FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security — 25 Questions

Question 1

An enterprise branch office needs to establish a secure, encrypted site-to-site tunnel back to the headquarters FortiGate over the public internet. Which VPN technology provides a standard IPsec framework combined with Fortinet Security Fabric integration features?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IPsec VPN tunnel in route-based mode. A route-based IPsec VPN tunnel on FortiGate uses the standard IPsec framework (IKEv1/IKEv2, ESP) to establish an encrypted site-to-site connection over the public internet, and it integrates natively with the Fortinet Security Fabric. This integration allows the tunnel interface to participate in Security Fabric features such as dynamic routing, security profiles, and central management via FortiManager. Route-based mode is the recommended approach for site-to-site VPNs because it creates a virtual interface that can be referenced in firewall policies and routing tables, enabling granular control and visibility within the Fabric.

Answer

FortiClient EMS telemetry connection

Answer

SSL VPN web portal mode

Answer

RADIUS single sign-on agent

Question 2

An organization wants to implement the Fortinet Security Fabric to gain centralized visibility across multiple distributed security devices. Which core protocol is utilized by Security Fabric devices to discover, authenticate, and securely communicate with the root FortiGate?

Accepted Answer

Security Fabric Downstream Heartbeat and REST API telemetry. Fortinet Security Fabric devices use the Security Fabric Downstream Heartbeat and REST API telemetry to discover, authenticate, and securely communicate with the root FortiGate. The root FortiGate acts as the Fabric root, and downstream devices establish a secure connection using the fabric's proprietary heartbeat protocol over TLS, exchanging telemetry and configuration data via REST API. This enables centralized visibility and management across distributed devices.

Answer

Dynamic Host Configuration Protocol (DHCP) option 43

Answer

Simple Network Management Protocol (SNMP) v3 traps

Answer

Syslog over unencrypted UDP port 514

Question 3

An administrator wants to deploy a wireless network across a corporate campus managed directly by the FortiGate firewall. Which Fortinet technology enables the FortiGate to control and provision FortiAPs directly?

Accepted Answer

Built-in FortiGate Wireless Controller using CAPWAP. The FortiGate firewall includes a built-in wireless controller that uses the CAPWAP (Control And Provisioning of Wireless Access Points) protocol to directly manage and provision FortiAP access points. This allows the FortiGate to act as a single point of control for the wireless network, handling AP discovery, configuration, firmware updates, and client authentication without needing an external controller. CAPWAP is the standard protocol for this purpose, operating over UDP ports 5246 (control) and 5247 (data).

Answer

FortiClient EMS telemetry channels

Answer

External FortiSwitch Manager via SNMP polling

Answer

RADIUS single sign-on wireless bridging

Question 4

An administrator notices that a specific software application is being blocked by Application Control. Upon checking the logs, the administrator wants to create an exception to allow this specific application while keeping the rest of the application control category blocked. How can this be achieved?

Accepted Answer

By adding an Application Override rule inside the Application Control profile. To allow a specific application while keeping the rest of the category blocked, the administrator should create an Application Override rule within the Application Control profile. Application Override rules take precedence over the application control signatures and allow the administrator to define custom behavior for specific applications, such as allowing them or assigning different actions.

Answer

By disabling the entire Antivirus scanning engine globally

Answer

By changing the static routing table administrative distance

Answer

By switching the FortiGate firewall from NAT mode to Transparent mode

Question 5

Which TWO firewall operational modes can be configured on a FortiGate device? (Choose two.)

Accepted Answer

Transparent mode. Option C (Transparent mode) is correct because a FortiGate in transparent mode operates as a Layer 2 bridge, forwarding traffic between interfaces without changing IP addresses or acting as a router hop, which is a valid operational mode configured via 'set vdom-mode' or interface settings. Option E (NAT mode) is correct because NAT/route mode is the default operational mode where the FortiGate routes traffic between different subnets and performs source NAT on outgoing packets, configured per VDOM. The other options are not FortiGate firewall operational modes: sandbox isolation (A) refers to FortiSandbox behavior, promiscuous sniffing (B) describes a one-arm sniffer/IDS interface rather than a device mode, and endpoint agent mode (D) relates to FortiClient EMS endpoint management, not a FortiGate firewall mode.

