FORTINET-NSE123 Practice Test 21 — 15 Questions

Question 1

Which TWO settings are required when configuring a basic static route on a FortiGate? (Choose two.)

Accepted Answer

Gateway IP address (next-hop). When configuring a basic static route on a FortiGate, the two required settings are the destination IP address and netmask (Option C) and the gateway IP address or next-hop (Option B). Option C is correct because a static route must specify the destination network (e.g., 10.0.0.0/24) that the route is intended to reach, defining the match criteria for traffic. Option B is correct because the FortiGate needs the next-hop gateway IP address (e.g., 192.168.1.1) to know where to forward matching packets, typically the upstream router's interface on the connected subnet. The other options do not belong: an IPsec Phase 1 Pre-Shared Key (A) is only used when building a VPN tunnel, not a static route; an Antivirus inspection profile (D) is a security profile applied to firewall policies, not routing; and a DHCP server IP pool range (E) is unrelated to routing and is configured under the DHCP server settings.

Answer

IPsec Phase 1 Pre-Shared Key

Answer

Antivirus inspection profile

Answer

DHCP server IP pool range

Question 2

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

Accepted Answer

Ransomware infection. The symptoms — sluggish workstation performance, file extensions changed to an unfamiliar format, and a ransom text file — are the textbook signature of a ransomware infection. Ransomware encrypts user files (often renaming them with a new extension) and drops a ransom note demanding payment for the decryption key. The combination of file-extension mutation plus a ransom note is definitive.

Answer

DDoS attack

Answer

Man-in-the-middle interception

Answer

SQL injection

Question 3

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

Accepted Answer

The risk of operational downtime caused by faulty updates. Testing patches in a staging environment before production deployment is a change-management control designed to catch defective or incompatible updates before they can cause outages. History is full of patches that broke production — a faulty update can crash services, corrupt data, or render systems unbootable — so the test environment acts as a canary. The policy's primary risk mitigation is therefore operational downtime caused by faulty updates.

Answer

The risk of unauthorized physical entry to data centers

Answer

The risk of zero-day hardware manufacturing defects

Answer

The risk of social engineering attacks against helpdesk staff

Question 4

An administrator needs to monitor bandwidth consumption across different applications on the FortiGate. Which feature allows the administrator to view real-time traffic bandwidth by application and enforce traffic shaping guarantees?

Accepted Answer

Traffic Shaping and FortiView Application monitors. Traffic Shaping on a FortiGate allows the administrator to define guaranteed and maximum bandwidth limits per application or traffic type, while FortiView Application monitors provide real-time visibility into bandwidth consumption broken down by application. Together, these features satisfy both the monitoring and enforcement requirements. Traffic shaping policies can be applied via firewall policies or shaping profiles, and FortiView aggregates NetFlow-like data from the session table to display per-application bandwidth. This combination is the standard Fortinet solution for application-aware bandwidth management.

Answer

Static routing administrative distance tables

Answer

Antivirus quarantine logs

Answer

High availability cluster heartbeat monitors

Question 5

A company's security team wants to reduce the damage an attacker could cause if a single employee account is compromised. They decide that every employee should have only the access needed to perform their daily job, and no more. Which security principle are they applying?

Accepted Answer

Least privilege. Least privilege restricts each account to only the permissions required for its role, so a compromised credential exposes far less data and fewer systems. This directly reduces the potential impact of a single account takeover. Other principles such as separation of duties, defense in depth, and non-repudiation address different risks, including fraud, layered protection, and accountability, rather than minimizing per-account access.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Separation of duties

Question 6

A security analyst is reviewing logs from a FortiGate and notices numerous entries indicating that traffic from the internal network to a specific external IP is being blocked by a firewall policy. The analyst wants to quickly identify which firewall policy is responsible for the block. Which FortiGate log field should the analyst examine to find the policy ID that matched the traffic?

Accepted Answer

policyid. In FortiGate traffic logs, the policyid field contains the unique identifier of the firewall policy that matched the session. This allows administrators to quickly locate the policy in the configuration and understand why the traffic was blocked. Other fields like source interface, destination IP, and action provide context but do not directly identify the policy.

Answer

srcintf

Answer

action

Answer

dstip

Question 7

A new employee at a small accounting firm receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to avoid account suspension. The email address looks slightly misspelled, and the link points to a domain that is not the bank's real website. What type of attack is this?

Accepted Answer

A phishing attack. The email impersonates a trusted financial institution, creates urgency about account suspension, uses a look-alike sender address, and directs the recipient to a fraudulent domain to capture credentials. These are the defining traits of phishing, a social-engineering technique that targets the human element rather than a technical vulnerability. Recognizing the mismatched domain and unusual request is the key defensive skill.

Answer

A man-in-the-middle attack

Answer

A brute-force attack

Answer

A denial-of-service attack

Question 8

A network administrator is deploying FortiGate next-generation firewalls at the perimeter and wants to inspect encrypted traffic for malware without breaking user privacy for banking and healthcare sites. The administrator plans to use SSL inspection but needs to avoid decrypting sensitive categories. Which FortiGate feature should be used to selectively bypass decryption for specific website categories?

