FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 3 — 15 Questions

Question 1

When configuring an IPsec VPN tunnel between two FortiGate devices, what is the specific role of Phase 1 negotiation?

Accepted Answer

To authenticate the two VPN peers and establish a secure management channel (ISAKMP SA). IPsec Phase 1 (IKE Phase 1) negotiates and authenticates the two VPN peers, establishing the ISAKMP Security Association (SA) that protects subsequent Phase 2 negotiations. It uses main mode or aggressive mode to agree on encryption/hashing algorithms, perform authentication (pre-shared key or certificates), and derive keys for the management tunnel. Only after Phase 1 succeeds can Phase 2 build the actual IPsec SAs for data.

Answer

To assign dynamic virtual IP addresses to remote SSL VPN client workstations

Answer

To encrypt actual user data packets traversing the VPN using IPsec ESP protocols

Answer

To perform DNS name resolution for remote peer public IP addresses

Question 2

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

Accepted Answer

By adding the AD user group to the source field of the firewall policy. On a FortiGate, firewall policies can use Active Directory user groups as the source, allowing the device to enforce access based on AD group membership. When a user authenticates (via FSSO, LDAP, or captive portal), the FortiGate maps the user to their AD groups and matches the policy accordingly. This lets you permit internet access for one group while denying it for another without changing routing or interface settings.

Answer

By modifying the physical interface speed settings

Answer

By editing the static routing table metrics

Answer

By applying an Antivirus security profile to the interface

Question 3

Which Fortinet security product is specifically designed to protect web applications (such as public-facing e-commerce portals) against OWASP Top 10 vulnerabilities like SQL injection and cross-site scripting?

Accepted Answer

FortiWeb. FortiWeb is Fortinet's dedicated Web Application Firewall (WAF) that provides specialized protection for web applications against OWASP Top 10 threats such as SQL injection, cross-site scripting (XSS), and cross-site request forgery. It uses behavioral analysis, signature-based detection, and machine learning to inspect HTTP/HTTPS traffic and block malicious requests before they reach the application. FortiWeb is designed for public-facing web services like e-commerce portals, APIs, and web portals, offering features like virtual patching, bot mitigation, and API protection.

Answer

FortiGate

Answer

FortiMail

Answer

FortiSandbox

Question 4

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. FortiGate allows administrators to encrypt the configuration backup file with a password during export from the GUI. This ensures that the configuration file, which contains sensitive information like passwords and keys, is protected if intercepted or stored insecurely. The option to encrypt with a password is available when performing a backup via System > Config > Backup.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP

Question 5

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard Distribution Network (FDN) is Fortinet's global threat intelligence infrastructure that pushes real-time updates — antivirus signatures, IPS signatures, web filter categories, and other security content — to FortiGate, FortiMail, FortiClient, and other Fortinet devices. It ensures devices have current protection against emerging threats without manual intervention.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 6

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

Accepted Answer

It sends a real-time rating query to the FortiGuard servers to classify the URL. When a FortiGate encounters a URL whose category is unknown, it sends a real-time rating query to FortiGuard servers to obtain the category. This is part of the FortiGuard Web Filtering service, which maintains a vast database of URLs and their categories. The FortiGate then applies the appropriate action based on the web filter profile.

Answer

It forwards the page to FortiSandbox for zero-day file execution

Answer

It automatically blocks the website as a high-risk security threat

Answer

It quarantines the user's workstation inside FortiClient EMS

Question 7

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

Accepted Answer

To negotiate the security parameters and encryption algorithms used to protect user data packets (IPsec SAs). IPsec Phase 2 negotiation establishes the IPsec Security Associations (SAs) that define how user data packets are encrypted and authenticated. It negotiates parameters like encryption algorithms (AES, 3DES), integrity algorithms (SHA-256), and Perfect Forward Secrecy (PFS) settings, creating the actual tunnel used for data transport.

Answer

To assign dynamic IP addresses to remote dial-up users via DHCP relay

Answer

To verify the administrator credentials attempting to log into the FortiGate GUI

Answer

To establish the initial IKE handshake and peer authentication identity

Question 8

What is the primary function of a FortiSwitch unit when integrated into the Fortinet Security Fabric?

Accepted Answer

To provide secure Layer 2 network access managed directly from the FortiGate. When a FortiSwitch is integrated into the Fortinet Security Fabric, it is managed directly by the FortiGate, which acts as the Fabric's central controller. The FortiSwitch provides secure Layer 2 network access for wired clients, with the FortiGate pushing VLAN, port, and security policies down to the switch. This tight integration allows the FortiGate to enforce unified security and network policies across both wired and wireless edges, eliminating the need for separate switch management.

