FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 6 — 15 Questions

Question 1

What is the primary function of a FortiSwitch port configured with FortiLink?

Accepted Answer

To establish a secure management and data connection between a FortiGate and a FortiSwitch. FortiLink is a protocol that enables a FortiGate to manage and control a FortiSwitch, providing a secure management and data connection between the two devices. It allows the FortiGate to push VLAN, policy, and security configurations to the FortiSwitch, effectively making the switch an extension of the FortiGate's security fabric.

Answer

To connect external ISP routers via PPPoE authentication

Answer

To scan emails for spam and phishing attachments

Answer

To tunnel remote worker traffic via IPsec site-to-site protocols

Question 2

An administrator needs to ensure that administrative sessions to the FortiGate GUI automatically terminate after 15 minutes of inactivity. Where is this idle timeout setting configured?

Accepted Answer

Under System Global settings (Administrator Idle Timeout). The administrator idle timeout is a global system setting configured under System > Settings (System Global) in the FortiGate GUI, or via the CLI with 'config system global' then 'set admintimeout <minutes>'. It applies to all administrative sessions (GUI, SSH, Telnet, console) and defaults to 5 minutes on most FortiOS versions.

Answer

Inside the individual firewall policy rule settings

Answer

Inside the DHCP server IP lease settings

Answer

Within the static routing table configuration

Question 3

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Accepted Answer

FortiAnalyzer. FortiGate (E) is correct because it is the foundational security appliance of the Fortinet Security Fabric, providing the firewall, IPS, and other security functions that anchor the fabric's core. FortiAnalyzer (C) is correct because it is a native Fortinet component that collects, correlates, and analyzes logs and events from fabric devices, delivering the visibility and reporting layer of the architecture. VMware ESXi (A) is a third-party hypervisor that can host virtual FortiGate instances but is not itself a Security Fabric component. Microsoft Active Directory (B) is an external directory service used for authentication integration, not a core fabric element. Cisco Catalyst Switch (D) is third-party networking hardware that can be integrated via Fabric Connectors but is not part of the Fortinet Security Fabric architecture.

Answer

VMware ESXi hypervisor

Answer

Microsoft Active Directory

Answer

Cisco Catalyst Switch

Question 4

When configuring dynamic routing on a FortiGate using OSPF, what is the function of a designated router (DR) in a multi-access broadcast network?

Accepted Answer

To centralize LSA exchanges and minimize routing protocol traffic on multi-access broadcast networks. In OSPF, a designated router (DR) is elected on multi-access broadcast networks (like Ethernet) to centralize the exchange of Link State Advertisements (LSAs). Instead of every router forming adjacencies with every other router (full mesh), all non-DR routers (DROTHERs) form adjacencies only with the DR and BDR. The DR then floods LSAs to all other routers on the segment, drastically reducing protocol overhead and preventing excessive LSA replication.

Answer

To translate private internal IP addresses to public IPs for internet browsing

Answer

To encrypt user data traffic traversing IPsec VPN tunnels between headquarters and branches

Answer

To distribute antivirus signature updates to isolated FortiGate appliances

Question 5

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

Accepted Answer

Flow-based inspection. Flow-based inspection (C) is correct because FortiGate processes traffic using a single-pass, stream-based engine that scans packets as they flow through the firewall, applying UTM profiles with lower latency and higher throughput. Proxy-based inspection (D) is also correct because FortiGate can buffer and fully reassemble traffic at the application layer, allowing deeper content inspection, file scanning, and protocol validation. These two modes are the standard UTM inspection modes configured in FortiOS security profiles and firewall policies. The other options do not belong: NAT routing inspection (A) and static gateway inspection (E) are not FortiGate UTM inspection modes, and transparent bridging inspection (B) describes a deployment/interface mode rather than a UTM processing mode.

