FORTINET-NSE123 Practice Test 22 — 15 Questions

Question 1

An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?

Accepted Answer

IPS sensor. Intrusion Prevention System (IPS) sensors inspect network traffic for vulnerability exploits and malicious signatures.

Answer

Web Filtering profile

Answer

Application Control profile

Answer

Data Loss Prevention (DLP) sensor

Question 2

An administrator needs to check the status of FortiCare registration and feature licenses. Where in the web-based manager is this license summary displayed?

Accepted Answer

System > FortiGuard. License and registration status can be viewed under System > FortiGuard or the Dashboard License Information widget.

Answer

Policy & Objects > Licenses

Answer

Security Fabric > Registration

Answer

Log & Report > License Audit

Question 3

An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?

Accepted Answer

Dashboard > System Information widget. The System Information widget on the dashboard displays the firmware version, hostname, serial number, and uptime.

Answer

Log & Report > System Events

Answer

Policy & Objects > Addresses

Answer

Network > Interfaces

Question 4

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?

Accepted Answer

FortiAnalyzer. FortiAnalyzer collects, analyzes, and correlates log data from FortiGate and other Security Fabric devices, generating comprehensive reports.

Answer

FortiSandbox

Answer

FortiAuthenticator

Answer

FortiWeb

Question 5

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

Accepted Answer

Firewall policies reference the SD-WAN zone name instead of individual physical interfaces. Once physical WAN interfaces are added to an SD-WAN zone, firewall policies reference the SD-WAN zone name instead of individual physical interfaces.

Answer

Firewall policies must only use static routing next-hop IP addresses

Answer

Firewall policies are disabled entirely when SD-WAN is enabled

Answer

Firewall policies must reference every physical WAN interface individually in separate rules

Question 6

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Accepted Answer

Disabling automatic connection to open Wi-Fi networks on your mobile device. Using a VPN, avoiding sensitive transactions on unencrypted networks, and disabling automatic network connection features protect users on public Wi-Fi.

Answer

Conducting personal online banking without checking for HTTPS or using a VPN

Answer

Accepting all unknown certificate warnings when browsing on public hotspots

Question 7

When configuring an IPsec VPN tunnel between two FortiGate units using pre-shared keys (PSK), what is required for successful Phase 1 authentication?

Accepted Answer

Both peers must match on Phase 1 encryption, hash algorithms, DH group, and identical pre-shared keys. For IPsec Phase 1 with PSK to succeed, both peers must match on authentication settings, encryption/hash algorithms, Diffie-Hellman groups, and the identical pre-shared key string.

Answer

The pre-shared key must be configured in Phase 2 rather than Phase 1

Answer

Both peers must use dynamic IP addresses assigned by DHCP

Answer

Both peers must run different firmware versions to ensure cryptographic compatibility

Question 8

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

Accepted Answer

The exposure window during which attackers can exploit known unpatched vulnerabilities.. Rapid patching minimizes the window of exposure between when a vulnerability is disclosed and when it is remediated.

Answer

The network lease duration assigned by corporate DHCP servers.

Answer

The physical hardware warranty expiration window for end-user laptops.

Answer

The vendor development lifecycle window for creating new software features.

Question 9

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

Accepted Answer

Store them in an encrypted password manager or secure offline location. Recovery codes should be stored securely and privately, such as in an encrypted password manager, rather than on sticky notes or unsecured text files.

Answer

Write them on a sticky note attached to the computer monitor for convenience

Answer

Discard them immediately as they are unnecessary if an app is installed

Answer

Share them in a public corporate chat channel so teammates can assist if needed

Question 10

An administrator needs to verify DNS and time synchronization settings to ensure accurate log timestamps and FortiGuard connectivity. Which THREE settings or commands should be verified? (Choose three)

Accepted Answer

System timezone configuration. DNS servers, NTP server synchronization, and system time/timezone settings are crucial for log timestamps and FortiGuard updates.

Answer

Firewall policy packet hit counters

Answer

Hardware switch port duplex modes

Question 11

A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?

Accepted Answer

Application Control profile. Application Control identifies applications based on signature analysis and behavioral characteristics rather than TCP/UDP port numbers.

Answer

Static port-blocking firewall rules

Answer

SSL certificate inspection profile

Answer

Antivirus signature database

Question 12

An administrator needs to change the management IP address of the internal interface (e.g., port1) via the CLI. Which sequence of configuration commands is correct?

Accepted Answer

config system interface > edit port1 > set ip [IP] [netmask] > end. Configuring interface IP addresses requires entering the system interface config context, editing the specific interface, and setting the ip parameter.

Answer

config router interface > edit port1 > set address [IP] > end

Answer

set interface port1 ip [IP] > save

Answer

execute set ip port1 [IP]

Question 13

An administrator needs to ensure that internal network users cannot bypass corporate security policies by using unauthorized peer-to-peer file sharing or gaming applications. Which FortiGate security feature is specifically designed to identify and take action against these types of network protocols?

Accepted Answer

Application Control. Application Control identifies and controls applications (like P2P, gaming, social media) regardless of port or protocol by analyzing traffic heuristics and signatures.

Answer

Antivirus Profile

Answer

NAT IP Pool

Answer

Static Route Table

Question 14

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, outbound traffic passing through a firewall policy with NAT enabled is translated (SNAT) to the outgoing interface's IP address.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 15

An administrator is configuring a new firewall policy to allow internal users to access the internet. Which parameter is mandatory when defining a IPv4 firewall policy in FortiOS?

Accepted Answer

Action (Accept, Deny, or IPsec). Every firewall policy must define source interfaces, source addresses, destination interfaces, destination addresses, service, and action.

Answer

Schedule

Answer

NAT (Network Address Translation)

Answer

Destination Address