FORTINET-NSE123 Practice Test 6 — 10 Questions

Question 1

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network segmentation. Network segmentation is the practice of dividing a network into isolated segments (e.g., guest, internal, DMZ) to control traffic flow and limit lateral movement. Placing guest Wi-Fi users on the same subnet as internal workstations without isolation violates this principle, as guests could potentially access internal resources. The correct answer is network segmentation.

Answer

Cryptographic salting

Answer

Symmetric encryption

Answer

Non-repudiation verification

Question 2

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Option B (IPS sensor) is correct because a FortiGate firewall policy can reference an IPS sensor in its security profiles section, enabling signature-based and anomaly-based inspection of traffic to detect and block intrusions and attacks. Option E (Antivirus profile) is correct because an antivirus profile can likewise be attached to a firewall policy to scan allowed traffic for viruses, worms, and other malware, with actions such as block or monitor. The remaining options are not security profiles: A (Static route table) is a routing construct for forwarding packets, C (DHCP server scope) defines address leases for clients, and D (DNS server forwarding list) configures DNS resolution behavior, none of which are attached to a policy for threat protection.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 3

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

Accepted Answer

Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.. Defense-in-Depth means layering multiple independent security controls so that a failure in one does not compromise the whole system. Implementing network segmentation, endpoint protection, MFA, and user awareness training covers network, endpoint, identity, and human layers, which is the textbook example of a layered defense strategy.

Answer

Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

Answer

Enforcing identical complex passwords across all local and cloud administrative portals.

Answer

Duplicating identical edge firewalls in an active-passive cluster for high availability.

Question 4

Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?

Accepted Answer

Log & Report > System Events. System event logs, including system alerts, warning-level messages, and administrative event logs, are viewed under Log & Report > System Events in the FortiGate GUI. This section aggregates logs from the 'event' log category, which covers admin logins, configuration changes, HA events, and system warnings. The other menus do not display these event logs.

Answer

Security Fabric > Audit

Answer

System > Advanced

Answer

Monitor > Routing Monitor

Question 5

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Accepted Answer

Mitigating brute-force and credential-guessing attacks.. Complex password policies increase the search space an attacker must cover, making brute-force and credential-guessing attacks computationally expensive. Requiring uppercase, lowercase, digits, and special characters raises the number of possible combinations per character position, so even a short password becomes far harder to crack. The objective is to slow down or defeat automated guessing, not to address application-layer or physical threats.

Answer

Preventing structured SQL injection attacks against web databases.

Answer

Preventing physical theft of laptop hardware.

Answer

Ensuring high network bandwidth availability for video conferencing.

Question 6

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Accepted Answer

Under System > Alert Email settings. FortiGate alert email settings are configured globally under System > Alert Email, where the administrator defines the SMTP server, recipient addresses, and which event categories (such as admin login events and configuration changes) trigger an email. This centralized location allows the FortiGate to send real-time notifications for critical events without needing per-policy configuration. The alert email feature is a built-in logging and notification mechanism that operates independently of firewall policies.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the FortiGuard subscription server parameters

Answer

Within the static routing table configuration

Question 7

What is the primary function of a FortiGate static route?

Accepted Answer

To manually specify the next-hop gateway for routing traffic to specific destination networks. A FortiGate static route is used to manually define a path for traffic to a specific destination network by specifying the next-hop gateway. This is a fundamental routing concept where the administrator explicitly sets the route rather than relying on dynamic routing protocols. Static routes are often used for simple networks or to override dynamic routing decisions.

Answer

To translate private internal IP addresses to public WAN IP addresses

Answer

To inspect HTTP web traffic for malicious scripts

Answer

To authenticate remote VPN users against Active Directory

Question 8

What is the primary purpose of a firewall address group in FortiOS?

Accepted Answer

To group multiple address objects together for simplified firewall policy configuration. A firewall address group in FortiOS is a container that bundles multiple address objects (IP addresses, subnets, FQDNs, or geolocation objects) into a single named entity. This simplifies firewall policy configuration because the group can be referenced in a single policy instead of listing each address individually, and updating the group automatically updates all policies that use it.

Answer

To assign dynamic VLAN tags to switch ports

Answer

To configure VPN Phase 1 encryption transforms

Answer

To schedule automated system backup intervals

Question 9

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. In FortiOS, a zone is a logical grouping of one or more physical or virtual interfaces that can be referenced as a single object in firewall policies. This lets an administrator write one policy for 'LAN-to-WAN' instead of duplicating rules for every interface, dramatically simplifying policy management and reducing rule sprawl. Zones are a policy-abstraction feature, not a routing, bandwidth, or DHCP mechanism.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 10

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

Accepted Answer

FortiView > Applications. FortiView > Applications provides aggregated application visibility, showing top applications by bandwidth, sessions, and other metrics. FortiView is FortiGate's built-in analytics dashboard that aggregates log data into visual widgets, and the Applications view specifically ranks applications by traffic volume, making it the correct place to see top bandwidth-consuming applications.

Answer

Log & Report > Forward Traffic

Answer

Security Fabric > Topology

Answer

System > FortiGuard