FORTINET-NSE123 Practice Test 2 — 25 Questions

Question 1

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

Accepted Answer

To exchange keepalive health packets and synchronize session states and configurations between cluster members. In FortiGate HA active-passive mode, heartbeat interfaces are dedicated links used to exchange keepalive packets (HELLO messages) that monitor cluster member health. They also synchronize session states and configuration changes between the primary and backup units, ensuring seamless failover. This communication is critical for maintaining cluster integrity and stateful failover.

Answer

To connect FortiClient EMS endpoints to the root FortiGate

Answer

To download daily antivirus signature updates from FortiGuard servers

Answer

To route user internet traffic across public WAN connections to the ISP

Question 2

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

Accepted Answer

Web mode is browser-based with bookmarks, while tunnel mode assigns a virtual IP and requires FortiClient. SSL VPN Web Mode is browser-based and provides access to internal web applications through bookmarks and a reverse-proxy portal, requiring no client software. Tunnel Mode, in contrast, assigns the client a virtual IP from a configured pool and requires FortiClient (or a compatible client) to establish a full network tunnel, giving access to any internal resource as if on the LAN.

Answer

Web mode encrypts traffic with IPsec, while tunnel mode uses unencrypted HTTP connections

Answer

Tunnel mode only supports Windows XP, while web mode supports modern mobile browsers

Answer

Web mode requires a hardware FortiToken, while tunnel mode requires no authentication

Question 3

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

Accepted Answer

admin. FortiGate appliances ship with a default administrator account whose username is 'admin' and which has no password initially (forcing a password change on first login in recent firmware). This is documented in Fortinet's default credentials and is required knowledge for initial device setup.

Answer

administrator

Answer

supervisor

Answer

root

Question 4

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

Accepted Answer

Dashboard. The FortiGate GUI's standard menu tree includes Dashboard (A), which is the default landing page showing widgets for system status, licenses, and resource usage. Policy & Objects (C) is a core menu category where firewall policies, addresses, services, and other object definitions are configured. Log & Report (D) is also a standard menu area that provides access to log viewing, forwarding, and report generation. Kernel Debugger (B) is not a GUI menu category; it is a CLI diagnostic tool accessed via commands like 'diagnose debug' or 'diagnose sys top'. BIOS Utility (E) is not part of the FortiGate GUI at all; it is a low-level firmware/hardware setup interface accessed outside FortiOS.

Answer

Kernel Debugger

Answer

BIOS Utility

Question 5

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

Accepted Answer

Flow-based inspection. Flow-based inspection processes packets at Layer 3 and Layer 4 using packet headers without reassembling the application data stream. It is optimized for performance and is the default inspection mode on most FortiGate models, especially those with NP (Network Processor) acceleration.

Answer

Proxy-based inspection

Answer

Deep SSL decryption inspection

Answer

Sandbox isolation inspection

Question 6

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

Accepted Answer

Clean desk policy adherence. The scenario describes sensitive documents left unattended on a shared printer, which directly violates the clean desk policy. A clean desk policy requires employees to secure sensitive materials (physical and digital) when leaving their workspace, including promptly retrieving printouts. This best practice minimizes the risk of unauthorized access, theft, or inadvertent disclosure of confidential information. Thus, the situation highlights the need for clean desk policy adherence.

Answer

Network segmentation compliance

Answer

Endpoint firewall configuration

Answer

Multi-factor authentication protocols

Question 7

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

Accepted Answer

Report the email using the organization's designated phishing reporting mechanism. The email exhibits classic phishing indicators: urgency, authority impersonation (HR), and a request for sensitive financial data. Per foundational security awareness best practices (and frameworks like NIST SP 800-50 and Fortinet's own training), the correct initial action is to report the suspicious email via the organization's designated phishing reporting mechanism (e.g., a 'Report Phish' button or dedicated mailbox). This allows the security team to analyze, block, and remove the threat from other inboxes, and it avoids any interaction that could compromise the user or network.

Answer

Click the link to verify if the website looks authentic before reporting it

Answer

Forward the email to all colleagues as a warning

Answer

Reply to the sender asking for verbal confirmation of their identity

Question 8

Which dashboard widget displays the overall hardware status, serial number, firmware version, and system uptime of the FortiGate?

Accepted Answer

System Information. The System Information widget is the dashboard element that surfaces hostname, serial number, firmware version, system uptime, and overall hardware/HA status. It is the default top widget on a fresh FortiGate dashboard.

Answer

License Information

Answer

Network Interface Monitor

Answer

CLI Console

Question 9

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

Accepted Answer

Ransomware that encrypts critical files and demands payment for access.. A locked screen displaying a cryptocurrency payment demand alongside encrypted files is the textbook signature of ransomware — malware that encrypts victim data and holds it hostage until a payment (often in Bitcoin or Monero) is made. The lock screen with payment instructions is the ransom note.

Answer

A rootkit that grants administrative privileges to remote attackers.

Answer

Adware that automatically displays unwanted promotional banners.

Answer

Spyware that covertly records keystrokes and captures screenshots.

Question 10

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Accepted Answer

Voice phishing (Vishing). Voice phishing (vishing) is a social engineering attack where the attacker uses a phone call to manipulate the victim into revealing sensitive information, such as passwords. In this scenario, the caller impersonates IT helpdesk and creates urgency, which are classic vishing tactics. Vishing exploits human trust over the phone rather than technical vulnerabilities.

