FORTINET-NSE123 Nse 3 Fortigate Operational Fundamentals Practice Test 7 — 15 Questions

Question 1

An administrator is examining the FortiGate routing table via the CLI. Which THREE types of routes can appear in the active routing table? (Choose three)

Accepted Answer

Dynamic routes (learned via protocols such as OSPF, BGP, or RIP). The FortiGate active routing table (viewed with 'get router info routing-table all' or 'database') contains three fundamental route sources. Option A is correct because dynamic routes learned through routing protocols such as OSPF, BGP, or RIP are installed in the routing table and marked with their protocol code (O, B, R). Option D is correct because connected routes represent directly attached subnets on FortiGate interfaces and appear automatically with the C code. Option E is correct because static routes manually configured by the administrator are installed in the routing table and marked with the S code. Options B and C are incorrect because firewall policy objects and Security Fabric telemetry do not generate routing table entries; firewall policies control traffic forwarding decisions but are not routes, and Security Fabric telemetry is a logging/visibility feature, not a routing source.

Answer

Firewall policy object routes

Answer

Security Fabric telemetry routes

Question 2

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Accepted Answer

Rearrange existing widgets by dragging and dropping them into preferred positions.. Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget. Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Answer

Convert the dashboard into a command-line terminal emulator.

Answer

Delete physical firewall ports from the dashboard interface view.

Answer

Modify core FortiOS kernel code directly from the dashboard widget settings.

Question 3

An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)

Accepted Answer

Power supply unit (PSU) status. Options A, B, and D are correct because FortiGate hardware status commands (such as 'get system status', 'diagnose hardware deviceinfo', and the Hardware Status dashboard widget) expose physical chassis telemetry: A (PSU status) reports whether each power supply is present, powered, and functioning; B (internal chassis/CPU temperature sensors) reports thermal readings used to detect overheating that can throttle performance; and D (fan operational status and speeds) reports fan RPM and failure states that directly affect cooling and stability. These are exactly the hardware parameters FortiOS surfaces for high-end appliances during performance troubleshooting. Option C (BGP peer uptime) is incorrect because BGP is a Layer 3 routing protocol monitored via routing/neighbor commands like 'get router info bgp summary', not hardware sensors. Option E (SSL VPN tunnel encryption keys) is incorrect because encryption keys are cryptographic session material, not a monitorable hardware component or sensor.

Answer

Active BGP peer uptime metrics

Answer

SSL VPN tunnel encryption keys

Question 4

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

Accepted Answer

Administrator username. When creating a new local administrator account, the administrator username (Option A) is a required element because it uniquely identifies the account on the device and is used for authentication and audit logging. The administrator access profile (Option C) is also required/configurable because it defines the permissions and privileges assigned to that account, such as read-only, read-write, or super-admin scope, which is exactly what the scenario demands for 'specific operational privileges.' Options B, D, and E are unrelated to local administrator account creation: a firewall policy source IP object (B) is used in security policy rules, a DHCP lease pool range (D) configures dynamic IP address assignment for clients, and an SSL VPN portal bookmark (E) defines web resources presented to remote VPN users, none of which are part of defining a local admin account's identity or privileges.

Answer

Firewall policy source IP object

Answer

DHCP lease pool range

Answer

SSL VPN portal bookmark

Question 5

An administrator wants to view historical web filtering and traffic logs on the FortiGate. Which TWO methods can be used to search and analyze stored logs? (Choose two)

Accepted Answer

Log & Report menu in the web-based manager with filter and search options. Option A is correct because the FortiGate GUI's Log & Report menu provides built-in filter and search controls that let an administrator query historical web filtering and traffic logs stored locally or on a disk. Option D is correct because FortiAnalyzer integration centralizes and indexes logs for advanced search and analysis, while the local log viewer filters also allow searching stored logs directly on the FortiGate. Option B is incorrect because restarting the routing daemon (gated) affects routing processes and does not provide any log search or analysis capability. Option C is incorrect because editing FortiOS kernel source code is neither supported nor related to viewing historical logs. Option E is incorrect because 'execute factory-reset' erases the configuration and does not help search or analyze stored logs.

Answer

Restarting the routing daemon (gated)

Answer

Editing the FortiOS kernel source code directly

Answer

Running execute factory-reset

Question 6

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

Accepted Answer

Administrative access settings (e.g., enabling HTTPS and ping for management). Option D is correct because every physical interface that will carry traffic must have an IP address and subnet mask assigned so the FortiGate can participate in the network and route packets between its interfaces before any firewall policy can meaningfully match traffic. Option B is correct because administrative access settings on an interface (for example enabling HTTPS, SSH, or ping for management) determine how the administrator can reach and manage the FortiGate, which is a basic interface-level configuration typically done during initial setup. Option A is incorrect because explicit proxy authentication realms are an advanced web-proxy feature configured under proxy settings, not a prerequisite interface parameter for firewall policies. Option C is incorrect because BGP AS numbers and neighbor peer groups are dynamic routing configurations that are optional and only needed in environments using BGP, not part of basic interface setup. Option E is incorrect because SSL VPN client certificate revocation lists relate to VPN authentication and are configured later, not as a basic physical interface setting.

Answer

Explicit proxy authentication realms

Answer

BGP AS number and neighbor peer groups

Answer

SSL VPN client certificate revocation lists

Question 7

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

Accepted Answer

System Resources. The System Resources widget on the FortiGate dashboard is specifically designed to display real-time CPU and memory usage, along with other system-level metrics such as session count and log rate. Adding this widget provides administrators with an at-a-glance view of resource utilization directly on the dashboard. It is the correct choice for monitoring CPU and memory in real time.