Accepted Answer

SSL inspection exemption list based on FortiGuard categories. Selective SSL inspection is achieved by configuring an SSL inspection profile with an exemption list that includes FortiGuard categories such as Finance and Health. This allows the FortiGate to skip decryption for those categories while still decrypting and inspecting other traffic. The other options either do not involve decryption or lack category-based exemption capabilities.

Answer

Deep packet inspection with protocol anomaly detection

Answer

Web filter profile with category-based blocking

Answer

Application control with SSL inspection enabled for all applications

Question 9

An administrator needs to allow remote users to access the corporate network securely over the internet. The administrator wants to use a FortiGate's built-in VPN functionality that provides a clientless web portal for users to access internal resources. Which VPN type should the administrator configure?

Accepted Answer

SSL VPN. SSL VPN is the FortiGate feature that provides a clientless web portal for remote users to access internal resources through a browser. IPsec, L2TP, and GRE VPNs require client software or are not designed for clientless access. Therefore, SSL VPN is the correct choice.

Answer

L2TP VPN

Answer

IPsec VPN

Answer

GRE VPN

Question 10

A new hire at a financial services firm receives an email that appears to come from the CEO, asking them to urgently purchase gift cards for a client appreciation event and to send the redemption codes by reply email. The message uses the CEO's correct name and photo but originates from an external address. Which type of attack is this?

Accepted Answer

Business Email Compromise (BEC) using impersonation. The message impersonates a senior executive, creates urgency, and requests an untraceable transfer of value to an external party. That combination defines Business Email Compromise, a social engineering category emphasized in NSE 1 foundational training. Recognizing authority impersonation and unusual payment requests is a core user-level defense, since technical filters cannot reliably catch every spoofed executive message.

Answer

A phishing email delivering a malicious macro document

Answer

A denial-of-service attack against the mail server

Answer

A watering hole attack targeting the finance department

Question 11

An organization's security policy states that users should have only the access needed to perform their job, and that access should be reviewed regularly. A database administrator currently retains full administrative rights to a finance application even though her role changed six months ago and no longer requires those rights. Which principle is being violated?

Accepted Answer

Least privilege. Least privilege requires that accounts hold only the rights their current job demands, with periodic reviews to remove stale entitlements. The administrator's retained full rights after a role change is a textbook violation. This principle is foundational in NSE 1 security concepts and underpins identity and access management controls such as role-based access and recertification campaigns.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Separation of duties

Question 12

A network administrator at a branch office is deploying a FortiGate 60F and wants to provide a single, unified dashboard that shows the real-time status of all Fortinet devices in the branch, including the FortiSwitch and FortiAP. Which Fortinet feature should the administrator enable to discover and display these devices automatically?

Accepted Answer

Security Fabric. The Security Fabric is Fortinet's integrated architecture that allows automatic discovery of Fortinet devices and provides a single-pane-of-glass dashboard. Enabling it on the FortiGate lets the administrator see FortiSwitch and FortiAP status in real time. FortiLink, FortiManager, and FortiAnalyzer serve different purposes and do not fulfill the requirement of a unified local dashboard.

Answer

FortiAnalyzer

Answer

FortiManager

Answer

FortiLink

Question 13

A security administrator is configuring a FortiGate to inspect traffic for malicious files. The administrator wants to ensure that files are analyzed in a sandbox environment to detect zero-day threats. Which Fortinet product should be integrated with the FortiGate to provide this sandboxing capability?

Accepted Answer

FortiSandbox. FortiSandbox is the Fortinet product designed for sandboxing suspicious files. Integration with FortiGate allows automatic submission of files for analysis, and verdicts are used to block zero-day attacks. FortiAnalyzer, FortiManager, and FortiClient do not provide sandboxing, so they are incorrect for this scenario.

Answer

FortiClient

Answer

FortiManager

Answer

FortiAnalyzer

Question 14

A company's security team notices a sudden spike in authentication failures for many user accounts within a short window, followed by successful logins from unfamiliar geographic locations using valid credentials. Which attack best matches this pattern?

Accepted Answer

Credential stuffing using passwords leaked from another breach. The combination of widespread authentication failures and subsequent successes using valid credentials from unfamiliar locations is characteristic of credential stuffing. Attackers replay breached username-password pairs across services, capitalizing on password reuse. Defenses include multi-factor authentication, breached-password screening, and monitoring for anomalous login patterns—topics covered in NSE 1 foundational security awareness.

Answer

A brute-force attack guessing random passwords for a single account

Answer

A man-in-the-middle attack intercepting session tokens

Answer

A password spray using a small set of common passwords across many accounts

Question 15

A hospital's security team deploys network segmentation so that the radiology imaging VLAN cannot directly reach the billing VLAN. A vendor's maintenance laptop connected to the imaging VLAN is later found to be infected with ransomware. Which security benefit of segmentation does this design primarily provide in this situation?

Accepted Answer

It reduces the lateral movement path available to the ransomware.. By preventing the imaging VLAN from directly reaching the billing VLAN, the design blocks a compromised device from pivoting into other sensitive systems. This containment of lateral movement is the core security value of segmentation, especially in environments like healthcare where flat networks magnify ransomware impact. Fortinet teaches segmentation and internal firewalling as key techniques for limiting breach scope.

Answer

It encrypts all traffic between the imaging and billing VLANs.

Answer

It automatically removes ransomware from the vendor laptop.

Answer

It authenticates the vendor laptop before granting network access.