FORTINET-NSE123 Practice Test 2 — 30 Questions

Question 1

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

Accepted Answer

Clean desk policy adherence. The scenario describes sensitive documents left unattended on a shared printer, which directly violates the clean desk policy. A clean desk policy requires employees to secure sensitive materials (physical and digital) when leaving their workspace, including promptly retrieving printouts. This best practice minimizes the risk of unauthorized access, theft, or inadvertent disclosure of confidential information. Thus, the situation highlights the need for clean desk policy adherence.

Answer

Network segmentation compliance

Answer

Endpoint firewall configuration

Answer

Multi-factor authentication protocols

Question 2

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

Accepted Answer

Report the email using the organization's designated phishing reporting mechanism. The email exhibits classic phishing indicators: urgency, authority impersonation (HR), and a request for sensitive financial data. Per foundational security awareness best practices (and frameworks like NIST SP 800-50 and Fortinet's own training), the correct initial action is to report the suspicious email via the organization's designated phishing reporting mechanism (e.g., a 'Report Phish' button or dedicated mailbox). This allows the security team to analyze, block, and remove the threat from other inboxes, and it avoids any interaction that could compromise the user or network.

Answer

Click the link to verify if the website looks authentic before reporting it

Answer

Forward the email to all colleagues as a warning

Answer

Reply to the sender asking for verbal confirmation of their identity

Question 3

Which dashboard widget displays the overall hardware status, serial number, firmware version, and system uptime of the FortiGate?

Accepted Answer

System Information. The System Information widget is the dashboard element that surfaces hostname, serial number, firmware version, system uptime, and overall hardware/HA status. It is the default top widget on a fresh FortiGate dashboard.

Answer

License Information

Answer

Network Interface Monitor

Answer

CLI Console

Question 4

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

Accepted Answer

Ransomware that encrypts critical files and demands payment for access.. A locked screen displaying a cryptocurrency payment demand alongside encrypted files is the textbook signature of ransomware — malware that encrypts victim data and holds it hostage until a payment (often in Bitcoin or Monero) is made. The lock screen with payment instructions is the ransom note.

Answer

A rootkit that grants administrative privileges to remote attackers.

Answer

Adware that automatically displays unwanted promotional banners.

Answer

Spyware that covertly records keystrokes and captures screenshots.

Question 5

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Accepted Answer

Voice phishing (Vishing). Voice phishing (vishing) is a social engineering attack where the attacker uses a phone call to manipulate the victim into revealing sensitive information, such as passwords. In this scenario, the caller impersonates IT helpdesk and creates urgency, which are classic vishing tactics. Vishing exploits human trust over the phone rather than technical vulnerabilities.

Answer

Watering hole attack

Answer

Phishing via SMS (Smishing)

Answer

Credential stuffing

Question 6

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

Accepted Answer

Firewall policies reference the SD-WAN zone name instead of individual physical interfaces. When WAN interfaces are members of an SD-WAN zone, firewall policies reference the SD-WAN zone name as the source or destination interface rather than individual physical interfaces. This abstraction lets SD-WAN rules dynamically select the best member link per session without rewriting policies.

Answer

Firewall policies must only use static routing next-hop IP addresses

Answer

Firewall policies are disabled entirely when SD-WAN is enabled

Answer

Firewall policies must reference every physical WAN interface individually in separate rules

Question 7

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Accepted Answer

SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss). Option A, SD-WAN Performance SLAs, is correct because FortiGate SD-WAN uses SLA probes (e.g., ICMP, HTTP, or UDP echo) to continuously measure latency, jitter, and packet loss per WAN link, and these live metrics are the foundation for deciding whether a link meets the required quality threshold. Option E, SD-WAN rules for dynamic path selection, is correct because SD-WAN rules define the matching criteria (source/destination, application, user, etc.) and the strategy (best quality, lowest cost, load balance, or SLA-based) that tells the FortiGate which member link to steer traffic over, enabling dynamic multi-path routing. Option B, Telnet, is an insecure cleartext remote terminal protocol unrelated to path selection or WAN link quality measurement. Option C, POP3, is a mail retrieval protocol with no role in SD-WAN traffic steering. Option D, SNMP v1 traps, is a legacy monitoring/notification mechanism and does not perform the per-link SLA measurement or dynamic path selection that Fortinet SD-WAN relies on.

Answer

Telnet remote terminal management protocol

Answer

POP3 email retrieval protocol

Answer

SNMP v1 network monitoring traps

Question 8

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) is the centralized management platform specifically designed to manage FortiClient endpoints, enforce compliance policies (such as requiring an active, up-to-date FortiClient agent), and synchronize endpoint security status with the Fortinet Security Fabric. It acts as the authoritative source for endpoint compliance, enabling integration with FortiGate and other Fabric components to grant or deny network access based on endpoint posture. Unlike other Fortinet products, EMS is purpose-built for endpoint management and compliance enforcement.

Answer

FortiSandbox

Answer

FortiAnalyzer

Answer

FortiManager

Question 9

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, a FortiGate operates as a Layer 2 bridge, forwarding Ethernet frames between interfaces without changing IP addresses or performing routing. It still applies security profiles and firewall policies to the bridged traffic, but it is invisible at Layer 3. This allows inline inspection without re-addressing the network.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 10

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, FortiGate by default performs source NAT (SNAT) on outbound traffic, translating the private source IP address to the IP address of the outgoing interface. This allows internal private addresses (RFC 1918) to communicate over the public internet, where private addresses are not routable. The translation is stateful, so return traffic is automatically mapped back to the original internal host.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 11

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

Accepted Answer

Forward the email to the IT helpdesk using the official reporting procedure.. Forwarding the suspicious email to the IT helpdesk via the official reporting procedure allows security teams to investigate, block the sender, and warn other employees who may have received the same message. It also avoids interacting with the malicious content, which is the safest course of action.

