FORTINET-NSE123 Practice Test 8 — 10 Questions

Question 1

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

Accepted Answer

Users and services are granted only the bare minimum permissions required to perform their explicit functions.. The principle of least privilege (PoLP) requires that users and service accounts are granted only the minimum permissions necessary to perform their explicit job functions. This limits the blast radius of compromised accounts and reduces the risk of accidental or malicious misuse. Applying PoLP to service accounts means avoiding over-privileged accounts that can perform unrelated administrative tasks.

Answer

Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

Answer

Every user account is automatically granted local administrator rights on their assigned workstation by default.

Answer

All administrators share a single root account with full access to simplify password management.

Question 2

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

Accepted Answer

VPN > SSL-VPN Settings (Server Certificate field). The active SSL VPN server certificate is configured and can be verified or changed under VPN > SSL-VPN Settings in the Server Certificate field. This is where the administrator selects which certificate the FortiGate presents to SSL VPN clients. If users encounter certificate validation errors, checking this setting ensures the correct certificate is bound to the SSL VPN portal.

Answer

Policy & Objects > SSL Settings

Answer

System > Certificates > SSL-VPN

Answer

Security Fabric > VPN Settings

Question 3

Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?

Accepted Answer

FortiView > Destinations. FortiView > Destinations is the built-in analytics view that aggregates log data in real time and displays the top destination IP addresses, countries, and domains accessed by internal users. It pulls from forward traffic logs and presents them in a sortable, drill-down dashboard, which is exactly what the question asks for. This is the standard location for monitoring user browsing destinations on a FortiGate.

Answer

Log & Report > Destination Summary

Answer

Policy & Objects > Destinations

Answer

Monitor > Routing Table

Question 4

An administrator needs to restore a saved configuration file to the FortiGate via the CLI. Which command is used to restore configuration settings from a backup file stored on a TFTP server?

Accepted Answer

execute restore config tftp [filename] [server-IP]. The correct CLI command to restore a configuration backup from a TFTP server on a FortiGate is 'execute restore config tftp [filename] [server-IP]'. This command initiates the restoration process, pulling the specified file from the TFTP server and applying it to the device. It is part of the 'execute' command family used for system-level operations.

Answer

config restore tftp [server-IP] [filename]

Answer

system restore backup [filename]

Answer

upload config tftp [server-IP]

Question 5

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

Accepted Answer

diagnose ip route lookup [dest-IP]. The FortiGate CLI command 'diagnose ip route lookup' (or 'diagnose ip route lookup [dest-IP]') simulates a routing lookup for a specified destination IP and shows which route would be selected, including the outgoing interface and gateway. This is the standard tool for verifying route selection without generating actual traffic.

Answer

show routing-table match [dest-IP]

Answer

get router route-check [dest-IP]

Answer

execute route-test [dest-IP]

Question 6

What is the primary function of a FortiGate firewall policy destination setting?

Accepted Answer

To specify the target IP addresses or subnets that traffic is allowed or denied to reach. In a FortiGate firewall policy, the destination setting defines the target IP addresses, subnets, or address objects that the policy matches on the receiving side of the traffic. It works together with source, service, and schedule to determine whether traffic is permitted or denied toward those destinations. This is the core function of the destination field in policy matching.

Answer

To determine the NTP time server synchronization interval

Answer

To configure the physical port speed and duplex mode

Answer

To set the administrator GUI login timeout threshold

Question 7

An administrator needs to back up the current FortiGate configuration securely to a local PC via the GUI. Which option should the administrator select?

Accepted Answer

System > Settings > Backup Configuration. In FortiOS GUI, the configuration backup is performed via System > Settings > Backup Configuration, which allows the administrator to download the current configuration file (encrypted or plain text) to a local PC. This is the standard, documented path for secure configuration backup through the web-based manager.

Answer

System > Firmware > Backup

Answer

Log & Report > Log Settings > Backup

Answer

Security Fabric > Settings > Export

Question 8

What is the primary function of a FortiGate firewall policy source interface setting?

Accepted Answer

To specify the interface from which incoming traffic must originate to match the policy. The source interface setting in a FortiGate firewall policy specifies which incoming interface traffic must originate from to match the policy. This is a fundamental match criterion: only traffic entering the FortiGate on that interface will be evaluated against the policy. It helps control traffic flow based on network topology.

Answer

To assign dynamic IP addresses to wireless clients via DHCP

Answer

To configure the IPsec VPN Phase 1 encryption keys

Answer

To determine the MAC address of the destination web server

Question 9

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

Accepted Answer

Event logs (System Event logs). HA state transitions (failover, role changes, heartbeat failures) are recorded in the System Event logs, which capture cluster membership changes, interface monitoring failures, and HA daemon events. Checking Event logs on the FortiGate or FortiAnalyzer reveals the exact cause and timestamp of the failover. This is the correct log category for diagnosing HA behavior.

Answer

Antivirus quarantine logs

Answer

Web filtering browsing logs

Answer

DHCP lease assignment logs

Question 10

An administrator needs to view active hardware temperature and power supply statuses on the dashboard. Which widget should be added?

Accepted Answer

Hardware Status widget. The Hardware Status widget on the FortiGate dashboard is specifically designed to display real-time hardware health information, including CPU/motherboard temperatures, fan speeds, and power supply status. Adding this widget gives the administrator immediate visibility into thermal and power conditions, which is exactly what the question asks for. Other widgets focus on traffic, sessions, or inventory rather than physical hardware sensors.

Answer

Device Inventory

Answer

Power Monitor

Answer

System Resources