FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 5 — 15 Questions

Question 1

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Firewall policies reference the SD-WAN zone name instead of individual physical interfaces. When WAN interfaces are members of an SD-WAN zone, firewall policies reference the SD-WAN zone name as the source or destination interface rather than individual physical interfaces. This abstraction lets SD-WAN rules dynamically select the best member link per session without rewriting policies.

Answer

Firewall policies must only use static routing next-hop IP addresses

Answer

Firewall policies are disabled entirely when SD-WAN is enabled

Answer

Firewall policies must reference every physical WAN interface individually in separate rules

Question 2

What is the primary function of a FortiGate static route?

Accepted Answer

To manually specify the next-hop gateway for routing traffic to specific destination networks. A FortiGate static route is used to manually define a path for traffic to a specific destination network by specifying the next-hop gateway. This is a fundamental routing concept where the administrator explicitly sets the route rather than relying on dynamic routing protocols. Static routes are often used for simple networks or to override dynamic routing decisions.

Answer

To translate private internal IP addresses to public WAN IP addresses

Answer

To inspect HTTP web traffic for malicious scripts

Answer

To authenticate remote VPN users against Active Directory

Question 3

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

Accepted Answer

Event logs (System Event logs). HA state transitions (failover, role changes, heartbeat failures) are recorded in the System Event logs, which capture cluster membership changes, interface monitoring failures, and HA daemon events. Checking Event logs on the FortiGate or FortiAnalyzer reveals the exact cause and timestamp of the failover. This is the correct log category for diagnosing HA behavior.

Answer

Antivirus quarantine logs

Answer

Web filtering browsing logs

Answer

DHCP lease assignment logs

Question 4

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

Accepted Answer

Web mode is browser-based with bookmarks, while tunnel mode assigns a virtual IP and requires FortiClient. SSL VPN Web Mode is browser-based and provides access to internal web applications through bookmarks and a reverse-proxy portal, requiring no client software. Tunnel Mode, in contrast, assigns the client a virtual IP from a configured pool and requires FortiClient (or a compatible client) to establish a full network tunnel, giving access to any internal resource as if on the LAN.

Answer

Web mode encrypts traffic with IPsec, while tunnel mode uses unencrypted HTTP connections

Answer

Tunnel mode only supports Windows XP, while web mode supports modern mobile browsers

Answer

Web mode requires a hardware FortiToken, while tunnel mode requires no authentication

Question 5

What is the primary function of a FortiGate hardware acceleration processor (FortiASIC)?

Accepted Answer

To offload firewall session processing and cryptographic operations, accelerating performance. FortiASIC is Fortinet's custom silicon designed to offload computationally expensive operations — firewall session lookup, IPsec encryption/decryption, SSL inspection, and pattern matching — from the main CPU. This hardware acceleration dramatically increases throughput and reduces latency, which is why FortiGate appliances with FortiASIC can achieve multi-gigabit firewall and VPN performance.

Answer

To manage user identities and generate FortiToken push notifications

Answer

To provide wireless access point controller management via CAPWAP

Answer

To act as an external database for storing FortiAnalyzer log archives

Question 6

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

Accepted Answer

Firewall Schedule object. A Firewall Schedule object is used in a firewall policy to define specific time periods during which the policy is active. By adding a schedule to the policy, the administrator can enforce that internal users can only access the internet during non-work hours. The schedule can be one-time or recurring, and it directly controls when the policy matches traffic.

Answer

Virtual IP (VIP) object

Answer

Application Control signature

Answer

Traffic Shaper object

Question 7

When configuring an IPsec VPN tunnel between two FortiGate units using pre-shared keys (PSK), what is required for successful Phase 1 authentication?

Accepted Answer

Both peers must match on Phase 1 encryption, hash algorithms, DH group, and identical pre-shared keys. IPsec Phase 1 (IKE SA) negotiation requires both peers to agree on matching parameters: encryption algorithm, hash/integrity algorithm, Diffie-Hellman group, authentication method, and the pre-shared key value. If any of these differ, the IKE SA cannot be established and Phase 2 never begins. Identical PSKs on both peers are mandatory for PSK-based authentication.

Answer

The pre-shared key must be configured in Phase 2 rather than Phase 1

Answer

Both peers must use dynamic IP addresses assigned by DHCP

Answer

Both peers must run different firmware versions to ensure cryptographic compatibility

Question 8

What is the primary function of a FortiGate interface configured in NAT mode?

