FORTINET-NSE123 Nse 2 Technical Introduction TO Fortinet Security — Timed 40 Questions

Question 1

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

40 minute time limit — choose an answer to begin.

Accepted Answer

FortiClient EMS. FortiClient EMS (Enterprise Management Server) manages FortiClient endpoints, deploys configurations, and enforces endpoint compliance within the Security Fabric.

Answer

FortiSandbox

Answer

FortiAnalyzer

Answer

FortiManager

Question 2

An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?

Accepted Answer

IPS sensor. Intrusion Prevention System (IPS) sensors inspect network traffic for vulnerability exploits and malicious signatures.

Answer

Web Filtering profile

Answer

Application Control profile

Answer

Data Loss Prevention (DLP) sensor

Question 3

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

Accepted Answer

Inside an IPv4 firewall policy matching the traffic. Security profiles, such as Antivirus, Web Filtering, and IPS, must be bound to an active IPv4 or IPv6 firewall policy to inspect traffic traversing the FortiGate.

Answer

Directly under the physical interface configuration

Answer

Inside the static routing table configuration

Answer

Under the Global System Settings menu

Question 4

An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?

Accepted Answer

Web Filtering profile. Web Filtering allows administrators to block or allow websites based on predefined FortiGuard categories such as Social Networking.

Answer

DNS Filter profile

Answer

IPS sensor

Answer

Antivirus profile

Question 5

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

Accepted Answer

Flow-based inspection. Flow-based inspection examines traffic patterns and metadata efficiently, whereas proxy-based inspection buffers and fully reconstructs application sessions.

Answer

Proxy-based inspection

Answer

Deep SSL decryption inspection

Answer

Sandbox isolation inspection

Question 6

An enterprise branch office needs to establish a secure, encrypted site-to-site tunnel back to the headquarters FortiGate over the public internet. Which VPN technology provides a standard IPsec framework combined with Fortinet Security Fabric integration features?

Accepted Answer

IPsec VPN tunnel in route-based mode. IPsec VPN with aggressive or main mode supports secure site-to-site connectivity. In FortiOS, IPsec tunnels can be configured in policy-based or route-based modes.

Answer

FortiClient EMS telemetry connection

Answer

SSL VPN web portal mode

Answer

RADIUS single sign-on agent

Question 7

An organization wants to implement the Fortinet Security Fabric to gain centralized visibility across multiple distributed security devices. Which core protocol is utilized by Security Fabric devices to discover, authenticate, and securely communicate with the root FortiGate?

Accepted Answer

Security Fabric Downstream Heartbeat and REST API telemetry. The Security Fabric uses the Fortinet Fabric connector and specialized heartbeat/telemetry communication protocols over HTTPS/TLS to link downstream devices to the root FortiGate.

Answer

Dynamic Host Configuration Protocol (DHCP) option 43

Answer

Simple Network Management Protocol (SNMP) v3 traps

Answer

Syslog over unencrypted UDP port 514

Question 8

An administrator is setting up a new FortiGate firewall and needs to configure basic access control between the internal corporate network and the external public network. Which object type should the administrator create first to group internal IP addresses for policy creation?

Accepted Answer

Firewall Address object. Firewall addresses are used to group IP addresses or subnets so they can be easily referenced in firewall policies.

Answer

Application Control signature

Answer

Virtual IP object

Answer

Traffic Shaper object

Question 9

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

Accepted Answer

SSL VPN Web Mode. Web Mode SSL VPN provides a browser-based user interface with bookmarks to internal web applications and file shares without needing FortiClient.

Answer

Explicit Proxy Mode

Answer

IPsec Client Mode

Answer

SSL VPN Tunnel Mode

Question 10

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?

Accepted Answer

FortiAnalyzer. FortiAnalyzer collects, analyzes, and correlates log data from FortiGate and other Security Fabric devices, generating comprehensive reports.

Answer

FortiSandbox

Answer

FortiAuthenticator

Answer

FortiWeb

Question 11

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Accepted Answer

Implicit Deny. Implicit Deny is the default security behavior of FortiGate firewalls, ensuring any traffic not explicitly permitted by a firewall policy is dropped.

Answer

Drop and send ICMP destination unreachable

Answer

Redirect to Captive Portal

Answer

Implicit Accept

Question 12

When a FortiGate device inspects HTTPS traffic using deep inspection, how does the security engine handle the TLS/SSL encryption handshake between the client and the destination server?

