FORTINET-NSE123 Practice Test 23 — 15 Questions

Question 1

An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Power supply unit (PSU) status. Hardware health monitoring includes fan speeds, power supply status, and internal temperature sensors.

Answer

Active BGP peer uptime metrics

Answer

SSL VPN tunnel encryption keys

Question 2

An enterprise branch office needs to establish a secure, encrypted site-to-site tunnel back to the headquarters FortiGate over the public internet. Which VPN technology provides a standard IPsec framework combined with Fortinet Security Fabric integration features?

Accepted Answer

IPsec VPN tunnel in route-based mode. IPsec VPN with aggressive or main mode supports secure site-to-site connectivity. In FortiOS, IPsec tunnels can be configured in policy-based or route-based modes.

Answer

FortiClient EMS telemetry connection

Answer

SSL VPN web portal mode

Answer

RADIUS single sign-on agent

Question 3

An organization wants to implement the Fortinet Security Fabric to gain centralized visibility across multiple distributed security devices. Which core protocol is utilized by Security Fabric devices to discover, authenticate, and securely communicate with the root FortiGate?

Accepted Answer

Security Fabric Downstream Heartbeat and REST API telemetry. The Security Fabric uses the Fortinet Fabric connector and specialized heartbeat/telemetry communication protocols over HTTPS/TLS to link downstream devices to the root FortiGate.

Answer

Dynamic Host Configuration Protocol (DHCP) option 43

Answer

Simple Network Management Protocol (SNMP) v3 traps

Answer

Syslog over unencrypted UDP port 514

Question 4

An administrator notices that the FortiGate configuration changes made during troubleshooting were lost after an unexpected power outage. Where should the administrator check to ensure that the current running configuration is permanently saved?

Accepted Answer

FortiGate automatically saves running configurations to non-volatile memory immediately upon successful CLI or GUI commit actions.. Configuration changes in the CLI or GUI must be saved to flash storage. The active running configuration can be backed up or saved, but changes made via certain methods or scripts require explicit saves.

Answer

System > Admin > Settings

Answer

System > Configuration > Backup

Answer

The CLI command execute backup config

Question 5

An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?

Accepted Answer

Network > Interfaces. Interface configurations and status summaries are viewed under Network > Interfaces.

Answer

Policy & Objects > Interfaces

Answer

Monitor > Interface Summary

Answer

System > Interfaces

Question 6

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

Accepted Answer

Administrative access settings (e.g., enabling HTTPS and ping for management). Interfaces require addressing mode (static or DHCP) and proper IP/netmask configuration, along with administrative access permissions (HTTPS, ping, etc.).

Answer

Explicit proxy authentication realms

Answer

BGP AS number and neighbor peer groups

Answer

SSL VPN client certificate revocation lists

Question 7

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Accepted Answer

Implicit Deny. Implicit Deny is the default security behavior of FortiGate firewalls, ensuring any traffic not explicitly permitted by a firewall policy is dropped.

Answer

Drop and send ICMP destination unreachable

Answer

Redirect to Captive Portal

Answer

Implicit Accept

Question 8

An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?

Accepted Answer

FortiGate Clustering Protocol (FGCP) Active-Passive mode. FGCP (FortiGate Clustering Protocol) in an active-passive high availability configuration synchronizes session tables and configurations so the secondary unit can seamlessly take over if the primary fails.

Answer

Dynamic Multicast Routing Protocol (PIM-SM)

Answer

Virtual Router Redundancy Protocol (VRRP) active-active balancing

Answer

Border Gateway Protocol (BGP) Multipath clustering

Question 9

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

Accepted Answer

Man-in-the-Middle attack. A Man-in-the-Middle (MitM) attack involves an attacker secretly relaying and potentially altering communications between two parties who believe they are directly communicating.

Answer

MAC flooding attack

Answer

Distributed denial of service

Answer

SQL injection exploit

Question 10

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Accepted Answer

Storing passwords in an encrypted password manager application. Using unique passwords for every account prevents credential stuffing attacks from cascading, and utilizing password managers ensures complex, unguessable strings are stored securely.

Answer

Writing passwords on a physical notepad kept inside a locked desk drawer

Answer

Reusing the same strong master password across all banking and work systems for ease of recall

Answer

Changing passwords every single week regardless of whether a compromise is suspected

Question 11

When a FortiGate device inspects HTTPS traffic using deep inspection, how does the security engine handle the TLS/SSL encryption handshake between the client and the destination server?

Accepted Answer

It acts as a man-in-the-middle, terminating the session and re-signing traffic with a local CA certificate. Deep inspection acts as a man-in-the-middle by terminating the client's SSL connection, presenting a re-signed certificate using a local CA, and opening a separate SSL connection to the destination server.

Answer

It strips all encryption permanently and forwards all internal traffic as plain text HTTP to the server

Answer

It inspects only the SNI (Server Name Indication) field in the unencrypted TLS Client Hello packet header

Answer

It relies entirely on the destination web server's private key pre-configured in the firewall policy

Question 12

A network administrator notices that a web filtering profile configured on a FortiGate is blocking a specific educational video streaming category, but the exception list needs to allow a single permitted URL within that category. Where in FortiOS should the administrator add this specific URL override?

Accepted Answer

Inside the Web Filter Security Profile under URL Filter table overrides.. FortiOS Web Filtering profiles allow administrators to configure URL Filters with action types such as Exempt, Block, Allow, or Monitor to override category-based decisions.

Answer

Inside the Application Control sensor blacklist configuration.

Answer

Under Firewall Policy Destination Addresses.

Answer

Within the Intrusion Prevention System (IPS) sensor signature exception list.

Question 13

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Accepted Answer

It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.. When FortiOS enters memory conserve mode, it stops allocating new memory for non-critical tasks, drops new sessions or drops new connection setups depending on configuration, and prevents configuration changes to protect stability.

Answer

It immediately reboots the device to clear RAM.

Answer

It wipes all historical log files from local disk storage.

Answer

It automatically initiates a firmware rollback to the previous stable version.

Question 14

An organization is deploying FortiClient Endpoint Management Server (EMS) alongside FortiGate to enforce Zero Trust Network Access (ZTNA). A remote user's laptop connects to an unsecured public Wi-Fi hotspot. How does the Fortinet ZTNA solution ensure secure application access for this user without establishing a traditional full-tunnel VPN?

Accepted Answer

By dynamically checking endpoint posture tags supplied by FortiClient EMS and applying proxy-based access control per application.. FortiClient ZTNA evaluates device posture (OS patches, antivirus status, registry checks) via EMS tags, and FortiGate acts as a ZTNA proxy, granting application-level access through explicit proxy rules only if posture tags match.

Answer

By forcing all local Wi-Fi traffic through a hardware-based Layer 2 bridge established via FortiExtender.

Answer

By translating all internal server IP addresses into public routable IPs via Static NAT on the endpoint.

Answer

By establishing a permanent IPsec tunnel that encapsulates all endpoint traffic regardless of destination.

Question 15

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

Accepted Answer

Interface IP address and subnet mask. Basic network setup requires configuring physical interface IP addresses, default static routes to reach external networks, and DNS servers for name resolution.

Answer

BGP routing peer AS number

Answer

SSL VPN portal customization