FORTINET-NSE123 Practice Questions 1 — 50 Questions

Question 1

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment. Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 2

What is the primary function of a FortiAuthenticator device?

Accepted Answer

To centralize user authentication, identity services, and token management. FortiAuthenticator is Fortinet's dedicated identity and access management (IAM) appliance. Its core purpose is to centralize authentication (via RADIUS, LDAP, SAML, etc.), provide identity services such as user identification and group mapping, and manage tokens for two-factor authentication (2FA) and one-time passwords (OTP). It acts as a central point for enforcing authentication policies across the Fortinet Security Fabric and third-party devices. Unlike firewalls or sandboxes, it does not inspect traffic for threats or manage network infrastructure.

Answer

To scan incoming network traffic for virus signatures

Answer

To manage physical switch ports and VLANs via FortiLink

Answer

To analyze zero-day files in an isolated virtual sandbox

Question 3

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Accepted Answer

Rearrange existing widgets by dragging and dropping them into preferred positions.. Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget. Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Answer

Convert the dashboard into a command-line terminal emulator.

Answer

Delete physical firewall ports from the dashboard interface view.

Answer

Modify core FortiOS kernel code directly from the dashboard widget settings.

Question 4

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide a routing domain into a two-level hierarchy (backbone Area 0 and other areas) to reduce routing overhead. By summarizing routes at area boundaries, OSPF limits the scope of link-state advertisements (LSAs), reducing CPU, memory, and bandwidth consumption on routers.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 5

An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?

Accepted Answer

Dashboard > System Information widget (System Mode field). The operational mode (NAT vs. Transparent) is displayed in the Dashboard > System Information widget under the System Mode field. The System Information widget on the default dashboard shows key device details including hostname, firmware version, serial number, and the current system mode, making it the correct place to verify whether the FortiGate is in NAT or Transparent mode.

Answer

System > Feature Visibility > NAT Mode

Answer

Network > Operation Mode

Answer

Policy & Objects > Mode Settings

Question 6

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

Accepted Answer

Establish an authorized corporate VPN connection before accessing internal systems.. A corporate VPN creates an encrypted tunnel (typically IPsec or TLS) between the employee's device and the corporate gateway, so any data traversing the untrusted coffee shop Wi-Fi is protected from eavesdropping. Without this encryption layer, an attacker on the same hotspot can capture credentials, session tokens, and sensitive traffic using tools like Wireshark or a rogue AP. The VPN must be established before any internal resource is accessed so that no cleartext traffic leaks onto the public network.

Answer

Enable local file sharing to speed up document syncing over public connections.

Answer

Disable the operating system firewall to allow seamless packet routing through the hotspot.

Answer

Configure the web browser to accept all SSL certificates to bypass public portal warnings.

Question 7

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. FortiGate allows administrators to encrypt the configuration backup file with a password during export from the GUI. This ensures that the configuration file, which contains sensitive information like passwords and keys, is protected if intercepted or stored insecurely. The option to encrypt with a password is available when performing a backup via System > Config > Backup.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP

Question 8

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

Accepted Answer

A long passphrase consisting of random unrelated words and special characters. A long passphrase made of random unrelated words plus special characters maximizes length and entropy while remaining memorable, which is the strongest practice among the options. Length is the primary defense against brute-force and dictionary attacks, and random unrelated words defeat predictable patterns. This aligns with modern guidance from NIST SP 800-63B, which emphasizes length over complexity.

Answer

A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

Answer

A password reused from personal social media accounts to ensure easy recall

Answer

A short word combined with the current year, such as 'Summer2026!'

Question 9

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard Distribution Network (FDN) is Fortinet's global threat intelligence infrastructure that pushes real-time updates — antivirus signatures, IPS signatures, web filter categories, and other security content — to FortiGate, FortiMail, FortiClient, and other Fortinet devices. It ensures devices have current protection against emerging threats without manual intervention.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 10

An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?

Accepted Answer

It aborts the connection immediately and displays a replacement message to the user. In flow-based inspection mode, when the FortiGate detects an infected file, it aborts the connection immediately and displays a replacement message to the user. This is because flow-based inspection does not buffer the entire file; it scans as data streams and can terminate the session upon detection. The replacement message informs the user why the download failed.

Answer

It drops the packet silently without notifying the user or generating a log

Answer

It buffers the entire file to disk, cleans the file, and then emails the cleaned file to the user

Answer

It allows the download to complete and then quarantines the file locally on the client endpoint

Question 11

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

Accepted Answer

Bandwidth widget. The Bandwidth widget on the FortiGate dashboard is specifically designed to display a historical graph of bandwidth usage (ingress and egress) over selectable time ranges including the last 24 hours. It samples interface throughput counters and renders them as a time-series chart, making it the correct answer for viewing historical traffic trends. This widget is available on the default dashboard and can be customized per admin.