Accepted Answer

It acts as a man-in-the-middle, terminating the session and re-signing traffic with a local CA certificate. Deep inspection acts as a man-in-the-middle by terminating the client's SSL connection, presenting a re-signed certificate using a local CA, and opening a separate SSL connection to the destination server.

Answer

It strips all encryption permanently and forwards all internal traffic as plain text HTTP to the server

Answer

It inspects only the SNI (Server Name Indication) field in the unencrypted TLS Client Hello packet header

Answer

It relies entirely on the destination web server's private key pre-configured in the firewall policy

Question 13

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

Accepted Answer

FortiManager configured as a local FortiGuard distribution server. FortiManager can act as a local distribution server (FDS proxy) to download updates from FortiGuard and distribute them to isolated FortiGate devices.

Answer

FortiClient EMS deployment server

Answer

FortiAuthenticator user database server

Answer

FortiWeb application firewall

Question 14

An organization requires high availability (HA) for two FortiGate devices to ensure continuous network uptime during hardware failures. Which operating mode synchronizes sessions, configuration, and routing state between the primary and secondary units in an active-passive cluster?

Accepted Answer

FortiGate Clustering Protocol (FGCP) Active-Passive mode. FGCP (FortiGate Clustering Protocol) in an active-passive high availability configuration synchronizes session tables and configurations so the secondary unit can seamlessly take over if the primary fails.

Answer

Dynamic Multicast Routing Protocol (PIM-SM)

Answer

Virtual Router Redundancy Protocol (VRRP) active-active balancing

Answer

Border Gateway Protocol (BGP) Multipath clustering

Question 15

When configuring a FortiGate interface to connect to an external ISP network that utilizes dynamic IP assignment via DHCP, which setting must be enabled on the interface parameters?

Accepted Answer

Set Addressing Mode to DHCP. When connecting an external interface to an ISP providing dynamic addressing, the addressing mode must be set to DHCP so the FortiGate requests and acquires its IP address automatically.

Answer

Enable Secondary IP addressing

Answer

Configure a Static Virtual IP (VIP) mapping

Answer

Enable PPPoE client emulation mode

Question 16

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

Accepted Answer

To group multiple interfaces into a single entity for simplified firewall policy management. Interface zones group multiple physical or logical interfaces together, allowing administrators to apply a single firewall policy to multiple interfaces sharing the same security requirements.

Answer

To enforce static routing protocols across distinct subnets

Answer

To increase the physical bandwidth capacity of aggregated switch ports

Answer

To assign dynamic IP addresses to connected client workstations

Question 17

An organization is deploying a FortiGate firewall in NAT mode. By default, how does the FortiGate handle outbound traffic leaving the internal network for the internet in terms of source IP addressing?

Accepted Answer

It translates the private source IP address to the outgoing interface IP address using Network Address Translation (SNAT). In NAT mode, outbound traffic passing through a firewall policy with NAT enabled is translated (SNAT) to the outgoing interface's IP address.

Answer

It encapsulates all outbound packets inside GRE tunnels without IP header alteration

Answer

It forwards the original private IP address without modification across public routers

Answer

It drops outbound packets unless explicit static destination NAT rules are created

Question 18

A network security administrator needs to block peer-to-peer (P2P) file sharing applications across the corporate network. Which FortiOS security feature should be added to the firewall policy to identify and block these specific applications regardless of the ports they use?

Accepted Answer

Application Control profile. Application Control identifies applications based on signature analysis and behavioral characteristics rather than TCP/UDP port numbers.

Answer

Static port-blocking firewall rules

Answer

SSL certificate inspection profile

Answer

Antivirus signature database

Question 19

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

Accepted Answer

FortiManager. FortiManager is the centralized management platform designed for provisioning and managing FortiGate and other security devices at scale.

Answer

FortiAnalyzer

Answer

FortiAuthenticator

Answer

FortiSandbox

Question 20

An administrator wants to inspect incoming files for unknown zero-day malware using advanced behavior analysis in a secure virtual environment before allowing them onto endpoints. Which Fortinet security component fulfills this requirement?

Accepted Answer

FortiSandbox integration. FortiSandbox executes suspicious files in an isolated virtual sandbox environment to observe behavior and detect zero-day threats.

Answer

Intrusion Prevention System signature matching

Answer

FortiGuard Antivirus signature lookup

Answer

Web filtering URL categorization