FORTINET-NSE123 Hard Questions — 25 Difficult Questions

Question 1

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide a routing domain into a two-level hierarchy (backbone Area 0 and other areas) to reduce routing overhead. By summarizing routes at area boundaries, OSPF limits the scope of link-state advertisements (LSAs), reducing CPU, memory, and bandwidth consumption on routers.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 2

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access. Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 3

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

Accepted Answer

They are stored exclusively on the remote FortiAnalyzer and not on the local FortiGate storage.. When a FortiGate is configured to send logs to FortiAnalyzer and local disk logging is not enabled, the traffic logs are transmitted to the remote FortiAnalyzer and are not retained on the FortiGate's local storage. That is why the administrator sees nothing under Log & Report > Forward Traffic on the FortiGate itself — the logs exist, but on FortiAnalyzer. The correct answer reflects that remote logging destinations receive the logs exclusively when local storage is not configured.

Answer

They are stored in the FortiGate system memory ring buffer.

Answer

They are buffered in RAM and will only flush when the FortiGate reboots.

Answer

They are discarded because local logging is automatically disabled when remote logging is active.

Question 4

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

Accepted Answer

SD-WAN Performance SLAs and Link Cost Rules. SD-WAN Performance SLAs in FortiOS allow the FortiGate to continuously probe multiple WAN links for latency, jitter, and packet loss, then use Link Cost Rules to dynamically steer traffic to the best-performing path. This is the core mechanism for intelligent, application-aware WAN selection in a multi-WAN architecture. It goes beyond simple failover by making routing decisions based on real-time link quality.

Answer

RIPv2 hop-count metric calculation

Answer

Equal-Cost Multi-Path (ECMP) round-robin hashing

Answer

Static routing administrative distance metrics

Question 5

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

Accepted Answer

To exchange keepalive health packets and synchronize session states and configurations between cluster members. In FortiGate HA active-passive mode, heartbeat interfaces are dedicated links used to exchange keepalive packets (HELLO messages) that monitor cluster member health. They also synchronize session states and configuration changes between the primary and backup units, ensuring seamless failover. This communication is critical for maintaining cluster integrity and stateful failover.

Answer

To connect FortiClient EMS endpoints to the root FortiGate

Answer

To download daily antivirus signature updates from FortiGuard servers

Answer

To route user internet traffic across public WAN connections to the ISP

Question 6

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

Accepted Answer

Web mode is browser-based with bookmarks, while tunnel mode assigns a virtual IP and requires FortiClient. SSL VPN Web Mode is browser-based and provides access to internal web applications through bookmarks and a reverse-proxy portal, requiring no client software. Tunnel Mode, in contrast, assigns the client a virtual IP from a configured pool and requires FortiClient (or a compatible client) to establish a full network tunnel, giving access to any internal resource as if on the LAN.

Answer

Web mode encrypts traffic with IPsec, while tunnel mode uses unencrypted HTTP connections

Answer

Tunnel mode only supports Windows XP, while web mode supports modern mobile browsers

Answer

Web mode requires a hardware FortiToken, while tunnel mode requires no authentication

Question 7

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

Accepted Answer

Firewall policies reference the SD-WAN zone name instead of individual physical interfaces. When WAN interfaces are members of an SD-WAN zone, firewall policies reference the SD-WAN zone name as the source or destination interface rather than individual physical interfaces. This abstraction lets SD-WAN rules dynamically select the best member link per session without rewriting policies.

Answer

Firewall policies must only use static routing next-hop IP addresses

Answer

Firewall policies are disabled entirely when SD-WAN is enabled

Answer

Firewall policies must reference every physical WAN interface individually in separate rules

Question 8

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, a FortiGate operates as a Layer 2 bridge, forwarding Ethernet frames between interfaces without changing IP addresses or performing routing. It still applies security profiles and firewall policies to the bridged traffic, but it is invisible at Layer 3. This allows inline inspection without re-addressing the network.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 9

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, FortiGate by default performs source NAT (SNAT) on outbound traffic, translating the private source IP address to the IP address of the outgoing interface. This allows internal private addresses (RFC 1918) to communicate over the public internet, where private addresses are not routable. The translation is stateful, so return traffic is automatically mapped back to the original internal host.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 10

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN in FortiOS provides Performance SLAs that continuously probe link health (latency, jitter, packet loss) and SD-WAN rules that select the preferred member based on those SLA results. By defining an SLA with a 5% packet-loss threshold and a rule preferring the Fiber member, FortiOS automatically steers traffic to Cable when Fiber violates the SLA. This is the native, intent-based failover mechanism for multiple WAN links.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 11

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Accepted Answer

It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.. When FortiOS enters conserve mode, it stops allocating memory for non-essential cache operations and may block new non-administrative connection attempts (e.g., new sessions that would consume memory) to protect the device from a full memory exhaustion that could crash it. Administrative access is preserved so the admin can remediate. This is a protective degradation, not a reboot or data wipe.

