FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security Practice Test 7 — 15 Questions

Question 1

Which TWO logging destinations can receive log data from a FortiGate firewall? (Choose two.)

Accepted Answer

External Syslog server. FortiGate can send logs to local system disk/memory, FortiAnalyzer, and external Syslog servers.

Answer

FortiAuthenticator token server

Answer

FortiClient EMS endpoint agent

Answer

Microsoft Active Directory domain controller

Question 2

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Accepted Answer

SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss). Fortinet SD-WAN uses performance SLAs to monitor link health and SD-WAN rules to steer traffic dynamically.

Answer

Telnet remote terminal management protocol

Answer

POP3 email retrieval protocol

Answer

SNMP v1 network monitoring traps

Question 3

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

Accepted Answer

Security Profile. Security profiles (grouped under Security Profiles in FortiOS) are attached to firewall policies to apply UTM inspections like Antivirus, Web Filtering, and IPS. Interface addresses, zones, and schedules control routing and timing, not threat inspection.

Answer

Virtual Domain (VDOM)

Answer

Interface Zone

Answer

Firewall Schedule

Question 4

Which THREE actions can a FortiGate Web Filtering profile take when a user attempts to access a website belonging to a blocked category? (Choose three.)

Accepted Answer

Block the request and display a customizable replacement message page. When a web filter category is blocked, the FortiGate can block the page and show a replacement message, allow with a warning prompt, or monitor/log the event.

Answer

Automatically quarantine the user workstation inside FortiClient EMS

Answer

Encapsulate all HTTP packets inside an IPsec VPN tunnel

Question 5

Within the Fortinet Security Fabric architecture, what is the primary role of an upstream FortiGate device acting as the root node compared to downstream internal segmentation firewalls?

Accepted Answer

To coordinate fabric topology, aggregate fabric information, and distribute top-level security configurations.. The root FortiGate in a Security Fabric orchestrates overall fabric topology, aggregates threat intelligence, and synchronizes settings downward to internal segmentation firewalls (ISF).

Answer

To replace the need for FortiClient endpoints by directly installing VPN clients on user laptops.

Answer

To act exclusively as an offline logging collector without participating in traffic forwarding.

Answer

To handle local domain name resolution (DNS) and DHCP services for the entire enterprise network.

Question 6

An enterprise network architect is designing a site-to-site VPN architecture to connect a branch office to headquarters using FortiGate devices. The branch office relies on a dynamic broadband connection with a frequently changing public IP address. Which VPN configuration approach should be implemented?

Accepted Answer

Configure a site-to-site IPsec VPN with the headquarters acting as the dial-up server and the branch acting as the dial-up client.. When one peer has a dynamic IP address, Main Mode IPsec VPNs with dynamic dial-up user settings or Aggressive Mode with dynamic ID peer IDs are typically used. In modern FortiOS, dial-up IPsec VPN configurations allow the dynamically addressed branch to initiate the tunnel to the static headquarters.

Answer

Implement Virtual Domain (VDOM) links to bridge the branch office directly to headquarters across Layer 2.

Answer

Configure static IPsec phase 1 parameters specifying the exact public IP address of the branch office on the headquarters FortiGate.

Answer

Configure an SSL VPN web portal on the branch office FortiGate.

Question 7

A network administrator notices that a web filtering profile configured on a FortiGate is blocking a specific educational video streaming category, but the exception list needs to allow a single permitted URL within that category. Where in FortiOS should the administrator add this specific URL override?

Accepted Answer

Inside the Web Filter Security Profile under URL Filter table overrides.. FortiOS Web Filtering profiles allow administrators to configure URL Filters with action types such as Exempt, Block, Allow, or Monitor to override category-based decisions.

Answer

Inside the Application Control sensor blacklist configuration.

Answer

Under Firewall Policy Destination Addresses.

Answer

Within the Intrusion Prevention System (IPS) sensor signature exception list.

Question 8

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

Accepted Answer

The FortiGate CA certificate has not been installed in the trusted root certificate store of the client endpoints.. During Deep Packet Inspection (DPI), FortiGate acts as a man-in-the-middle, re-signing SSL/TLS traffic with its internal CA certificate. If the FortiGate CA certificate is not installed in the client browser's trusted root store, the browser displays untrusted certificate warnings.

Answer

The Web Filtering license on the FortiGate has expired, causing HTTPS inspection to fail open.