Answer

NAT routing inspection

Answer

Transparent bridging inspection

Answer

Static gateway inspection

Question 6

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Accepted Answer

SSL VPN. SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology. Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Answer

Telnet plain-text management

Answer

HTTP unencrypted web browsing

Question 7

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Accepted Answer

IPS sensor. Option B (IPS sensor) is correct because a FortiGate firewall policy can reference an IPS sensor in its security profiles section, enabling signature-based and anomaly-based inspection of traffic to detect and block intrusions and attacks. Option E (Antivirus profile) is correct because an antivirus profile can likewise be attached to a firewall policy to scan allowed traffic for viruses, worms, and other malware, with actions such as block or monitor. The remaining options are not security profiles: A (Static route table) is a routing construct for forwarding packets, C (DHCP server scope) defines address leases for clients, and D (DNS server forwarding list) configures DNS resolution behavior, none of which are attached to a policy for threat protection.

Answer

Static route table

Answer

DHCP server scope

Answer

DNS server forwarding list

Question 8

Which TWO authentication methods or servers can be integrated with a FortiGate for user identity verification? (Choose two.)

Accepted Answer

LDAP / Active Directory server. Option B (LDAP / Active Directory server) is correct because FortiGate natively supports LDAP as a remote authentication method, allowing it to query an LDAP directory such as Microsoft Active Directory to verify user credentials and retrieve group membership for identity-based policies. Option C (RADIUS authentication server) is correct because FortiGate can be configured as a RADIUS client that forwards user authentication requests to an external RADIUS server, commonly used for two-factor authentication and centralized user verification. Option A (SNMP agent) is incorrect because SNMP is used for monitoring and management of network devices, not for authenticating user identities. Option D (Syslog UDP collector) is incorrect because syslog is a logging and event-forwarding protocol, not an authentication mechanism. Option E (NTP server) is incorrect because NTP only synchronizes system time across devices and plays no role in verifying user identity.

Answer

Simple Network Management Protocol (SNMP) agent

Answer

Syslog UDP collector

Answer

Network Time Protocol (NTP) server

Question 9

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

Accepted Answer

Endpoint compliance and quarantine enforcement. Option A is correct because FortiClient EMS acts as the endpoint management server that evaluates endpoints against compliance profiles (for example, antivirus, patch, and OS requirements) and can trigger quarantine actions—such as dynamic address group assignment or restricted access—when an endpoint fails compliance. Option D is correct because FortiClient EMS provides endpoint vulnerability scanning, using FortiClient's vulnerability scan engine to detect missing patches and vulnerable software on managed endpoints and report those findings to the EMS console. Option E is correct because, when integrated into the Fortinet Security Fabric, FortiClient EMS shares endpoint telemetry (identity, compliance status, and threat information) with FortiGate and other Fabric devices via the Fabric connector, enabling coordinated enforcement and visibility. Option B is not correct because firewall policy compilation is performed locally by FortiGate (or centrally via FortiManager), not by FortiClient EMS. Option C is not correct because syslog aggregation for routers is a logging function typically handled by FortiAnalyzer or a dedicated syslog server, not by FortiClient EMS.

Answer

Centralized FortiGate firewall policy compilation

Answer

Syslog server log aggregation for routers

Question 10

Which TWO settings are required when configuring a basic static route on a FortiGate? (Choose two.)

Accepted Answer

Gateway IP address (next-hop). When configuring a basic static route on a FortiGate, the two required settings are the destination IP address and netmask (Option C) and the gateway IP address or next-hop (Option B). Option C is correct because a static route must specify the destination network (e.g., 10.0.0.0/24) that the route is intended to reach, defining the match criteria for traffic. Option B is correct because the FortiGate needs the next-hop gateway IP address (e.g., 192.168.1.1) to know where to forward matching packets, typically the upstream router's interface on the connected subnet. The other options do not belong: an IPsec Phase 1 Pre-Shared Key (A) is only used when building a VPN tunnel, not a static route; an Antivirus inspection profile (D) is a security profile applied to firewall policies, not routing; and a DHCP server IP pool range (E) is unrelated to routing and is configured under the DHCP server settings.

Answer

IPsec Phase 1 Pre-Shared Key

Answer

Antivirus inspection profile

Answer

DHCP server IP pool range

Question 11

Which THREE methods can be used to back up or restore a FortiGate configuration? (Choose three.)

