FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 6 — 15 Questions

Question 1

When configuring dynamic routing on a FortiGate using OSPF, what is the function of a designated router (DR) in a multi-access broadcast network?

Accepted Answer

To centralize LSA exchanges and minimize routing protocol traffic on multi-access broadcast networks. In OSPF broadcast networks, a Designated Router (DR) minimizes routing protocol traffic by acting as a central collection and distribution point for link-state advertisements (LSAs) among all routers on that segment.

Answer

To translate private internal IP addresses to public IPs for internet browsing

Answer

To encrypt user data traffic traversing IPsec VPN tunnels between headquarters and branches

Answer

To distribute antivirus signature updates to isolated FortiGate appliances

Question 2

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

Accepted Answer

Flow-based inspection. FortiOS supports Flow-based inspection and Proxy-based inspection modes for UTM security profiles.

Answer

NAT routing inspection

Answer

Transparent bridging inspection

Answer

Static gateway inspection

Question 3

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. FortiGate supports IPsec VPN, SSL VPN, and FortiClient-based telemetry/VPN tunnels for secure remote access.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 4

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Antivirus and IPS (Intrusion Prevention System) are primary security profiles used to detect and block malware and exploits.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 5

Which TWO firewall operational modes can be configured on a FortiGate device? (Choose two.)

Accepted Answer

Transparent mode. FortiGate firewalls operate in either NAT mode or Transparent mode.

Answer

Sandbox isolation mode

Answer

Promiscuous sniffing mode

Answer

Endpoint agent mode

Question 6

Which TWO authentication methods or servers can be integrated with a FortiGate for user identity verification? (Choose two.)

Accepted Answer

LDAP / Active Directory server. FortiGate supports integration with external authentication servers such as LDAP/Active Directory and RADIUS.

Answer

Simple Network Management Protocol (SNMP) agent

Answer

Syslog UDP collector

Answer

Network Time Protocol (NTP) server

Question 7

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

Accepted Answer

Endpoint compliance and quarantine enforcement. FortiClient EMS provides endpoint telemetry, vulnerability scanning, and automated quarantine/compliance enforcement.

Answer

Centralized FortiGate firewall policy compilation

Answer

Syslog server log aggregation for routers

Question 8

Which TWO settings are required when configuring a basic static route on a FortiGate? (Choose two.)

Accepted Answer

Gateway IP address (next-hop). A static route requires a destination IP/subnet and a gateway IP (or outgoing interface) to forward packets.

Answer

IPsec Phase 1 Pre-Shared Key

Answer

Antivirus inspection profile

Answer

DHCP server IP pool range

Question 9

Which THREE methods can be used to back up or restore a FortiGate configuration? (Choose three.)

Accepted Answer

FortiManager centralized configuration management and revision templates. FortiGate configurations can be backed up or restored via the Web GUI, CLI (console/SSH/TFTP), and centralized management platforms like FortiManager.

Answer

FortiAnalyzer log archive export utilities

Answer

FortiClient EMS endpoint profile synchronization

Question 10

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Administrators can create firewall address objects/groups and service objects/groups to organize policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group

Question 11

Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)

Accepted Answer

Service objects (ports and protocols like HTTP or SSH). Firewall policies match traffic based on source/destination interfaces, source/destination addresses, services, schedules, and user identities.

Answer

FortiGuard signature version number

Answer

CPU utilization percentage of FortiASIC chips

Answer

Administrator GUI idle timeout threshold

Question 12

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

Accepted Answer

Session synchronization and session pickup settings. FGCP clustering relies on dedicated heartbeat interfaces, cluster hello/keepalive packets, and session synchronization/pickup configurations.

Answer

BGP exterior routing protocol peer autonomous systems

Answer

RADIUS authentication server token polling

Question 13

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Accepted Answer

HTTPS. HTTPS and SSH are secure protocols used for web-based GUI and command-line administrative access.

Answer

POP3

Answer

Telnet

Answer

HTTP

Question 14

Which TWO threat intelligence services or features are delivered dynamically by the FortiGuard network? (Choose two.)

Accepted Answer

Web Filtering URL categorization database. FortiGuard provides dynamic database updates for Web Filtering URL categories and Antivirus/IPS threat signatures.

Answer

FortiClient EMS endpoint installation binaries

Answer

Physical switch port VLAN assignment maps

Answer

Microsoft Active Directory user group membership

Question 15

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

Accepted Answer

Encryption and hashing algorithms (e.g., AES-256 and SHA-256). IPsec Phase 1 requires matching authentication methods (like pre-shared keys), encryption/hash algorithms, and Diffie-Hellman groups.

Answer

System time zone offset in hours

Answer

FortiGate administrator username