FORTINET-NSE123 Practice Test 3 — 10 Questions

Question 1

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Accepted Answer

SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.. Option D is correct because SSL VPN on a FortiGate typically listens on TCP port 443 (HTTPS), which is almost always permitted through restrictive outbound firewalls and NAT devices, whereas IPsec VPN relies on IKE (UDP 500/4500) and ESP (IP protocol 50), which are frequently blocked. Option E is correct because FortiGate SSL VPN supports a clientless web portal mode, allowing users to access internal web resources, bookmarks, and file shares through a browser without installing FortiClient or any pre-installed VPN client. Option A is wrong because IPsec operates at Layer 3 (network layer) and does not use HTTP/HTTPS; it is SSL VPN that leverages TLS/HTTPS at higher layers. Option B is wrong because IKE phase 1 and phase 2 negotiations are characteristics of IPsec VPN, not SSL VPN, which uses TLS handshakes instead. Option C is wrong because a FortiGate can terminate IPsec VPN tunnels natively without any FortiClient EMS license; EMS is only relevant for managing FortiClient endpoints, not for basic IPsec termination.

Answer

IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.

Answer

SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.

Answer

IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.

Question 2

A security analyst is investigating a security alert generated by FortiGate Intrusion Prevention System (IPS). The log indicates that a known exploit signature was detected and dropped. How does FortiGate IPS inspect network traffic to identify such patterns?

Accepted Answer

By matching packet payloads and protocol behavior against a database of known exploit signatures.. FortiGate IPS inspects traffic by matching packet payloads and protocol behavior against a database of known exploit signatures. When a signature matches, the FortiGate can log, alert, or drop the packet depending on the IPS sensor action configured. This is signature-based deep packet inspection at the application layer.

Answer

By forcing all communicating hosts to authenticate via Kerberos before establishing a TCP handshake.

Answer

By monitoring static ARP tables for unauthorized MAC address changes on the local subnet.

Answer

By querying a cloud-based DNS blacklist every time a packet crosses the physical firewall interface.

Question 3

How can an administrator quickly verify whether the FortiGate unit has a valid and active FortiCare support contract from the GUI?

Accepted Answer

System > FortiGuard. The FortiGuard page under System > FortiGuard displays the FortiGate's entitlement status, including the FortiCare support contract, license validity, and individual security service subscriptions (AV, IPS, Web Filter, etc.). Administrators can view the support level, expiry date, and registration status directly from this GUI page. This is the single pane where FortiGate reports its FortiCare registration and service license state.

Answer

Network > Interfaces

Answer

Policy & Objects > Objects

Answer

Log & Report > Event Log

Question 4

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

Accepted Answer

SD-WAN Performance SLAs and Link Cost Rules. SD-WAN Performance SLAs in FortiOS allow the FortiGate to continuously probe multiple WAN links for latency, jitter, and packet loss, then use Link Cost Rules to dynamically steer traffic to the best-performing path. This is the core mechanism for intelligent, application-aware WAN selection in a multi-WAN architecture. It goes beyond simple failover by making routing decisions based on real-time link quality.

Answer

RIPv2 hop-count metric calculation

Answer

Equal-Cost Multi-Path (ECMP) round-robin hashing

Answer

Static routing administrative distance metrics

Question 5

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

Accepted Answer

System Resources. The System Resources widget on the FortiGate web-based manager dashboard displays real-time CPU and memory utilization, along with other resource metrics like session count and log rate. It is included by default on the dashboard and is the standard place administrators check for immediate performance visibility. This directly answers the requirement to check CPU and memory from the GUI.

Answer

FortiView Sessions

Answer

License Information

Answer

Network Interfaces

Question 6

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

Accepted Answer

To exchange keepalive health packets and synchronize session states and configurations between cluster members. In FortiGate HA active-passive mode, heartbeat interfaces are dedicated links used to exchange keepalive packets (HELLO messages) that monitor cluster member health. They also synchronize session states and configuration changes between the primary and backup units, ensuring seamless failover. This communication is critical for maintaining cluster integrity and stateful failover.

Answer

To connect FortiClient EMS endpoints to the root FortiGate

Answer

To download daily antivirus signature updates from FortiGuard servers

Answer

To route user internet traffic across public WAN connections to the ISP

Question 7

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

Accepted Answer

Web mode is browser-based with bookmarks, while tunnel mode assigns a virtual IP and requires FortiClient. SSL VPN Web Mode is browser-based and provides access to internal web applications through bookmarks and a reverse-proxy portal, requiring no client software. Tunnel Mode, in contrast, assigns the client a virtual IP from a configured pool and requires FortiClient (or a compatible client) to establish a full network tunnel, giving access to any internal resource as if on the LAN.

Answer

Web mode encrypts traffic with IPsec, while tunnel mode uses unencrypted HTTP connections

Answer

Tunnel mode only supports Windows XP, while web mode supports modern mobile browsers

Answer

Web mode requires a hardware FortiToken, while tunnel mode requires no authentication

Question 8

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

Accepted Answer

admin. FortiGate appliances ship with a default administrator account whose username is 'admin' and which has no password initially (forcing a password change on first login in recent firmware). This is documented in Fortinet's default credentials and is required knowledge for initial device setup.

Answer

administrator

Answer

supervisor

Answer

root

Question 9

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

Accepted Answer

Dashboard. The FortiGate GUI's standard menu tree includes Dashboard (A), which is the default landing page showing widgets for system status, licenses, and resource usage. Policy & Objects (C) is a core menu category where firewall policies, addresses, services, and other object definitions are configured. Log & Report (D) is also a standard menu area that provides access to log viewing, forwarding, and report generation. Kernel Debugger (B) is not a GUI menu category; it is a CLI diagnostic tool accessed via commands like 'diagnose debug' or 'diagnose sys top'. BIOS Utility (E) is not part of the FortiGate GUI at all; it is a low-level firmware/hardware setup interface accessed outside FortiOS.

Answer

Kernel Debugger

Answer

BIOS Utility

Question 10

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

Accepted Answer

Flow-based inspection. Flow-based inspection processes packets at Layer 3 and Layer 4 using packet headers without reassembling the application data stream. It is optimized for performance and is the default inspection mode on most FortiGate models, especially those with NP (Network Processor) acceleration.

Answer

Proxy-based inspection

Answer

Deep SSL decryption inspection

Answer

Sandbox isolation inspection