FORTINET-NSE123 Practice Questions 2 — 50 Questions

Question 1

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network segmentation. Network segmentation is the practice of dividing a network into isolated segments (e.g., guest, internal, DMZ) to control traffic flow and limit lateral movement. Placing guest Wi-Fi users on the same subnet as internal workstations without isolation violates this principle, as guests could potentially access internal resources. The correct answer is network segmentation.

Answer

Cryptographic salting

Answer

Symmetric encryption

Answer

Non-repudiation verification

Question 2

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Option B (IPS sensor) is correct because a FortiGate firewall policy can reference an IPS sensor in its security profiles section, enabling signature-based and anomaly-based inspection of traffic to detect and block intrusions and attacks. Option E (Antivirus profile) is correct because an antivirus profile can likewise be attached to a firewall policy to scan allowed traffic for viruses, worms, and other malware, with actions such as block or monitor. The remaining options are not security profiles: A (Static route table) is a routing construct for forwarding packets, C (DHCP server scope) defines address leases for clients, and D (DNS server forwarding list) configures DNS resolution behavior, none of which are attached to a policy for threat protection.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 3

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

Accepted Answer

Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.. Defense-in-Depth means layering multiple independent security controls so that a failure in one does not compromise the whole system. Implementing network segmentation, endpoint protection, MFA, and user awareness training covers network, endpoint, identity, and human layers, which is the textbook example of a layered defense strategy.

Answer

Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

Answer

Enforcing identical complex passwords across all local and cloud administrative portals.

Answer

Duplicating identical edge firewalls in an active-passive cluster for high availability.

Question 4

Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?

Accepted Answer

Log & Report > System Events. System event logs, including system alerts, warning-level messages, and administrative event logs, are viewed under Log & Report > System Events in the FortiGate GUI. This section aggregates logs from the 'event' log category, which covers admin logins, configuration changes, HA events, and system warnings. The other menus do not display these event logs.

Answer

Security Fabric > Audit

Answer

System > Advanced

Answer

Monitor > Routing Monitor

Question 5

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Accepted Answer

Mitigating brute-force and credential-guessing attacks.. Complex password policies increase the search space an attacker must cover, making brute-force and credential-guessing attacks computationally expensive. Requiring uppercase, lowercase, digits, and special characters raises the number of possible combinations per character position, so even a short password becomes far harder to crack. The objective is to slow down or defeat automated guessing, not to address application-layer or physical threats.

Answer

Preventing structured SQL injection attacks against web databases.

Answer

Preventing physical theft of laptop hardware.

Answer

Ensuring high network bandwidth availability for video conferencing.

Question 6

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Accepted Answer

Under System > Alert Email settings. FortiGate alert email settings are configured globally under System > Alert Email, where the administrator defines the SMTP server, recipient addresses, and which event categories (such as admin login events and configuration changes) trigger an email. This centralized location allows the FortiGate to send real-time notifications for critical events without needing per-policy configuration. The alert email feature is a built-in logging and notification mechanism that operates independently of firewall policies.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the FortiGuard subscription server parameters

Answer

Within the static routing table configuration

Question 7

What is the primary function of a FortiGate static route?

Accepted Answer

To manually specify the next-hop gateway for routing traffic to specific destination networks. A FortiGate static route is used to manually define a path for traffic to a specific destination network by specifying the next-hop gateway. This is a fundamental routing concept where the administrator explicitly sets the route rather than relying on dynamic routing protocols. Static routes are often used for simple networks or to override dynamic routing decisions.

Answer

To translate private internal IP addresses to public WAN IP addresses

Answer

To inspect HTTP web traffic for malicious scripts

Answer

To authenticate remote VPN users against Active Directory

Question 8

What is the primary purpose of a firewall address group in FortiOS?

Accepted Answer

To group multiple address objects together for simplified firewall policy configuration. A firewall address group in FortiOS is a container that bundles multiple address objects (IP addresses, subnets, FQDNs, or geolocation objects) into a single named entity. This simplifies firewall policy configuration because the group can be referenced in a single policy instead of listing each address individually, and updating the group automatically updates all policies that use it.

Answer

To assign dynamic VLAN tags to switch ports

Answer

To configure VPN Phase 1 encryption transforms

Answer

To schedule automated system backup intervals

Question 9

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. In FortiOS, a zone is a logical grouping of one or more physical or virtual interfaces that can be referenced as a single object in firewall policies. This lets an administrator write one policy for 'LAN-to-WAN' instead of duplicating rules for every interface, dramatically simplifying policy management and reducing rule sprawl. Zones are a policy-abstraction feature, not a routing, bandwidth, or DHCP mechanism.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 10

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

Accepted Answer

FortiView > Applications. FortiView > Applications provides aggregated application visibility, showing top applications by bandwidth, sessions, and other metrics. FortiView is FortiGate's built-in analytics dashboard that aggregates log data into visual widgets, and the Applications view specifically ranks applications by traffic volume, making it the correct place to see top bandwidth-consuming applications.

