primary administrator passwords on sticky notes attached to computer monitors.

Answer

Reusing the same strong password across all personal and professional accounts for convenience.

Question 5

An administrator needs to reboot the FortiGate device remotely during a maintenance window without causing data corruption. Which CLI command should be executed?

Accepted Answer

execute reboot. 'execute reboot' is the correct FortiGate CLI command to perform a clean, graceful reboot that flushes buffers and stops services properly, avoiding filesystem or configuration corruption. It is the standard maintenance command used during scheduled windows and prompts for confirmation before restarting.

Answer

execute factory-reset

Answer

system restart

Answer

config system global set reboot

Question 6

When configuring an SSL VPN tunnel mode connection for mobile workers, what does the FortiGate assign to the client machine to enable communication with internal subnets?

Accepted Answer

A virtual IP address from a configured SSL VPN IP pool. In FortiGate SSL VPN tunnel mode, the FortiGate acts as a VPN gateway and assigns the remote client a virtual IP address from a pre-configured SSL VPN IP pool (also called an IP range). This virtual IP is used as the client's source address for traffic destined to internal subnets, allowing the FortiGate to route and apply firewall policies to that traffic. The pool must be defined under VPN > SSL-VPN Settings, and it is typically a private subnet distinct from the internal LAN. Without this virtual IP, the client cannot communicate with internal resources because it has no routable address within the VPN topology.

Answer

A static public IP address belonging to the ISP WAN interface

Answer

A physical MAC address mapped to the switch port

Answer

A dynamic DNS hostname managed by FortiGuard

Question 7

Which THREE methods can be used to back up or restore a FortiGate configuration? (Choose three.)

Accepted Answer

FortiManager centralized configuration management and revision templates. Option A is correct because FortiManager provides centralized configuration management, allowing administrators to back up FortiGate configurations as revision history and restore them via policy packages or revision templates. Option B is correct because the FortiGate CLI supports configuration backup and restore through commands such as 'execute backup config' and 'execute restore config', which save or load the full configuration file. Option C is correct because the FortiGate GUI (Web-based Manager) includes a System > Configuration > Backup/Restore utility that lets administrators download or upload a configuration file. Option D is not correct because FortiAnalyzer is a logging and reporting appliance; its archive/export utilities handle log data, not FortiGate configuration backup or restore. Option E is not correct because FortiClient EMS manages endpoint profiles and synchronization, not FortiGate device configuration backup or restore.

Answer

FortiAnalyzer log archive export utilities

Answer

FortiClient EMS endpoint profile synchronization

Question 8

What is the primary function of FortiMail in an enterprise security architecture?

Accepted Answer

To protect the organization against email-borne threats such as spam, malware, and phishing. FortiMail is Fortinet's dedicated Secure Email Gateway (SEG), purpose-built to inspect SMTP, IMAP, and POP3 traffic and block email-borne threats before they reach user mailboxes. It combines antispam, antivirus, anti-phishing, sandboxing, and DLP engines with policy-based routing of inbound, outbound, and internal mail. Its core identity in the Fortinet Security Fabric is email security — not logging, wireless, or remote access.

Answer

To act as a centralized log analysis and reporting appliance

Answer

To manage wireless access points and guest Wi-Fi authentication portals

Answer

To provide SSL VPN client tunnels for remote workers

Question 9

A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?

Accepted Answer

Application Control profile. An Application Control profile is the correct feature because it identifies applications based on their behavioral signatures and protocol characteristics, not just port numbers. This allows FortiGate to detect and block P2P applications even when they use non-standard ports or port hopping. Adding the Application Control profile to the firewall policy enforces the block.

Answer

Static port-blocking firewall rules

Answer

SSL certificate inspection profile

Answer

Antivirus signature database

Question 10

What is the primary function of a firewall policy ID on a FortiGate?

