FORTINET-NSE123 Practice Exam 3 — 20 Questions

Question 1

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Accepted Answer

Implementing account lockout policies after a threshold of failed login attempts.. Multi-factor authentication and account lockout policies effectively mitigate credential stuffing and brute-forcing.

Answer

Permitting HTTP plaintext transmission for login forms to speed up authentication.

Answer

Allowing users to share identical passwords to reduce password fatigue.

Answer

Disabling logging mechanisms to prevent server storage bloat.

Question 2

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Phishing, baiting with USB drives, and tech support scams are all classic threat types targeting end users.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 3

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

Accepted Answer

USB baiting exploiting human curiosity and physical media.. Leaving physical media in public spaces to entice curiosity is a social engineering tactic known as USB baiting.

Answer

Man-in-the-middle interception of wireless frames.

Answer

Cross-site scripting executed within a browser session.

Answer

Watering hole attack targeting web browsing habits.

Question 4

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA continuously verifies user identity, device posture, and grants access strictly to specific applications rather than the entire network.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 5

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Accepted Answer

Creating a false sense of urgency and fear of loss.. Attackers create a sense of urgency and panic to bypass critical thinking and prompt immediate compliance.

Answer

Offering financial rewards for completing a corporate survey.

Answer

Establishing authority by impersonating a system administrator calmly.

Answer

Providing technical assistance for routine software patching.

Question 6

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

Accepted Answer

FortiSandbox integration. FortiSandbox executes suspicious files in an isolated virtual sandbox environment to observe behavior and detect zero-day threats.

Answer

Intrusion Prevention System signature matching

Answer

FortiGuard Antivirus signature lookup

Answer

Web filtering URL categorization

Question 7

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

Accepted Answer

To transform employees into an active defense layer capable of recognizing social engineering.. Employees are frequently targeted as the human firewall; training helps them recognize and report social engineering attempts.

Answer

To ensure all personnel understand how to compile source code securely.

Answer

To replace automated endpoint detection and response software with human monitoring.

Answer

To train every staff member to write advanced firewall configuration scripts.

Question 8

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

Accepted Answer

A keystroke injection attack using a compromised HID device.. A device disguised as a standard USB human interface device that injects keystrokes is known as a BadUSB or keystroke injection attack.

Answer

A distributed denial-of-service attack originating from the keyboard firmware.

Answer

A hardware logic bomb that physically destroys the motherboard upon boot.

Answer

A physical RAM scraping attack reading volatile memory contents.

Question 9

Which THREE of the following are recognized signs of a potential phishing attempt?

Accepted Answer

The email uses urgent or threatening language to demand immediate action.. Unexpected attachments, urgent language, and suspicious sender domains are common indicators of phishing.

Answer

The email is sent during standard business hours.

Answer

The email is addressed to the employee by their correct first name.

Question 10

Which Fortinet security product is specifically designed to protect web applications (such as public-facing e-commerce portals) against OWASP Top 10 vulnerabilities like SQL injection and cross-site scripting?

Accepted Answer

FortiWeb. FortiWeb is a Web Application Firewall (WAF) that protects web applications from application-layer attacks and vulnerabilities.

Answer

FortiGate

Answer

FortiMail

Answer

FortiSandbox

Question 11

What is the primary function of FortiMail in an enterprise security architecture?

Accepted Answer

To protect the organization against email-borne threats such as spam, malware, and phishing. FortiMail is a secure email gateway designed to protect organizations from spam, malware, phishing, and data loss via email.

Answer

To act as a centralized log analysis and reporting appliance

Answer

To manage wireless access points and guest Wi-Fi authentication portals

Answer

To provide SSL VPN client tunnels for remote workers

Question 12

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

Accepted Answer

Flow-based inspection. FortiOS supports Flow-based inspection and Proxy-based inspection modes for UTM security profiles.

Answer

NAT routing inspection

Answer

Transparent bridging inspection

Answer

Static gateway inspection

Question 13

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Accepted Answer

Notify the internal IT security or incident response team without delay.. Upon suspecting a compromise, users should disconnect from the network to stop lateral movement and immediately report the incident to IT security.

Answer

Forward the suspicious file to all external clients as a warning alert.

Answer

Delete all system logs and temporary files to clear up disk space for the virus scanner.

Answer

Download and execute unverified registry cleaner utilities from pop-up advertisements.

Question 14

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

Accepted Answer

Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.. Defense-in-depth uses multiple overlapping security controls so that if one control fails, subsequent controls prevent a breach.

Answer

Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

Answer

Enforcing identical complex passwords across all local and cloud administrative portals.

Answer

Duplicating identical edge firewalls in an active-passive cluster for high availability.

Question 15

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. When backing up a FortiGate configuration from the GUI or CLI, administrators can choose to encrypt the configuration file with a password so sensitive secrets like pre-shared keys are protected.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP

Question 16

What is the primary function of a FortiGate static route?

Accepted Answer

To manually specify the next-hop gateway for routing traffic to specific destination networks. A static route manually defines the next-hop IP gateway for specific destination subnets when packets cannot be resolved by directly connected interfaces.

Answer

To translate private internal IP addresses to public WAN IP addresses

Answer

To inspect HTTP web traffic for malicious scripts

Answer

To authenticate remote VPN users against Active Directory

Question 17

An administrator notices that a specific software application is being blocked by Application Control. Upon checking the logs, the administrator wants to create an exception to allow this specific application while keeping the rest of the application control category blocked. How can this be achieved?

Accepted Answer

By adding an Application Override rule inside the Application Control profile. Application Control profiles support application overrides, allowing administrators to add specific allow or block exceptions for individual applications within a category.

Answer

By disabling the entire Antivirus scanning engine globally

Answer

By changing the static routing table administrative distance

Answer

By switching the FortiGate firewall from NAT mode to Transparent mode

Question 18

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. FortiGate supports IPsec VPN, SSL VPN, and FortiClient-based telemetry/VPN tunnels for secure remote access.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 19

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Accepted Answer

Conducting regular security awareness training and simulated phishing tests for all staff.. Effective defense against social engineering combines human security awareness training with robust technical email filtering controls.

Answer

Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.

Answer

Instructing employees to comply immediately with any urgent executive request received via personal email.

Answer

Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.

Question 20

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Accepted Answer

Installing a kernel-level rootkit that hooks into core operating system processes.. Attackers maintain persistence through mechanisms such as scheduled tasks, startup registry keys, or installed rootkits.

Answer

Running a temporary calculation script inside an isolated browser incognito tab.

Answer

Running an optional software update diagnostic tool provided by the hardware manufacturer.

Answer

Clearing the system browser cache and emptying the local operating system recycle bin.