FORTINET-NSE123 Multiple Select — 20 Questions

Question 1

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment. Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 2

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Accepted Answer

Rearrange existing widgets by dragging and dropping them into preferred positions.. Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget. Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Answer

Convert the dashboard into a command-line terminal emulator.

Answer

Delete physical firewall ports from the dashboard interface view.

Answer

Modify core FortiOS kernel code directly from the dashboard widget settings.

Question 3

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access. Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 4

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

Accepted Answer

Configure Trusted Hosts on the administrator account to restrict management login to specific IP addresses.. Option B is correct because configuring Trusted Hosts on an administrator account restricts management logins to specific, pre-approved source IP addresses, which prevents unauthorized hosts from even attempting to authenticate to the FortiGate web-based manager. Option E is correct because disabling HTTP administrative access and enforcing HTTPS only ensures that all management traffic to the web-based manager is encrypted with TLS, protecting credentials and session data from interception or tampering. Options A, C, and D are incorrect because Telnet transmits credentials in cleartext, default accounts with blank passwords are trivially exploitable, and disabling password complexity weakens rather than strengthens administrative security.

Answer

Enable Telnet for administrative CLI access.

Answer

Use default admin accounts with blank passwords.

Answer

Disable password complexity requirements globally.

Question 5

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Accepted Answer

SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.. Option D is correct because SSL VPN on a FortiGate typically listens on TCP port 443 (HTTPS), which is almost always permitted through restrictive outbound firewalls and NAT devices, whereas IPsec VPN relies on IKE (UDP 500/4500) and ESP (IP protocol 50), which are frequently blocked. Option E is correct because FortiGate SSL VPN supports a clientless web portal mode, allowing users to access internal web resources, bookmarks, and file shares through a browser without installing FortiClient or any pre-installed VPN client. Option A is wrong because IPsec operates at Layer 3 (network layer) and does not use HTTP/HTTPS; it is SSL VPN that leverages TLS/HTTPS at higher layers. Option B is wrong because IKE phase 1 and phase 2 negotiations are characteristics of IPsec VPN, not SSL VPN, which uses TLS handshakes instead. Option C is wrong because a FortiGate can terminate IPsec VPN tunnels natively without any FortiClient EMS license; EMS is only relevant for managing FortiClient endpoints, not for basic IPsec termination.

Answer

IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.

Answer

SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.

Answer

IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.

Question 6

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

Accepted Answer

Dashboard. The FortiGate GUI's standard menu tree includes Dashboard (A), which is the default landing page showing widgets for system status, licenses, and resource usage. Policy & Objects (C) is a core menu category where firewall policies, addresses, services, and other object definitions are configured. Log & Report (D) is also a standard menu area that provides access to log viewing, forwarding, and report generation. Kernel Debugger (B) is not a GUI menu category; it is a CLI diagnostic tool accessed via commands like 'diagnose debug' or 'diagnose sys top'. BIOS Utility (E) is not part of the FortiGate GUI at all; it is a low-level firmware/hardware setup interface accessed outside FortiOS.

Answer

Kernel Debugger

Answer

BIOS Utility

Question 7

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Accepted Answer

SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss). Option A, SD-WAN Performance SLAs, is correct because FortiGate SD-WAN uses SLA probes (e.g., ICMP, HTTP, or UDP echo) to continuously measure latency, jitter, and packet loss per WAN link, and these live metrics are the foundation for deciding whether a link meets the required quality threshold. Option E, SD-WAN rules for dynamic path selection, is correct because SD-WAN rules define the matching criteria (source/destination, application, user, etc.) and the strategy (best quality, lowest cost, load balance, or SLA-based) that tells the FortiGate which member link to steer traffic over, enabling dynamic multi-path routing. Option B, Telnet, is an insecure cleartext remote terminal protocol unrelated to path selection or WAN link quality measurement. Option C, POP3, is a mail retrieval protocol with no role in SD-WAN traffic steering. Option D, SNMP v1 traps, is a legacy monitoring/notification mechanism and does not perform the per-link SLA measurement or dynamic path selection that Fortinet SD-WAN relies on.

Answer

Telnet remote terminal management protocol

Answer

POP3 email retrieval protocol

Answer

SNMP v1 network monitoring traps

Question 8

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Firewall address groups (option C) are created in FortiGate under Policy & Objects > Addresses to bundle multiple IPv4/IPv6 addresses, IP ranges, FQDNs, or geolocation objects into a single named object, which can then be referenced in firewall policies to match source or destination network resources. Firewall service groups (option D) similarly aggregate multiple service objects (protocol/port definitions such as TCP/80 or UDP/53) into one named object for use in policy service fields, making them the other valid grouping object for firewall policies. SD-WAN performance SLA groups (option A) are used to define health-check thresholds for SD-WAN members, not to group network resources for policy matching. High availability heartbeat groups (option B) relate to HA interface monitoring and cluster communication, not firewall policy objects. Antivirus signature groups (option E) are security-profile components for AV scanning, not address or service groupings used in firewall policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group

