FORTINET-NSE123 Nse 3 Fortigate Operational Fundamentals Practice Test 3 — 15 Questions

Question 1

A network administrator is troubleshooting traffic passing through a FortiGate using the CLI command 'diagnose debug flow'. Before capturing traffic, what command must be executed to ensure the debug output appears in the current CLI session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diag debug enable. The 'diagnose debug enable' command is required to turn on debug output in the current CLI session; without it, 'diagnose debug flow' filters and tracing produce no visible output. This is a global toggle that must be set before any debug flow filters take effect. Once enabled, the admin can run 'diagnose debug flow filter' and 'diagnose debug flow trace start' to capture packets.

Answer

diag debug console timestamp enable

Answer

execute debug reset

Answer

diag debug enable

Question 2

An administrator notices that configuration changes made via the CLI are not persisting after a device reboot. What is the most likely reason for this behavior?

Accepted Answer

The administrator exited the configuration block using 'abort' instead of 'end'.. In FortiOS, configuration changes made inside a 'config' block are only committed to the running configuration when the block is closed with 'end'. If the administrator types 'abort' instead, FortiOS discards all changes made within that block, so nothing is written to the running config and nothing persists after reboot. This is the classic cause of 'my CLI changes disappeared' behavior.

Answer

The administrator forgot to issue the 'write memory' command.

Answer

The administrator did not issue a 'execute factory-reset' to commit.

Answer

The administrator failed to enable manual commit mode in system settings.

Question 3

Where in the FortiGate GUI can an administrator view a summary of detected security incidents, top applications, and top bandwidth users across the network?

Accepted Answer

FortiView > All Sessions / Dashboards. FortiView is FortiGate's dedicated analytics and visualization module, and the 'All Sessions' view (along with the customizable FortiView dashboards) aggregates log data into summaries of detected security incidents, top applications, top sources/destinations, and top bandwidth consumers. This is the intended location for cross-network visibility because FortiView pulls from local traffic, UTM, and event logs to build these ranked lists. The Dashboard > Status page shows system health and interface stats, not incident/application analytics, and Security Fabric > Topology only maps device relationships.

Answer

Security Fabric > Topology

Answer

FortiView > Sources

Answer

Dashboard > Status

Question 4

An administrator wants to check the operational status and firmware version of all connected FortiExtender devices managed by the FortiGate. Which menu path should they follow?

Accepted Answer

Security Fabric > Managed Devices. The operational status and firmware version of managed FortiExtender devices can be viewed under Security Fabric > Managed Devices. This section lists all devices managed by the Security Fabric, including FortiExtenders, and provides details such as status, firmware version, and IP address. It is the correct menu path for checking FortiExtender device information.

Answer

System > FortiExtender

Answer

Policy & Objects > Device Inventory

Answer

Network > FortiExtender

Question 5

An administrator needs to verify whether a specific security profile (e.g., Antivirus) is actively inspecting traffic matching a firewall policy. Which CLI command displays the detailed runtime statistics and counter hits for security profiles bound to a policy ID?

Accepted Answer

get firewall policy . The CLI command 'get firewall policy ' displays detailed runtime statistics and counter hits for security profiles bound to a specific policy. It shows hit counts for antivirus, IPS, web filter, and other profiles, allowing the administrator to verify active inspection. This command is executed in the VDOM context where the policy resides.

Answer

diagnose sys session list

Answer

diagnose firewall pauth list

Answer

get system status

Question 6

An administrator is configuring a new firewall policy to allow internal users to access the internet. Which parameter is mandatory when defining a IPv4 firewall policy in FortiOS?

Accepted Answer

Action (Accept, Deny, or IPsec). In FortiOS IPv4 firewall policies, the Action parameter (Accept, Deny, or IPsec) is mandatory because it defines what the firewall does with matching traffic. Without an action, the policy has no effect. While other parameters like Schedule, NAT, and Destination Address are configurable, they have defaults or can be left unspecified; the action is the fundamental decision point.

Answer

Schedule

Answer

NAT (Network Address Translation)

Answer

Destination Address

Question 7

An administrator is reviewing the configuration options available under System > Admin Settings in the FortiGate GUI. Which TWO settings can be configured in this menu?

Accepted Answer

HTTP and HTTPS administrative service ports. System > Admin Settings allows administrators to configure administrative access ports (HTTP/HTTPS), idle timeout, and trusted hosts.

