FORTINET-NSE123 Practice Test 5 — 10 Questions

Question 1

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

Accepted Answer

Forward the email to the IT helpdesk using the official reporting procedure.. Forwarding the suspicious email to the IT helpdesk via the official reporting procedure allows security teams to investigate, block the sender, and warn other employees who may have received the same message. It also avoids interacting with the malicious content, which is the safest course of action.

Answer

Delete the email and clear the browser cache.

Answer

Click the link to check if the website looks authentic.

Answer

Reply to the email with the requested credentials to avoid account lockout.

Question 2

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN in FortiOS provides Performance SLAs that continuously probe link health (latency, jitter, packet loss) and SD-WAN rules that select the preferred member based on those SLA results. By defining an SLA with a 5% packet-loss threshold and a rule preferring the Fiber member, FortiOS automatically steers traffic to Cable when Fiber violates the SLA. This is the native, intent-based failover mechanism for multiple WAN links.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 3

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Accepted Answer

It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.. When FortiOS enters conserve mode, it stops allocating memory for non-essential cache operations and may block new non-administrative connection attempts (e.g., new sessions that would consume memory) to protect the device from a full memory exhaustion that could crash it. Administrative access is preserved so the admin can remediate. This is a protective degradation, not a reboot or data wipe.

Answer

It immediately reboots the device to clear RAM.

Answer

It wipes all historical log files from local disk storage.

Answer

It automatically initiates a firmware rollback to the previous stable version.

Question 4

An administrator wants to view a chronological list of all administrator logins, configuration changes, and system alerts. Which log category contains this information?

Accepted Answer

Log & Report > System Events. Log & Report > System Events is the correct location because it aggregates administrative activity logs, configuration change logs, and system-level alerts into a single chronological view. FortiGate categorizes these as 'event' logs, which include admin logins, config changes, and system events such as HA transitions or interface up/down. This is the only option that directly provides a unified, time-ordered list of these specific event types.

Answer

Log & Report > Forward Traffic

Answer

Dashboard > Event Summary

Answer

FortiView > Admins

Question 5

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Firewall address groups (option C) are created in FortiGate under Policy & Objects > Addresses to bundle multiple IPv4/IPv6 addresses, IP ranges, FQDNs, or geolocation objects into a single named object, which can then be referenced in firewall policies to match source or destination network resources. Firewall service groups (option D) similarly aggregate multiple service objects (protocol/port definitions such as TCP/80 or UDP/53) into one named object for use in policy service fields, making them the other valid grouping object for firewall policies. SD-WAN performance SLA groups (option A) are used to define health-check thresholds for SD-WAN members, not to group network resources for policy matching. High availability heartbeat groups (option B) relate to HA interface monitoring and cluster communication, not firewall policy objects. Antivirus signature groups (option E) are security-profile components for AV scanning, not address or service groupings used in firewall policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group

Question 6

An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?

Accepted Answer

Network > Interfaces. In FortiGate's web-based manager, the operational status of all physical and logical interfaces is displayed in a summary table under Network > Interfaces. This page shows real-time link status, IP addresses, speed/duplex, and traffic statistics for each interface. It is the central location for monitoring and configuring interface settings, not just configuration.

Answer

Policy & Objects > Interfaces

Answer

Monitor > Interface Summary

Answer

System > Interfaces

Question 7

What is the primary function of a FortiGate Virtual IP (VIP) object?

Accepted Answer

To perform Destination NAT (DNAT) for mapping external public IP addresses to internal private servers. A FortiGate Virtual IP (VIP) object is used to perform Destination NAT (DNAT), mapping an external public IP address and port to an internal private server IP and port. It is the standard mechanism for publishing internal services (web, mail, RDP) to the internet through the FortiGate.

Answer

To encrypt site-to-site VPN tunnels using IPsec phase 1 parameters

Answer

To assign dynamic IP addresses to wireless access points via DHCP

Answer

To group internal source IP addresses for outbound internet browsing policies

Question 8

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

Accepted Answer

Smishing. Smishing is the specific term for phishing conducted via SMS text messages. The attacker impersonates a trusted entity (the bank) and uses a short link to lure the victim into clicking, which is the defining characteristic of SMS-based phishing. The 'SMS' + 'phishing' combination gives the term 'smishing'.

Answer

Spear phishing

Answer

Vishing

Answer

Whaling

Question 9

An administrator needs to test DNS resolution directly from the FortiGate command line interface to troubleshoot a FortiGuard connectivity issue. Which command should be used?

Accepted Answer

execute dns-lookup [hostname]. The correct command is `execute dns-lookup [hostname]` because it directly queries the FortiGate's configured DNS servers to resolve a hostname, providing the exact IP resolution result needed to troubleshoot FortiGuard connectivity. This command uses the FortiGate's DNS resolver settings and returns the resolved IP address or an error, making it the most direct tool for DNS resolution testing. Other commands either perform ICMP checks, display DNS configuration, or are not valid FortiOS commands.

Answer

ping [hostname]

Answer

get system dns

Answer

diagnose test resolv [hostname]

Question 10

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

Accepted Answer

A targeted spear-phishing attack designed for financial fraud.. This is a targeted spear-phishing attack (specifically a business email compromise / CEO fraud variant) where the attacker spoofs or mimics an executive's display name to pressure an employee into an urgent wire transfer. The defining traits — external domain, executive impersonation, urgency, financial request — map directly to spear-phishing for financial fraud. It is targeted, not mass, and relies on social engineering rather than malware.

Answer

A brute-force credential stuffing attack.

Answer

An advanced persistent threat using zero-day malware.

Answer

A standard denial-of-service attack.