FORTINET-NSE123 Nse 3 Fortigate Operational Fundamentals — Timed 10 Questions

Question 1

An administrator notices that the FortiGate configuration changes made during troubleshooting were lost after an unexpected power outage. Where should the administrator check to ensure that the current running configuration is permanently saved?

10 minute time limit — choose an answer to begin.

Accepted Answer

FortiGate automatically saves running configurations to non-volatile memory immediately upon successful CLI or GUI commit actions.. FortiGate commits configuration changes to non-volatile memory immediately upon a successful CLI 'end' or GUI 'OK/Apply' action, so the running configuration is already persistent and survives power loss. There is no separate 'save' step like on some other network platforms. The administrator should verify that changes were actually committed rather than looking for a save location.

Answer

System > Admin > Settings

Answer

System > Configuration > Backup

Answer

The CLI command execute backup config

Question 2

An administrator is troubleshooting a policy match issue and needs to inspect a specific security policy's hit count and ID directly from the CLI. Which CLI command should the administrator use to list all firewall policies with their internal IDs and rule details?

Accepted Answer

show firewall policy. The 'show firewall policy' command is the correct CLI syntax on FortiOS to display all configured firewall policies, including their internal policy IDs, source/destination interfaces, addresses, services, and action. It provides the rule details and hit counts needed to verify which policy is matching traffic. This is the standard read-only inspection command for policy verification from the CLI.

Answer

get system performance

Answer

diagnose sys session list

Answer

get system status

Question 3

An administrator needs to verify whether the FortiGate unit can successfully communicate with the FortiGuard distribution servers for license and signature updates. Which command should be run in the CLI to test this specific connectivity?

Accepted Answer

execute update-now. The 'execute update-now' command forces the FortiGate to immediately contact the FortiGuard Distribution Network (FDN) to check for and download the latest antivirus, IPS, and other security signatures, as well as validate licensing. If connectivity to FortiGuard is broken, this command will fail with a timeout or connection error, making it the correct way to test that specific communication path. It exercises the actual FortiGuard update channel rather than generic internet reachability.

Answer

diagnose sys top

Answer

ping 8.8.8.8

Answer

execute FortiGuard-test

Question 4

An administrator wants to inspect historical logs stored locally on the FortiGate hard drive. Which menu should they open?

Accepted Answer

Log & Report > Forward Traffic. To inspect historical logs stored locally on the FortiGate hard drive, the administrator should open Log & Report > Forward Traffic, which displays traffic log entries that can be filtered by time, source, destination, and other criteria. This menu provides access to the local log database for traffic logs. The other menus either show summaries, configure logging, or are not valid FortiGate menu paths.

Answer

Dashboard > Log Summary

Answer

System > Log Config

Answer

Monitor > Log Viewer

Question 5

An administrator needs to verify the hardware sensor status (fans, power supplies, temperatures) of a high-end FortiGate unit. Which command provides this hardware health status?

Accepted Answer

get system hardware status. The get system hardware status command displays sensor readings such as fan speed and temperature.

Answer

execute hardware-test

Answer

diagnose hardware device info

Answer

show system sensor

Question 6

An administrator wants to verify which administrator is currently logged into the FortiGate and from which IP address. Which CLI command should be used?

Accepted Answer

get system admin status. The CLI command 'get system admin status' displays the list of administrators currently logged into the FortiGate, including their username, access level, and the source IP address from which they are connected. This directly answers the administrator's need to verify who is logged in and from where.

Answer

diagnose sys admin list

Answer

get system user active

Answer

show system admin session

Question 7

An administrator wants to customize the dashboard view by adding a new widget. What is the standard method to add widgets in the FortiGate GUI?

Accepted Answer

Click 'Add Widget' in the top-left corner of the Dashboard view. In the FortiGate GUI, widgets are added to the Dashboard by clicking the 'Add Widget' button located in the top-left corner of the Dashboard view, which opens a menu of available widgets (System Information, License Information, Logs, etc.) that can be dragged or selected onto the dashboard. This is the standard, documented method in FortiOS.

Answer

Right-click any empty space in the GUI background

Answer

Go to Log & Report > Dashboard Options

Answer

Go to System > Dashboard > Settings

Question 8

An administrator suspects a routing loop or gateway failure and needs to test basic IP connectivity to the default gateway with a specified source IP. Which CLI command allows specifying the source IP for a ping test?

Accepted Answer

execute ping-options source [source-IP] followed by execute ping [dest-IP]. FortiGate separates ping parameters from the ping action. The `execute ping-options` command enters a sub-configuration context where you can set parameters like `source`, `interface`, `repeat-count`, and `timeout`. After configuring the source IP with `execute ping-options source [source-IP]`, you then run `execute ping [dest-IP]` to send the ICMP echo requests using that source address. This two-step approach is the only valid way to specify a source IP for a ping on FortiOS.

Answer

diagnose ping src [source-IP] [dest-IP]

Answer

set ping source [source-IP]

Answer

ping-source [source-IP] [dest-IP]

Question 9

An administrator needs to verify whether a specific security profile (such as an Antivirus or Web Filter profile) is currently referenced by any firewall policy. Which CLI command helps trace object dependencies?

Accepted Answer

get system object-usage [object-name] or checking object references in CLI configuration context. To verify whether a security profile is referenced by any firewall policy, the administrator can use 'get system object-usage [object-name]' or check object references within the CLI configuration context. These commands trace dependencies and show which policies or objects reference the profile, helping avoid accidental deletion of in-use objects.

Answer

execute check-profile [profile-name]

Answer

diagnose firewall policy reference

Answer

show firewall policy dependency

Question 10

An administrator wants to flush all current entries from the FortiGate session table to resolve a stubborn state synchronization issue. Which CLI command achieves this?

Accepted Answer

execute clear system session. The correct command is `execute clear system session`, which is the FortiOS CLI command that flushes all current entries from the session table. This command is part of the `execute` command tree, which contains operational commands that take immediate effect, unlike `config` commands that modify persistent configuration. When an administrator needs to forcibly clear all active sessions — for example, to resolve state synchronization issues between HA peers — this is the appropriate command. It clears the entire session table, forcing all traffic to re-establish new sessions.

Answer

flush session table

Answer

diagnose sys session clear

Answer

config system session flush