Answer

Delete the email and clear the browser cache.

Answer

Click the link to check if the website looks authentic.

Answer

Reply to the email with the requested credentials to avoid account lockout.

Question 12

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN in FortiOS provides Performance SLAs that continuously probe link health (latency, jitter, packet loss) and SD-WAN rules that select the preferred member based on those SLA results. By defining an SLA with a 5% packet-loss threshold and a rule preferring the Fiber member, FortiOS automatically steers traffic to Cable when Fiber violates the SLA. This is the native, intent-based failover mechanism for multiple WAN links.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 13

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Accepted Answer

It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.. When FortiOS enters conserve mode, it stops allocating memory for non-essential cache operations and may block new non-administrative connection attempts (e.g., new sessions that would consume memory) to protect the device from a full memory exhaustion that could crash it. Administrative access is preserved so the admin can remediate. This is a protective degradation, not a reboot or data wipe.

Answer

It immediately reboots the device to clear RAM.

Answer

It wipes all historical log files from local disk storage.

Answer

It automatically initiates a firmware rollback to the previous stable version.

Question 14

An administrator wants to view a chronological list of all administrator logins, configuration changes, and system alerts. Which log category contains this information?

Accepted Answer

Log & Report > System Events. Log & Report > System Events is the correct location because it aggregates administrative activity logs, configuration change logs, and system-level alerts into a single chronological view. FortiGate categorizes these as 'event' logs, which include admin logins, config changes, and system events such as HA transitions or interface up/down. This is the only option that directly provides a unified, time-ordered list of these specific event types.

Answer

Log & Report > Forward Traffic

Answer

Dashboard > Event Summary

Answer

FortiView > Admins

Question 15

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Firewall address groups (option C) are created in FortiGate under Policy & Objects > Addresses to bundle multiple IPv4/IPv6 addresses, IP ranges, FQDNs, or geolocation objects into a single named object, which can then be referenced in firewall policies to match source or destination network resources. Firewall service groups (option D) similarly aggregate multiple service objects (protocol/port definitions such as TCP/80 or UDP/53) into one named object for use in policy service fields, making them the other valid grouping object for firewall policies. SD-WAN performance SLA groups (option A) are used to define health-check thresholds for SD-WAN members, not to group network resources for policy matching. High availability heartbeat groups (option B) relate to HA interface monitoring and cluster communication, not firewall policy objects. Antivirus signature groups (option E) are security-profile components for AV scanning, not address or service groupings used in firewall policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group

Question 16

An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?

Accepted Answer

Network > Interfaces. In FortiGate's web-based manager, the operational status of all physical and logical interfaces is displayed in a summary table under Network > Interfaces. This page shows real-time link status, IP addresses, speed/duplex, and traffic statistics for each interface. It is the central location for monitoring and configuring interface settings, not just configuration.

Answer

Policy & Objects > Interfaces

Answer

Monitor > Interface Summary

Answer

System > Interfaces

Question 17

What is the primary function of a FortiGate Virtual IP (VIP) object?

Accepted Answer

To perform Destination NAT (DNAT) for mapping external public IP addresses to internal private servers. A FortiGate Virtual IP (VIP) object is used to perform Destination NAT (DNAT), mapping an external public IP address and port to an internal private server IP and port. It is the standard mechanism for publishing internal services (web, mail, RDP) to the internet through the FortiGate.

Answer

To encrypt site-to-site VPN tunnels using IPsec phase 1 parameters

Answer

To assign dynamic IP addresses to wireless access points via DHCP

Answer

To group internal source IP addresses for outbound internet browsing policies

Question 18

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

Accepted Answer

Smishing. Smishing is the specific term for phishing conducted via SMS text messages. The attacker impersonates a trusted entity (the bank) and uses a short link to lure the victim into clicking, which is the defining characteristic of SMS-based phishing. The 'SMS' + 'phishing' combination gives the term 'smishing'.

Answer

Spear phishing

Answer

Vishing

Answer

Whaling

Question 19

An administrator needs to test DNS resolution directly from the FortiGate command line interface to troubleshoot a FortiGuard connectivity issue. Which command should be used?

Accepted Answer

execute dns-lookup [hostname]. The correct command is `execute dns-lookup [hostname]` because it directly queries the FortiGate's configured DNS servers to resolve a hostname, providing the exact IP resolution result needed to troubleshoot FortiGuard connectivity. This command uses the FortiGate's DNS resolver settings and returns the resolved IP address or an error, making it the most direct tool for DNS resolution testing. Other commands either perform ICMP checks, display DNS configuration, or are not valid FortiOS commands.

Answer

ping [hostname]

Answer

get system dns

Answer

diagnose test resolv [hostname]

Question 20

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

Accepted Answer

A targeted spear-phishing attack designed for financial fraud.. This is a targeted spear-phishing attack (specifically a business email compromise / CEO fraud variant) where the attacker spoofs or mimics an executive's display name to pressure an employee into an urgent wire transfer. The defining traits — external domain, executive impersonation, urgency, financial request — map directly to spear-phishing for financial fraud. It is targeted, not mass, and relies on social engineering rather than malware.

Answer

A brute-force credential stuffing attack.

Answer

An advanced persistent threat using zero-day malware.

Answer

A standard denial-of-service attack.