FORTINET-NSE123 Practice Test 3 — 30 Questions

Question 1

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

Accepted Answer

Security Fabric > Topology. The Security Fabric > Topology widget on the FortiGate dashboard visually displays the connected Security Fabric devices, their roles (root, downstream FortiGates, FortiSwitches, FortiAPs, FortiAnalyzer, etc.), and the links between them. It provides a real-time view of fabric health and device connectivity, making it the correct place to monitor fabric status and topology.

Answer

FortiView Threat Map

Answer

Security Fabric Rating

Answer

System Resources

Question 2

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

Accepted Answer

Security Profile. A Security Profile is the object type that bundles UTM features such as Antivirus, Web Filtering, and Intrusion Prevention (IPS) and is applied to a firewall policy to enforce unified threat management on matching traffic. It allows the administrator to define the security posture for traffic from internal to external. This is the correct object for enforcing UTM on a policy.

Answer

Virtual Domain (VDOM)

Answer

Interface Zone

Answer

Firewall Schedule

Question 3

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Accepted Answer

Using a long, unique passphrase managed by an approved enterprise password manager.. Using a long, unique passphrase managed by an approved enterprise password manager aligns with NIST SP 800-63B and modern zero-trust guidance: length and uniqueness beat complexity and rotation. The password manager ensures each account has a distinct, high-entropy credential that the user never has to memorize or reuse, and enterprise approval ensures the vault meets organizational security and compliance requirements.

Answer

Writing the password on a sticky note attached to the monitor for easy access during shifts.

Answer

Reusing the same strong password across all personal and work applications for easy recall.

Answer

Using a short password with special characters and changing it every 30 days.

Question 4

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

Accepted Answer

By adding the AD user group to the source field of the firewall policy. On a FortiGate, firewall policies can use Active Directory user groups as the source, allowing the device to enforce access based on AD group membership. When a user authenticates (via FSSO, LDAP, or captive portal), the FortiGate maps the user to their AD groups and matches the policy accordingly. This lets you permit internet access for one group while denying it for another without changing routing or interface settings.

Answer

By modifying the physical interface speed settings

Answer

By editing the static routing table metrics

Answer

By applying an Antivirus security profile to the interface

Question 5

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

Accepted Answer

It provides broad visibility, automated threat detection, and synchronized remediation across distributed security devices.. Option B is correct because the Fortinet Security Fabric is designed to deliver broad network visibility, automated threat detection, and coordinated, synchronized remediation across distributed security devices through Fabric-enabled products and the Fabric Connectors/automation stitches. Option E is correct because the Security Fabric integrates disparate security solutions—FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, endpoint, and third-party products via APIs—into a single collaborative architecture that centralizes management and reduces operational complexity. The unmarked options do not belong: A is wrong because threat intelligence exchange in the Fabric is real-time and automated, not based on offline flat-file backups; C is wrong because the Fabric uses automated Fabric Connectors and Security Fabric automation rather than manual CLI scripting on every downstream device; and D is wrong because the Fabric supports virtual machines, public cloud, and third-party API integrations, not only Fortinet hardware appliances.

Answer

It relies entirely on offline flat-file backups for threat intelligence exchange.

Answer

It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

Answer

It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

Question 6

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Accepted Answer

Creating a false sense of urgency and fear of loss.. The email uses a deadline ('deactivated within 24 hours') combined with a threat of losing account access, which is the textbook definition of urgency plus fear of loss — two of the most common social engineering levers. Attackers weaponize time pressure to short-circuit the victim's critical thinking so they click and enter credentials without verifying the sender. This is a hallmark of phishing and pretexting campaigns.

Answer

Offering financial rewards for completing a corporate survey.

Answer

Establishing authority by impersonating a system administrator calmly.

Answer

Providing technical assistance for routine software patching.

Question 7

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology. Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 8

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA (Zero Trust Network Access) operates on the principle of 'never trust, always verify' — it continuously validates both user identity and device posture (health, patching, compliance) on every session, not just at initial login. Access is granted on a per-application basis using least-privilege principles, so users only reach the specific apps they need rather than the whole network. This contrasts with traditional VPN-style remote access that grants broad network-level trust after a single authentication event.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 9

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

Accepted Answer

Log in via the physical console port using the 'maintainer' login procedure during a device reboot.. The standard recovery method for a locked-out FortiGate administrator without losing configuration is to connect via the physical console port and use the 'maintainer' login procedure during a reboot. This involves rebooting the device, interrupting the boot process, and logging in with the maintainer account to reset the admin password or unlock the account while preserving the configuration.

Answer

Perform a hardware factory reset using the pinhole reset button.

Answer

Use the default factory IP address 192.168.1.99 via HTTPS.

Answer

Wait for the lockout timer to expire, which defaults to 24 hours.

Question 10

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

Accepted Answer

Policy & Objects > Firewall Policy view, by checking the 'Hit Count' column. In the FortiGate GUI, per-policy hit counters are displayed directly in the Policy & Objects > Firewall Policy view as a 'Hit Count' column (sometimes labeled 'Hits' or shown as bytes/packets). This lets an administrator quickly see which policies are matching traffic and which are not, making it the correct place to verify whether a specific rule is being hit.

