FORTINET-NSE123 Nse 3 Fortigate Operational Fundamentals Practice Test 2 — 15 Questions

Question 1

An administrator needs to check the status of static routes configured on the FortiGate. Which CLI command lists all static routes?

Accepted Answer

get router info routing-table static. The command 'get router info routing-table static' displays the static routes currently installed in the FortiGate's routing table. It shows the destination network, gateway, interface, and administrative distance for each static route, allowing the administrator to verify their status.

Answer

config router static show

Answer

show firewall static-route

Answer

diagnose ip route list static

Question 2

Where can an administrator view a summary of system alerts and warning messages directly in the web-based manager without navigating to full log reports?

Accepted Answer

Dashboard > System Events widget (or Event Log summary). The Dashboard in FortiGate's web-based manager (GUI) includes a System Events widget that displays a summary of recent system alerts, warnings, and event log entries without requiring the administrator to open full log reports. This widget aggregates critical system-level messages such as configuration changes, HA events, and resource warnings. It is designed for at-a-glance monitoring directly from the landing page after login.

Answer

System > Monitoring

Answer

Network > Alerts

Answer

Policy & Objects > Event Monitoring

Question 3

An administrator needs to verify the license status and serial number of a managed FortiSwitch connected to the FortiGate. Where can managed switches be viewed in the web-based manager?

Accepted Answer

WiFi & Switch Controller > Managed FortiSwitches. In FortiOS, managed FortiSwitches are viewed and configured under WiFi & Switch Controller > Managed FortiSwitches. This page lists each authorized FortiSwitch along with its serial number, model, firmware version, and license status, allowing the administrator to verify the details requested. It is the central management pane for FortiLink-connected switches.

Answer

Network > Switch Controller

Answer

System > FortiSwitch

Answer

Security Fabric > FortiSwitch

Question 4

An administrator wants to check the connection status of Security Fabric telemetry between the root FortiGate and downstream devices. Where is the Security Fabric status viewed?

Accepted Answer

Security Fabric > Topology. The Security Fabric > Topology page is the dedicated view in the FortiGate GUI that displays the Security Fabric topology, including the root FortiGate and all downstream (authorized) devices. It shows the connection status of the fabric telemetry links between the root and each downstream device, so administrators can confirm whether devices are properly joined and communicating. This is the correct location for verifying Security Fabric telemetry connectivity.

Answer

System > Security Fabric Settings

Answer

Monitor > Fabric Monitor

Answer

Dashboard > Fabric Health

Question 5

An administrator suspects memory fragmentation or a memory leak in a specific daemon (e.g., wad). Which CLI command provides detailed memory allocation statistics per daemon?

Accepted Answer

diagnose sys top or diagnose memory sysusage. The command 'diagnose sys top' (and related memory diagnostics like 'diagnose sys memusage' or 'diagnose memory sysusage') provides per-daemon memory allocation statistics, allowing an administrator to identify which daemon (e.g., wad) is consuming excessive memory or exhibiting a leak. These diagnose commands expose detailed process-level memory metrics that the standard 'get system' commands do not.

Answer

get system memory detail

Answer

show memory daemon

Answer

diagnose hardware memory usage

Question 6

An administrator needs to verify whether FortiGuard web filtering rating lookups are succeeding for specific categories. Which CLI command tests web filter rating lookups for a specific URL?

Accepted Answer

diagnose webfilter FortiGuard lookup [URL]. The command 'diagnose webfilter FortiGuard lookup <URL>' performs a real-time query to the FortiGuard rating service for the specified URL and returns the category, reputation, and whether the lookup succeeded. This directly tests whether rating lookups are working for specific categories.

Answer

get webfilter status [URL]

Answer

execute webfilter-test [URL]

Answer

ping fortiguard-rating [URL]

Question 7

An administrator needs to modify the TCP session timeout for specific services. Where are global system timeout values configured in the CLI?

Accepted Answer

config system global > set tcp-idle-timer [seconds] > end. Global TCP session timeout values on FortiGate are configured via 'config system global' followed by 'set tcp-idle-timer [seconds]'. This sets the default idle timeout for TCP sessions that do not have a more specific timeout defined elsewhere (e.g., per-policy or per-service). The 'tcp-idle-timer' parameter is the correct global knob for TCP session aging.