Answer

Sandbox isolation mode

Answer

Promiscuous sniffing mode

Answer

Endpoint agent mode

Question 6

A security analyst is reviewing a FortiGate configuration and notices that a firewall policy has the action set to 'DENY' but the 'Log Violation Traffic' option is disabled. The analyst wants to ensure that all denied traffic is logged for auditing purposes. What should the analyst do?

Accepted Answer

Enable 'Log Violation Traffic' in the firewall policy.. To log denied traffic in a FortiGate firewall policy, the 'Log Violation Traffic' option must be enabled. This setting specifically logs traffic that is denied by the policy. Other logging options pertain to allowed traffic and do not capture denied traffic. Therefore, enabling 'Log Violation Traffic' is the correct action.

Answer

Set the action to 'ALLOW' and enable 'Log Allowed Traffic'.

Answer

Enable 'Log Allowed Traffic' in the firewall policy.

Answer

Configure a separate firewall policy with action 'DENY' and enable 'Log Allowed Traffic'.

Question 7

An administrator is configuring a FortiGate to use two-factor authentication for SSL VPN users. The administrator wants to combine something the user knows with something the user has. Which TWO authentication methods can be combined to achieve this? (Choose two.)

Accepted Answer

FortiToken mobile push. Two-factor authentication requires combining two different factors: something you know (password) and something you have (token). A local password database provides the knowledge factor, while FortiToken mobile push provides the possession factor. LDAP and RADIUS are authentication servers that can store credentials but do not inherently add a second factor. A client certificate is a possession factor, but it is not the typical pairing for SSL VPN two-factor with FortiGate.

Answer

LDAP server

Answer

RADIUS server

Answer

Client certificate

Question 8

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) is the centralized management platform specifically designed to manage FortiClient endpoints, enforce compliance policies (such as requiring an active, up-to-date FortiClient agent), and synchronize endpoint security status with the Fortinet Security Fabric. It acts as the authoritative source for endpoint compliance, enabling integration with FortiGate and other Fabric components to grant or deny network access based on endpoint posture. Unlike other Fortinet products, EMS is purpose-built for endpoint management and compliance enforcement.

Answer

FortiSandbox

Answer

FortiAnalyzer

Answer

FortiManager

Question 9

An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?

Accepted Answer

IPS sensor. An IPS sensor is the FortiGate feature that detects and blocks known vulnerability exploits and attack signatures. It inspects traffic against a signature database and can take action (block, monitor, reset) based on the matched signature, making it the correct choice for protecting internal servers from exploits.

Answer

Web Filtering profile

Answer

Application Control profile

Answer

Data Loss Prevention (DLP) sensor

Question 10

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

Accepted Answer

Inside an IPv4 firewall policy matching the traffic. In FortiOS, security profiles such as antivirus, IPS, web filter, and application control are enforced only when referenced inside a firewall policy that matches the traffic. The policy is the enforcement point where inspection profiles are attached and applied to flows traversing the FortiGate. Applying a profile anywhere else (interface, routing, global settings) does not trigger inspection of matching sessions.

Answer

Directly under the physical interface configuration

Answer

Inside the static routing table configuration

Answer

Under the Global System Settings menu

Question 11

An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?

Accepted Answer

Web Filtering profile. A Web Filtering profile on the FortiGate allows administrators to block or allow access to specific website categories, such as social media, based on FortiGuard categories or custom URL lists. It is the correct feature to enforce acceptable use policies and restrict unauthorized browsing.

Answer

DNS Filter profile

Answer

IPS sensor

Answer

Antivirus profile

Question 12

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

Accepted Answer

Flow-based inspection. Flow-based inspection processes packets at Layer 3 and Layer 4 using packet headers without reassembling the application data stream. It is optimized for performance and is the default inspection mode on most FortiGate models, especially those with NP (Network Processor) acceleration.

Answer

Proxy-based inspection

Answer

Deep SSL decryption inspection

Answer

Sandbox isolation inspection

Question 13

An administrator is setting up a new FortiGate firewall and needs to configure basic access control between the internal corporate network and the external public network. Which object type should the administrator create first to group internal IP addresses for policy creation?

Accepted Answer

Firewall Address object. Firewall Address objects are the fundamental building blocks used to define IP addresses, subnets, or ranges (such as the internal corporate network) that are then referenced in firewall policies. Grouping internal IPs into an address object (or address group) allows the administrator to reference that object as the source in a policy, which is the standard first step before creating access control rules. Application Control signatures, Virtual IPs, and Traffic Shapers serve entirely different purposes and cannot group internal subnets for policy matching.

