FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 2 — 15 Questions

Question 1

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implicit Deny. FortiGate firewall policies have an implicit deny at the end of the policy list. If traffic does not match any configured policy, it is dropped by default. This is a fundamental security principle and cannot be overridden unless you explicitly create a permit-all policy.

Answer

Drop and send ICMP destination unreachable

Answer

Redirect to Captive Portal

Answer

Implicit Accept

Question 2

When a FortiGate device inspects HTTPS traffic using deep inspection, how does the security engine handle the TLS/SSL encryption handshake between the client and the destination server?

Accepted Answer

It acts as a man-in-the-middle, terminating the session and re-signing traffic with a local CA certificate. FortiGate deep inspection performs full TLS/SSL man-in-the-middle interception: it terminates the client's TLS session, decrypts the traffic, inspects it against security profiles (IPS, antivirus, web filter), then re-encrypts and forwards it to the destination server using a certificate signed by a local CA that the client must trust. This allows inspection of encrypted payloads that would otherwise be opaque.

Answer

It strips all encryption permanently and forwards all internal traffic as plain text HTTP to the server

Answer

It inspects only the SNI (Server Name Indication) field in the unencrypted TLS Client Hello packet header

Answer

It relies entirely on the destination web server's private key pre-configured in the firewall policy

Question 3

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

Accepted Answer

FortiManager configured as a local FortiGuard distribution server. FortiManager can be configured as a local FortiGuard distribution server to provide signature updates to FortiGates that lack direct internet access. It downloads updates from FortiGuard and then serves them to managed devices on the isolated network. This allows offline updates for antivirus, IPS, and other security services.

Answer

FortiClient EMS deployment server

Answer

FortiAuthenticator user database server

Answer

FortiWeb application firewall

Question 4

An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?

Accepted Answer

FortiGate Clustering Protocol (FGCP) Active-Passive mode. FortiGate Clustering Protocol (FGCP) in Active-Passive mode is the native Fortinet HA mechanism that synchronizes sessions, configuration, and routing state between cluster members. The primary unit handles all traffic while the secondary remains in standby, ready to take over seamlessly upon failure. FGCP uses heartbeat interfaces and hello packets to detect failures and trigger failover within seconds, preserving established sessions.

Answer

Dynamic Multicast Routing Protocol (PIM-SM)

Answer

Virtual Router Redundancy Protocol (VRRP) active-active balancing

Answer

Border Gateway Protocol (BGP) Multipath clustering

Question 5

When configuring a FortiGate interface to connect to an external ISP network that utilizes dynamic IP assignment via DHCP, which setting must be enabled on the interface parameters?

Accepted Answer

Set Addressing Mode to DHCP. When a FortiGate interface connects to an ISP that assigns IP addresses dynamically via DHCP, the interface's Addressing Mode must be set to DHCP. This enables the FortiGate to act as a DHCP client, automatically obtaining an IP address, subnet mask, default gateway, and DNS servers from the ISP's DHCP server. Without this setting, the interface would use a static IP and fail to obtain the dynamic address.

Answer

Enable Secondary IP addressing

Answer

Configure a Static Virtual IP (VIP) mapping

Answer

Enable PPPoE client emulation mode

Question 6

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. In FortiOS, a zone is a logical grouping of one or more physical or virtual interfaces that can be referenced as a single object in firewall policies. This lets an administrator write one policy for 'LAN-to-WAN' instead of duplicating rules for every interface, dramatically simplifying policy management and reducing rule sprawl. Zones are a policy-abstraction feature, not a routing, bandwidth, or DHCP mechanism.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 7

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, FortiGate by default performs source NAT (SNAT) on outbound traffic, translating the private source IP address to the IP address of the outgoing interface. This allows internal private addresses (RFC 1918) to communicate over the public internet, where private addresses are not routable. The translation is stateful, so return traffic is automatically mapped back to the original internal host.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 8

A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?