Answer

DHCP server lease time

Answer

Firewall policy default action

Question 8

A network administrator is troubleshooting an intermittent connectivity issue between an internal subnet and a remote branch office. The FortiGate is configured with a static route to the remote network, but traffic is sometimes dropped. The administrator suspects that the FortiGate is not receiving return traffic because the next-hop router is not responding to ARP requests. Which CLI command should the administrator use to verify the ARP resolution for the next-hop IP address?

Accepted Answer

get system arp. The correct command is 'get system arp', which lists all ARP entries known to the FortiGate. In this scenario, the administrator needs to confirm whether the next-hop router's IP has a corresponding MAC address. If the ARP entry is missing or incomplete, it indicates an ARP resolution failure, explaining the intermittent connectivity.

Answer

show system interface

Answer

diagnose ip arp list

Answer

get router info routing-table all

Question 9

A network engineer is troubleshooting a FortiGate HA cluster where the primary unit has failed over to the secondary unit unexpectedly. They need to check the HA status and the reason for the failover. Which CLI command should they use to view detailed HA information, including the last failover reason?

Accepted Answer

get system ha status. The 'get system ha status' command provides a detailed view of the HA cluster's current state, including which unit is primary, the HA mode, and the reason for the last failover. This is essential for diagnosing unexpected failovers. The other options are either invalid commands or only show configuration, not status.

Answer

diagnose ha status

Answer

show system ha

Answer

diagnose sys ha status

Question 10

A security administrator is investigating a suspicious traffic pattern where a specific internal host is repeatedly attempting to connect to an external IP address on port 445. The administrator wants to capture packets related to this host to analyze the traffic. Which CLI command should be used to capture packets for this specific host without disrupting other traffic?

Accepted Answer

diagnose sniffer packet any 'host 192.168.1.100 and port 445' 4 0 a. The correct command uses 'diagnose sniffer packet' with a filter for the host and port, verbosity level 4 to show interface details, and absolute timestamps. This captures both directions of traffic for the suspicious host, allowing the administrator to analyze connection attempts to port 445 without capturing unrelated traffic.

Answer

diagnose sniffer packet any 'host 192.168.1.100 and tcp port 445' 6 0 l

Answer

diagnose sniffer packet any 'host 192.168.1.100 and port 445' 2 0 a

Answer

diagnose sniffer packet any 'src host 192.168.1.100 and dst port 445' 3 0 a

Question 11

An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?

Accepted Answer

Click the administrator profile name at the top right of the GUI > Configuration > Backup. In the FortiGate web-based manager, the configuration backup option is accessed by clicking the administrator profile name at the top-right of the GUI and then selecting Configuration > Backup. This opens the backup page where the administrator can choose to encrypt the file with a password and download it locally. The other menu paths do not contain the configuration backup function.

Answer

System > Settings > Maintenance

Answer

Security Fabric > Settings > Export

Answer

Log & Report > Backup Settings

Question 12

Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?

Accepted Answer

Log & Report > System Events. System event logs, including system alerts, warning-level messages, and administrative event logs, are viewed under Log & Report > System Events in the FortiGate GUI. This section aggregates logs from the 'event' log category, which covers admin logins, configuration changes, HA events, and system warnings. The other menus do not display these event logs.

Answer

Security Fabric > Audit

Answer

System > Advanced

Answer

Monitor > Routing Monitor

Question 13

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

Accepted Answer

System Resources. The System Resources widget on the FortiGate web-based manager dashboard displays real-time CPU and memory utilization, along with other resource metrics like session count and log rate. It is included by default on the dashboard and is the standard place administrators check for immediate performance visibility. This directly answers the requirement to check CPU and memory from the GUI.

Answer

FortiView Sessions

Answer

License Information

Answer

Network Interfaces

Question 14

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

Accepted Answer

FortiView > Applications. FortiView > Applications provides aggregated application visibility, showing top applications by bandwidth, sessions, and other metrics. FortiView is FortiGate's built-in analytics dashboard that aggregates log data into visual widgets, and the Applications view specifically ranks applications by traffic volume, making it the correct place to see top bandwidth-consuming applications.

Answer

Log & Report > Forward Traffic

Answer

Security Fabric > Topology

Answer

System > FortiGuard

Question 15

An administrator is investigating a network routing issue on the FortiGate and needs to see the current active kernel routing table entries. Which CLI command provides this information?

Accepted Answer

get router info routing-table all. The command 'get router info routing-table all' displays the complete active kernel routing table on a FortiGate, including all routes (connected, static, dynamic) with their attributes. It is the standard CLI method for verifying routing entries and troubleshooting routing issues.

Answer

execute traceroute

Answer

get system interface

Answer

diagnose firewall IP-antibot list