FORTINET-NSE123 Practice Test 20 — 15 Questions

Question 1

When configuring an IPsec VPN tunnel between two FortiGate units, what is the purpose of establishing a local ID (Peer ID) in Phase 1?

Accepted Answer

To provide a distinct peer identifier during Phase 1 authentication, particularly useful with dynamic IPs. The local ID (Peer ID) in IPsec Phase 1 provides a unique identifier for the peer during IKE authentication, which is especially important when peers use dynamic IP addresses. It allows the FortiGate to match the correct Phase 1 configuration to the incoming peer regardless of its IP.

Answer

To assign virtual IP addresses to SSL VPN client workstations

Answer

To encrypt user data payloads using AES-GCM encryption

Answer

To define the static routing administrative distance metric for the VPN tunnel

Question 2

When configuring dynamic routing on a FortiGate using OSPF, what is the function of a designated router (DR) in a multi-access broadcast network?

Accepted Answer

To centralize LSA exchanges and minimize routing protocol traffic on multi-access broadcast networks. In OSPF, a designated router (DR) is elected on multi-access broadcast networks (like Ethernet) to centralize the exchange of Link State Advertisements (LSAs). Instead of every router forming adjacencies with every other router (full mesh), all non-DR routers (DROTHERs) form adjacencies only with the DR and BDR. The DR then floods LSAs to all other routers on the segment, drastically reducing protocol overhead and preventing excessive LSA replication.

Answer

To translate private internal IP addresses to public IPs for internet browsing

Answer

To encrypt user data traffic traversing IPsec VPN tunnels between headquarters and branches

Answer

To distribute antivirus signature updates to isolated FortiGate appliances

Question 3

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

Accepted Answer

Baiting. Baiting is a social engineering attack where the attacker leaves a physical item (like a USB drive) or offers something enticing to lure victims into compromising security. The branded USB drives labeled 'Confidential Salary Data 2026' exploit curiosity and the promise of valuable information, hoping employees plug them in and execute malicious payloads. This is the textbook definition of baiting.

Answer

Watering hole attack

Answer

Tailgating

Answer

Phishing

Question 4

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

Accepted Answer

Impossible travel anomaly. The scenario describes a user account being accessed from two geographically distant locations within a timeframe that makes physical travel between them impossible. This is the textbook definition of an impossible travel anomaly, a common behavioral analytics detection used in security monitoring. Fortinet's FortiAnalyzer and FortiSIEM, for example, correlate login events with geolocation data to flag such events as suspicious, often indicating credential compromise or session hijacking.

Answer

Bandwidth saturation anomaly

Answer

Hardware failure indicator

Answer

DNS poisoning event

Question 5

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

Accepted Answer

Human psychology and helpfulness. This is a classic vishing (voice phishing) / social engineering attack where the attacker manipulates the helpdesk agent's natural desire to be helpful and their deference to authority (a stressed executive). The vulnerability exploited is human psychology — urgency, authority, and empathy — not any technical misconfiguration. No firewall rule, cryptographic weakness, or kernel bug is involved because the attacker never touches the technology directly; they convince a human to bypass controls.

Answer

Misconfigured firewall security policies

Answer

Cryptographic weak implementation

Answer

Unpatched operating system kernel bugs

Question 6

When a FortiGate device inspects HTTPS traffic using deep inspection, how does the security engine handle the TLS/SSL encryption handshake between the client and the destination server?

Accepted Answer

It acts as a man-in-the-middle, terminating the session and re-signing traffic with a local CA certificate. FortiGate deep inspection performs full TLS/SSL man-in-the-middle interception: it terminates the client's TLS session, decrypts the traffic, inspects it against security profiles (IPS, antivirus, web filter), then re-encrypts and forwards it to the destination server using a certificate signed by a local CA that the client must trust. This allows inspection of encrypted payloads that would otherwise be opaque.

Answer

It strips all encryption permanently and forwards all internal traffic as plain text HTTP to the server

Answer

It inspects only the SNI (Server Name Indication) field in the unencrypted TLS Client Hello packet header

Answer

It relies entirely on the destination web server's private key pre-configured in the firewall policy

Question 7

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

Accepted Answer

The exposure window during which attackers can exploit known unpatched vulnerabilities.. A 48-hour patch mandate for critical vulnerabilities is designed to shrink the exposure window — the period between public disclosure of a vulnerability and the application of a fix. Attackers frequently weaponize exploits within days of disclosure, so minimizing this window reduces the chance of successful exploitation.

Answer

The network lease duration assigned by corporate DHCP servers.

Answer

The physical hardware warranty expiration window for end-user laptops.

Answer

The vendor development lifecycle window for creating new software features.

Question 8

Which Fortinet security product is specifically designed to protect web applications (such as public-facing e-commerce portals) against OWASP Top 10 vulnerabilities like SQL injection and cross-site scripting?

Accepted Answer

FortiWeb. FortiWeb is Fortinet's dedicated Web Application Firewall (WAF) that provides specialized protection for web applications against OWASP Top 10 threats such as SQL injection, cross-site scripting (XSS), and cross-site request forgery. It uses behavioral analysis, signature-based detection, and machine learning to inspect HTTP/HTTPS traffic and block malicious requests before they reach the application. FortiWeb is designed for public-facing web services like e-commerce portals, APIs, and web portals, offering features like virtual patching, bot mitigation, and API protection.

