FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 4 — 15 Questions

Question 1

An enterprise branch office has two distinct internet connections (Fiber and Cable). The administrator wants traffic to preferentially use the Fiber link, but automatically fail over to the Cable link if the Fiber link experiences packet loss exceeding 5%. Which FortiOS feature accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SD-WAN Performance SLA and SD-WAN rules. SD-WAN in FortiOS provides Performance SLAs that continuously probe link health (latency, jitter, packet loss) and SD-WAN rules that select the preferred member based on those SLA results. By defining an SLA with a 5% packet-loss threshold and a rule preferring the Fiber member, FortiOS automatically steers traffic to Cable when Fiber violates the SLA. This is the native, intent-based failover mechanism for multiple WAN links.

Answer

RIPv2 dynamic routing protocol updates

Answer

Static routes with equal administrative distance and metric

Answer

High availability active-active clustering heartbeat rules

Question 2

What is the primary function of a firewall policy ID on a FortiGate?

Accepted Answer

To uniquely identify and reference the firewall policy rule. The [CORRECT] answer is B because a firewall policy ID on a FortiGate is a unique numeric identifier automatically assigned to each policy rule. It is used internally by the FortiGate to reference, order, and manage policies, and administrators use it in CLI commands, logs, and troubleshooting to pinpoint specific rules.

Answer

To assign an IP address to the DHCP client

Answer

To determine the cryptographic key used for IPsec VPN encryption

Answer

To define the physical switch port VLAN assignment

Question 3

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

Accepted Answer

Configure remote logging to FortiAnalyzer or Syslog server and enable log overwriting. The correct action is to configure remote logging to FortiAnalyzer or a Syslog server and enable log overwriting. Offloading logs to a remote server frees local disk space while preserving historical logs for analysis and compliance. Enabling log overwriting ensures that when the local disk reaches its configured threshold, the oldest logs are automatically deleted, preventing a full disk condition. This approach maintains continuous logging without manual intervention.

Answer

Disable all firewall policy rule logging permanently

Answer

Lower the physical interface MTU size across all WAN ports

Answer

Switch the FortiGate from NAT mode to Transparent mode

Question 4

When configuring an SSL VPN tunnel mode connection for mobile workers, what does the FortiGate assign to the client machine to enable communication with internal subnets?

Accepted Answer

A virtual IP address from a configured SSL VPN IP pool. In FortiGate SSL VPN tunnel mode, the FortiGate acts as a VPN gateway and assigns the remote client a virtual IP address from a pre-configured SSL VPN IP pool (also called an IP range). This virtual IP is used as the client's source address for traffic destined to internal subnets, allowing the FortiGate to route and apply firewall policies to that traffic. The pool must be defined under VPN > SSL-VPN Settings, and it is typically a private subnet distinct from the internal LAN. Without this virtual IP, the client cannot communicate with internal resources because it has no routable address within the VPN topology.

Answer

A static public IP address belonging to the ISP WAN interface

Answer

A physical MAC address mapped to the switch port

Answer

A dynamic DNS hostname managed by FortiGuard

Question 5

An administrator wants to prevent users from uploading confidential company documents to external cloud storage websites. Which Fortinet security profile feature inspects outbound traffic for specific file types or sensitive keywords?

Accepted Answer

Data Loss Prevention (DLP) sensor. The Data Loss Prevention (DLP) sensor in FortiOS is specifically designed to inspect outbound traffic for sensitive data patterns, including file types (e.g., .docx, .pdf) and keywords (e.g., 'confidential'). It can be applied to firewall policies to block or log attempts to upload such data to external destinations. Unlike other profiles, DLP focuses on data exfiltration rather than malware or URL categorization. Therefore, D is the correct answer.

Answer

Intrusion Prevention System (IPS) sensor

Answer

Antivirus profile

Answer

Web filtering profile

Question 6

An administrator wants to view a chronological log of security threats and blocked virus events in real-time directly on the FortiGate GUI. Which FortiOS feature provides this live graphical and tabular logging interface?

Accepted Answer

FortiView dashboards. FortiView dashboards in FortiOS provide live, graphical and tabular views of traffic, threats, and blocked events — including virus detections — aggregated in real time on the FortiGate GUI. Administrators can drill into sources, destinations, applications, and threat types without leaving the device. This is the feature designed for at-a-glance real-time security monitoring.

Answer

Firmware upgrade wizards

Answer

HA cluster status monitors

Answer

Static routing summary tables

Question 7

An administrator is configuring a FortiGate firewall and needs to ensure that packets matching an explicit allow policy are also logged. Where should the administrator enable logging for this specific policy?

Accepted Answer

Inside the specific firewall policy rule settings under Log Allowed Traffic. Logging for traffic that matches a firewall policy is enabled per-policy inside the policy's settings, specifically by enabling the 'Log Allowed Traffic' option and choosing whether to log All Sessions or only Security Events. This ensures every packet permitted by that explicit allow rule generates a log entry for auditing and troubleshooting. The setting is scoped to the individual policy, so it does not affect other rules on the FortiGate.

