FORTINET-NSE123 Practice Test 5 — 25 Questions

Question 1

An administrator wants to deploy a wireless network across a corporate campus managed directly by the FortiGate firewall. Which Fortinet technology enables the FortiGate to control and provision FortiAPs directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Built-in FortiGate Wireless Controller using CAPWAP. FortiGate includes a built-in wireless controller that manages FortiAPs using CAPWAP (Control and Provisioning of Wireless Access Points) protocols.

Answer

FortiClient EMS telemetry channels

Answer

External FortiSwitch Manager via SNMP polling

Answer

RADIUS single sign-on wireless bridging

Question 2

An administrator is configuring a FortiGate firewall and needs to ensure that packets matching an explicit allow policy are also logged. Where should the administrator enable logging for this specific policy?

Accepted Answer

Inside the specific firewall policy rule settings under Log Allowed Traffic. Log settings for a firewall policy (such as logging all sessions or security events) are configured directly inside the individual firewall policy rule parameters.

Answer

Inside the static route next-hop configuration

Answer

Within the physical interface administrative access profile

Answer

Under the global system time zone and NTP settings

Question 3

An administrator needs to restrict administrative access to the FortiGate CLI and GUI so that management connections are only accepted from a specific trusted internal management workstation subnet. Where is this source IP restriction configured?

Accepted Answer

On the administrator user account configuration (Trusted Hosts). Trusted hosts can be defined on administrator user accounts to ensure management access is only permitted from specified source IP addresses.

Answer

Within the FortiGuard subscription server list

Answer

Inside the DHCP server IP pool range

Answer

Inside the global DNS server settings

Question 4

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

Accepted Answer

Encryption and hashing algorithms (e.g., AES-256 and SHA-256). IPsec Phase 1 requires matching authentication methods (like pre-shared keys), encryption/hash algorithms, and Diffie-Hellman groups.

Answer

System time zone offset in hours

Answer

FortiGate administrator username

Question 5

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

Accepted Answer

Security Fabric > Topology. The Security Fabric widget or Security Fabric topology view provides visibility into connected fabric devices.

Answer

FortiView Threat Map

Answer

Security Fabric Rating

Answer

System Resources

Question 6

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

Accepted Answer

System > Admin Profiles. Administrator access profiles are managed under System > Admin Profiles.

Answer

Security Fabric > Profiles

Answer

System > Administrators > Profiles

Answer

Policy & Objects > Admin Profiles

Question 7

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

Accepted Answer

SD-WAN Performance SLAs and Link Cost Rules. SD-WAN (Software-Defined WAN) performance SLAs monitor link metrics and dynamically steer traffic based on performance criteria.

Answer

RIPv2 hop-count metric calculation

Answer

Equal-Cost Multi-Path (ECMP) round-robin hashing

Answer

Static routing administrative distance metrics

Question 8

What is the primary purpose of a firewall address group in FortiOS?

Accepted Answer

To group multiple address objects together for simplified firewall policy configuration. Firewall address groups combine multiple individual address objects into a single group, simplifying policy management when rules apply to multiple hosts or subnets.

Answer

To assign dynamic VLAN tags to switch ports

Answer

To configure VPN Phase 1 encryption transforms

Answer

To schedule automated system backup intervals

Question 9

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

Accepted Answer

Web mode is browser-based with bookmarks, while tunnel mode assigns a virtual IP and requires FortiClient. Web mode provides clientless access via a web browser using bookmarks, whereas tunnel mode assigns a virtual IP address and uses FortiClient to provide full network layer access.

Answer

Web mode encrypts traffic with IPsec, while tunnel mode uses unencrypted HTTP connections

Answer

Tunnel mode only supports Windows XP, while web mode supports modern mobile browsers

Answer

Web mode requires a hardware FortiToken, while tunnel mode requires no authentication

Question 10

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

Accepted Answer

The FortiGate CA certificate has not been installed in the trusted root certificate store of the client endpoints.. During Deep Packet Inspection (DPI), FortiGate acts as a man-in-the-middle, re-signing SSL/TLS traffic with its internal CA certificate. If the FortiGate CA certificate is not installed in the client browser's trusted root store, the browser displays untrusted certificate warnings.

Answer

The Web Filtering license on the FortiGate has expired, causing HTTPS inspection to fail open.