Question 9

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Option B (IPS sensor) is correct because a FortiGate firewall policy can reference an IPS sensor in its security profiles section, enabling signature-based and anomaly-based inspection of traffic to detect and block intrusions and attacks. Option E (Antivirus profile) is correct because an antivirus profile can likewise be attached to a firewall policy to scan allowed traffic for viruses, worms, and other malware, with actions such as block or monitor. The remaining options are not security profiles: A (Static route table) is a routing construct for forwarding packets, C (DHCP server scope) defines address leases for clients, and D (DNS server forwarding list) configures DNS resolution behavior, none of which are attached to a policy for threat protection.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 10

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

Accepted Answer

It provides broad visibility, automated threat detection, and synchronized remediation across distributed security devices.. Option B is correct because the Fortinet Security Fabric is designed to deliver broad network visibility, automated threat detection, and coordinated, synchronized remediation across distributed security devices through Fabric-enabled products and the Fabric Connectors/automation stitches. Option E is correct because the Security Fabric integrates disparate security solutions—FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, endpoint, and third-party products via APIs—into a single collaborative architecture that centralizes management and reduces operational complexity. The unmarked options do not belong: A is wrong because threat intelligence exchange in the Fabric is real-time and automated, not based on offline flat-file backups; C is wrong because the Fabric uses automated Fabric Connectors and Security Fabric automation rather than manual CLI scripting on every downstream device; and D is wrong because the Fabric supports virtual machines, public cloud, and third-party API integrations, not only Fortinet hardware appliances.

Answer

It relies entirely on offline flat-file backups for threat intelligence exchange.

Answer

It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

Answer

It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

Question 11

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology. Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 12

An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)

Accepted Answer

Power supply unit (PSU) status. Options A, B, and D are correct because FortiGate hardware status commands (such as 'get system status', 'diagnose hardware deviceinfo', and the Hardware Status dashboard widget) expose physical chassis telemetry: A (PSU status) reports whether each power supply is present, powered, and functioning; B (internal chassis/CPU temperature sensors) reports thermal readings used to detect overheating that can throttle performance; and D (fan operational status and speeds) reports fan RPM and failure states that directly affect cooling and stability. These are exactly the hardware parameters FortiOS surfaces for high-end appliances during performance troubleshooting. Option C (BGP peer uptime) is incorrect because BGP is a Layer 3 routing protocol monitored via routing/neighbor commands like 'get router info bgp summary', not hardware sensors. Option E (SSL VPN tunnel encryption keys) is incorrect because encryption keys are cryptographic session material, not a monitorable hardware component or sensor.

Answer

Active BGP peer uptime metrics

Answer

SSL VPN tunnel encryption keys

Question 13

When configuring firewall policies on a FortiGate device, an administrator must define matching criteria and actions. Which THREE elements are mandatory components of a standard IPv4 firewall policy in FortiOS? (Choose three.)

Accepted Answer

Source Interface and Destination Interface. In FortiOS, a standard IPv4 firewall policy must specify the traffic's ingress and egress points, so option B (Source Interface and Destination Interface) is required to tell the FortiGate which interfaces the policy applies to. Option D (Source Address and Destination Address objects) is also mandatory because the policy must match traffic based on the originating and receiving IP addresses or address groups. Option E (Service objects, i.e., protocols and port numbers) is required as well, since FortiOS needs to know which TCP/UDP/ICMP services the policy permits or denies. Option A is not a policy component; FortiSandbox cloud registration is a separate licensing/subscription setting, not a per-policy matching criterion. Option C is incorrect because security profiles such as Web Filtering are optional and can be attached to a policy, but they are not mandatory for the policy to exist or function.

Answer

An active FortiSandbox cloud subscription registration key.

Answer

A mandatory Web Filtering security profile attached directly to the policy.

Question 14

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

Accepted Answer

Administrative access settings (e.g., enabling HTTPS and ping for management). Option D is correct because every physical interface that will carry traffic must have an IP address and subnet mask assigned so the FortiGate can participate in the network and route packets between its interfaces before any firewall policy can meaningfully match traffic. Option B is correct because administrative access settings on an interface (for example enabling HTTPS, SSH, or ping for management) determine how the administrator can reach and manage the FortiGate, which is a basic interface-level configuration typically done during initial setup. Option A is incorrect because explicit proxy authentication realms are an advanced web-proxy feature configured under proxy settings, not a prerequisite interface parameter for firewall policies. Option C is incorrect because BGP AS numbers and neighbor peer groups are dynamic routing configurations that are optional and only needed in environments using BGP, not part of basic interface setup. Option E is incorrect because SSL VPN client certificate revocation lists relate to VPN authentication and are configured later, not as a basic physical interface setting.