Answer

FortiGate

Answer

FortiMail

Answer

FortiSandbox

Question 9

Which THREE steps are critical for an effective cybersecurity incident response plan?

Accepted Answer

Preparation and planning to ensure the team is ready to react.. Option B (Preparation and planning) is correct because an effective incident response plan requires proactive readiness—defining roles, playbooks, communication channels, and tools—so the team can react quickly and consistently when an incident occurs. Option D (Identification and analysis of the threat) is correct because responders must detect, validate, and scope the incident (e.g., determining affected hosts, accounts, and indicators of compromise) before they can choose appropriate remediation actions. Option E (Containment) is correct because limiting the spread of the incident—such as isolating compromised systems, disabling accounts, or blocking malicious traffic—prevents further damage while investigation and eradication proceed. Option A is incorrect because ignoring an incident allows attackers to persist and escalate, and Option C is incorrect because deleting all corporate data destroys evidence and business operations rather than containing or remediating the threat.

Answer

Ignoring the incident to see if it resolves itself automatically.

Answer

Immediately deleting all corporate data to prevent further theft.

Question 10

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

Accepted Answer

A keystroke injection attack using a compromised HID device.. A USB keyboard that immediately executes automated command-line instructions is a classic keystroke injection attack, where the device presents itself as a Human Interface Device (HID) and sends pre-programmed keystrokes to the host. This is often achieved with devices like the USB Rubber Ducky, which emulate a keyboard and can execute scripts at high speed. The correct answer is a keystroke injection attack using a compromised HID device.

Answer

A distributed denial-of-service attack originating from the keyboard firmware.

Answer

A hardware logic bomb that physically destroys the motherboard upon boot.

Answer

A physical RAM scraping attack reading volatile memory contents.

Question 11

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

Accepted Answer

A generic salutation such as 'Dear Customer' instead of the recipient's actual name.. Option A is correct because phishing messages typically use generic salutations like 'Dear Customer' since attackers send them in bulk and don't know the recipient's real name, whereas legitimate organizations usually personalize communications. Option B is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are a classic phishing tactic that impersonates a trusted brand to deceive recipients. Option D is correct because urgency combined with requests to verify credentials or financial data is a hallmark social-engineering pressure tactic designed to bypass the victim's critical thinking. Option C is not a phishing indicator because routine internal announcements such as cafeteria holiday hours are normal, low-risk corporate communications. Option E is not a phishing indicator because a valid digital signature (e.g., S/MIME or PGP) actually confirms sender authenticity and message integrity, which is the opposite of a phishing sign.

Answer

A standard company-wide newsletter detailing upcoming office cafeteria holiday hours.

Answer

A digital signature verifying the cryptographic integrity and authenticity of the sender.

Question 12

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

Accepted Answer

Availability, ensuring authorized users have reliable access to information and resources when needed.. The CIA Triad consists of Confidentiality, Integrity, and Availability. Option A (Availability) is correct because it ensures authorized users have reliable and timely access to information and resources, typically supported by redundancy, backups, and uptime controls. Option C (Confidentiality) is correct because it restricts sensitive data access to authorized individuals through mechanisms like encryption, access control lists, and authentication. Option E (Integrity) is correct because it ensures data and systems remain accurate and protected from unauthorized modification via hashing, digital signatures, and version controls. Option B (Compliance) is not a foundational CIA Triad principle; it is a governance and regulatory requirement that may support security but is not one of the three core components. Option D (Cost-efficiency) is a business or financial objective, not a security principle of the CIA Triad.

Answer

Compliance, ensuring all regional government tax laws are strictly obeyed.

Answer

Cost-efficiency, ensuring security budgets remain minimal relative to operational revenue.

Question 13

An administrator wants to prevent users from uploading confidential company documents to external cloud storage websites. Which Fortinet security profile feature inspects outbound traffic for specific file types or sensitive keywords?

Accepted Answer

Data Loss Prevention (DLP) sensor. The Data Loss Prevention (DLP) sensor in FortiOS is specifically designed to inspect outbound traffic for sensitive data patterns, including file types (e.g., .docx, .pdf) and keywords (e.g., 'confidential'). It can be applied to firewall policies to block or log attempts to upload such data to external destinations. Unlike other profiles, DLP focuses on data exfiltration rather than malware or URL categorization. Therefore, D is the correct answer.

Answer

Intrusion Prevention System (IPS) sensor

Answer

Antivirus profile

Answer

Web filtering profile

Question 14

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

Accepted Answer

Controlled application execution (Whitelisting). Controlled application execution, also called application whitelisting, enforces that only approved, signed, or centrally pushed applications can run on endpoints. By requiring IT to approve and deploy software, the organization prevents users from installing unverified applications, which is the definition of whitelisting. This principle directly reduces the attack surface from malicious or unauthorized software.

Answer

Network boundary defense

Answer

Asymmetric encryption key management

Answer

Principle of fail-secure

Question 15

An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?

Accepted Answer

IPS sensor. An IPS sensor is the FortiGate feature that detects and blocks known vulnerability exploits and attack signatures. It inspects traffic against a signature database and can take action (block, monitor, reset) based on the matched signature, making it the correct choice for protecting internal servers from exploits.

Answer

Web Filtering profile

Answer

Application Control profile

Answer

Data Loss Prevention (DLP) sensor