FORTINET-NSE123 Practice Questions 2 — 50 Questions

Question 1

What is the primary function of FortiMail in an enterprise security architecture?

Accepted Answer

To protect the organization against email-borne threats such as spam, malware, and phishing. FortiMail is a secure email gateway designed to protect organizations from spam, malware, phishing, and data loss via email.

Answer

To act as a centralized log analysis and reporting appliance

Answer

To manage wireless access points and guest Wi-Fi authentication portals

Answer

To provide SSL VPN client tunnels for remote workers

Question 2

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

Accepted Answer

Flow-based inspection. FortiOS supports Flow-based inspection and Proxy-based inspection modes for UTM security profiles.

Answer

NAT routing inspection

Answer

Transparent bridging inspection

Answer

Static gateway inspection

Question 3

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Accepted Answer

Notify the internal IT security or incident response team without delay.. Upon suspecting a compromise, users should disconnect from the network to stop lateral movement and immediately report the incident to IT security.

Answer

Forward the suspicious file to all external clients as a warning alert.

Answer

Delete all system logs and temporary files to clear up disk space for the virus scanner.

Answer

Download and execute unverified registry cleaner utilities from pop-up advertisements.

Question 4

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

Accepted Answer

Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.. Defense-in-depth uses multiple overlapping security controls so that if one control fails, subsequent controls prevent a breach.

Answer

Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

Answer

Enforcing identical complex passwords across all local and cloud administrative portals.

Answer

Duplicating identical edge firewalls in an active-passive cluster for high availability.

Question 5

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. When backing up a FortiGate configuration from the GUI or CLI, administrators can choose to encrypt the configuration file with a password so sensitive secrets like pre-shared keys are protected.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP

Question 6

What is the primary function of a FortiGate static route?

Accepted Answer

To manually specify the next-hop gateway for routing traffic to specific destination networks. A static route manually defines the next-hop IP gateway for specific destination subnets when packets cannot be resolved by directly connected interfaces.

Answer

To translate private internal IP addresses to public WAN IP addresses

Answer

To inspect HTTP web traffic for malicious scripts

Answer

To authenticate remote VPN users against Active Directory

Question 7

An administrator notices that a specific software application is being blocked by Application Control. Upon checking the logs, the administrator wants to create an exception to allow this specific application while keeping the rest of the application control category blocked. How can this be achieved?

Accepted Answer

By adding an Application Override rule inside the Application Control profile. Application Control profiles support application overrides, allowing administrators to add specific allow or block exceptions for individual applications within a category.

Answer

By disabling the entire Antivirus scanning engine globally

Answer

By changing the static routing table administrative distance

Answer

By switching the FortiGate firewall from NAT mode to Transparent mode

Question 8

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. FortiGate supports IPsec VPN, SSL VPN, and FortiClient-based telemetry/VPN tunnels for secure remote access.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 9

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Accepted Answer

Conducting regular security awareness training and simulated phishing tests for all staff.. Effective defense against social engineering combines human security awareness training with robust technical email filtering controls.

Answer

Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.

Answer

Instructing employees to comply immediately with any urgent executive request received via personal email.

Answer

Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.

Question 10

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Accepted Answer

Installing a kernel-level rootkit that hooks into core operating system processes.. Attackers maintain persistence through mechanisms such as scheduled tasks, startup registry keys, or installed rootkits.

Answer

Running a temporary calculation script inside an isolated browser incognito tab.

Answer

Running an optional software update diagnostic tool provided by the hardware manufacturer.

Answer

Clearing the system browser cache and emptying the local operating system recycle bin.

Question 11

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Accepted Answer

The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.. Urgency, mismatched sender domains, and unexpected attachments are key indicators of phishing.

Answer

The message includes a link to the corporate intranet home page via the internal DNS domain.

Answer

The email is addressed specifically to your correct full corporate title and department.

Answer

The email contains standard company newsletter updates sent through an official mailing platform.

Question 12

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

Accepted Answer

admin. The default administrator account on a brand-new or factory-reset FortiGate is 'admin'.

Answer

administrator

Answer

supervisor

Answer

root

Question 13

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

Accepted Answer

It adds a layer of defense even if the primary password is stolen.. MFA requires a second form of verification, ensuring that even if a password is compromised, the attacker cannot access the account.

Answer

It prevents all forms of social engineering.

Answer

It eliminates the need for strong password policies.

Answer

It automatically encrypts all outgoing email traffic.

Question 14

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

Accepted Answer

Forward the email to the IT helpdesk using the official reporting procedure.. Reporting the email via the organization's official phishing reporting mechanism ensures the security team can analyze the threat and protect other users.

Answer

Delete the email and clear the browser cache.

Answer

Click the link to check if the website looks authentic.

Answer

Reply to the email with the requested credentials to avoid account lockout.

Question 15

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

Accepted Answer

Inside an IPv4 firewall policy matching the traffic. Security profiles, such as Antivirus, Web Filtering, and IPS, must be bound to an active IPv4 or IPv6 firewall policy to inspect traffic traversing the FortiGate.

Answer

Directly under the physical interface configuration

Answer

Inside the static routing table configuration

Answer

Under the Global System Settings menu

Question 16

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN performance SLAs monitor latency, jitter, and packet loss, allowing administrators to configure rule-based path selection and automatic failover.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 17

Which of the following scenarios describes a 'pretexting' social engineering attack?

Accepted Answer

An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.. Pretexting involves creating a fabricated scenario to manipulate a victim into providing information.

Answer

An attacker leaves a malicious USB drive in the lobby.

Answer

An attacker uses automated software to guess passwords.

Answer

An attacker shoulder-surfs to capture a password.

Question 18

Which TWO actions should an end-user take to protect their physical workstation security?

Accepted Answer

Store sensitive documents in a locked drawer when not in use.. Locking the screen and keeping sensitive documents stored securely are fundamental physical security controls.

Answer

Disable the screensaver to ensure the system is always visible.

Answer

Leave the workstation unlocked during lunch breaks to save time.

Answer

Write the BIOS password on a post-it note attached to the monitor.

Question 19

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, the FortiGate operates as a bridge (Layer 2 device) without modifying IP addresses, inspecting traffic as it passes between interfaces on the same subnet.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 20

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

Accepted Answer

Active-active distributes session processing across multiple cluster units, whereas active-passive processes all traffic on a single primary unit. In active-active mode, session load is distributed across multiple cluster members using session-pickup/load-balancing mechanisms, whereas active-passive runs all traffic through the primary unit until a failover occurs.

Answer

Active-active requires manual administrator failover, while active-passive is fully automated

Answer

Active-active disables all firewall security profiles to maximize raw throughput

Answer

Active-active eliminates the need for heartbeat cables between cluster units