Answer

Watering hole attack

Answer

Phishing via SMS (Smishing)

Answer

Credential stuffing

Question 11

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

Accepted Answer

Firewall policies reference the SD-WAN zone name instead of individual physical interfaces. When WAN interfaces are members of an SD-WAN zone, firewall policies reference the SD-WAN zone name as the source or destination interface rather than individual physical interfaces. This abstraction lets SD-WAN rules dynamically select the best member link per session without rewriting policies.

Answer

Firewall policies must only use static routing next-hop IP addresses

Answer

Firewall policies are disabled entirely when SD-WAN is enabled

Answer

Firewall policies must reference every physical WAN interface individually in separate rules

Question 12

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Accepted Answer

SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss). Option A, SD-WAN Performance SLAs, is correct because FortiGate SD-WAN uses SLA probes (e.g., ICMP, HTTP, or UDP echo) to continuously measure latency, jitter, and packet loss per WAN link, and these live metrics are the foundation for deciding whether a link meets the required quality threshold. Option E, SD-WAN rules for dynamic path selection, is correct because SD-WAN rules define the matching criteria (source/destination, application, user, etc.) and the strategy (best quality, lowest cost, load balance, or SLA-based) that tells the FortiGate which member link to steer traffic over, enabling dynamic multi-path routing. Option B, Telnet, is an insecure cleartext remote terminal protocol unrelated to path selection or WAN link quality measurement. Option C, POP3, is a mail retrieval protocol with no role in SD-WAN traffic steering. Option D, SNMP v1 traps, is a legacy monitoring/notification mechanism and does not perform the per-link SLA measurement or dynamic path selection that Fortinet SD-WAN relies on.

Answer

Telnet remote terminal management protocol

Answer

POP3 email retrieval protocol

Answer

SNMP v1 network monitoring traps

Question 13

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) is the centralized management platform specifically designed to manage FortiClient endpoints, enforce compliance policies (such as requiring an active, up-to-date FortiClient agent), and synchronize endpoint security status with the Fortinet Security Fabric. It acts as the authoritative source for endpoint compliance, enabling integration with FortiGate and other Fabric components to grant or deny network access based on endpoint posture. Unlike other Fortinet products, EMS is purpose-built for endpoint management and compliance enforcement.

Answer

FortiSandbox

Answer

FortiAnalyzer

Answer

FortiManager

Question 14

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, a FortiGate operates as a Layer 2 bridge, forwarding Ethernet frames between interfaces without changing IP addresses or performing routing. It still applies security profiles and firewall policies to the bridged traffic, but it is invisible at Layer 3. This allows inline inspection without re-addressing the network.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 15

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, FortiGate by default performs source NAT (SNAT) on outbound traffic, translating the private source IP address to the IP address of the outgoing interface. This allows internal private addresses (RFC 1918) to communicate over the public internet, where private addresses are not routable. The translation is stateful, so return traffic is automatically mapped back to the original internal host.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 16

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

Accepted Answer

Forward the email to the IT helpdesk using the official reporting procedure.. Forwarding the suspicious email to the IT helpdesk via the official reporting procedure allows security teams to investigate, block the sender, and warn other employees who may have received the same message. It also avoids interacting with the malicious content, which is the safest course of action.

Answer

Delete the email and clear the browser cache.

Answer

Click the link to check if the website looks authentic.

Answer

Reply to the email with the requested credentials to avoid account lockout.

Question 17

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN in FortiOS provides Performance SLAs that continuously probe link health (latency, jitter, packet loss) and SD-WAN rules that select the preferred member based on those SLA results. By defining an SLA with a 5% packet-loss threshold and a rule preferring the Fiber member, FortiOS automatically steers traffic to Cable when Fiber violates the SLA. This is the native, intent-based failover mechanism for multiple WAN links.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 18

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Accepted Answer

It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.. When FortiOS enters conserve mode, it stops allocating memory for non-essential cache operations and may block new non-administrative connection attempts (e.g., new sessions that would consume memory) to protect the device from a full memory exhaustion that could crash it. Administrative access is preserved so the admin can remediate. This is a protective degradation, not a reboot or data wipe.

Answer

It immediately reboots the device to clear RAM.

Answer

It wipes all historical log files from local disk storage.

Answer

It automatically initiates a firmware rollback to the previous stable version.

Question 19

An administrator wants to view a chronological list of all administrator logins, configuration changes, and system alerts. Which log category contains this information?

Accepted Answer

Log & Report > System Events. Log & Report > System Events is the correct location because it aggregates administrative activity logs, configuration change logs, and system-level alerts into a single chronological view. FortiGate categorizes these as 'event' logs, which include admin logins, config changes, and system events such as HA transitions or interface up/down. This is the only option that directly provides a unified, time-ordered list of these specific event types.

Answer

Log & Report > Forward Traffic

Answer

Dashboard > Event Summary

Answer

FortiView > Admins

Question 20

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Firewall address groups (option C) are created in FortiGate under Policy & Objects > Addresses to bundle multiple IPv4/IPv6 addresses, IP ranges, FQDNs, or geolocation objects into a single named object, which can then be referenced in firewall policies to match source or destination network resources. Firewall service groups (option D) similarly aggregate multiple service objects (protocol/port definitions such as TCP/80 or UDP/53) into one named object for use in policy service fields, making them the other valid grouping object for firewall policies. SD-WAN performance SLA groups (option A) are used to define health-check thresholds for SD-WAN members, not to group network resources for policy matching. High availability heartbeat groups (option B) relate to HA interface monitoring and cluster communication, not firewall policy objects. Antivirus signature groups (option E) are security-profile components for AV scanning, not address or service groupings used in firewall policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group