Answer

Log & Report > Forward Traffic

Answer

Security Fabric > Topology

Answer

System > FortiGuard

Question 11

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

Accepted Answer

Security Fabric > Topology. The Security Fabric > Topology widget on the FortiGate dashboard visually displays the connected Security Fabric devices, their roles (root, downstream FortiGates, FortiSwitches, FortiAPs, FortiAnalyzer, etc.), and the links between them. It provides a real-time view of fabric health and device connectivity, making it the correct place to monitor fabric status and topology.

Answer

FortiView Threat Map

Answer

Security Fabric Rating

Answer

System Resources

Question 12

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

Accepted Answer

Security Profile. A Security Profile is the object type that bundles UTM features such as Antivirus, Web Filtering, and Intrusion Prevention (IPS) and is applied to a firewall policy to enforce unified threat management on matching traffic. It allows the administrator to define the security posture for traffic from internal to external. This is the correct object for enforcing UTM on a policy.

Answer

Virtual Domain (VDOM)

Answer

Interface Zone

Answer

Firewall Schedule

Question 13

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Accepted Answer

Using a long, unique passphrase managed by an approved enterprise password manager.. Using a long, unique passphrase managed by an approved enterprise password manager aligns with NIST SP 800-63B and modern zero-trust guidance: length and uniqueness beat complexity and rotation. The password manager ensures each account has a distinct, high-entropy credential that the user never has to memorize or reuse, and enterprise approval ensures the vault meets organizational security and compliance requirements.

Answer

Writing the password on a sticky note attached to the monitor for easy access during shifts.

Answer

Reusing the same strong password across all personal and work applications for easy recall.

Answer

Using a short password with special characters and changing it every 30 days.

Question 14

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

Accepted Answer

By adding the AD user group to the source field of the firewall policy. On a FortiGate, firewall policies can use Active Directory user groups as the source, allowing the device to enforce access based on AD group membership. When a user authenticates (via FSSO, LDAP, or captive portal), the FortiGate maps the user to their AD groups and matches the policy accordingly. This lets you permit internet access for one group while denying it for another without changing routing or interface settings.

Answer

By modifying the physical interface speed settings

Answer

By editing the static routing table metrics

Answer

By applying an Antivirus security profile to the interface

Question 15

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

Accepted Answer

It provides broad visibility, automated threat detection, and synchronized remediation across distributed security devices.. Option B is correct because the Fortinet Security Fabric is designed to deliver broad network visibility, automated threat detection, and coordinated, synchronized remediation across distributed security devices through Fabric-enabled products and the Fabric Connectors/automation stitches. Option E is correct because the Security Fabric integrates disparate security solutions—FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, endpoint, and third-party products via APIs—into a single collaborative architecture that centralizes management and reduces operational complexity. The unmarked options do not belong: A is wrong because threat intelligence exchange in the Fabric is real-time and automated, not based on offline flat-file backups; C is wrong because the Fabric uses automated Fabric Connectors and Security Fabric automation rather than manual CLI scripting on every downstream device; and D is wrong because the Fabric supports virtual machines, public cloud, and third-party API integrations, not only Fortinet hardware appliances.

Answer

It relies entirely on offline flat-file backups for threat intelligence exchange.

Answer

It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

Answer

It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

Question 16

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Accepted Answer

Creating a false sense of urgency and fear of loss.. The email uses a deadline ('deactivated within 24 hours') combined with a threat of losing account access, which is the textbook definition of urgency plus fear of loss — two of the most common social engineering levers. Attackers weaponize time pressure to short-circuit the victim's critical thinking so they click and enter credentials without verifying the sender. This is a hallmark of phishing and pretexting campaigns.

Answer

Offering financial rewards for completing a corporate survey.

Answer

Establishing authority by impersonating a system administrator calmly.

Answer

Providing technical assistance for routine software patching.

Question 17

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology. Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 18

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA (Zero Trust Network Access) operates on the principle of 'never trust, always verify' — it continuously validates both user identity and device posture (health, patching, compliance) on every session, not just at initial login. Access is granted on a per-application basis using least-privilege principles, so users only reach the specific apps they need rather than the whole network. This contrasts with traditional VPN-style remote access that grants broad network-level trust after a single authentication event.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 19

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

Accepted Answer

Log in via the physical console port using the 'maintainer' login procedure during a device reboot.. The standard recovery method for a locked-out FortiGate administrator without losing configuration is to connect via the physical console port and use the 'maintainer' login procedure during a reboot. This involves rebooting the device, interrupting the boot process, and logging in with the maintainer account to reset the admin password or unlock the account while preserving the configuration.

Answer

Perform a hardware factory reset using the pinhole reset button.

Answer

Use the default factory IP address 192.168.1.99 via HTTPS.

Answer

Wait for the lockout timer to expire, which defaults to 24 hours.

Question 20

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

Accepted Answer

Policy & Objects > Firewall Policy view, by checking the 'Hit Count' column. In the FortiGate GUI, per-policy hit counters are displayed directly in the Policy & Objects > Firewall Policy view as a 'Hit Count' column (sometimes labeled 'Hits' or shown as bytes/packets). This lets an administrator quickly see which policies are matching traffic and which are not, making it the correct place to verify whether a specific rule is being hit.

Answer

FortiView > Policies view

Answer

System > Feature Visibility > Policy Statistics

Answer

Log & Report > Traffic Log Summary