Answer

config firewall settings > set timeout [seconds] > end

Answer

config router global > set tcp-timeout [seconds] > end

Answer

execute set-timeout [seconds]

Question 8

An administrator needs to configure SNMP v3 monitoring on the FortiGate for integration with a network management system (NMS). Where is SNMP configured in the web-based manager?

Accepted Answer

System > SNMP. In FortiOS, SNMP configuration—including SNMP v3 users, communities, hosts, and traps—is located under System > SNMP in the web-based manager (GUI). This is the central location for enabling the SNMP agent and defining the parameters needed for an NMS to poll the FortiGate. The System menu groups device-level management services like SNMP, DNS, and administrators, making it the correct path for this task.

Answer

Network > SNMP Agent

Answer

Log & Report > SNMP Settings

Answer

Security Fabric > SNMP

Question 9

An administrator needs to verify the status of hardware acceleration (NP processors) and check whether traffic is offloaded to the NP chips. Which CLI command displays NP processor status and offloaded session counters?

Accepted Answer

get hardware npu np6 or diagnose npu [processor] stats. The command 'get hardware npu np6' displays NP6 processor status, and 'diagnose npu [processor] stats' shows offloaded session counters and NP statistics. These commands verify that NP processors are operational and that traffic is being offloaded, which is essential for troubleshooting performance and acceleration issues.

Answer

get system npu-status

Answer

show firewall hardware-acceleration

Answer

execute npu-test

Question 10

An administrator needs to check system performance and resource bottlenecks on a FortiGate device using the CLI. Which TWO commands can be used to display CPU, memory, and process-level utilization? (Choose two)

Accepted Answer

diagnose sys top. Option A, 'diagnose sys top', is correct because it launches a real-time, top-style monitor on the FortiGate CLI that displays per-process CPU and memory utilization along with overall CPU and memory usage, making it ideal for spotting process-level bottlenecks. Option C, 'get system performance status', is correct because it returns a snapshot of overall system performance including CPU usage, memory usage, and uptime, which directly addresses the requirement to check system performance and resource utilization. Option B, 'get system interface physical', only lists physical interface details such as link status and speed, not CPU or memory data. Option D, 'show system resources', is not a valid FortiGate CLI command for this purpose. Option E, 'execute system status', is not a recognized FortiGate command that reports CPU, memory, and process utilization.

Answer

get system interface physical

Answer

show system resources

Answer

execute system status

Question 11

An administrator is troubleshooting a FortiGate device where traffic passing through a specific firewall policy is failing. Which TWO dashboard widgets or monitoring views should the administrator inspect to verify live traffic status and policy hits? (Choose two)

Accepted Answer

FortiView > Policies. Option D (FortiView > Policies) is correct because FortiView provides a live, real-time visualization of traffic flows matched against firewall policies, letting the administrator see which policies are being hit and how much traffic is passing through them. Option E (Policy & Objects > Firewall Policy, Hit Count column) is correct because the Hit Count column shows the cumulative number of sessions or packets that have matched each policy, which directly verifies whether the specific policy is being triggered. Together these two views confirm live traffic status and policy hits for the failing policy. Option A (Network > Interfaces widget) only shows interface bandwidth and status, not per-policy matching. Option B (Security Fabric > Audit) displays Fabric topology and audit/security rating information, not live policy traffic. Option C (System > FortiGuard Status) shows license and signature update status, which is unrelated to policy hit verification.

Answer

Network > Interfaces widget

Answer

Security Fabric > Audit

Answer

System > FortiGuard Status

Question 12

An administrator is troubleshooting a routing and connectivity issue on the FortiGate. Which THREE CLI commands can be used to test network reachability and path characteristics? (Choose three)

Accepted Answer

execute dns-lookup [hostname]. Option A, 'execute dns-lookup [hostname]', is correct because it resolves a hostname to an IP address using the FortiGate's configured DNS servers, which is essential for verifying name resolution as part of network reachability troubleshooting. Option C, 'execute ping [IP-address]', is correct because it sends ICMP echo requests to test basic IP-level reachability to a destination and reports packet loss and round-trip time. Option E, 'execute traceroute [IP-address]', is correct because it maps the hop-by-hop path to a destination using incrementing TTL values, revealing where packets are dropped or delayed along the route. Option B, 'show router routing-table', is not correct here because it only displays the routing table entries and does not actively test reachability or path characteristics. Option D, 'get system performance status', is not correct because it reports CPU, memory, and uptime statistics rather than testing network connectivity or path behavior.

