FORTINET-NSE123 Practice Test 7 — 10 Questions

Question 1

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

Accepted Answer

Security Fabric > Topology. The Security Fabric > Topology widget on the FortiGate dashboard visually displays the connected Security Fabric devices, their roles (root, downstream FortiGates, FortiSwitches, FortiAPs, FortiAnalyzer, etc.), and the links between them. It provides a real-time view of fabric health and device connectivity, making it the correct place to monitor fabric status and topology.

Answer

FortiView Threat Map

Answer

Security Fabric Rating

Answer

System Resources

Question 2

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

Accepted Answer

Security Profile. A Security Profile is the object type that bundles UTM features such as Antivirus, Web Filtering, and Intrusion Prevention (IPS) and is applied to a firewall policy to enforce unified threat management on matching traffic. It allows the administrator to define the security posture for traffic from internal to external. This is the correct object for enforcing UTM on a policy.

Answer

Virtual Domain (VDOM)

Answer

Interface Zone

Answer

Firewall Schedule

Question 3

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Accepted Answer

Using a long, unique passphrase managed by an approved enterprise password manager.. Using a long, unique passphrase managed by an approved enterprise password manager aligns with NIST SP 800-63B and modern zero-trust guidance: length and uniqueness beat complexity and rotation. The password manager ensures each account has a distinct, high-entropy credential that the user never has to memorize or reuse, and enterprise approval ensures the vault meets organizational security and compliance requirements.

Answer

Writing the password on a sticky note attached to the monitor for easy access during shifts.

Answer

Reusing the same strong password across all personal and work applications for easy recall.

Answer

Using a short password with special characters and changing it every 30 days.

Question 4

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

Accepted Answer

By adding the AD user group to the source field of the firewall policy. On a FortiGate, firewall policies can use Active Directory user groups as the source, allowing the device to enforce access based on AD group membership. When a user authenticates (via FSSO, LDAP, or captive portal), the FortiGate maps the user to their AD groups and matches the policy accordingly. This lets you permit internet access for one group while denying it for another without changing routing or interface settings.

Answer

By modifying the physical interface speed settings

Answer

By editing the static routing table metrics

Answer

By applying an Antivirus security profile to the interface

Question 5

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

Accepted Answer

It provides broad visibility, automated threat detection, and synchronized remediation across distributed security devices.. Option B is correct because the Fortinet Security Fabric is designed to deliver broad network visibility, automated threat detection, and coordinated, synchronized remediation across distributed security devices through Fabric-enabled products and the Fabric Connectors/automation stitches. Option E is correct because the Security Fabric integrates disparate security solutions—FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, endpoint, and third-party products via APIs—into a single collaborative architecture that centralizes management and reduces operational complexity. The unmarked options do not belong: A is wrong because threat intelligence exchange in the Fabric is real-time and automated, not based on offline flat-file backups; C is wrong because the Fabric uses automated Fabric Connectors and Security Fabric automation rather than manual CLI scripting on every downstream device; and D is wrong because the Fabric supports virtual machines, public cloud, and third-party API integrations, not only Fortinet hardware appliances.

Answer

It relies entirely on offline flat-file backups for threat intelligence exchange.

Answer

It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

Answer

It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

Question 6

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Accepted Answer

Creating a false sense of urgency and fear of loss.. The email uses a deadline ('deactivated within 24 hours') combined with a threat of losing account access, which is the textbook definition of urgency plus fear of loss — two of the most common social engineering levers. Attackers weaponize time pressure to short-circuit the victim's critical thinking so they click and enter credentials without verifying the sender. This is a hallmark of phishing and pretexting campaigns.

Answer

Offering financial rewards for completing a corporate survey.

Answer

Establishing authority by impersonating a system administrator calmly.

Answer

Providing technical assistance for routine software patching.

Question 7

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology. Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 8

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA (Zero Trust Network Access) operates on the principle of 'never trust, always verify' — it continuously validates both user identity and device posture (health, patching, compliance) on every session, not just at initial login. Access is granted on a per-application basis using least-privilege principles, so users only reach the specific apps they need rather than the whole network. This contrasts with traditional VPN-style remote access that grants broad network-level trust after a single authentication event.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 9

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

Accepted Answer

Log in via the physical console port using the 'maintainer' login procedure during a device reboot.. The standard recovery method for a locked-out FortiGate administrator without losing configuration is to connect via the physical console port and use the 'maintainer' login procedure during a reboot. This involves rebooting the device, interrupting the boot process, and logging in with the maintainer account to reset the admin password or unlock the account while preserving the configuration.

Answer

Perform a hardware factory reset using the pinhole reset button.

Answer

Use the default factory IP address 192.168.1.99 via HTTPS.

Answer

Wait for the lockout timer to expire, which defaults to 24 hours.

Question 10

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

Accepted Answer

Policy & Objects > Firewall Policy view, by checking the 'Hit Count' column. In the FortiGate GUI, per-policy hit counters are displayed directly in the Policy & Objects > Firewall Policy view as a 'Hit Count' column (sometimes labeled 'Hits' or shown as bytes/packets). This lets an administrator quickly see which policies are matching traffic and which are not, making it the correct place to verify whether a specific rule is being hit.

Answer

FortiView > Policies view

Answer

System > Feature Visibility > Policy Statistics

Answer

Log & Report > Traffic Log Summary