Accepted Answer

To route traffic between different subnets and perform Network Address Translation (NAT). A FortiGate interface in NAT mode is a Layer 3 routed interface — it holds an IP address, participates in routing decisions, and applies source NAT (and optionally destination NAT via VIPs) to traffic crossing it. This is the default and most common interface mode on a FortiGate, and it is what allows the device to act as a firewall/router between the LAN and WAN.

Answer

To provide wireless access point management via CAPWAP

Answer

To bridge Ethernet frames at Layer 2 without performing routing or IP translation

Answer

To act as a dedicated storage volume for FortiAnalyzer log archives

Question 9

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Accepted Answer

Under System > Alert Email settings. FortiGate alert email settings are configured globally under System > Alert Email, where the administrator defines the SMTP server, recipient addresses, and which event categories (such as admin login events and configuration changes) trigger an email. This centralized location allows the FortiGate to send real-time notifications for critical events without needing per-policy configuration. The alert email feature is a built-in logging and notification mechanism that operates independently of firewall policies.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the FortiGuard subscription server parameters

Answer

Within the static routing table configuration

Question 10

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

Accepted Answer

Active-active distributes session processing across multiple cluster units, whereas active-passive processes all traffic on a single primary unit. In FortiGate FGCP active-active HA, all cluster members actively process traffic, and sessions are distributed across units using load-balancing algorithms (such as source-destination IP hashing or weighted distribution). Session synchronization ensures that session state is shared between members so that any unit can handle the traffic if another fails. Active-passive, by contrast, has only the primary unit processing all traffic while the subordinate(s) remain on standby, ready to take over on failover.

Answer

Active-active requires manual administrator failover, while active-passive is fully automated

Answer

Active-active disables all firewall security profiles to maximize raw throughput

Answer

Active-active eliminates the need for heartbeat cables between cluster units

Question 11

What is the primary function of a FortiGate firewall policy source interface setting?

Accepted Answer

To specify the interface from which incoming traffic must originate to match the policy. The source interface setting in a FortiGate firewall policy specifies which incoming interface traffic must originate from to match the policy. This is a fundamental match criterion: only traffic entering the FortiGate on that interface will be evaluated against the policy. It helps control traffic flow based on network topology.

Answer

To assign dynamic IP addresses to wireless clients via DHCP

Answer

To configure the IPsec VPN Phase 1 encryption keys

Answer

To determine the MAC address of the destination web server

Question 12

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

Accepted Answer

To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers. NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams (typically UDP port 4500) so they can pass through NAT devices that would otherwise drop or mangle ESP traffic. This allows IPsec VPN peers behind NAT to establish and maintain tunnels.

Answer

To assign dynamic DHCP addresses to SSL VPN mobile clients

Answer

To translate internal private web server IP addresses to public IPs for inbound users

Answer

To balance VPN traffic across multiple high availability cluster members

Question 13

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

Accepted Answer

Web Filtering profile with malicious domain blocking enabled. A Web Filtering profile with malicious domain blocking enabled uses FortiGuard's categorized URL/domain database to intercept DNS/HTTP requests to known phishing and malware-hosting domains and block them before the connection is established. This is the only profile in the list designed specifically to evaluate destination reputation and deny access to malicious sites at the policy level.

Answer

Data Loss Prevention (DLP) sensor

Answer

Traffic Shaping rule profile

Answer

Antivirus signature profile in flow mode

Question 14

What is the primary function of a FortiGate firewall policy destination setting?

Accepted Answer

To specify the target IP addresses or subnets that traffic is allowed or denied to reach. In a FortiGate firewall policy, the destination setting defines the target IP addresses, subnets, or address objects that the policy matches on the receiving side of the traffic. It works together with source, service, and schedule to determine whether traffic is permitted or denied toward those destinations. This is the core function of the destination field in policy matching.

Answer

To determine the NTP time server synchronization interval

Answer

To configure the physical port speed and duplex mode

Answer

To set the administrator GUI login timeout threshold

Question 15

When configuring an IPsec VPN tunnel between two FortiGate units, what is the purpose of establishing a local ID (Peer ID) in Phase 1?

Accepted Answer

To provide a distinct peer identifier during Phase 1 authentication, particularly useful with dynamic IPs. The local ID (Peer ID) in IPsec Phase 1 provides a unique identifier for the peer during IKE authentication, which is especially important when peers use dynamic IP addresses. It allows the FortiGate to match the correct Phase 1 configuration to the incoming peer regardless of its IP.

Answer

To assign virtual IP addresses to SSL VPN client workstations

Answer

To encrypt user data payloads using AES-GCM encryption

Answer

To define the static routing administrative distance metric for the VPN tunnel