FORTINET-NSE123 Practice Test 4 — 25 Questions

Question 1

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

Accepted Answer

To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers. NAT-T encapsulates IPsec ESP packets inside UDP port 4500 packets when a NAT device is detected between the VPN peers, preventing NAT from breaking the IPsec session.

Answer

To assign dynamic DHCP addresses to SSL VPN mobile clients

Answer

To translate internal private web server IP addresses to public IPs for inbound users

Answer

To balance VPN traffic across multiple high availability cluster members

Question 2

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard distribution network provides real-time threat intelligence updates, including antivirus signatures, IPS definitions, and web filtering categories to Fortinet devices.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 3

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Antivirus and IPS (Intrusion Prevention System) are primary security profiles used to detect and block malware and exploits.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 4

What is the primary objective of a 'DDoS' attack?

Accepted Answer

To exhaust system resources and render a service unavailable.. A Distributed Denial of Service attack aims to make a service unavailable by overwhelming it with traffic.

Answer

To steal intellectual property.

Answer

To modify user permissions on the server.

Answer

To install a hidden backdoor for future access.

Question 5

Which THREE steps are critical for an effective cybersecurity incident response plan?

Accepted Answer

Preparation and planning to ensure the team is ready to react.. Preparation, identification, and containment are foundational phases of any incident response lifecycle.

Answer

Ignoring the incident to see if it resolves itself automatically.

Answer

Immediately deleting all corporate data to prevent further theft.

Question 6

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

Accepted Answer

Flow-based inspection. Flow-based inspection examines traffic patterns and metadata efficiently, whereas proxy-based inspection buffers and fully reconstructs application sessions.

Answer

Proxy-based inspection

Answer

Deep SSL decryption inspection

Answer

Sandbox isolation inspection

Question 7

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

Accepted Answer

To negotiate the security parameters and encryption algorithms used to protect user data packets (IPsec SAs). Phase 2 establishes the actual IPsec Security Associations (SAs) that protect user data traffic, negotiating encapsulation protocols (ESP/AH), encryption algorithms, and lifetime parameters.

Answer

To assign dynamic IP addresses to remote dial-up users via DHCP relay

Answer

To verify the administrator credentials attempting to log into the FortiGate GUI

Answer

To establish the initial IKE handshake and peer authentication identity

Question 8

What is the primary function of a FortiSwitch port configured with FortiLink?

Accepted Answer

To establish a secure management and data connection between a FortiGate and a FortiSwitch. FortiLink is a proprietary Fortinet protocol that connects FortiSwitches to a FortiGate firewall, enabling centralized management, VLAN provisioning, and security fabric integration.

Answer

To connect external ISP routers via PPPoE authentication

Answer

To scan emails for spam and phishing attachments

Answer

To tunnel remote worker traffic via IPsec site-to-site protocols

Question 9

Which TWO settings are required when configuring a basic static route on a FortiGate? (Choose two.)

Accepted Answer

Gateway IP address (next-hop). A static route requires a destination IP/subnet and a gateway IP (or outgoing interface) to forward packets.

Answer

IPsec Phase 1 Pre-Shared Key

Answer

Antivirus inspection profile

Answer

DHCP server IP pool range

Question 10

Which TWO of the following are considered 'social engineering' techniques?

Accepted Answer

Baiting a victim with a 'free' USB drive that contains malware.. Baiting and tailgating are both social engineering methods used to exploit human behavior.

Answer

Using a rainbow table to crack hashed passwords.

Answer

Performing a denial of service attack on a web server.

Answer

Using a vulnerability scanner to find open ports.

Question 11

What is the primary function of a FortiSwitch unit when integrated into the Fortinet Security Fabric?

Accepted Answer

To provide secure Layer 2 network access managed directly from the FortiGate. FortiSwitch provides secure Layer 2 access switching that integrates tightly with the FortiGate firewall, allowing centralized management and switch port security features.

Answer

To act as an external DNS and DHCP server for client workstations

Answer

To scan inbound email attachments for spam and phishing attacks

Answer

To provide SSL VPN portal access for remote mobile workers

Question 12

When configuring an SSL VPN tunnel mode connection for mobile workers, what does the FortiGate assign to the client machine to enable communication with internal subnets?

Accepted Answer

A virtual IP address from a configured SSL VPN IP pool. In SSL VPN tunnel mode, the FortiGate assigns a virtual IP address from a dedicated IP pool to the client virtual adapter.

Answer

A static public IP address belonging to the ISP WAN interface

Answer

A physical MAC address mapped to the switch port

Answer

A dynamic DNS hostname managed by FortiGuard

Question 13

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Unexpected system behavior, unauthorized network connections, and modified system files are clear signs of an infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 14

An administrator needs to monitor bandwidth consumption across different applications on the FortiGate. Which feature allows the administrator to view real-time traffic bandwidth by application and enforce traffic shaping guarantees?

Accepted Answer

Traffic Shaping and FortiView Application monitors. Traffic Shaping policies and FortiView application monitors provide visibility and bandwidth control over specific applications and users.

Answer

Static routing administrative distance tables

Answer

Antivirus quarantine logs

Answer

High availability cluster heartbeat monitors

Question 15

An administrator wants to prevent users from uploading confidential company documents to external cloud storage websites. Which Fortinet security profile feature inspects outbound traffic for specific file types or sensitive keywords?

Accepted Answer

Data Loss Prevention (DLP) sensor. Data Loss Prevention (DLP) sensors inspect traffic for sensitive data signatures, file types, and keywords to prevent data exfiltration.

Answer

Intrusion Prevention System (IPS) sensor

Answer

Antivirus profile

Answer

Web filtering profile

Question 16

Which THREE methods can be used to back up or restore a FortiGate configuration? (Choose three.)

Accepted Answer

FortiManager centralized configuration management and revision templates. FortiGate configurations can be backed up or restored via the Web GUI, CLI (console/SSH/TFTP), and centralized management platforms like FortiManager.

Answer

FortiAnalyzer log archive export utilities

Answer

FortiClient EMS endpoint profile synchronization

Question 17

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?

Accepted Answer

FortiAuthenticator. FortiAuthenticator integrates with Active Directory, provides user identity services, and acts as an RADIUS/LDAP server and SSO polling agent.

Answer

FortiWeb application firewall

Answer

FortiAnalyzer reporting engine

Answer

FortiManager policy server

Question 18

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

Accepted Answer

It sends a real-time rating query to the FortiGuard servers to classify the URL. When a URL is uncached or uncategorized locally, the FortiGate queries the FortiGuard Web Filtering rating servers in real-time to determine the category.

Answer

It forwards the page to FortiSandbox for zero-day file execution

Answer

It automatically blocks the website as a high-risk security threat

Answer

It quarantines the user's workstation inside FortiClient EMS

Question 19

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

Accepted Answer

Firewall Schedule object. Schedule objects define specific time periods and days of the week, which can be added to firewall policies to enforce time-based access control.

Answer

Virtual IP (VIP) object

Answer

Application Control signature

Answer

Traffic Shaper object

Question 20

An administrator wants to verify which configuration revision history is currently active and wants to roll back to a previous revision. Where can configuration revisions be managed in the web-based manager?

Accepted Answer

Administrator profile dropdown menu > Configuration > Revision History. Configuration revisions are managed under System > Configuration or via the administrator profile dropdown menu revision history.

Answer

Log & Report > Revision Logs

Answer

System > Maintenance > Rollback

Answer

Security Fabric > Backups