Answer

Explicit proxy authentication realms

Answer

BGP AS number and neighbor peer groups

Answer

SSL VPN client certificate revocation lists

Question 15

An administrator is examining the FortiGate routing table via the CLI. Which THREE types of routes can appear in the active routing table? (Choose three)

Accepted Answer

Dynamic routes (learned via protocols such as OSPF, BGP, or RIP). The FortiGate active routing table (viewed with 'get router info routing-table all' or 'database') contains three fundamental route sources. Option A is correct because dynamic routes learned through routing protocols such as OSPF, BGP, or RIP are installed in the routing table and marked with their protocol code (O, B, R). Option D is correct because connected routes represent directly attached subnets on FortiGate interfaces and appear automatically with the C code. Option E is correct because static routes manually configured by the administrator are installed in the routing table and marked with the S code. Options B and C are incorrect because firewall policy objects and Security Fabric telemetry do not generate routing table entries; firewall policies control traffic forwarding decisions but are not routes, and Security Fabric telemetry is a logging/visibility feature, not a routing source.

Answer

Firewall policy object routes

Answer

Security Fabric telemetry routes

Question 16

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

Accepted Answer

Implementing network segmentation to restrict lateral movement between departments. Option B is correct because network segmentation (e.g., VLANs, subnets, or microsegmentation) limits lateral movement so that a compromised host in one department cannot freely reach systems in another, adding an internal control layer beyond the perimeter. Option C is correct because requiring multi-factor authentication for all remote and privileged access enforces an additional identity-verification factor (something you know plus something you have/are), directly mitigating credential theft and unauthorized privileged use. These measures align with Defense in Depth by layering preventive controls across network and identity domains rather than trusting a single boundary. Option A is wrong because relying solely on one perimeter firewall creates a single point of failure and ignores insider threats and internal lateral movement. Option D is wrong because deleting logs and monitoring destroys detection, auditing, and incident-response capabilities. Option E is wrong because disabling endpoint antivirus removes a critical host-level control and exposes systems to malware.

Answer

Relying entirely on a single powerful perimeter firewall with no internal security controls

Answer

Eliminating all system logs and monitoring to maximize user privacy

Answer

Disabling all endpoint antivirus solutions to improve computer processing speed

Question 17

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

Accepted Answer

Encryption and hashing algorithms (e.g., AES-256 and SHA-256). In IPsec Phase 1 (IKE SA negotiation), both peers must agree on the encryption and hashing algorithms (e.g., AES-256 and SHA-256), so option B is correct because mismatched proposals cause the IKE negotiation to fail. Option C is correct because the authentication method (pre-shared key or certificates) and the matching PSK/certificate credentials must be identical or mutually trusted on both peers for authentication to succeed. Option D is correct because the Diffie-Hellman group determines the key exchange parameters and must match on both sides to derive the shared secret. Option A is not required because IKE uses timestamps/anti-replay windows rather than requiring identical time zone offsets, and option E is irrelevant since the FortiGate administrator username is a local management credential, not an IPsec Phase 1 parameter.

Answer

System time zone offset in hours

Answer

FortiGate administrator username

Question 18

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Accepted Answer

HTTPS. Option D (HTTPS) is correct because it encrypts administrative GUI/API traffic to the FortiGate interface using TLS on port 443, protecting credentials and session data from eavesdropping. Option E (SSH) is correct because it provides an encrypted CLI management channel, typically on TCP port 22, for secure administrative access. The other options do not belong: POP3 (A) is a mail retrieval protocol, not a management protocol; Telnet (B) is a management protocol but sends credentials and data in cleartext, so it is not secure; and HTTP (C) is an unencrypted web protocol, so it also fails the secure-access requirement.

Answer

POP3

Answer

Telnet

Answer

HTTP

Question 19

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Accepted Answer

Storing passwords in an encrypted password manager application. Option C is correct because an encrypted password manager securely stores credentials using strong encryption (e.g., AES-256) behind a single master passphrase, enabling users to maintain many distinct, high-entropy passwords without memorizing them or writing them in plaintext. Option E is correct because using a unique, complex password for every account prevents credential-stuffing and lateral movement: if one site is breached, the reused secret cannot unlock other systems, which is a foundational habit for both personal and corporate security. Option A is not recommended because a written notepad, even in a locked drawer, stores passwords in plaintext and is vulnerable to physical access, theft, or insider snooping. Option B is wrong because reusing one master password across banking and work systems creates a single point of failure, so one breach compromises every account. Option D is wrong because arbitrary weekly rotation without evidence of compromise encourages weaker, predictable passwords and is not aligned with modern guidance (e.g., NIST) that favors unique credentials and rotation only on suspected compromise.

Answer

Writing passwords on a physical notepad kept inside a locked desk drawer

Answer

Reusing the same strong master password across all banking and work systems for ease of recall

Answer

Changing passwords every single week regardless of whether a compromise is suspected

Question 20

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Accepted Answer

The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.. Option A is correct because social-engineering phishing relies on urgency and threats (e.g., account suspension, legal action, or loss of access) to pressure the recipient into acting before verifying the request. Option C is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are classic spoofing indicators used to impersonate a trusted sender. Options B, D, and E are not indicators: an internal intranet link on the corporate DNS domain, accurate addressing to your real title and department, and legitimate newsletters from an official mailing platform are all consistent with normal, benign email.

Answer

The message includes a link to the corporate intranet home page via the internal DNS domain.

Answer

The email is addressed specifically to your correct full corporate title and department.

Answer

The email contains standard company newsletter updates sent through an official mailing platform.