FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 3 — 15 Questions

Question 1

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard distribution network provides real-time threat intelligence updates, including antivirus signatures, IPS definitions, and web filtering categories to Fortinet devices.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 2

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

Accepted Answer

It sends a real-time rating query to the FortiGuard servers to classify the URL. When a URL is uncached or uncategorized locally, the FortiGate queries the FortiGuard Web Filtering rating servers in real-time to determine the category.

Answer

It forwards the page to FortiSandbox for zero-day file execution

Answer

It automatically blocks the website as a high-risk security threat

Answer

It quarantines the user's workstation inside FortiClient EMS

Question 3

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

Accepted Answer

To negotiate the security parameters and encryption algorithms used to protect user data packets (IPsec SAs). Phase 2 establishes the actual IPsec Security Associations (SAs) that protect user data traffic, negotiating encapsulation protocols (ESP/AH), encryption algorithms, and lifetime parameters.

Answer

To assign dynamic IP addresses to remote dial-up users via DHCP relay

Answer

To verify the administrator credentials attempting to log into the FortiGate GUI

Answer

To establish the initial IKE handshake and peer authentication identity

Question 4

What is the primary function of a FortiSwitch unit when integrated into the Fortinet Security Fabric?

Accepted Answer

To provide secure Layer 2 network access managed directly from the FortiGate. FortiSwitch provides secure Layer 2 access switching that integrates tightly with the FortiGate firewall, allowing centralized management and switch port security features.

Answer

To act as an external DNS and DHCP server for client workstations

Answer

To scan inbound email attachments for spam and phishing attacks

Answer

To provide SSL VPN portal access for remote mobile workers

Question 5

An administrator needs to monitor bandwidth consumption across different applications on the FortiGate. Which feature allows the administrator to view real-time traffic bandwidth by application and enforce traffic shaping guarantees?

Accepted Answer

Traffic Shaping and FortiView Application monitors. Traffic Shaping policies and FortiView application monitors provide visibility and bandwidth control over specific applications and users.

Answer

Static routing administrative distance tables

Answer

Antivirus quarantine logs

Answer

High availability cluster heartbeat monitors

Question 6

An organization is deploying FortiGate in Transparent mode instead of NAT mode. How does a Transparent mode FortiGate handle incoming packets at Layer 2?

Accepted Answer

It operates as a Layer 2 bridge, inspecting traffic without altering IP addresses or performing routing. In Transparent mode, the FortiGate operates as a bridge (Layer 2 device) without modifying IP addresses, inspecting traffic as it passes between interfaces on the same subnet.

Answer

It performs full NAT on all source and destination IP addresses for every packet

Answer

It terminates all Ethernet frames and encapsulates them into PPPoE tunnels

Answer

It acts as a dynamic routing peer running BGP and OSPF across all interfaces

Question 7

An administrator wants to ensure that administrative access to the FortiGate GUI is restricted to secure HTTPS connections only, while disabling insecure HTTP access. Where is this administrative access protocol configured on the FortiGate?

Accepted Answer

Under the physical or logical interface settings (Administrative Access). Administrative access protocols (HTTPS, SSH, PING) are enabled or disabled on individual physical or logical interface configurations under Network > Interfaces.

Answer

Inside the firewall policy table rules

Answer

Inside the static routing table configuration

Answer

Within the FortiGuard update subscription settings

Question 8

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

Accepted Answer

To exchange keepalive health packets and synchronize session states and configurations between cluster members. Heartbeat interfaces are dedicated connections between HA cluster members used to transmit keepalive signals, synchronize configuration states, and maintain session synchronization.

Answer

To connect FortiClient EMS endpoints to the root FortiGate

Answer

To download daily antivirus signature updates from FortiGuard servers

Answer

To route user internet traffic across public WAN connections to the ISP

Question 9

What is the primary function of FortiMail in an enterprise security architecture?

Accepted Answer

To protect the organization against email-borne threats such as spam, malware, and phishing. FortiMail is a secure email gateway designed to protect organizations from spam, malware, phishing, and data loss via email.

Answer

To act as a centralized log analysis and reporting appliance

Answer

To manage wireless access points and guest Wi-Fi authentication portals

Answer

To provide SSL VPN client tunnels for remote workers

Question 10

What is the primary purpose of FortiToken in a Fortinet security solution?

Accepted Answer

To provide two-factor authentication (2FA) for secure user logins. FortiToken provides two-factor authentication (2FA) tokens (hardware or software) to verify user identities securely during logins.

Answer

To accelerate encryption performance for IPsec VPN tunnels

Answer

To cache web filtering categories locally on the firewall

Answer

To quarantine infected endpoints automatically

Question 11

What is the primary function of a FortiAuthenticator device?

Accepted Answer

To centralize user authentication, identity services, and token management. FortiAuthenticator provides user identity services, guest management, two-factor authentication tokens, and SSO integration.

Answer

To scan incoming network traffic for virus signatures

Answer

To manage physical switch ports and VLANs via FortiLink

Answer

To analyze zero-day files in an isolated virtual sandbox

Question 12

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN performance SLAs monitor latency, jitter, and packet loss, allowing administrators to configure rule-based path selection and automatic failover.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 13

What is the primary function of a firewall policy ID on a FortiGate?

Accepted Answer

To uniquely identify and reference the firewall policy rule. Every firewall policy is assigned a unique policy ID number by FortiOS to identify, reference, and reorder rules in the policy list.

Answer

To assign an IP address to the DHCP client

Answer

To determine the cryptographic key used for IPsec VPN encryption

Answer

To define the physical switch port VLAN assignment

Question 14

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

Accepted Answer

Configure remote logging to FortiAnalyzer or Syslog server and enable log overwriting. Configuring centralized logging to FortiAnalyzer or setting up log retention/overwrite policies ensures local storage exhaustion is prevented.

Answer

Disable all firewall policy rule logging permanently

Answer

Lower the physical interface MTU size across all WAN ports

Answer

Switch the FortiGate from NAT mode to Transparent mode

Question 15

When configuring an SSL VPN tunnel mode connection for mobile workers, what does the FortiGate assign to the client machine to enable communication with internal subnets?

Accepted Answer

A virtual IP address from a configured SSL VPN IP pool. In SSL VPN tunnel mode, the FortiGate assigns a virtual IP address from a dedicated IP pool to the client virtual adapter.

Answer

A static public IP address belonging to the ISP WAN interface

Answer

A physical MAC address mapped to the switch port

Answer

A dynamic DNS hostname managed by FortiGuard