FORTINET-NSE123 Practice Test 9 — 10 Questions

Question 1

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Maintaining immutable, offline data backups. Immutable, offline backups allow the organization to restore encrypted data without paying the ransom because the backup copies are isolated from the ransomware's reach. Ransomware typically encrypts files on connected systems and network shares, but cannot modify offline or write-once media. This is why the 3-2-1 backup rule (3 copies, 2 media types, 1 offsite) and air-gapped/immutable storage are foundational resilience controls.

Answer

Enforcing mandatory password complexity rules

Answer

Implementing strict egress firewall filtering

Answer

Deploying host-based intrusion detection systems

Question 2

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

Accepted Answer

Log & Report > System Events (Admin Login and CLI Command Logs). Administrative CLI command execution is recorded under Log & Report > System Events, specifically in the Admin Login and CLI Command log subtypes. These logs capture the admin username, source IP, the exact command string, and the timestamp, making them the authoritative source for audit and troubleshooting history.

Answer

Security Fabric > Audit Logs

Answer

FortiView > Command History

Answer

Log & Report > CLI History

Question 3

What is the primary function of a FortiGate interface configured in NAT mode?

Accepted Answer

To route traffic between different subnets and perform Network Address Translation (NAT). A FortiGate interface in NAT mode is a Layer 3 routed interface — it holds an IP address, participates in routing decisions, and applies source NAT (and optionally destination NAT via VIPs) to traffic crossing it. This is the default and most common interface mode on a FortiGate, and it is what allows the device to act as a firewall/router between the LAN and WAN.

Answer

To provide wireless access point management via CAPWAP

Answer

To bridge Ethernet frames at Layer 2 without performing routing or IP translation

Answer

To act as a dedicated storage volume for FortiAnalyzer log archives

Question 4

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

Accepted Answer

SSL VPN Web Mode. SSL VPN Web Mode provides browser-based access through a portal that presents a customizable login page and bookmarks to internal resources (HTTP/HTTPS, RDP, SSH, etc.) without requiring any pre-installed client. It is designed exactly for the scenario described: remote users connecting via a web browser to reach internal resources.

Answer

Explicit Proxy Mode

Answer

IPsec Client Mode

Answer

SSL VPN Tunnel Mode

Question 5

An administrator wants to see a real-time list of top applications generating traffic on the network. Which FortiView tab should be opened?

Accepted Answer

FortiView > Applications. FortiView > Applications is the dedicated real-time analytics view that aggregates live traffic by application, showing top applications, bandwidth consumed, sessions, and source/destination breakdowns. It pulls from the session and UTM logs in real time, so it directly answers 'which applications are generating traffic right now.' This is the correct location for real-time application visibility on a FortiGate.

Answer

Monitor > Application Control

Answer

Log & Report > Application Logs

Answer

Policy & Objects > Applications

Question 6

An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)

Accepted Answer

Power supply unit (PSU) status. Options A, B, and D are correct because FortiGate hardware status commands (such as 'get system status', 'diagnose hardware deviceinfo', and the Hardware Status dashboard widget) expose physical chassis telemetry: A (PSU status) reports whether each power supply is present, powered, and functioning; B (internal chassis/CPU temperature sensors) reports thermal readings used to detect overheating that can throttle performance; and D (fan operational status and speeds) reports fan RPM and failure states that directly affect cooling and stability. These are exactly the hardware parameters FortiOS surfaces for high-end appliances during performance troubleshooting. Option C (BGP peer uptime) is incorrect because BGP is a Layer 3 routing protocol monitored via routing/neighbor commands like 'get router info bgp summary', not hardware sensors. Option E (SSL VPN tunnel encryption keys) is incorrect because encryption keys are cryptographic session material, not a monitorable hardware component or sensor.

Answer

Active BGP peer uptime metrics

Answer

SSL VPN tunnel encryption keys

Question 7

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

Accepted Answer

Principle of Least Privilege. The Principle of Least Privilege (PoLP) mandates that users are granted only the minimum access rights necessary to perform their job functions—nothing more. Restricting access to specific data and applications directly implements this principle by limiting the blast radius of compromised accounts and reducing insider threat risk. Fortinet products like FortiGate and FortiManager enforce PoLP through role-based access control (RBAC) profiles and administrative profiles that define granular permissions.

Answer

Separation of Duties

Answer

Security by Obscurity

Answer

Defense in Depth

Question 8

When configuring firewall policies on a FortiGate device, an administrator must define matching criteria and actions. Which THREE elements are mandatory components of a standard IPv4 firewall policy in FortiOS? (Choose three.)

Accepted Answer

Source Interface and Destination Interface. In FortiOS, a standard IPv4 firewall policy must specify the traffic's ingress and egress points, so option B (Source Interface and Destination Interface) is required to tell the FortiGate which interfaces the policy applies to. Option D (Source Address and Destination Address objects) is also mandatory because the policy must match traffic based on the originating and receiving IP addresses or address groups. Option E (Service objects, i.e., protocols and port numbers) is required as well, since FortiOS needs to know which TCP/UDP/ICMP services the policy permits or denies. Option A is not a policy component; FortiSandbox cloud registration is a separate licensing/subscription setting, not a per-policy matching criterion. Option C is incorrect because security profiles such as Web Filtering are optional and can be attached to a policy, but they are not mandatory for the policy to exist or function.

Answer

An active FortiSandbox cloud subscription registration key.

Answer

A mandatory Web Filtering security profile attached directly to the policy.

Question 9

An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?

Accepted Answer

Dashboard > System Information widget. The Dashboard's System Information widget displays the FortiGate's hostname, firmware version, serial number, uptime, and system resource usage immediately after login. This is the fastest way to verify the running firmware build.

Answer

Log & Report > System Events

Answer

Policy & Objects > Addresses

Answer

Network > Interfaces

Question 10

An administrator needs to test reachability and path MTU to a destination IP using ICMP packets with the Don't Fragment (DF) bit set. Which CLI command allows this?

Accepted Answer

execute ping-options df-bit yes followed by execute ping [dest-IP]. FortiOS uses the two-step 'execute ping-options' then 'execute ping' pattern. Setting 'execute ping-options df-bit yes' enables the Don't Fragment bit on subsequent pings, and 'execute ping <dest-IP>' sends them. This allows path MTU discovery by observing whether large packets are dropped with an ICMP 'fragmentation needed' response.

Answer

set ping df-bit enable

Answer

ping -M do [dest-IP]

Answer

diagnose ping df [dest-IP]