Answer

FortiView > Policies view

Answer

System > Feature Visibility > Policy Statistics

Answer

Log & Report > Traffic Log Summary

Question 11

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

Accepted Answer

Users and services are granted only the bare minimum permissions required to perform their explicit functions.. The principle of least privilege (PoLP) requires that users and service accounts are granted only the minimum permissions necessary to perform their explicit job functions. This limits the blast radius of compromised accounts and reduces the risk of accidental or malicious misuse. Applying PoLP to service accounts means avoiding over-privileged accounts that can perform unrelated administrative tasks.

Answer

Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

Answer

Every user account is automatically granted local administrator rights on their assigned workstation by default.

Answer

All administrators share a single root account with full access to simplify password management.

Question 12

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

Accepted Answer

VPN > SSL-VPN Settings (Server Certificate field). The active SSL VPN server certificate is configured and can be verified or changed under VPN > SSL-VPN Settings in the Server Certificate field. This is where the administrator selects which certificate the FortiGate presents to SSL VPN clients. If users encounter certificate validation errors, checking this setting ensures the correct certificate is bound to the SSL VPN portal.

Answer

Policy & Objects > SSL Settings

Answer

System > Certificates > SSL-VPN

Answer

Security Fabric > VPN Settings

Question 13

Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?

Accepted Answer

FortiView > Destinations. FortiView > Destinations is the built-in analytics view that aggregates log data in real time and displays the top destination IP addresses, countries, and domains accessed by internal users. It pulls from forward traffic logs and presents them in a sortable, drill-down dashboard, which is exactly what the question asks for. This is the standard location for monitoring user browsing destinations on a FortiGate.

Answer

Log & Report > Destination Summary

Answer

Policy & Objects > Destinations

Answer

Monitor > Routing Table

Question 14

An administrator needs to restore a saved configuration file to the FortiGate via the CLI. Which command is used to restore configuration settings from a backup file stored on a TFTP server?

Accepted Answer

execute restore config tftp [filename] [server-IP]. The correct CLI command to restore a configuration backup from a TFTP server on a FortiGate is 'execute restore config tftp [filename] [server-IP]'. This command initiates the restoration process, pulling the specified file from the TFTP server and applying it to the device. It is part of the 'execute' command family used for system-level operations.

Answer

config restore tftp [server-IP] [filename]

Answer

system restore backup [filename]

Answer

upload config tftp [server-IP]

Question 15

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

Accepted Answer

diagnose ip route lookup [dest-IP]. The FortiGate CLI command 'diagnose ip route lookup' (or 'diagnose ip route lookup [dest-IP]') simulates a routing lookup for a specified destination IP and shows which route would be selected, including the outgoing interface and gateway. This is the standard tool for verifying route selection without generating actual traffic.

Answer

show routing-table match [dest-IP]

Answer

get router route-check [dest-IP]

Answer

execute route-test [dest-IP]

Question 16

What is the primary function of a FortiGate firewall policy destination setting?

Accepted Answer

To specify the target IP addresses or subnets that traffic is allowed or denied to reach. In a FortiGate firewall policy, the destination setting defines the target IP addresses, subnets, or address objects that the policy matches on the receiving side of the traffic. It works together with source, service, and schedule to determine whether traffic is permitted or denied toward those destinations. This is the core function of the destination field in policy matching.

Answer

To determine the NTP time server synchronization interval

Answer

To configure the physical port speed and duplex mode

Answer

To set the administrator GUI login timeout threshold

Question 17

An administrator needs to back up the current FortiGate configuration securely to a local PC via the GUI. Which option should the administrator select?

Accepted Answer

System > Settings > Backup Configuration. In FortiOS GUI, the configuration backup is performed via System > Settings > Backup Configuration, which allows the administrator to download the current configuration file (encrypted or plain text) to a local PC. This is the standard, documented path for secure configuration backup through the web-based manager.

Answer

System > Firmware > Backup

Answer

Log & Report > Log Settings > Backup

Answer

Security Fabric > Settings > Export

Question 18

What is the primary function of a FortiGate firewall policy source interface setting?

Accepted Answer

To specify the interface from which incoming traffic must originate to match the policy. The source interface setting in a FortiGate firewall policy specifies which incoming interface traffic must originate from to match the policy. This is a fundamental match criterion: only traffic entering the FortiGate on that interface will be evaluated against the policy. It helps control traffic flow based on network topology.

Answer

To assign dynamic IP addresses to wireless clients via DHCP

Answer

To configure the IPsec VPN Phase 1 encryption keys

Answer

To determine the MAC address of the destination web server

Question 19

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

Accepted Answer

Event logs (System Event logs). HA state transitions (failover, role changes, heartbeat failures) are recorded in the System Event logs, which capture cluster membership changes, interface monitoring failures, and HA daemon events. Checking Event logs on the FortiGate or FortiAnalyzer reveals the exact cause and timestamp of the failover. This is the correct log category for diagnosing HA behavior.

Answer

Antivirus quarantine logs

Answer

Web filtering browsing logs

Answer

DHCP lease assignment logs

Question 20

An administrator needs to view active hardware temperature and power supply statuses on the dashboard. Which widget should be added?

Accepted Answer

Hardware Status widget. The Hardware Status widget on the FortiGate dashboard is specifically designed to display real-time hardware health information, including CPU/motherboard temperatures, fan speeds, and power supply status. Adding this widget gives the administrator immediate visibility into thermal and power conditions, which is exactly what the question asks for. Other widgets focus on traffic, sessions, or inventory rather than physical hardware sensors.

Answer

Device Inventory

Answer

Power Monitor

Answer

System Resources