FORTINET-NSE123 Practice Exam 2 — 20 Questions

Question 1

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confidentiality is violated; remediation involves migrating to encrypted management protocols like SSH and HTTPS.. Telnet and HTTP transmit credentials and management data in clear text, violating confidentiality, and should be replaced with SSH and HTTPS.

Answer

Integrity is violated; remediation involves enabling packet checksum validation on all switches.

Answer

Non-repudiation is violated; remediation involves implementing digital signatures on email traffic.

Answer

Availability is violated; remediation involves upgrading uplink port speeds to 10Gbps.

Question 2

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Accepted Answer

Using a long, unique passphrase managed by an approved enterprise password manager.. Modern guidelines emphasize length and complexity, often achieved via passphrases, combined with multi-factor authentication, while avoiding predictable patterns.

Answer

Writing the password on a sticky note attached to the monitor for easy access during shifts.

Answer

Reusing the same strong password across all personal and work applications for easy recall.

Answer

Using a short password with special characters and changing it every 30 days.

Question 3

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

Accepted Answer

Refrain from opening files with double extensions like .pdf.exe or unexpected script formats. Users should verify files with senders through independent channels and avoid opening unknown executable or script attachments.

Answer

Forward suspicious attachments to all coworkers to see if anyone recognizes them

Answer

Immediately open executable attachments (.exe) to check what program they run

Answer

Disable your antivirus software temporarily so it does not block the file download

Question 4

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Accepted Answer

Network segmentation. Network segmentation isolates untrusted zones (like guest networks) from sensitive internal assets to limit the impact of a breach.

Answer

Cryptographic salting

Answer

Symmetric encryption

Answer

Non-repudiation verification

Question 5

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

Accepted Answer

The principle of least privilege ensures users and accounts are granted only the minimum access needed. Least privilege, defense in depth, and separation of duties are core foundational security principles.

Answer

System administrators should always share a single root account password to ensure accountability

Answer

Security through obscurity should be used as the primary defense mechanism for databases

Question 6

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

Accepted Answer

Locking the workstation screen whenever walking away from the desk.. End users should maintain strong, unique passwords and lock their screens when leaving workstations unattended.

Answer

Clicking on unexpected email attachments immediately to verify their safety.

Answer

Sharing corporate passwords with trusted team members to ensure project continuity.

Answer

Disabling all endpoint antivirus software to speed up system performance.

Question 7

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

Accepted Answer

Utilize a secure VPN tunnel to the corporate network.. A VPN encrypts the traffic between the client and the corporate gateway, protecting data from interception on public networks.

Answer

Enable browser-based spell check.

Answer

Ensure the laptop firewall is turned off to allow easier connectivity.

Answer

Use an unencrypted FTP connection for file transfers.

Question 8

An administrator wants to ensure that administrative access to the FortiGate GUI is restricted to secure HTTPS connections only, while disabling insecure HTTP access. Where is this administrative access protocol configured on the FortiGate?

Accepted Answer

Under the physical or logical interface settings (Administrative Access). Administrative access protocols (HTTPS, SSH, PING) are enabled or disabled on individual physical or logical interface configurations under Network > Interfaces.

Answer

Inside the firewall policy table rules

Answer

Inside the static routing table configuration

Answer

Within the FortiGuard update subscription settings

Question 9

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Accepted Answer

Under System > Alert Email settings. Email alert settings (Alert Email) can be configured on the FortiGate to send notifications when specific log severity levels or events occur.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the FortiGuard subscription server parameters

Answer

Within the static routing table configuration

Question 10

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Accepted Answer

FortiAnalyzer. FortiGate (firewall) and FortiAnalyzer (logging/analytics) are core foundational pillars of the Fortinet Security Fabric.

Answer

VMware ESXi hypervisor

Answer

Microsoft Active Directory

Answer

Cisco Catalyst Switch

Question 11

Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)

Accepted Answer

Service objects (ports and protocols like HTTP or SSH). Firewall policies match traffic based on source/destination interfaces, source/destination addresses, services, schedules, and user identities.

Answer

FortiGuard signature version number

Answer

CPU utilization percentage of FortiASIC chips

Answer

Administrator GUI idle timeout threshold

Question 12

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Accepted Answer

By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH). Advanced malware often uses alternative lookup methods, such as utilizing hardcoded public DNS resolvers or tunneling protocols, to bypass internal DNS restrictions.

Answer

By relying exclusively on local ARP tables

Answer

By broadcasting requests via local Bluetooth signals

Answer

By converting domain names into physical print jobs

Question 13

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

Accepted Answer

Users and services are granted only the bare minimum permissions required to perform their explicit functions.. Least privilege dictates that users and services should only be granted the minimum permissions necessary to perform their specific functions.

Answer

Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

Answer

Every user account is automatically granted local administrator rights on their assigned workstation by default.

Answer

All administrators share a single root account with full access to simplify password management.

Question 14

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

Accepted Answer

A generic salutation such as 'Dear Customer' instead of the recipient's actual name.. Phishing emails often feature generic greetings, mismatched sender domains, and urgent demands for sensitive information.

Answer

A standard company-wide newsletter detailing upcoming office cafeteria holiday hours.

Answer

A digital signature verifying the cryptographic integrity and authenticity of the sender.

Question 15

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Accepted Answer

Voice phishing (Vishing). Vishing (voice phishing) uses phone calls and social manipulation to trick individuals into divulging confidential information.

Answer

Watering hole attack

Answer

Phishing via SMS (Smishing)

Answer

Credential stuffing

Question 16

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

Accepted Answer

The risk of operational downtime caused by faulty updates. Testing updates prevents faulty patches from causing widespread system instability, crashes, or availability loss in production.

Answer

The risk of unauthorized physical entry to data centers

Answer

The risk of zero-day hardware manufacturing defects

Answer

The risk of social engineering attacks against helpdesk staff

Question 17

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Accepted Answer

Mitigating brute-force and credential-guessing attacks.. Complex passwords increase entropy, making brute-force and dictionary attacks significantly harder to execute successfully.

Answer

Preventing structured SQL injection attacks against web databases.

Answer

Preventing physical theft of laptop hardware.

Answer

Ensuring high network bandwidth availability for video conferencing.

Question 18

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

Accepted Answer

Use a password manager to generate and store unique, strong passwords for each site.. Using a unique, complex password for every service ensures that one breach does not lead to the compromise of other accounts.

Answer

Change passwords only when forced by the system administrator.

Answer

Write passwords on a physical sticky note hidden under the keyboard.

Answer

Use the same password for all work-related accounts to ensure memory efficiency.

Question 19

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. Interface zones group multiple physical or logical interfaces together, allowing administrators to apply a single firewall policy to multiple interfaces sharing the same security requirements.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 20

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Accepted Answer

They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes. Social engineering often relies on manipulation of human emotions such as fear or urgency, impersonation of trusted entities, and bypassing technical controls by targeting users.

Answer

They always require advanced kernel-level debugging tools to execute

Answer

They are entirely preventable by installing a standard graphics card driver update