FORTINET-NSE123 Practice Exam 4 — 20 Questions

Question 1

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Accepted Answer

The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.. Urgency, mismatched sender domains, and unexpected attachments are key indicators of phishing.

Answer

The message includes a link to the corporate intranet home page via the internal DNS domain.

Answer

The email is addressed specifically to your correct full corporate title and department.

Answer

The email contains standard company newsletter updates sent through an official mailing platform.

Question 2

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

Accepted Answer

admin. The default administrator account on a brand-new or factory-reset FortiGate is 'admin'.

Answer

administrator

Answer

supervisor

Answer

root

Question 3

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

Accepted Answer

It adds a layer of defense even if the primary password is stolen.. MFA requires a second form of verification, ensuring that even if a password is compromised, the attacker cannot access the account.

Answer

It prevents all forms of social engineering.

Answer

It eliminates the need for strong password policies.

Answer

It automatically encrypts all outgoing email traffic.

Question 4

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

Accepted Answer

Forward the email to the IT helpdesk using the official reporting procedure.. Reporting the email via the organization's official phishing reporting mechanism ensures the security team can analyze the threat and protect other users.

Answer

Delete the email and clear the browser cache.

Answer

Click the link to check if the website looks authentic.

Answer

Reply to the email with the requested credentials to avoid account lockout.

Question 5

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

Accepted Answer

Inside an IPv4 firewall policy matching the traffic. Security profiles, such as Antivirus, Web Filtering, and IPS, must be bound to an active IPv4 or IPv6 firewall policy to inspect traffic traversing the FortiGate.

Answer

Directly under the physical interface configuration

Answer

Inside the static routing table configuration

Answer

Under the Global System Settings menu

Question 6

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN performance SLAs monitor latency, jitter, and packet loss, allowing administrators to configure rule-based path selection and automatic failover.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 7

Which of the following scenarios describes a 'pretexting' social engineering attack?

Accepted Answer

An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.. Pretexting involves creating a fabricated scenario to manipulate a victim into providing information.

Answer

An attacker leaves a malicious USB drive in the lobby.

Answer

An attacker uses automated software to guess passwords.

Answer

An attacker shoulder-surfs to capture a password.

Question 8

Which TWO actions should an end-user take to protect their physical workstation security?

Accepted Answer

Store sensitive documents in a locked drawer when not in use.. Locking the screen and keeping sensitive documents stored securely are fundamental physical security controls.

Answer

Disable the screensaver to ensure the system is always visible.

Answer

Leave the workstation unlocked during lunch breaks to save time.

Answer

Write the BIOS password on a post-it note attached to the monitor.

Question 9

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, the FortiGate operates as a bridge (Layer 2 device) without modifying IP addresses, inspecting traffic as it passes between interfaces on the same subnet.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 10

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

Accepted Answer

Active-active distributes session processing across multiple cluster units, whereas active-passive processes all traffic on a single primary unit. In active-active mode, session load is distributed across multiple cluster members using session-pickup/load-balancing mechanisms, whereas active-passive runs all traffic through the primary unit until a failover occurs.

Answer

Active-active requires manual administrator failover, while active-passive is fully automated

Answer

Active-active disables all firewall security profiles to maximize raw throughput

Answer

Active-active eliminates the need for heartbeat cables between cluster units

Question 11

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

Accepted Answer

Session synchronization and session pickup settings. FGCP clustering relies on dedicated heartbeat interfaces, cluster hello/keepalive packets, and session synchronization/pickup configurations.

Answer

BGP exterior routing protocol peer autonomous systems

Answer

RADIUS authentication server token polling

Question 12

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

Accepted Answer

Dynamic URL filtering with reputation-based feeds.. URL filtering integrated with threat intelligence feeds allows the gateway to block access to known malicious domains before the connection is established.

Answer

MAC address filtering on the local switch.

Answer

Local static IP filtering.

Answer

Disabling cookies in the browser.

Question 13

An administrator wants to verify which administrator is currently logged into the FortiGate and from which IP address. Which CLI command should be used?

Accepted Answer

get system admin status. Active administrative sessions can be viewed using the get system admin status or system session list commands.

Answer

diagnose sys admin list

Answer

get system user active

Answer

show system admin session

Question 14

An administrator needs to check the status of static routes configured on the FortiGate. Which CLI command lists all static routes?

Accepted Answer

get router info routing-table static. The get router info routing-table static command displays configured static routes.

Answer

config router static show

Answer

show firewall static-route

Answer

diagnose ip route list static

Question 15

An administrator needs to verify whether FortiGuard web filtering rating lookups are succeeding for specific categories. Which CLI command tests web filter rating lookups for a specific URL?

Accepted Answer

diagnose webfilter FortiGuard lookup [URL]. The diagnose webfilter FortiGuard lookup command tests URL categorization.

Answer

get webfilter status [URL]

Answer

execute webfilter-test [URL]

Answer

ping fortiguard-rating [URL]

Question 16

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

Accepted Answer

To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers. NAT-T encapsulates IPsec ESP packets inside UDP port 4500 packets when a NAT device is detected between the VPN peers, preventing NAT from breaking the IPsec session.

Answer

To assign dynamic DHCP addresses to SSL VPN mobile clients

Answer

To translate internal private web server IP addresses to public IPs for inbound users

Answer

To balance VPN traffic across multiple high availability cluster members

Question 17

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard distribution network provides real-time threat intelligence updates, including antivirus signatures, IPS definitions, and web filtering categories to Fortinet devices.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 18

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Antivirus and IPS (Intrusion Prevention System) are primary security profiles used to detect and block malware and exploits.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 19

What is the primary objective of a 'DDoS' attack?

Accepted Answer

To exhaust system resources and render a service unavailable.. A Distributed Denial of Service attack aims to make a service unavailable by overwhelming it with traffic.

Answer

To steal intellectual property.

Answer

To modify user permissions on the server.

Answer

To install a hidden backdoor for future access.

Question 20

Which THREE steps are critical for an effective cybersecurity incident response plan?

Accepted Answer

Preparation and planning to ensure the team is ready to react.. Preparation, identification, and containment are foundational phases of any incident response lifecycle.

Answer

Ignoring the incident to see if it resolves itself automatically.

Answer

Immediately deleting all corporate data to prevent further theft.