Accepted Answer

To uniquely identify and reference the firewall policy rule. The [CORRECT] answer is B because a firewall policy ID on a FortiGate is a unique numeric identifier automatically assigned to each policy rule. It is used internally by the FortiGate to reference, order, and manage policies, and administrators use it in CLI commands, logs, and troubleshooting to pinpoint specific rules.

Answer

To assign an IP address to the DHCP client

Answer

To determine the cryptographic key used for IPsec VPN encryption

Answer

To define the physical switch port VLAN assignment

Question 11

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

Accepted Answer

Drive-by download. A drive-by download is a silent, automatic download of malicious code (often an executable) that occurs when a user merely visits a compromised or malicious website, without any explicit user action like clicking a download link. The browser blocking the automatic executable download is a classic defense against this threat. This matches the scenario exactly: no user interaction, automatic download attempt, browser-level block.

Answer

Physical shoulder surfing

Answer

Social engineering phone call

Answer

Email phishing scam

Question 12

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

Accepted Answer

Locking the workstation screen whenever walking away from the desk.. Option D is correct because locking the workstation screen whenever leaving the desk prevents unauthorized physical access and session hijacking, a core endpoint hygiene practice (e.g., Windows+L or Ctrl+Alt+Del lock). Option E is correct because using complex, unique passwords for every separate work account limits credential-reuse attacks such as credential stuffing and pass-the-hash lateral movement, and supports per-account breach containment. The unmarked options are unsafe: A invites phishing/malware execution by opening unexpected attachments, B violates least privilege and non-repudiation by sharing credentials, and C removes a key detective/preventive control (antivirus/EDR) and increases malware risk.

Answer

Clicking on unexpected email attachments immediately to verify their safety.

Answer

Sharing corporate passwords with trusted team members to ensure project continuity.

Answer

Disabling all endpoint antivirus software to speed up system performance.

Question 13

A network administrator notices that a web filtering profile configured on a FortiGate is blocking a specific educational video streaming category, but the exception list needs to allow a single permitted URL within that category. Where in FortiOS should the administrator add this specific URL override?

Accepted Answer

Inside the Web Filter Security Profile under URL Filter table overrides.. The Web Filter Security Profile in FortiOS contains a URL Filter table where administrators can define granular allow/block actions for specific URLs or patterns. To override a category block for a single URL, the administrator adds an entry in this table with the action set to 'Allow' or 'Exempt'. This entry takes precedence over the category-based block, enabling the permitted URL while keeping the rest of the category blocked. This is the standard method for URL-level exceptions in FortiGate web filtering.

Answer

Inside the Application Control sensor blacklist configuration.

Answer

Under Firewall Policy Destination Addresses.

Answer

Within the Intrusion Prevention System (IPS) sensor signature exception list.

Question 14

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

Accepted Answer

Store them in an encrypted password manager or secure offline location. Recovery codes are a critical fallback for MFA when the primary authenticator device is lost, stolen, or reset. Storing them in an encrypted password manager or a physically secure offline location (e.g., a safe) ensures they remain confidential and available only to the legitimate user. This aligns with the principle of least privilege and defense in depth, preventing unauthorized access while preserving account recoverability.

Answer

Write them on a sticky note attached to the computer monitor for convenience

Answer

Discard them immediately as they are unnecessary if an app is installed

Answer

Share them in a public corporate chat channel so teammates can assist if needed

Question 15

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

Accepted Answer

Maintaining secure, immutable, and offline backups of critical data.. Immutable, offline backups ensure that even if ransomware encrypts production databases and attempts to encrypt or delete backup copies, a clean recovery point remains available. Because the backups are offline and immutable (write-once), ransomware cannot reach or modify them, enabling full restoration without paying a ransom. This directly mitigates the impact of a catastrophic infection on critical data.

Answer

Deploying standard HTTP web proxies without inspection.

Answer

Increasing the corporate internet bandwidth capacity.

Answer

Enabling automatic operating system wallpaper updates.