Answer

Application Control signature

Answer

Virtual IP object

Answer

Traffic Shaper object

Question 14

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

Accepted Answer

SSL VPN Web Mode. SSL VPN Web Mode provides browser-based access through a portal that presents a customizable login page and bookmarks to internal resources (HTTP/HTTPS, RDP, SSH, etc.) without requiring any pre-installed client. It is designed exactly for the scenario described: remote users connecting via a web browser to reach internal resources.

Answer

Explicit Proxy Mode

Answer

IPsec Client Mode

Answer

SSL VPN Tunnel Mode

Question 15

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is Fortinet's centralized log management, analytics, and reporting appliance (physical or VM) that aggregates logs from FortiGate, FortiMail, FortiWeb, and other Fortinet devices. It provides dashboards, compliance reports, and forensic search across the enterprise.

Answer

FortiSandbox

Answer

FortiAuthenticator

Answer

FortiWeb

Question 16

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Accepted Answer

Implicit Deny. FortiGate firewall policies have an implicit deny at the end of the policy list. If traffic does not match any configured policy, it is dropped by default. This is a fundamental security principle and cannot be overridden unless you explicitly create a permit-all policy.

Answer

Drop and send ICMP destination unreachable

Answer

Redirect to Captive Portal

Answer

Implicit Accept

Question 17

When a FortiGate device inspects HTTPS traffic using deep inspection, how does the security engine handle the TLS/SSL encryption handshake between the client and the destination server?

Accepted Answer

It acts as a man-in-the-middle, terminating the session and re-signing traffic with a local CA certificate. FortiGate deep inspection performs full TLS/SSL man-in-the-middle interception: it terminates the client's TLS session, decrypts the traffic, inspects it against security profiles (IPS, antivirus, web filter), then re-encrypts and forwards it to the destination server using a certificate signed by a local CA that the client must trust. This allows inspection of encrypted payloads that would otherwise be opaque.

Answer

It strips all encryption permanently and forwards all internal traffic as plain text HTTP to the server

Answer

It inspects only the SNI (Server Name Indication) field in the unencrypted TLS Client Hello packet header

Answer

It relies entirely on the destination web server's private key pre-configured in the firewall policy

Question 18

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

Accepted Answer

FortiManager configured as a local FortiGuard distribution server. FortiManager can be configured as a local FortiGuard distribution server to provide signature updates to FortiGates that lack direct internet access. It downloads updates from FortiGuard and then serves them to managed devices on the isolated network. This allows offline updates for antivirus, IPS, and other security services.

Answer

FortiClient EMS deployment server

Answer

FortiAuthenticator user database server

Answer

FortiWeb application firewall

Question 19

An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?

Accepted Answer

FortiGate Clustering Protocol (FGCP) Active-Passive mode. FortiGate Clustering Protocol (FGCP) in Active-Passive mode is the native Fortinet HA mechanism that synchronizes sessions, configuration, and routing state between cluster members. The primary unit handles all traffic while the secondary remains in standby, ready to take over seamlessly upon failure. FGCP uses heartbeat interfaces and hello packets to detect failures and trigger failover within seconds, preserving established sessions.

Answer

Dynamic Multicast Routing Protocol (PIM-SM)

Answer

Virtual Router Redundancy Protocol (VRRP) active-active balancing

Answer

Border Gateway Protocol (BGP) Multipath clustering

Question 20

When configuring a FortiGate interface to connect to an external ISP network that utilizes dynamic IP assignment via DHCP, which setting must be enabled on the interface parameters?

Accepted Answer

Set Addressing Mode to DHCP. When a FortiGate interface connects to an ISP that assigns IP addresses dynamically via DHCP, the interface's Addressing Mode must be set to DHCP. This enables the FortiGate to act as a DHCP client, automatically obtaining an IP address, subnet mask, default gateway, and DNS servers from the ISP's DHCP server. Without this setting, the interface would use a static IP and fail to obtain the dynamic address.

Answer

Enable Secondary IP addressing

Answer

Configure a Static Virtual IP (VIP) mapping

Answer

Enable PPPoE client emulation mode