Answer

The firewall policy is configured with proxy-based inspection instead of flow-based inspection.

Answer

The Antivirus database update failed, preventing the FortiGate from decrypting TLS 1.3 handshakes.

Question 11

An administrator needs to restore a saved configuration file to the FortiGate via the CLI. Which command is used to restore configuration settings from a backup file stored on a TFTP server?

Accepted Answer

execute restore config tftp [filename] [server-IP]. The execute restore config command is used to restore configuration backups.

Answer

config restore tftp [server-IP] [filename]

Answer

system restore backup [filename]

Answer

upload config tftp [server-IP]

Question 12

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

Accepted Answer

To exchange keepalive health packets and synchronize session states and configurations between cluster members. Heartbeat interfaces are dedicated connections between HA cluster members used to transmit keepalive signals, synchronize configuration states, and maintain session synchronization.

Answer

To connect FortiClient EMS endpoints to the root FortiGate

Answer

To download daily antivirus signature updates from FortiGuard servers

Answer

To route user internet traffic across public WAN connections to the ISP

Question 13

What is the primary function of a FortiGate firewall policy source interface setting?

Accepted Answer

To specify the interface from which incoming traffic must originate to match the policy. The source interface specifies which physical or logical interface traffic must originate from to match the firewall policy rule.

Answer

To assign dynamic IP addresses to wireless clients via DHCP

Answer

To configure the IPsec VPN Phase 1 encryption keys

Answer

To determine the MAC address of the destination web server

Question 14

When configuring dynamic routing on a FortiGate using OSPF, what is the function of a designated router (DR) in a multi-access broadcast network?

Accepted Answer

To centralize LSA exchanges and minimize routing protocol traffic on multi-access broadcast networks. In OSPF broadcast networks, a Designated Router (DR) minimizes routing protocol traffic by acting as a central collection and distribution point for link-state advertisements (LSAs) among all routers on that segment.

Answer

To translate private internal IP addresses to public IPs for internet browsing

Answer

To encrypt user data traffic traversing IPsec VPN tunnels between headquarters and branches

Answer

To distribute antivirus signature updates to isolated FortiGate appliances

Question 15

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

Accepted Answer

Configure remote logging to FortiAnalyzer or Syslog server and enable log overwriting. Configuring centralized logging to FortiAnalyzer or setting up log retention/overwrite policies ensures local storage exhaustion is prevented.

Answer

Disable all firewall policy rule logging permanently

Answer

Lower the physical interface MTU size across all WAN ports

Answer

Switch the FortiGate from NAT mode to Transparent mode

Question 16

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide large autonomous systems into smaller logical hierarchical segments to reduce routing table size, limit link-state update propagation, and optimize convergence.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 17

When configuring an IPsec VPN tunnel between two FortiGate units, what is the purpose of establishing a local ID (Peer ID) in Phase 1?

Accepted Answer

To provide a distinct peer identifier during Phase 1 authentication, particularly useful with dynamic IPs. Local ID allows peers to identify themselves during Phase 1 negotiation, which is especially useful when one or both peers use dynamic IP addresses and need a distinct identifier for authentication matching.

Answer

To assign virtual IP addresses to SSL VPN client workstations

Answer

To encrypt user data payloads using AES-GCM encryption

Answer

To define the static routing administrative distance metric for the VPN tunnel

Question 18

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

Accepted Answer

Endpoint compliance and quarantine enforcement. FortiClient EMS provides endpoint telemetry, vulnerability scanning, and automated quarantine/compliance enforcement.

Answer

Centralized FortiGate firewall policy compilation

Answer

Syslog server log aggregation for routers

Question 19

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Accepted Answer

SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss). Fortinet SD-WAN uses performance SLAs to monitor link health and SD-WAN rules to steer traffic dynamically.

Answer

Telnet remote terminal management protocol

Answer

POP3 email retrieval protocol

Answer

SNMP v1 network monitoring traps

Question 20

An administrator wants to check the operational status of FortiGate HA clustering. Which dashboard widget provides an overview of HA member health and role status?

Accepted Answer

High Availability widget. The High Availability widget displays cluster member status, sync state, and master/slave roles.

Answer

Security Fabric Status

Answer

System Topology

Answer

Cluster Monitor