FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 2 — 15 Questions

Question 1

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. Interface zones group multiple physical or logical interfaces together, allowing administrators to apply a single firewall policy to multiple interfaces sharing the same security requirements.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 2

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, outbound traffic passing through a firewall policy with NAT enabled is translated (SNAT) to the outgoing interface's IP address.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 3

A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?

Accepted Answer

Application Control profile. Application Control identifies applications based on signature analysis and behavioral characteristics rather than TCP/UDP port numbers.

Answer

Static port-blocking firewall rules

Answer

SSL certificate inspection profile

Answer

Antivirus signature database

Question 4

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

Accepted Answer

FortiManager. FortiManager is the centralized management platform designed for provisioning and managing FortiGate and other security devices at scale.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiSandbox

Question 5

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

Accepted Answer

FortiSandbox integration. FortiSandbox executes suspicious files in an isolated virtual sandbox environment to observe behavior and detect zero-day threats.

Answer

Intrusion Prevention System signature matching

Answer

FortiGuard Antivirus signature lookup

Answer

Web filtering URL categorization

Question 6

An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?

Accepted Answer

It aborts the connection immediately and displays a replacement message to the user. In flow-based inspection, when malware is detected, the FortiGate interrupts and drops the connection stream immediately, replacing the file with a replacement message.

Answer

It drops the packet silently without notifying the user or generating a log

Answer

It buffers the entire file to disk, cleans the file, and then emails the cleaned file to the user

Answer

It allows the download to complete and then quarantines the file locally on the client endpoint

Question 7

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

Accepted Answer

SD-WAN Performance SLAs and Link Cost Rules. SD-WAN (Software-Defined WAN) performance SLAs monitor link metrics and dynamically steer traffic based on performance criteria.

Answer

RIPv2 hop-count metric calculation

Answer

Equal-Cost Multi-Path (ECMP) round-robin hashing

Answer

Static routing administrative distance metrics

Question 8

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

Accepted Answer

admin. The default administrator account on a brand-new or factory-reset FortiGate is 'admin'.

Answer

administrator

Answer

supervisor

Answer

root

Question 9

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?

Accepted Answer

FortiAuthenticator. FortiAuthenticator integrates with Active Directory, provides user identity services, and acts as an RADIUS/LDAP server and SSO polling agent.

Answer

FortiWeb application firewall

Answer

FortiAnalyzer reporting engine

Answer

FortiManager policy server

Question 10

What is the primary function of a FortiGate Virtual IP (VIP) object?

Accepted Answer

To perform Destination NAT (DNAT) for mapping external public IP addresses to internal private servers. A Virtual IP (VIP) is used for Destination NAT, translating an external public IP/port to an internal private IP/port for inbound connections.

Answer

To encrypt site-to-site VPN tunnels using IPsec phase 1 parameters

Answer

To assign dynamic IP addresses to wireless access points via DHCP

Answer

To group internal source IP addresses for outbound internet browsing policies

Question 11

When configuring an IPsec VPN tunnel between two FortiGate devices, what is the specific role of Phase 1 negotiation?

Accepted Answer

To authenticate the two VPN peers and establish a secure management channel (ISAKMP SA). IPsec Phase 1 establishes a secure, authenticated communication channel (ISAKMP SA) between two peers, negotiating encryption, hashing, authentication methods, and Diffie-Hellman groups.

Answer

To assign dynamic virtual IP addresses to remote SSL VPN client workstations

Answer

To encrypt actual user data packets traversing the VPN using IPsec ESP protocols

Answer

To perform DNS name resolution for remote peer public IP addresses

Question 12

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

Accepted Answer

By adding the AD user group to the source field of the firewall policy. Firewall policies can include user or user group authentication requirements, allowing the FortiGate to enforce policy rules based on AD credentials.

Answer

By modifying the physical interface speed settings

Answer

By editing the static routing table metrics

Answer

By applying an Antivirus security profile to the interface

Question 13

Which Fortinet security product is specifically designed to protect web applications (such as public-facing e-commerce portals) against OWASP Top 10 vulnerabilities like SQL injection and cross-site scripting?

Accepted Answer

FortiWeb. FortiWeb is a Web Application Firewall (WAF) that protects web applications from application-layer attacks and vulnerabilities.

Answer

FortiGate

Answer

FortiMail

Answer

FortiSandbox

Question 14

An administrator wants to deploy a wireless network across a corporate campus managed directly by the FortiGate firewall. Which Fortinet technology enables the FortiGate to control and provision FortiAPs directly?

Accepted Answer

Built-in FortiGate Wireless Controller using CAPWAP. FortiGate includes a built-in wireless controller that manages FortiAPs using CAPWAP (Control and Provisioning of Wireless Access Points) protocols.

Answer

FortiClient EMS telemetry channels

Answer

External FortiSwitch Manager via SNMP polling

Answer

RADIUS single sign-on wireless bridging

Question 15

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. When backing up a FortiGate configuration from the GUI or CLI, administrators can choose to encrypt the configuration file with a password so sensitive secrets like pre-shared keys are protected.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP