FORTINET-NSE123 Nse 3 Fortigate Operational Fundamentals Practice Test 6 — 15 Questions

Question 1

An administrator needs to view active hardware temperature and power supply statuses on the dashboard. Which widget should be added?

Accepted Answer

Hardware Status widget. The Hardware Status widget on the FortiGate dashboard is specifically designed to display real-time hardware health information, including CPU/motherboard temperatures, fan speeds, and power supply status. Adding this widget gives the administrator immediate visibility into thermal and power conditions, which is exactly what the question asks for. Other widgets focus on traffic, sessions, or inventory rather than physical hardware sensors.

Answer

Device Inventory

Answer

Power Monitor

Answer

System Resources

Question 2

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

Accepted Answer

System > Admin Profiles. Administrator access profiles are defined and edited under System > Admin Profiles in the FortiOS GUI (config system accprofile in the CLI). This is where profiles like 'super_admin', 'prof_admin', and custom profiles are created with granular read/write permissions per functional area (firewall, VPN, system, etc.). Assigning a profile to an admin account controls exactly what that admin can view and modify.

Answer

Security Fabric > Profiles

Answer

System > Administrators > Profiles

Answer

Policy & Objects > Admin Profiles

Question 3

An administrator needs to test reachability and path MTU to a destination IP using ICMP packets with the Don't Fragment (DF) bit set. Which CLI command allows this?

Accepted Answer

execute ping-options df-bit yes followed by execute ping [dest-IP]. FortiOS uses the two-step 'execute ping-options' then 'execute ping' pattern. Setting 'execute ping-options df-bit yes' enables the Don't Fragment bit on subsequent pings, and 'execute ping <dest-IP>' sends them. This allows path MTU discovery by observing whether large packets are dropped with an ICMP 'fragmentation needed' response.

Answer

set ping df-bit enable

Answer

ping -M do [dest-IP]

Answer

diagnose ping df [dest-IP]

Question 4

An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?

Accepted Answer

Network > Interfaces. In FortiGate's web-based manager, the operational status of all physical and logical interfaces is displayed in a summary table under Network > Interfaces. This page shows real-time link status, IP addresses, speed/duplex, and traffic statistics for each interface. It is the central location for monitoring and configuring interface settings, not just configuration.

Answer

Policy & Objects > Interfaces

Answer

Monitor > Interface Summary

Answer

System > Interfaces

Question 5

An administrator wants to see a real-time list of top applications generating traffic on the network. Which FortiView tab should be opened?

Accepted Answer

FortiView > Applications. FortiView > Applications is the dedicated real-time analytics view that aggregates live traffic by application, showing top applications, bandwidth consumed, sessions, and source/destination breakdowns. It pulls from the session and UTM logs in real time, so it directly answers 'which applications are generating traffic right now.' This is the correct location for real-time application visibility on a FortiGate.

Answer

Monitor > Application Control

Answer

Log & Report > Application Logs

Answer

Policy & Objects > Applications

Question 6

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

Accepted Answer

diagnose ip route lookup [dest-IP]. The FortiGate CLI command 'diagnose ip route lookup' (or 'diagnose ip route lookup [dest-IP]') simulates a routing lookup for a specified destination IP and shows which route would be selected, including the outgoing interface and gateway. This is the standard tool for verifying route selection without generating actual traffic.

Answer

show routing-table match [dest-IP]

Answer

get router route-check [dest-IP]

Answer

execute route-test [dest-IP]

Question 7

An administrator wants to verify the amount of free space available on the system log disk. Which dashboard widget displays this metric?

Accepted Answer

Log Disk widget. The Log Disk widget on the FortiGate dashboard displays the current usage and free space of the log disk (local storage used for logs). It shows a graphical representation of disk consumption, making it the correct widget for verifying free space on the system log disk.

Answer

Storage Usage widget

Answer

System Resources

Answer

Hard Drive Status

Question 8

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

Accepted Answer

Log & Report > System Events (Admin Login and CLI Command Logs). Administrative CLI command execution is recorded under Log & Report > System Events, specifically in the Admin Login and CLI Command log subtypes. These logs capture the admin username, source IP, the exact command string, and the timestamp, making them the authoritative source for audit and troubleshooting history.

Answer

Security Fabric > Audit Logs

Answer

FortiView > Command History

Answer

Log & Report > CLI History

Question 9

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

Accepted Answer

VPN > SSL-VPN Settings (Server Certificate field). The active SSL VPN server certificate is configured and can be verified or changed under VPN > SSL-VPN Settings in the Server Certificate field. This is where the administrator selects which certificate the FortiGate presents to SSL VPN clients. If users encounter certificate validation errors, checking this setting ensures the correct certificate is bound to the SSL VPN portal.

Answer

Policy & Objects > SSL Settings

Answer

System > Certificates > SSL-VPN

Answer

Security Fabric > VPN Settings

Question 10

An administrator wants to view top talkers by bandwidth usage over the past hour. Which FortiView view should be accessed?

Accepted Answer

FortiView > Sources. FortiView > Sources is the correct location because FortiView aggregates traffic logs and ranks source IP addresses by bandwidth, sessions, or applications. Selecting the Sources view and setting the time range to the past hour gives exactly the 'top talkers by bandwidth' report the administrator wants. It is a built-in analytics view, not a policy or log-report screen.