Answer

Inside the static route next-hop configuration

Answer

Within the physical interface administrative access profile

Answer

Under the global system time zone and NTP settings

Question 8

What is the primary purpose of a firewall address group in FortiOS?

Accepted Answer

To group multiple address objects together for simplified firewall policy configuration. A firewall address group in FortiOS is a container that bundles multiple address objects (IP addresses, subnets, FQDNs, or geolocation objects) into a single named entity. This simplifies firewall policy configuration because the group can be referenced in a single policy instead of listing each address individually, and updating the group automatically updates all policies that use it.

Answer

To assign dynamic VLAN tags to switch ports

Answer

To configure VPN Phase 1 encryption transforms

Answer

To schedule automated system backup intervals

Question 9

An administrator needs to restrict administrative access to the FortiGate CLI and GUI so that management connections are only accepted from a specific trusted internal management workstation subnet. Where is this source IP restriction configured?

Accepted Answer

On the administrator user account configuration (Trusted Hosts). Administrative source IP restriction is configured on the administrator account itself using the 'Trusted Hosts' field (config system admin, set trusthost1/2/3). This limits which source subnets can authenticate to the FortiGate via HTTPS, SSH, Telnet, or FortiToken-based GUI/CLI access. Only connections originating from the listed trusted hosts are accepted, providing a strong first line of defense against brute-force and unauthorized management access.

Answer

Within the FortiGuard subscription server list

Answer

Inside the DHCP server IP pool range

Answer

Inside the global DNS server settings

Question 10

When configuring an IPsec VPN tunnel between two FortiGate units, what is the function of Dead Peer Detection (DPD)?

Accepted Answer

To detect unresponsive VPN peers and tear down dead security associations. Dead Peer Detection (DPD) is a mechanism in IPsec VPN that detects when a peer is no longer responsive. It sends periodic hello messages (R-U-THERE) and if no response is received after a certain number of retries, it tears down the security association (SA) and can trigger a new tunnel negotiation. This ensures that dead tunnels are not left active, which could cause traffic blackholing.

Answer

To authenticate administrators logging into the FortiGate GUI via RADIUS

Answer

To balance outbound traffic across multiple WAN interfaces using SD-WAN

Answer

To encrypt user data payloads using AES-256 algorithms

Question 11

What is the primary function of FortiSandbox in an enterprise security architecture?

Accepted Answer

To analyze unknown files and zero-day malware in an isolated virtual environment. FortiSandbox is Fortinet's advanced threat detection platform that runs suspicious or unknown files in an isolated virtual environment (sandbox) to observe behavior and detect zero-day malware that signature-based tools miss. It integrates with FortiGate, FortiMail, and FortiWeb to submit files for dynamic analysis and returns verdicts that feed back into the security fabric. Its core purpose is behavioral analysis of unknown files, not URL filtering, log storage, or user authentication.

Answer

To filter web browsing categories and block malicious URLs

Answer

To centralize log storage and generate graphical compliance reports

Answer

To authenticate remote SSL VPN users against Active Directory

Question 12

An administrator wants to ensure that all configuration changes made on a FortiGate are tracked with specific user accountability and revision history. Which Fortinet management tool provides centralized configuration revision control and rollback capabilities?

Accepted Answer

FortiManager. FortiManager is Fortinet's centralized management platform that maintains a revision history of all configuration changes pushed to managed FortiGates. It logs each change with the administrator's username, timestamp, and a diff of the modified objects, enabling granular rollback to any previous revision. This directly satisfies the requirement for user accountability and revision control.

Answer

FortiAnalyzer

Answer

FortiClient EMS

Answer

FortiAuthenticator

Question 13

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide a routing domain into a two-level hierarchy (backbone Area 0 and other areas) to reduce routing overhead. By summarizing routes at area boundaries, OSPF limits the scope of link-state advertisements (LSAs), reducing CPU, memory, and bandwidth consumption on routers.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 14

What is the primary function of a FortiGate firewall policy action set to 'Accept'?

Accepted Answer

To permit matching traffic to traverse the FortiGate. In FortiOS, a firewall policy action of 'Accept' (shown as ACCEPT in the GUI) permits matching traffic to pass through the FortiGate after all UTM profiles and security inspections are applied. It is the fundamental allow action, and without it no traffic traverses the device. The other common action is DENY, which drops the traffic.

Answer

To redirect the user browser to a captive portal authentication page

Answer

To encapsulate the packet inside an IPsec VPN tunnel

Answer

To drop the matching packet silently without logging

Question 15

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

Accepted Answer

FortiClient EMS Device Control profile. FortiClient EMS (Enterprise Management Server) delivers endpoint management profiles, including Device Control profiles that define which USB and removable storage classes are allowed, blocked, or read-only on managed endpoints. The profile is pushed to FortiClient agents on corporate laptops, enforcing the policy at the endpoint.

Answer

FortiGate Antivirus profile

Answer

FortiSwitch port security settings

Answer

FortiAnalyzer reporting engine