FORTINET-NSE123 Nse 3 Fortigate Operational Fundamentals Practice Test 1 — 15 Questions

Question 1

An administrator notices that the FortiGate configuration changes made during troubleshooting were lost after an unexpected power outage. Where should the administrator check to ensure that the current running configuration is permanently saved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiGate automatically saves running configurations to non-volatile memory immediately upon successful CLI or GUI commit actions.. FortiGate commits configuration changes to non-volatile memory immediately upon a successful CLI 'end' or GUI 'OK/Apply' action, so the running configuration is already persistent and survives power loss. There is no separate 'save' step like on some other network platforms. The administrator should verify that changes were actually committed rather than looking for a save location.

Answer

System > Admin > Settings

Answer

System > Configuration > Backup

Answer

The CLI command execute backup config

Question 2

An administrator is troubleshooting a policy match issue and needs to inspect a specific security policy's hit count and ID directly from the CLI. Which CLI command should the administrator use to list all firewall policies with their internal IDs and rule details?

Accepted Answer

show firewall policy. The 'show firewall policy' command is the correct CLI syntax on FortiOS to display all configured firewall policies, including their internal policy IDs, source/destination interfaces, addresses, services, and action. It provides the rule details and hit counts needed to verify which policy is matching traffic. This is the standard read-only inspection command for policy verification from the CLI.

Answer

get system performance

Answer

diagnose sys session list

Answer

get system status

Question 3

An administrator needs to verify whether the FortiGate unit can successfully communicate with the FortiGuard distribution servers for license and signature updates. Which command should be run in the CLI to test this specific connectivity?

Accepted Answer

execute update-now. The 'execute update-now' command forces the FortiGate to immediately contact the FortiGuard Distribution Network (FDN) to check for and download the latest antivirus, IPS, and other security signatures, as well as validate licensing. If connectivity to FortiGuard is broken, this command will fail with a timeout or connection error, making it the correct way to test that specific communication path. It exercises the actual FortiGuard update channel rather than generic internet reachability.

Answer

diagnose sys top

Answer

ping 8.8.8.8

Answer

execute FortiGuard-test

Question 4

An administrator wants to inspect historical logs stored locally on the FortiGate hard drive. Which menu should they open?

Accepted Answer

Log & Report > Forward Traffic. To inspect historical logs stored locally on the FortiGate hard drive, the administrator should open Log & Report > Forward Traffic, which displays traffic log entries that can be filtered by time, source, destination, and other criteria. This menu provides access to the local log database for traffic logs. The other menus either show summaries, configure logging, or are not valid FortiGate menu paths.

Answer

Dashboard > Log Summary

Answer

System > Log Config

Answer

Monitor > Log Viewer

Question 5

An administrator needs to verify the hardware sensor status (fans, power supplies, temperatures) of a high-end FortiGate unit. Which command provides this hardware health status?

Accepted Answer

get system hardware status. The get system hardware status command displays sensor readings such as fan speed and temperature.

Answer

execute hardware-test

Answer

diagnose hardware device info

Answer

show system sensor

Question 6

An administrator wants to verify which administrator is currently logged into the FortiGate and from which IP address. Which CLI command should be used?

Accepted Answer

get system admin status. The CLI command 'get system admin status' displays the list of administrators currently logged into the FortiGate, including their username, access level, and the source IP address from which they are connected. This directly answers the administrator's need to verify who is logged in and from where.

Answer

diagnose sys admin list

Answer

get system user active

Answer

show system admin session

Question 7

An administrator wants to customize the dashboard view by adding a new widget. What is the standard method to add widgets in the FortiGate GUI?

Accepted Answer

Click 'Add Widget' in the top-left corner of the Dashboard view. In the FortiGate GUI, widgets are added to the Dashboard by clicking the 'Add Widget' button located in the top-left corner of the Dashboard view, which opens a menu of available widgets (System Information, License Information, Logs, etc.) that can be dragged or selected onto the dashboard. This is the standard, documented method in FortiOS.

Answer

Right-click any empty space in the GUI background

Answer

Go to Log & Report > Dashboard Options

Answer

Go to System > Dashboard > Settings

Question 8

An administrator suspects a routing loop or gateway failure and needs to test basic IP connectivity to the default gateway with a specified source IP. Which CLI command allows specifying the source IP for a ping test?