Answer

The firewall policy is configured with proxy-based inspection instead of flow-based inspection.

Answer

The Antivirus database update failed, preventing the FortiGate from decrypting TLS 1.3 handshakes.

Question 9

A security analyst is investigating a security alert generated by FortiGate Intrusion Prevention System (IPS). The log indicates that a known exploit signature was detected and dropped. How does FortiGate IPS inspect network traffic to identify such patterns?

Accepted Answer

By matching packet payloads and protocol behavior against a database of known exploit signatures.. FortiGate IPS uses pattern-matching engines and protocol decoders to inspect packet payloads against a signature database, identifying malicious sequences regardless of port or IP.

Answer

By forcing all communicating hosts to authenticate via Kerberos before establishing a TCP handshake.

Answer

By monitoring static ARP tables for unauthorized MAC address changes on the local subnet.

Answer

By querying a cloud-based DNS blacklist every time a packet crosses the physical firewall interface.

Question 10

An organization is deploying FortiClient Endpoint Management Server (EMS) alongside FortiGate to enforce Zero Trust Network Access (ZTNA). A remote user's laptop connects to an unsecured public Wi-Fi hotspot. How does the Fortinet ZTNA solution ensure secure application access for this user without establishing a traditional full-tunnel VPN?

Accepted Answer

By dynamically checking endpoint posture tags supplied by FortiClient EMS and applying proxy-based access control per application.. FortiClient ZTNA evaluates device posture (OS patches, antivirus status, registry checks) via EMS tags, and FortiGate acts as a ZTNA proxy, granting application-level access through explicit proxy rules only if posture tags match.

Answer

By forcing all local Wi-Fi traffic through a hardware-based Layer 2 bridge established via FortiExtender.

Answer

By translating all internal server IP addresses into public routable IPs via Static NAT on the endpoint.

Answer

By establishing a permanent IPsec tunnel that encapsulates all endpoint traffic regardless of destination.

Question 11

An administrator needs to ensure that internal network users cannot bypass corporate security policies by using unauthorized peer-to-peer file sharing or gaming applications. Which FortiGate security feature is specifically designed to identify and take action against these types of network protocols?

Accepted Answer

Application Control. Application Control identifies and controls applications (like P2P, gaming, social media) regardless of port or protocol by analyzing traffic heuristics and signatures.

Answer

Antivirus Profile

Answer

NAT IP Pool

Answer

Static Route Table

Question 12

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

Accepted Answer

It provides broad visibility, automated threat detection, and synchronized remediation across distributed security devices.. The Security Fabric provides broad visibility across the entire attack surface and automated threat remediation. It is not limited to a single vendor's cloud, nor does it require manual CLI scripting for fabric connections.

Answer

It relies entirely on offline flat-file backups for threat intelligence exchange.

Answer

It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

Answer

It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

Question 13

When configuring firewall policies on a FortiGate device, an administrator must define matching criteria and actions. Which THREE elements are mandatory components of a standard IPv4 firewall policy in FortiOS? (Choose three.)

Accepted Answer

Source Interface and Destination Interface. An IPv4 firewall policy in FortiOS requires incoming (Source Interface) and outgoing (Destination Interface) interfaces, source and destination address objects, service objects (ports/protocols), and an action (Accept/Deny).

Answer

An active FortiSandbox cloud subscription registration key.

Answer

A mandatory Web Filtering security profile attached directly to the policy.

Question 14

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Accepted Answer

SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.. SSL VPN can operate in web mode (browser-based) or tunnel mode, whereas IPsec VPN requires dedicated client software or OS-level configurations. SSL VPN typically uses standard ports like TCP 443, whereas IPsec VPN uses UDP 500/4500.

Answer

IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.

Answer

SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.

Answer

IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.

Question 15

An administrator is hardening endpoint security using FortiClient and FortiGate integration. Which THREE core security functions can be enforced through this endpoint-to-firewall integration? (Choose three.)

Accepted Answer

Enforcement of compliance posture tags for Zero Trust Network Access (ZTNA).. FortiClient and FortiGate integration supports vulnerability scanning, compliance/posture checks via EMS tags, dynamic ZTNA access control, and automated quarantine of compromised endpoints.

Answer

Direct replacement of core routing protocols such as BGP and OSPF on upstream carrier routers.

Answer

Hardware-level replacement of physical switch port VLAN configurations from the endpoint GUI.