Answer

FortiView Summary

Answer

System > Performance Graphs

Answer

Log & Report > Traffic Graph

Question 12

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Accepted Answer

Leave macros disabled unless the source is fully verified and trusted. The correct action is to leave macros disabled unless the source is fully verified and trusted. Macro-enabled documents are a common attack vector for malware delivery, as macros can execute arbitrary code when enabled. Since the email came from an external partner and the user cannot be certain of its legitimacy, the safest practice is to keep macros disabled and verify the sender through a separate channel before taking any further action.

Answer

Forward the spreadsheet to all company contacts for collaborative viewing

Answer

Print the spreadsheet immediately to a physical printer

Answer

Enable macros immediately so the file displays properly

Question 13

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access. Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 14

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

Accepted Answer

They are stored exclusively on the remote FortiAnalyzer and not on the local FortiGate storage.. When a FortiGate is configured to send logs to FortiAnalyzer and local disk logging is not enabled, the traffic logs are transmitted to the remote FortiAnalyzer and are not retained on the FortiGate's local storage. That is why the administrator sees nothing under Log & Report > Forward Traffic on the FortiGate itself — the logs exist, but on FortiAnalyzer. The correct answer reflects that remote logging destinations receive the logs exclusively when local storage is not configured.

Answer

They are stored in the FortiGate system memory ring buffer.

Answer

They are buffered in RAM and will only flush when the FortiGate reboots.

Answer

They are discarded because local logging is automatically disabled when remote logging is active.

Question 15

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

Accepted Answer

System Resources. The System Resources widget on the FortiGate dashboard is specifically designed to display real-time CPU and memory usage, along with other system-level metrics such as session count and log rate. Adding this widget provides administrators with an at-a-glance view of resource utilization directly on the dashboard. It is the correct choice for monitoring CPU and memory in real time.

Answer

FortiView Sessions

Answer

Log Rate

Answer

License Information

Question 16

An administrator wants to view real-time CPU utilization per system process. Which dashboard widget or view helps identify which process is consuming CPU resources?

Accepted Answer

System Resources widget (Process list). The System Resources widget includes a process list that shows real-time CPU and memory consumption per process on the FortiGate. This is the correct place to identify which daemon (e.g., ipsengine, wad, miglogd) is consuming CPU. It updates live and can be sorted by CPU usage.

Answer

Monitor > Performance Log

Answer

FortiView > Processes

Answer

Log & Report > CPU Logs

Question 17

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

Accepted Answer

Configure Trusted Hosts on the administrator account to restrict management login to specific IP addresses.. Option B is correct because configuring Trusted Hosts on an administrator account restricts management logins to specific, pre-approved source IP addresses, which prevents unauthorized hosts from even attempting to authenticate to the FortiGate web-based manager. Option E is correct because disabling HTTP administrative access and enforcing HTTPS only ensures that all management traffic to the web-based manager is encrypted with TLS, protecting credentials and session data from interception or tampering. Options A, C, and D are incorrect because Telnet transmits credentials in cleartext, default accounts with blank passwords are trivially exploitable, and disabling password complexity weakens rather than strengthens administrative security.

Answer

Enable Telnet for administrative CLI access.

Answer

Use default admin accounts with blank passwords.

Answer

Disable password complexity requirements globally.

Question 18

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

Accepted Answer

Web Filtering profile with malicious domain blocking enabled. A Web Filtering profile with malicious domain blocking enabled uses FortiGuard's categorized URL/domain database to intercept DNS/HTTP requests to known phishing and malware-hosting domains and block them before the connection is established. This is the only profile in the list designed specifically to evaluate destination reputation and deny access to malicious sites at the policy level.

Answer

Data Loss Prevention (DLP) sensor

Answer

Traffic Shaping rule profile

Answer

Antivirus signature profile in flow mode

Question 19

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Accepted Answer

By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH). Advanced malware can bypass blocked external DNS by using alternative public DNS resolvers or DNS-over-HTTPS (DoH), which encrypts DNS queries inside HTTPS traffic on port 443. This makes the malicious domain resolution blend with normal web traffic and evade traditional DNS filtering. DoH in particular is designed to prevent eavesdropping and manipulation, but attackers abuse it to hide C2 communications.

Answer

By relying exclusively on local ARP tables

Answer

By broadcasting requests via local Bluetooth signals

Answer

By converting domain names into physical print jobs

Question 20

An administrator is configuring a new local administrator account with restricted privileges. Where in the web-based manager are administrator accounts and access profiles created and managed?

Accepted Answer

System > Administrators. Administrator accounts and their associated access profiles (permission sets) are created and managed under System > Administrators in the FortiGate GUI. This is the central location where you define local admin users, assign admin profiles, restrict trusted hosts, and configure authentication methods such as LDAP, RADIUS, or local passwords. The access profile itself is also defined here, controlling which VDOMs and functional areas each admin can view or modify.

Answer

Policy & Objects > Admins

Answer

Security Fabric > Access Control

Answer

User & Authentication > Administrator Users