Answer

To act as an external DNS and DHCP server for client workstations

Answer

To scan inbound email attachments for spam and phishing attacks

Answer

To provide SSL VPN portal access for remote mobile workers

Question 9

An administrator needs to monitor bandwidth consumption across different applications on the FortiGate. Which feature allows the administrator to view real-time traffic bandwidth by application and enforce traffic shaping guarantees?

Accepted Answer

Traffic Shaping and FortiView Application monitors. Traffic Shaping on a FortiGate allows the administrator to define guaranteed and maximum bandwidth limits per application or traffic type, while FortiView Application monitors provide real-time visibility into bandwidth consumption broken down by application. Together, these features satisfy both the monitoring and enforcement requirements. Traffic shaping policies can be applied via firewall policies or shaping profiles, and FortiView aggregates NetFlow-like data from the session table to display per-application bandwidth. This combination is the standard Fortinet solution for application-aware bandwidth management.

Answer

Static routing administrative distance tables

Answer

Antivirus quarantine logs

Answer

High availability cluster heartbeat monitors

Question 10

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, a FortiGate operates as a Layer 2 bridge, forwarding Ethernet frames between interfaces without changing IP addresses or performing routing. It still applies security profiles and firewall policies to the bridged traffic, but it is invisible at Layer 3. This allows inline inspection without re-addressing the network.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 11

An administrator wants to ensure that administrative access to the FortiGate GUI is restricted to secure HTTPS connections only, while disabling insecure HTTP access. Where is this administrative access protocol configured on the FortiGate?

Accepted Answer

Under the physical or logical interface settings (Administrative Access). Administrative access protocols on a FortiGate are configured under the interface settings, specifically in the 'Administrative Access' section where you can enable or disable protocols like HTTPS, HTTP, SSH, Telnet, etc. This allows granular control per interface. Disabling HTTP and enabling HTTPS there restricts GUI access to secure connections only.

Answer

Inside the firewall policy table rules

Answer

Inside the static routing table configuration

Answer

Within the FortiGuard update subscription settings

Question 12

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

Accepted Answer

To exchange keepalive health packets and synchronize session states and configurations between cluster members. In FortiGate HA active-passive mode, heartbeat interfaces are dedicated links used to exchange keepalive packets (HELLO messages) that monitor cluster member health. They also synchronize session states and configuration changes between the primary and backup units, ensuring seamless failover. This communication is critical for maintaining cluster integrity and stateful failover.

Answer

To connect FortiClient EMS endpoints to the root FortiGate

Answer

To download daily antivirus signature updates from FortiGuard servers

Answer

To route user internet traffic across public WAN connections to the ISP

Question 13

What is the primary function of FortiMail in an enterprise security architecture?

Accepted Answer

To protect the organization against email-borne threats such as spam, malware, and phishing. FortiMail is Fortinet's dedicated Secure Email Gateway (SEG), purpose-built to inspect SMTP, IMAP, and POP3 traffic and block email-borne threats before they reach user mailboxes. It combines antispam, antivirus, anti-phishing, sandboxing, and DLP engines with policy-based routing of inbound, outbound, and internal mail. Its core identity in the Fortinet Security Fabric is email security — not logging, wireless, or remote access.

Answer

To act as a centralized log analysis and reporting appliance

Answer

To manage wireless access points and guest Wi-Fi authentication portals

Answer

To provide SSL VPN client tunnels for remote workers

Question 14

What is the primary purpose of FortiToken in a Fortinet security solution?

Accepted Answer

To provide two-factor authentication (2FA) for secure user logins. FortiToken is Fortinet's hardware or software one-time password (OTP) token that generates time-based codes for two-factor authentication. It integrates with FortiGate and FortiAuthenticator to add a second factor beyond username/password, securing VPN, SSL-VPN, and administrative logins. The token uses TOTP (RFC 6238) or HOTP (RFC 4226) to produce codes that are validated against the FortiGate's token seed, ensuring only the legitimate token holder can authenticate.

Answer

To accelerate encryption performance for IPsec VPN tunnels

Answer

To cache web filtering categories locally on the firewall

Answer

To quarantine infected endpoints automatically

Question 15

What is the primary function of a FortiAuthenticator device?

Accepted Answer

To centralize user authentication, identity services, and token management. FortiAuthenticator is Fortinet's dedicated identity and access management (IAM) appliance. Its core purpose is to centralize authentication (via RADIUS, LDAP, SAML, etc.), provide identity services such as user identification and group mapping, and manage tokens for two-factor authentication (2FA) and one-time passwords (OTP). It acts as a central point for enforcing authentication policies across the Fortinet Security Fabric and third-party devices. Unlike firewalls or sandboxes, it does not inspect traffic for threats or manage network infrastructure.

Answer

To scan incoming network traffic for virus signatures

Answer

To manage physical switch ports and VLANs via FortiLink

Answer

To analyze zero-day files in an isolated virtual sandbox