Answer

show router routing-table

Answer

get system performance status

Question 13

An administrator is troubleshooting a packet flow issue and needs to capture live traffic on the FortiGate CLI. Which THREE parameters or options must be specified when configuring the diagnose sniffer packet command? (Choose three)

Accepted Answer

Packet count or matching filter expression (e.g., 'host 10.0.0.1'). The diagnose sniffer packet command on a FortiGate requires three positional arguments: the interface name (E), such as 'any' or 'port1', which tells the FortiGate where to listen for traffic; the verbosity level (B), such as 4 or 6, which controls how much of each packet (headers, payload, hex/ASCII) is displayed; and a packet count or BPF-style filter expression (A), such as 'host 10.0.0.1', which limits how many packets are captured or which packets match. These three parameters form the core syntax 'diagnose sniffer packet ', so all three are mandatory to define the capture scope and output. Option C is wrong because the sniffer writes output to the CLI console or a file, not to a printer IP, and option D is irrelevant since GUI session timeout has nothing to do with CLI packet capture.

Answer

Destination printer IP address

Answer

Administrator GUI session timeout

Question 14

An administrator is troubleshooting a DHCP service running on a FortiGate interface. Which THREE commands or tools can be used to verify DHCP status and leases? (Choose three)

Accepted Answer

execute dhcp lease-list. Option B (execute dhcp lease-list) is correct because this FortiOS CLI command directly displays the current DHCP leases per interface, including assigned IP addresses, MAC addresses, and lease expiry, making it the primary tool for verifying active leases. Option C (checking interface IP and DHCP service binding in Network > Interfaces GUI menu) is correct because the interface configuration page shows whether the DHCP server role is enabled on that interface and its associated address scope, confirming the service is bound and active. Option D (show system dhcp-server in CLI configuration mode) is correct because this command displays the DHCP server configuration, including the IP range, gateway, DNS, and lease time settings, which verifies how the service is configured. Option A (FortiView > DHCP Sessions) is not a valid FortiGate DHCP verification tool, as FortiView provides traffic and session analytics rather than DHCP lease data. Option E (diagnose firewall dhcp-drop list) is not a standard FortiOS command for verifying DHCP status or leases; DHCP drop diagnostics are not exposed through that syntax.

Answer

FortiView > DHCP Sessions

Answer

diagnose firewall dhcp-drop list

Question 15

An administrator needs to verify DNS and time synchronization settings to ensure accurate log timestamps and FortiGuard connectivity. Which THREE settings or commands should be verified? (Choose three)

Accepted Answer

System timezone configuration. Option B (System timezone configuration) is correct because the FortiGate's local timezone directly determines how log timestamps are displayed and recorded, so an incorrect timezone would produce misleading log times even if NTP is synchronized. Option C (NTP server synchronization status and time configuration, verified via 'get system status' or 'get system settings') is correct because accurate timestamps depend on the device being synchronized to a valid NTP source, and these commands reveal the configured NTP servers and whether the clock is in sync. Option D (Configured DNS server IP addresses, verified via 'get system dns') is correct because FortiGuard connectivity relies on DNS resolution of FortiGuard service hostnames, so valid, reachable DNS servers must be configured for rating, updates, and licensing lookups to succeed. Option A (Firewall policy packet hit counters) is not relevant because hit counters only show traffic matching policies and have no bearing on DNS, time synchronization, or FortiGuard name resolution. Option E (Hardware switch port duplex modes) is not relevant because duplex settings affect Layer 1/2 link performance and do not influence DNS resolution, NTP synchronization, or log timestamp accuracy.

Answer

Firewall policy packet hit counters

Answer

Hardware switch port duplex modes