FORTINET-NSE123 Practice Test 2 — 30 Questions

Question 1

Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)

Accepted Answer

Service objects (ports and protocols like HTTP or SSH). Firewall policies match traffic based on source/destination interfaces, source/destination addresses, services, schedules, and user identities.

Answer

FortiGuard signature version number

Answer

CPU utilization percentage of FortiASIC chips

Answer

Administrator GUI idle timeout threshold

Question 2

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Accepted Answer

By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH). Advanced malware often uses alternative lookup methods, such as utilizing hardcoded public DNS resolvers or tunneling protocols, to bypass internal DNS restrictions.

Answer

By relying exclusively on local ARP tables

Answer

By broadcasting requests via local Bluetooth signals

Answer

By converting domain names into physical print jobs

Question 3

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

Accepted Answer

Users and services are granted only the bare minimum permissions required to perform their explicit functions.. Least privilege dictates that users and services should only be granted the minimum permissions necessary to perform their specific functions.

Answer

Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

Answer

Every user account is automatically granted local administrator rights on their assigned workstation by default.

Answer

All administrators share a single root account with full access to simplify password management.

Question 4

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

Accepted Answer

A generic salutation such as 'Dear Customer' instead of the recipient's actual name.. Phishing emails often feature generic greetings, mismatched sender domains, and urgent demands for sensitive information.

Answer

A standard company-wide newsletter detailing upcoming office cafeteria holiday hours.

Answer

A digital signature verifying the cryptographic integrity and authenticity of the sender.

Question 5

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Accepted Answer

Voice phishing (Vishing). Vishing (voice phishing) uses phone calls and social manipulation to trick individuals into divulging confidential information.

Answer

Watering hole attack

Answer

Phishing via SMS (Smishing)

Answer

Credential stuffing

Question 6

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

Accepted Answer

The risk of operational downtime caused by faulty updates. Testing updates prevents faulty patches from causing widespread system instability, crashes, or availability loss in production.

Answer

The risk of unauthorized physical entry to data centers

Answer

The risk of zero-day hardware manufacturing defects

Answer

The risk of social engineering attacks against helpdesk staff

Question 7

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Accepted Answer

Mitigating brute-force and credential-guessing attacks.. Complex passwords increase entropy, making brute-force and dictionary attacks significantly harder to execute successfully.

Answer

Preventing structured SQL injection attacks against web databases.

Answer

Preventing physical theft of laptop hardware.

Answer

Ensuring high network bandwidth availability for video conferencing.

Question 8

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

Accepted Answer

Use a password manager to generate and store unique, strong passwords for each site.. Using a unique, complex password for every service ensures that one breach does not lead to the compromise of other accounts.

Answer

Change passwords only when forced by the system administrator.

Answer

Write passwords on a physical sticky note hidden under the keyboard.

Answer

Use the same password for all work-related accounts to ensure memory efficiency.

Question 9

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. Interface zones group multiple physical or logical interfaces together, allowing administrators to apply a single firewall policy to multiple interfaces sharing the same security requirements.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 10

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Accepted Answer

They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes. Social engineering often relies on manipulation of human emotions such as fear or urgency, impersonation of trusted entities, and bypassing technical controls by targeting users.

Answer

They always require advanced kernel-level debugging tools to execute

Answer

They are entirely preventable by installing a standard graphics card driver update

Question 11

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Accepted Answer

Implementing account lockout policies after a threshold of failed login attempts.. Multi-factor authentication and account lockout policies effectively mitigate credential stuffing and brute-forcing.

Answer

Permitting HTTP plaintext transmission for login forms to speed up authentication.

Answer

Allowing users to share identical passwords to reduce password fatigue.

Answer

Disabling logging mechanisms to prevent server storage bloat.

Question 12

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Phishing, baiting with USB drives, and tech support scams are all classic threat types targeting end users.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 13

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

Accepted Answer

USB baiting exploiting human curiosity and physical media.. Leaving physical media in public spaces to entice curiosity is a social engineering tactic known as USB baiting.

Answer

Man-in-the-middle interception of wireless frames.

Answer

Cross-site scripting executed within a browser session.

Answer

Watering hole attack targeting web browsing habits.

Question 14

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA continuously verifies user identity, device posture, and grants access strictly to specific applications rather than the entire network.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 15

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Accepted Answer

Creating a false sense of urgency and fear of loss.. Attackers create a sense of urgency and panic to bypass critical thinking and prompt immediate compliance.

Answer

Offering financial rewards for completing a corporate survey.

Answer

Establishing authority by impersonating a system administrator calmly.

Answer

Providing technical assistance for routine software patching.

Question 16

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

Accepted Answer

FortiSandbox integration. FortiSandbox executes suspicious files in an isolated virtual sandbox environment to observe behavior and detect zero-day threats.

Answer

Intrusion Prevention System signature matching

Answer

FortiGuard Antivirus signature lookup

Answer

Web filtering URL categorization

Question 17

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

Accepted Answer

To transform employees into an active defense layer capable of recognizing social engineering.. Employees are frequently targeted as the human firewall; training helps them recognize and report social engineering attempts.

Answer

To ensure all personnel understand how to compile source code securely.

Answer

To replace automated endpoint detection and response software with human monitoring.

Answer

To train every staff member to write advanced firewall configuration scripts.

Question 18

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

Accepted Answer

A keystroke injection attack using a compromised HID device.. A device disguised as a standard USB human interface device that injects keystrokes is known as a BadUSB or keystroke injection attack.

Answer

A distributed denial-of-service attack originating from the keyboard firmware.

Answer

A hardware logic bomb that physically destroys the motherboard upon boot.

Answer

A physical RAM scraping attack reading volatile memory contents.

Question 19

Which THREE of the following are recognized signs of a potential phishing attempt?

Accepted Answer

The email uses urgent or threatening language to demand immediate action.. Unexpected attachments, urgent language, and suspicious sender domains are common indicators of phishing.

Answer

The email is sent during standard business hours.

Answer

The email is addressed to the employee by their correct first name.

Question 20

Which Fortinet security product is specifically designed to protect web applications (such as public-facing e-commerce portals) against OWASP Top 10 vulnerabilities like SQL injection and cross-site scripting?

Accepted Answer

FortiWeb. FortiWeb is a Web Application Firewall (WAF) that protects web applications from application-layer attacks and vulnerabilities.

Answer

FortiGate

Answer

FortiMail

Answer

FortiSandbox