Answer

Policy & Objects > Sources

Answer

Monitor > Top Talkers

Answer

Log & Report > Traffic Sources

Question 11

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

Accepted Answer

Configure Trusted Hosts on the administrator account to restrict management login to specific IP addresses.. Option B is correct because configuring Trusted Hosts on an administrator account restricts management logins to specific, pre-approved source IP addresses, which prevents unauthorized hosts from even attempting to authenticate to the FortiGate web-based manager. Option E is correct because disabling HTTP administrative access and enforcing HTTPS only ensures that all management traffic to the web-based manager is encrypted with TLS, protecting credentials and session data from interception or tampering. Options A, C, and D are incorrect because Telnet transmits credentials in cleartext, default accounts with blank passwords are trivially exploitable, and disabling password complexity weakens rather than strengthens administrative security.

Answer

Enable Telnet for administrative CLI access.

Answer

Use default admin accounts with blank passwords.

Answer

Disable password complexity requirements globally.

Question 12

An administrator needs to back up the FortiGate configuration and ensure that sensitive passwords are protected. Which TWO statements regarding FortiGate configuration backups are correct? (Choose two)

Accepted Answer

Backups can be encrypted with a password to protect sensitive information such as VPN pre-shared keys and user passwords.. Option C is correct because FortiGate configuration backups can be password-encrypted, which protects sensitive data such as VPN pre-shared keys, user passwords, and other credentials stored in the configuration. Option D is correct because administrators can export the configuration either through the GUI (System > Configuration > Backup) or via CLI commands such as 'execute backup config', making both methods valid. Option A is incorrect because, while FortiGate configuration files are text-based, they can be encrypted with a password, so the claim that they cannot be encrypted is false. Option B is incorrect because console access is not the only way to perform backups; GUI and CLI over network connections are supported. Option E is incorrect because configuration backups do not automatically include historical log databases by default; logs are backed up separately.

Answer

Configuration files are saved in plain text XML format that cannot be encrypted.

Answer

Configuration backups can only be performed by connecting a console cable.

Answer

Backups automatically include historical log databases by default.

Question 13

An administrator is reviewing log storage and management settings on the FortiGate. Which THREE storage options or destinations are supported for logging on a FortiGate? (Choose three)

Accepted Answer

Local disk (internal hard drive or flash storage). Option A (Local disk, internal hard drive or flash storage) is correct because FortiGates with an internal disk or flash can store logs locally, configured under config log disk setting and viewed via Log & Report. Option B (FortiAnalyzer) is correct because FortiAnalyzer is Fortinet's dedicated centralized log collection, analysis, and reporting appliance, configured on the FortiGate under config log fortianalyzer setting. Option E (Syslog server) is correct because the FortiGate supports sending logs to external syslog servers over UDP/TCP port 514 (or 6514 for reliable/TLS), configured under config log syslogd setting. Option C (Bluetooth pairing with a mobile phone) is not a supported log destination; Bluetooth is used only for initial FortiExplorer setup, not log storage. Option D (Local printer connected via USB) is not supported, as FortiGate USB ports are used for modem or storage functions, not direct printer logging.

Answer

Bluetooth pairing with a mobile phone

Answer

Local printer connected via USB

Question 14

An administrator wants to verify high availability (HA) cluster status and member synchronization. Which TWO commands or dashboard widgets provide this HA status? (Choose two)

Accepted Answer

get system ha status. Option A, 'get system ha status', is correct because this FortiGate CLI command directly reports HA cluster health, including the HA mode, the primary/standby role of each member, and the synchronization (sync) status between cluster units. Option D, the 'High Availability dashboard widget', is correct because it is the GUI equivalent that displays HA cluster status, member roles, and configuration synchronization state at a glance. Option B, 'get system interface physical', only shows physical interface link and speed information and does not report HA membership or sync state. Option C, 'FortiView > HA Traffic', is not a valid HA status widget and does not verify cluster synchronization. Option E, 'Policy & Objects > HA Rules', is not a real FortiGate HA status location; HA-related settings live under System > HA, not Policy & Objects.

Answer

get system interface physical

Answer

FortiView > HA Traffic

Answer

Policy & Objects > HA Rules

Question 15

An administrator needs to perform a firmware upgrade on a standalone FortiGate. Which TWO best practices should be followed before initiating the upgrade? (Choose two)

Accepted Answer

Back up the current FortiGate configuration file.. Option A is correct because backing up the current FortiGate configuration file before a firmware upgrade preserves all settings and allows restoration if the upgrade fails or introduces issues. Option C is correct because reviewing the official FortiOS release notes and verified upgrade paths ensures compatibility, identifies known issues, and confirms the proper sequence for moving between firmware versions. Option B is incorrect because a factory reset immediately after upgrading without saving configurations would erase the existing configuration and is not a recommended pre-upgrade best practice. Option D is incorrect because unplugging all physical network interfaces is unnecessary and could disrupt management access needed to perform and verify the upgrade. Option E is incorrect because downgrading the FortiGuard license contract is unrelated to preparing for a firmware upgrade and would not support the process.

Answer

Perform a factory reset immediately after upgrading without saving configurations.

Answer

Unplug all physical network interfaces during the upgrade.

Answer

Downgrade the FortiGuard license contract.