Accepted Answer

FortiManager centralized configuration management and revision templates. Option A is correct because FortiManager provides centralized configuration management, allowing administrators to back up FortiGate configurations as revision history and restore them via policy packages or revision templates. Option B is correct because the FortiGate CLI supports configuration backup and restore through commands such as 'execute backup config' and 'execute restore config', which save or load the full configuration file. Option C is correct because the FortiGate GUI (Web-based Manager) includes a System > Configuration > Backup/Restore utility that lets administrators download or upload a configuration file. Option D is not correct because FortiAnalyzer is a logging and reporting appliance; its archive/export utilities handle log data, not FortiGate configuration backup or restore. Option E is not correct because FortiClient EMS manages endpoint profiles and synchronization, not FortiGate device configuration backup or restore.

Answer

FortiAnalyzer log archive export utilities

Answer

FortiClient EMS endpoint profile synchronization

Question 12

Which TWO types of objects can be created to group network resources for firewall policies on a FortiGate? (Choose two.)

Accepted Answer

Firewall address group. Firewall address groups (option C) are created in FortiGate under Policy & Objects > Addresses to bundle multiple IPv4/IPv6 addresses, IP ranges, FQDNs, or geolocation objects into a single named object, which can then be referenced in firewall policies to match source or destination network resources. Firewall service groups (option D) similarly aggregate multiple service objects (protocol/port definitions such as TCP/80 or UDP/53) into one named object for use in policy service fields, making them the other valid grouping object for firewall policies. SD-WAN performance SLA groups (option A) are used to define health-check thresholds for SD-WAN members, not to group network resources for policy matching. High availability heartbeat groups (option B) relate to HA interface monitoring and cluster communication, not firewall policy objects. Antivirus signature groups (option E) are security-profile components for AV scanning, not address or service groupings used in firewall policies.

Answer

SD-WAN performance SLA group

Answer

High availability heartbeat group

Answer

Antivirus signature group

Question 13

Which TWO criteria can be used in a FortiGate firewall policy to match and control traffic? (Choose two.)

Accepted Answer

Service objects (ports and protocols like HTTP or SSH). Option A is correct because FortiGate firewall policies match traffic using service objects, which define the destination port and protocol (for example TCP/80 for HTTP or TCP/22 for SSH), allowing the policy to control traffic by application service. Option C is correct because firewall policies match on source and destination IP addresses, typically referenced through address objects (host, subnet, or range), which is a fundamental match criterion for permitting or denying traffic between networks. Option B is incorrect because the FortiGuard signature version number identifies the installed IPS/AV database revision, not a per-policy traffic match field. Option D is incorrect because FortiASIC CPU utilization is a hardware performance metric, not a policy matching criterion. Option E is incorrect because the administrator GUI idle timeout is an administrative session setting, not a firewall policy match condition.

Answer

FortiGuard signature version number

Answer

CPU utilization percentage of FortiASIC chips

Answer

Administrator GUI idle timeout threshold

Question 14

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

Accepted Answer

Session synchronization and session pickup settings. Option A is correct because FGCP HA relies on session synchronization and session pickup to replicate firewall and NAT session state between cluster members, so that a failover preserves existing connections. Option D is correct because FGCP uses heartbeat keepalive packets and hello messages over the HA link to detect member liveness and negotiate cluster state. Option E is correct because FortiGate HA clusters use dedicated HA heartbeat interfaces (physical or VLAN) to carry FGCP heartbeats and synchronization traffic, isolating it from production data. Option B is not required, since BGP is an exterior routing protocol and FGCP HA does not depend on BGP peer autonomous systems. Option C is not required, since RADIUS authentication token polling is unrelated to FGCP cluster formation or maintenance.

Answer

BGP exterior routing protocol peer autonomous systems

Answer

RADIUS authentication server token polling

Question 15

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Accepted Answer

HTTPS. Option D (HTTPS) is correct because it encrypts administrative GUI/API traffic to the FortiGate interface using TLS on port 443, protecting credentials and session data from eavesdropping. Option E (SSH) is correct because it provides an encrypted CLI management channel, typically on TCP port 22, for secure administrative access. The other options do not belong: POP3 (A) is a mail retrieval protocol, not a management protocol; Telnet (B) is a management protocol but sends credentials and data in cleartext, so it is not secure; and HTTP (C) is an unencrypted web protocol, so it also fails the secure-access requirement.

Answer

POP3

Answer

Telnet

Answer

HTTP