Accepted Answer

Application Control profile. An Application Control profile is the correct feature because it identifies applications based on their behavioral signatures and protocol characteristics, not just port numbers. This allows FortiGate to detect and block P2P applications even when they use non-standard ports or port hopping. Adding the Application Control profile to the firewall policy enforces the block.

Answer

Static port-blocking firewall rules

Answer

SSL certificate inspection profile

Answer

Antivirus signature database

Question 9

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

Accepted Answer

FortiManager. FortiManager is Fortinet's centralized management platform that provides a single pane of glass for provisioning, configuring, updating, and monitoring multiple FortiGate devices and their policies. It supports ADOMs to segment management domains and pushes policy packages to managed devices. This matches the described requirement exactly.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiSandbox

Question 10

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

Accepted Answer

FortiSandbox integration. FortiSandbox is Fortinet's advanced threat detection appliance that runs suspicious files in a secure virtual environment (sandbox) to observe behavior and detect unknown zero-day malware. Integrating FortiSandbox with FortiGate allows files to be submitted for behavioral analysis before being allowed to endpoints. This is exactly the 'secure virtual environment + behavior analysis' requirement.

Answer

Intrusion Prevention System signature matching

Answer

FortiGuard Antivirus signature lookup

Answer

Web filtering URL categorization

Question 11

An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?

Accepted Answer

It aborts the connection immediately and displays a replacement message to the user. In flow-based inspection mode, when the FortiGate detects an infected file, it aborts the connection immediately and displays a replacement message to the user. This is because flow-based inspection does not buffer the entire file; it scans as data streams and can terminate the session upon detection. The replacement message informs the user why the download failed.

Answer

It drops the packet silently without notifying the user or generating a log

Answer

It buffers the entire file to disk, cleans the file, and then emails the cleaned file to the user

Answer

It allows the download to complete and then quarantines the file locally on the client endpoint

Question 12

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

Accepted Answer

SD-WAN Performance SLAs and Link Cost Rules. SD-WAN Performance SLAs in FortiOS allow the FortiGate to continuously probe multiple WAN links for latency, jitter, and packet loss, then use Link Cost Rules to dynamically steer traffic to the best-performing path. This is the core mechanism for intelligent, application-aware WAN selection in a multi-WAN architecture. It goes beyond simple failover by making routing decisions based on real-time link quality.

Answer

RIPv2 hop-count metric calculation

Answer

Equal-Cost Multi-Path (ECMP) round-robin hashing

Answer

Static routing administrative distance metrics

Question 13

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

Accepted Answer

admin. FortiGate appliances ship with a default administrator account whose username is 'admin' and which has no password initially (forcing a password change on first login in recent firmware). This is documented in Fortinet's default credentials and is required knowledge for initial device setup.

Answer

administrator

Answer

supervisor

Answer

root

Question 14

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?

Accepted Answer

FortiAuthenticator. FortiAuthenticator is Fortinet's dedicated identity and access management appliance, designed to integrate with external directories such as Microsoft Active Directory via LDAP/RADIUS. It synchronizes user credentials and can act as an SSO (Single Sign-On) provider, issuing tokens and supporting protocols like SAML, Kerberos, and RADIUS for SSL VPN authentication. This makes it the correct component for authenticating remote SSL VPN users against AD with SSO.

Answer

FortiWeb application firewall

Answer

FortiAnalyzer reporting engine

Answer

FortiManager policy server

Question 15

What is the primary function of a FortiGate Virtual IP (VIP) object?

Accepted Answer

To perform Destination NAT (DNAT) for mapping external public IP addresses to internal private servers. A FortiGate Virtual IP (VIP) object is used to perform Destination NAT (DNAT), mapping an external public IP address and port to an internal private server IP and port. It is the standard mechanism for publishing internal services (web, mail, RDP) to the internet through the FortiGate.

Answer

To encrypt site-to-site VPN tunnels using IPsec phase 1 parameters

Answer

To assign dynamic IP addresses to wireless access points via DHCP

Answer

To group internal source IP addresses for outbound internet browsing policies