FORTINET-NSE123 Practice Test 8 — 10 Questions

Question 1

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

Accepted Answer

Session synchronization and session pickup settings. FGCP clustering relies on dedicated heartbeat interfaces, cluster hello/keepalive packets, and session synchronization/pickup configurations.

Answer

BGP exterior routing protocol peer autonomous systems

Answer

RADIUS authentication server token polling

Question 2

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

Accepted Answer

Dynamic URL filtering with reputation-based feeds.. URL filtering integrated with threat intelligence feeds allows the gateway to block access to known malicious domains before the connection is established.

Answer

MAC address filtering on the local switch.

Answer

Local static IP filtering.

Answer

Disabling cookies in the browser.

Question 3

An administrator wants to verify which administrator is currently logged into the FortiGate and from which IP address. Which CLI command should be used?

Accepted Answer

get system admin status. Active administrative sessions can be viewed using the get system admin status or system session list commands.

Answer

diagnose sys admin list

Answer

get system user active

Answer

show system admin session

Question 4

An administrator needs to check the status of static routes configured on the FortiGate. Which CLI command lists all static routes?

Accepted Answer

get router info routing-table static. The get router info routing-table static command displays configured static routes.

Answer

config router static show

Answer

show firewall static-route

Answer

diagnose ip route list static

Question 5

An administrator needs to verify whether FortiGuard web filtering rating lookups are succeeding for specific categories. Which CLI command tests web filter rating lookups for a specific URL?

Accepted Answer

diagnose webfilter FortiGuard lookup [URL]. The diagnose webfilter FortiGuard lookup command tests URL categorization.

Answer

get webfilter status [URL]

Answer

execute webfilter-test [URL]

Answer

ping fortiguard-rating [URL]

Question 6

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

Accepted Answer

To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers. NAT-T encapsulates IPsec ESP packets inside UDP port 4500 packets when a NAT device is detected between the VPN peers, preventing NAT from breaking the IPsec session.

Answer

To assign dynamic DHCP addresses to SSL VPN mobile clients

Answer

To translate internal private web server IP addresses to public IPs for inbound users

Answer

To balance VPN traffic across multiple high availability cluster members

Question 7

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard distribution network provides real-time threat intelligence updates, including antivirus signatures, IPS definitions, and web filtering categories to Fortinet devices.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 8

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Antivirus and IPS (Intrusion Prevention System) are primary security profiles used to detect and block malware and exploits.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 9

What is the primary objective of a 'DDoS' attack?

Accepted Answer

To exhaust system resources and render a service unavailable.. A Distributed Denial of Service attack aims to make a service unavailable by overwhelming it with traffic.

Answer

To steal intellectual property.

Answer

To modify user permissions on the server.

Answer

To install a hidden backdoor for future access.

Question 10

Which THREE steps are critical for an effective cybersecurity incident response plan?

Accepted Answer

Preparation and planning to ensure the team is ready to react.. Preparation, identification, and containment are foundational phases of any incident response lifecycle.

Answer

Ignoring the incident to see if it resolves itself automatically.

Answer

Immediately deleting all corporate data to prevent further theft.