FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 5 — 15 Questions

Question 1

What is the primary function of a FortiGate hardware acceleration processor (FortiASIC)?

Accepted Answer

To offload firewall session processing and cryptographic operations, accelerating performance. FortiASIC chips offload compute-intensive tasks like packet forwarding, cryptographic operations, and content inspection from the main CPU, accelerating firewall performance.

Answer

To manage user identities and generate FortiToken push notifications

Answer

To provide wireless access point controller management via CAPWAP

Answer

To act as an external database for storing FortiAnalyzer log archives

Question 2

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

Accepted Answer

Firewall Schedule object. Schedule objects define specific time periods and days of the week, which can be added to firewall policies to enforce time-based access control.

Answer

Virtual IP (VIP) object

Answer

Application Control signature

Answer

Traffic Shaper object

Question 3

When configuring an IPsec VPN tunnel between two FortiGate units using pre-shared keys (PSK), what is required for successful Phase 1 authentication?

Accepted Answer

Both peers must match on Phase 1 encryption, hash algorithms, DH group, and identical pre-shared keys. For IPsec Phase 1 with PSK to succeed, both peers must match on authentication settings, encryption/hash algorithms, Diffie-Hellman groups, and the identical pre-shared key string.

Answer

The pre-shared key must be configured in Phase 2 rather than Phase 1

Answer

Both peers must use dynamic IP addresses assigned by DHCP

Answer

Both peers must run different firmware versions to ensure cryptographic compatibility

Question 4

What is the primary function of a FortiGate interface configured in NAT mode?

Accepted Answer

To route traffic between different subnets and perform Network Address Translation (NAT). In NAT mode, the FortiGate routes traffic between interfaces and performs Network Address Translation (NAT) on packets traversing security boundaries.

Answer

To provide wireless access point management via CAPWAP

Answer

To bridge Ethernet frames at Layer 2 without performing routing or IP translation

Answer

To act as a dedicated storage volume for FortiAnalyzer log archives

Question 5

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Accepted Answer

Under System > Alert Email settings. Email alert settings (Alert Email) can be configured on the FortiGate to send notifications when specific log severity levels or events occur.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the FortiGuard subscription server parameters

Answer

Within the static routing table configuration

Question 6

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

Accepted Answer

Active-active distributes session processing across multiple cluster units, whereas active-passive processes all traffic on a single primary unit. In active-active mode, session load is distributed across multiple cluster members using session-pickup/load-balancing mechanisms, whereas active-passive runs all traffic through the primary unit until a failover occurs.

Answer

Active-active requires manual administrator failover, while active-passive is fully automated

Answer

Active-active disables all firewall security profiles to maximize raw throughput

Answer

Active-active eliminates the need for heartbeat cables between cluster units

Question 7

What is the primary function of a FortiGate firewall policy source interface setting?

Accepted Answer

To specify the interface from which incoming traffic must originate to match the policy. The source interface specifies which physical or logical interface traffic must originate from to match the firewall policy rule.

Answer

To assign dynamic IP addresses to wireless clients via DHCP

Answer

To configure the IPsec VPN Phase 1 encryption keys

Answer

To determine the MAC address of the destination web server

Question 8

An administrator notices that a specific software application is being blocked by Application Control. Upon checking the logs, the administrator wants to create an exception to allow this specific application while keeping the rest of the application control category blocked. How can this be achieved?

Accepted Answer

By adding an Application Override rule inside the Application Control profile. Application Control profiles support application overrides, allowing administrators to add specific allow or block exceptions for individual applications within a category.

Answer

By disabling the entire Antivirus scanning engine globally

Answer

By changing the static routing table administrative distance

Answer

By switching the FortiGate firewall from NAT mode to Transparent mode

Question 9

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

Accepted Answer

To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers. NAT-T encapsulates IPsec ESP packets inside UDP port 4500 packets when a NAT device is detected between the VPN peers, preventing NAT from breaking the IPsec session.

Answer

To assign dynamic DHCP addresses to SSL VPN mobile clients

Answer

To translate internal private web server IP addresses to public IPs for inbound users

Answer

To balance VPN traffic across multiple high availability cluster members

Question 10

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

Accepted Answer

Web Filtering profile with malicious domain blocking enabled. Web Filtering and DNS Filtering profiles block access to malicious, phishing, and command-and-control domains based on real-time FortiGuard intelligence.

Answer

Data Loss Prevention (DLP) sensor

Answer

Traffic Shaping rule profile

Answer

Antivirus signature profile in flow mode

Question 11

What is the primary function of a FortiGate firewall policy destination setting?

Accepted Answer

To specify the target IP addresses or subnets that traffic is allowed or denied to reach. The destination setting in a firewall policy defines the IP addresses, subnets, or address groups that traffic is allowed or denied to reach.

Answer

To determine the NTP time server synchronization interval

Answer

To configure the physical port speed and duplex mode

Answer

To set the administrator GUI login timeout threshold

Question 12

When configuring an IPsec VPN tunnel between two FortiGate units, what is the purpose of establishing a local ID (Peer ID) in Phase 1?

Accepted Answer

To provide a distinct peer identifier during Phase 1 authentication, particularly useful with dynamic IPs. Local ID allows peers to identify themselves during Phase 1 negotiation, which is especially useful when one or both peers use dynamic IP addresses and need a distinct identifier for authentication matching.

Answer

To assign virtual IP addresses to SSL VPN client workstations

Answer

To encrypt user data payloads using AES-GCM encryption

Answer

To define the static routing administrative distance metric for the VPN tunnel

Question 13

What is the primary function of a FortiSwitch port configured with FortiLink?

Accepted Answer

To establish a secure management and data connection between a FortiGate and a FortiSwitch. FortiLink is a proprietary Fortinet protocol that connects FortiSwitches to a FortiGate firewall, enabling centralized management, VLAN provisioning, and security fabric integration.

Answer

To connect external ISP routers via PPPoE authentication

Answer

To scan emails for spam and phishing attachments

Answer

To tunnel remote worker traffic via IPsec site-to-site protocols

Question 14

An administrator needs to ensure that administrative sessions to the FortiGate GUI automatically terminate after 15 minutes of inactivity. Where is this idle timeout setting configured?

Accepted Answer

Under System Global settings (Administrator Idle Timeout). System idle timeout for administrators is configured under system global settings.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the DHCP server IP lease settings

Answer

Within the static routing table configuration

Question 15

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Accepted Answer

FortiAnalyzer. FortiGate (firewall) and FortiAnalyzer (logging/analytics) are core foundational pillars of the Fortinet Security Fabric.

Answer

VMware ESXi hypervisor

Answer

Microsoft Active Directory

Answer

Cisco Catalyst Switch