FORTINET-NSE123 Practice Test 2 — 10 Questions

Question 1

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

Accepted Answer

Bandwidth widget. The Bandwidth widget on the FortiGate dashboard is specifically designed to display a historical graph of bandwidth usage (ingress and egress) over selectable time ranges including the last 24 hours. It samples interface throughput counters and renders them as a time-series chart, making it the correct answer for viewing historical traffic trends. This widget is available on the default dashboard and can be customized per admin.

Answer

FortiView Summary

Answer

System > Performance Graphs

Answer

Log & Report > Traffic Graph

Question 2

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Accepted Answer

Leave macros disabled unless the source is fully verified and trusted. The correct action is to leave macros disabled unless the source is fully verified and trusted. Macro-enabled documents are a common attack vector for malware delivery, as macros can execute arbitrary code when enabled. Since the email came from an external partner and the user cannot be certain of its legitimacy, the safest practice is to keep macros disabled and verify the sender through a separate channel before taking any further action.

Answer

Forward the spreadsheet to all company contacts for collaborative viewing

Answer

Print the spreadsheet immediately to a physical printer

Answer

Enable macros immediately so the file displays properly

Question 3

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access. Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 4

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

Accepted Answer

They are stored exclusively on the remote FortiAnalyzer and not on the local FortiGate storage.. When a FortiGate is configured to send logs to FortiAnalyzer and local disk logging is not enabled, the traffic logs are transmitted to the remote FortiAnalyzer and are not retained on the FortiGate's local storage. That is why the administrator sees nothing under Log & Report > Forward Traffic on the FortiGate itself — the logs exist, but on FortiAnalyzer. The correct answer reflects that remote logging destinations receive the logs exclusively when local storage is not configured.

Answer

They are stored in the FortiGate system memory ring buffer.

Answer

They are buffered in RAM and will only flush when the FortiGate reboots.

Answer

They are discarded because local logging is automatically disabled when remote logging is active.

Question 5

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

Accepted Answer

System Resources. The System Resources widget on the FortiGate dashboard is specifically designed to display real-time CPU and memory usage, along with other system-level metrics such as session count and log rate. Adding this widget provides administrators with an at-a-glance view of resource utilization directly on the dashboard. It is the correct choice for monitoring CPU and memory in real time.

Answer

FortiView Sessions

Answer

Log Rate

Answer

License Information

Question 6

An administrator wants to view real-time CPU utilization per system process. Which dashboard widget or view helps identify which process is consuming CPU resources?

Accepted Answer

System Resources widget (Process list). The System Resources widget includes a process list that shows real-time CPU and memory consumption per process on the FortiGate. This is the correct place to identify which daemon (e.g., ipsengine, wad, miglogd) is consuming CPU. It updates live and can be sorted by CPU usage.

Answer

Monitor > Performance Log

Answer

FortiView > Processes

Answer

Log & Report > CPU Logs

Question 7

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

Accepted Answer

Configure Trusted Hosts on the administrator account to restrict management login to specific IP addresses.. Option B is correct because configuring Trusted Hosts on an administrator account restricts management logins to specific, pre-approved source IP addresses, which prevents unauthorized hosts from even attempting to authenticate to the FortiGate web-based manager. Option E is correct because disabling HTTP administrative access and enforcing HTTPS only ensures that all management traffic to the web-based manager is encrypted with TLS, protecting credentials and session data from interception or tampering. Options A, C, and D are incorrect because Telnet transmits credentials in cleartext, default accounts with blank passwords are trivially exploitable, and disabling password complexity weakens rather than strengthens administrative security.

Answer

Enable Telnet for administrative CLI access.

Answer

Use default admin accounts with blank passwords.

Answer

Disable password complexity requirements globally.

Question 8

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

Accepted Answer

Web Filtering profile with malicious domain blocking enabled. A Web Filtering profile with malicious domain blocking enabled uses FortiGuard's categorized URL/domain database to intercept DNS/HTTP requests to known phishing and malware-hosting domains and block them before the connection is established. This is the only profile in the list designed specifically to evaluate destination reputation and deny access to malicious sites at the policy level.

Answer

Data Loss Prevention (DLP) sensor

Answer

Traffic Shaping rule profile

Answer

Antivirus signature profile in flow mode

Question 9

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Accepted Answer

By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH). Advanced malware can bypass blocked external DNS by using alternative public DNS resolvers or DNS-over-HTTPS (DoH), which encrypts DNS queries inside HTTPS traffic on port 443. This makes the malicious domain resolution blend with normal web traffic and evade traditional DNS filtering. DoH in particular is designed to prevent eavesdropping and manipulation, but attackers abuse it to hide C2 communications.

Answer

By relying exclusively on local ARP tables

Answer

By broadcasting requests via local Bluetooth signals

Answer

By converting domain names into physical print jobs

Question 10

An administrator is configuring a new local administrator account with restricted privileges. Where in the web-based manager are administrator accounts and access profiles created and managed?

Accepted Answer

System > Administrators. Administrator accounts and their associated access profiles (permission sets) are created and managed under System > Administrators in the FortiGate GUI. This is the central location where you define local admin users, assign admin profiles, restrict trusted hosts, and configure authentication methods such as LDAP, RADIUS, or local passwords. The access profile itself is also defined here, controlling which VDOMs and functional areas each admin can view or modify.

Answer

Policy & Objects > Admins

Answer

Security Fabric > Access Control

Answer

User & Authentication > Administrator Users