Accepted Answer

execute ping-options source [source-IP] followed by execute ping [dest-IP]. FortiGate separates ping parameters from the ping action. The `execute ping-options` command enters a sub-configuration context where you can set parameters like `source`, `interface`, `repeat-count`, and `timeout`. After configuring the source IP with `execute ping-options source [source-IP]`, you then run `execute ping [dest-IP]` to send the ICMP echo requests using that source address. This two-step approach is the only valid way to specify a source IP for a ping on FortiOS.

Answer

diagnose ping src [source-IP] [dest-IP]

Answer

set ping source [source-IP]

Answer

ping-source [source-IP] [dest-IP]

Question 9

An administrator needs to verify whether a specific security profile (such as an Antivirus or Web Filter profile) is currently referenced by any firewall policy. Which CLI command helps trace object dependencies?

Accepted Answer

get system object-usage [object-name] or checking object references in CLI configuration context. To verify whether a security profile is referenced by any firewall policy, the administrator can use 'get system object-usage [object-name]' or check object references within the CLI configuration context. These commands trace dependencies and show which policies or objects reference the profile, helping avoid accidental deletion of in-use objects.

Answer

execute check-profile [profile-name]

Answer

diagnose firewall policy reference

Answer

show firewall policy dependency

Question 10

An administrator wants to flush all current entries from the FortiGate session table to resolve a stubborn state synchronization issue. Which CLI command achieves this?

Accepted Answer

execute clear system session. The correct command is `execute clear system session`, which is the FortiOS CLI command that flushes all current entries from the session table. This command is part of the `execute` command tree, which contains operational commands that take immediate effect, unlike `config` commands that modify persistent configuration. When an administrator needs to forcibly clear all active sessions — for example, to resolve state synchronization issues between HA peers — this is the appropriate command. It clears the entire session table, forcing all traffic to re-establish new sessions.

Answer

flush session table

Answer

diagnose sys session clear

Answer

config system session flush

Question 11

An administrator needs to configure an idle timeout for administrative web GUI sessions to enhance security. Where is this setting located?

Accepted Answer

System > Settings > Administrator Idle Timeout. The administrator idle timeout for web GUI sessions is configured under System > Settings > Administrator Idle Timeout. This global setting defines how many minutes of inactivity are allowed before an admin session is logged out, and it applies to the web-based manager and sometimes CLI sessions depending on the setting. It is the correct location to enhance security by reducing idle session exposure.

Answer

System > Administrators > Timeout

Answer

Policy & Objects > Global Settings

Answer

Log & Report > Admin Settings

Question 12

An administrator needs to verify the current DNS server IP addresses configured on the FortiGate via the CLI. Which command should be used?

Accepted Answer

get system dns. The show system dns command displays the configured primary and secondary DNS server addresses.

Answer

execute show dns

Answer

diagnose sys dns list

Answer

show router dns

Question 13

An administrator wants to verify which configuration revision history is currently active and wants to roll back to a previous revision. Where can configuration revisions be managed in the web-based manager?

Accepted Answer

Administrator profile dropdown menu > Configuration > Revision History. In the FortiGate web-based manager, configuration revisions are managed from the administrator profile dropdown menu (top-right) under Configuration > Revision History. This allows the administrator to view all saved revisions, see which is currently active, and roll back to a previous revision if needed. This is the correct location for revision management.

Answer

Log & Report > Revision Logs

Answer

System > Maintenance > Rollback

Answer

Security Fabric > Backups

Question 14

An administrator is troubleshooting a configuration synchronization failure in an HA cluster. Which CLI command forces an immediate configuration synchronization from the primary unit to the secondary unit?

Accepted Answer

execute ha synchronize. The command 'execute ha synchronize' is the correct FortiGate CLI command that triggers an immediate, manual configuration synchronization from the primary unit to the secondary unit in an HA cluster. It bypasses the normal automatic sync process and forces the primary to push its current configuration to all secondary units. This is useful when automatic synchronization has failed or when you need to ensure the secondary is up-to-date immediately after a configuration change.

Answer

execute ha synchronize config

Answer

diagnose ha sync-now

Answer

config system ha force-sync

Question 15

An administrator wants to search for a specific user's web browsing logs from earlier in the day. Which menu should they open in the web-based manager?

Accepted Answer

Log & Report > Web Filter. Web browsing logs are stored and viewable under Log & Report > Web Filter in the FortiGate GUI. This menu provides filtered views of web traffic logs, allowing administrators to search for a specific user's browsing activity from earlier in the day.

Answer

Monitor > Web Activity

Answer

Policy & Objects > URL Filter

Answer

FortiView > Websites