Answer

FortiView Sessions

Answer

Log Rate

Answer

License Information

Question 8

An administrator needs to back up the current FortiGate configuration securely to a local PC via the GUI. Which option should the administrator select?

Accepted Answer

System > Settings > Backup Configuration. In FortiOS GUI, the configuration backup is performed via System > Settings > Backup Configuration, which allows the administrator to download the current configuration file (encrypted or plain text) to a local PC. This is the standard, documented path for secure configuration backup through the web-based manager.

Answer

System > Firmware > Backup

Answer

Log & Report > Log Settings > Backup

Answer

Security Fabric > Settings > Export

Question 9

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

Accepted Answer

They are stored exclusively on the remote FortiAnalyzer and not on the local FortiGate storage.. When a FortiGate is configured to send logs to FortiAnalyzer and local disk logging is not enabled, the traffic logs are transmitted to the remote FortiAnalyzer and are not retained on the FortiGate's local storage. That is why the administrator sees nothing under Log & Report > Forward Traffic on the FortiGate itself — the logs exist, but on FortiAnalyzer. The correct answer reflects that remote logging destinations receive the logs exclusively when local storage is not configured.

Answer

They are stored in the FortiGate system memory ring buffer.

Answer

They are buffered in RAM and will only flush when the FortiGate reboots.

Answer

They are discarded because local logging is automatically disabled when remote logging is active.

Question 10

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

Accepted Answer

Log in via the physical console port using the 'maintainer' login procedure during a device reboot.. The standard recovery method for a locked-out FortiGate administrator without losing configuration is to connect via the physical console port and use the 'maintainer' login procedure during a reboot. This involves rebooting the device, interrupting the boot process, and logging in with the maintainer account to reset the admin password or unlock the account while preserving the configuration.

Answer

Perform a hardware factory reset using the pinhole reset button.

Answer

Use the default factory IP address 192.168.1.99 via HTTPS.

Answer

Wait for the lockout timer to expire, which defaults to 24 hours.

Question 11

Which dashboard widget displays the overall hardware status, serial number, firmware version, and system uptime of the FortiGate?

Accepted Answer

System Information. The System Information widget is the dashboard element that surfaces hostname, serial number, firmware version, system uptime, and overall hardware/HA status. It is the default top widget on a fresh FortiGate dashboard.

Answer

License Information

Answer

Network Interface Monitor

Answer

CLI Console

Question 12

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

Accepted Answer

It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.. When FortiOS enters conserve mode, it stops allocating memory for non-essential cache operations and may block new non-administrative connection attempts (e.g., new sessions that would consume memory) to protect the device from a full memory exhaustion that could crash it. Administrative access is preserved so the admin can remediate. This is a protective degradation, not a reboot or data wipe.

Answer

It immediately reboots the device to clear RAM.

Answer

It wipes all historical log files from local disk storage.

Answer

It automatically initiates a firmware rollback to the previous stable version.

Question 13

How can an administrator quickly verify whether the FortiGate unit has a valid and active FortiCare support contract from the GUI?

Accepted Answer

System > FortiGuard. The FortiGuard page under System > FortiGuard displays the FortiGate's entitlement status, including the FortiCare support contract, license validity, and individual security service subscriptions (AV, IPS, Web Filter, etc.). Administrators can view the support level, expiry date, and registration status directly from this GUI page. This is the single pane where FortiGate reports its FortiCare registration and service license state.

Answer

Network > Interfaces

Answer

Policy & Objects > Objects

Answer

Log & Report > Event Log

Question 14

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

Accepted Answer

Interface IP address and subnet mask. Option A is correct because every FortiGate interface that will carry traffic needs an IP address and subnet mask (configured via config system interface, e.g., set ip 192.168.1.99 255.255.255.0) to participate in IP networking at all. Option B is correct because DNS server IPs (config system dns, set primary/secondary) are required for the FortiGate to resolve hostnames for FortiGuard updates, NTP, and other name-based lookups. Option D is correct because a default static route (config router static, destination 0.0.0.0/0 with a gateway) is needed so the FortiGate can forward traffic to destinations outside its directly connected subnets, including the internet. Option C is not required for basic connectivity since BGP is an advanced dynamic routing protocol only needed in specific multi-router topologies. Option E is not a basic network parameter; SSL VPN portal customization is an optional remote-access feature configured later, not part of initial connectivity.

Answer

BGP routing peer AS number

Answer

SSL VPN portal customization

Question 15

An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?

Accepted Answer

execute ping . Option D (execute ping ) is correct because it verifies basic IP reachability to the remote syslog server from the FortiGate, confirming that routing and Layer 3 connectivity to the destination exist before investigating higher-layer log delivery issues. Option E (diagnose sniffer packet any 'port 514' 4) is correct because it captures live packets on UDP/TCP port 514 (the standard syslog port) with verbose interface-level detail, allowing the administrator to confirm whether log packets are actually being transmitted to and received from the syslog server. Option A (diagnose debug flow filter) is not correct here because debug flow only sets filters for the flow trace and does not itself display connectivity or log transmission; it must be paired with 'diagnose debug flow trace start' and is aimed at session/forwarding analysis rather than syslog verification. Option B (execute factory-reset) is not correct because it erases the configuration and reboots the device, which is destructive and unrelated to troubleshooting log delivery. Option C (get system arps) is not correct because it only displays the ARP table and cannot verify end-to-end connectivity or syslog packet transmission.

Answer

diagnose debug flow filter

Answer

execute factory-reset

Answer

get system arps