Answer

It immediately reboots the device to clear RAM.

Answer

It wipes all historical log files from local disk storage.

Answer

It automatically initiates a firmware rollback to the previous stable version.

Question 12

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Accepted Answer

Network segmentation. Network segmentation is the practice of dividing a network into isolated segments (e.g., guest, internal, DMZ) to control traffic flow and limit lateral movement. Placing guest Wi-Fi users on the same subnet as internal workstations without isolation violates this principle, as guests could potentially access internal resources. The correct answer is network segmentation.

Answer

Cryptographic salting

Answer

Symmetric encryption

Answer

Non-repudiation verification

Question 13

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

Accepted Answer

Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.. Defense-in-Depth means layering multiple independent security controls so that a failure in one does not compromise the whole system. Implementing network segmentation, endpoint protection, MFA, and user awareness training covers network, endpoint, identity, and human layers, which is the textbook example of a layered defense strategy.

Answer

Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

Answer

Enforcing identical complex passwords across all local and cloud administrative portals.

Answer

Duplicating identical edge firewalls in an active-passive cluster for high availability.

Question 14

An enterprise security team implements Multi-Factor Authentication (MFA) across all employee accounts. Which combination of authentication factors represents the strongest implementation of MFA?

Accepted Answer

A password, a push notification sent to a physical mobile device, and a biometric thumbprint scan.. It combines three distinct authentication factor categories: something you know (password), something you have (push notification to a physical mobile device), and something you are (biometric thumbprint). This satisfies the strict definition of multi-factor authentication, which requires at least two different factor types, and here three are present. The push notification also adds a real-time possession check, making it resistant to replay and credential-stuffing attacks. This is the strongest implementation among the choices because it maximizes factor diversity and includes a biometric element that is difficult to replicate.

Answer

A smart card and a hardware security token.

Answer

A biometric fingerprint scan and a facial recognition scan.

Answer

A password and a PIN memorized by the user.

Question 15

When configuring an organization's email gateway, which security feature should be enabled to prevent attackers from spoofing the company domain?

Accepted Answer

Implementing SPF, DKIM, and DMARC records.. SPF, DKIM, and DMARC are the industry-standard mechanisms used to verify sender identity and prevent domain spoofing.

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

Enabling SMTP relaying for all internal users.

Answer

multi_select

Answer

Requiring all users to use digital signatures for internal emails only.

Answer

Disabling all attachments in incoming emails.

Question 16

An administrator needs to verify the hardware sensor status (fans, power supplies, temperatures) of a high-end FortiGate unit. Which command provides this hardware health status?

Accepted Answer

get system hardware status. The get system hardware status command displays sensor readings such as fan speed and temperature.

Answer

execute hardware-test

Answer

diagnose hardware device info

Answer

show system sensor

Question 17

An administrator notices that configuration changes made via the CLI are not persisting after a device reboot. What is the most likely reason for this behavior?

Accepted Answer

The administrator exited the configuration block using 'abort' instead of 'end'.. In FortiOS, configuration changes made inside a 'config' block are only committed to the running configuration when the block is closed with 'end'. If the administrator types 'abort' instead, FortiOS discards all changes made within that block, so nothing is written to the running config and nothing persists after reboot. This is the classic cause of 'my CLI changes disappeared' behavior.

Answer

The administrator forgot to issue the 'write memory' command.

Answer

The administrator did not issue a 'execute factory-reset' to commit.

Answer

The administrator failed to enable manual commit mode in system settings.

Question 18

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology. Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 19

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA (Zero Trust Network Access) operates on the principle of 'never trust, always verify' — it continuously validates both user identity and device posture (health, patching, compliance) on every session, not just at initial login. Access is granted on a per-application basis using least-privilege principles, so users only reach the specific apps they need rather than the whole network. This contrasts with traditional VPN-style remote access that grants broad network-level trust after a single authentication event.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 20

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

Accepted Answer

Policy & Objects > Firewall Policy view, by checking the 'Hit Count' column. In the FortiGate GUI, per-policy hit counters are displayed directly in the Policy & Objects > Firewall Policy view as a 'Hit Count' column (sometimes labeled 'Hits' or shown as bytes/packets). This lets an administrator quickly see which policies are matching traffic and which are not, making it the correct place to verify whether a specific rule is being hit.

Answer

FortiView > Policies view

Answer

System > Feature Visibility > Policy Statistics

Answer

Log & Report > Traffic Log Summary