Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) (FORTINET-NSE123) — Questions 1–75

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?

Where can an administrator view a summary of detected security threats, such as blocked malware and intrusion prevention events, in the FortiGate web-based manager?

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

An enterprise branch office needs to establish a secure, encrypted site-to-site tunnel back to the headquarters FortiGate over the public internet. Which VPN technology provides a standard IPsec framework combined with Fortinet Security Fabric integration features?

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

An administrator needs to check the status of FortiCare registration and feature licenses. Where in the web-based manager is this license summary displayed?

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

What is the primary function of a FortiGate hardware acceleration processor (FortiASIC)?

An administrator needs to restrict administrative access to the FortiGate CLI and GUI so that management connections are only accepted from a specific trusted internal management workstation subnet. Where is this source IP restriction configured?

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

An administrator needs to verify whether the FortiGate unit can successfully communicate with the FortiGuard distribution servers for license and signature updates. Which command should be run in the CLI to test this specific connectivity?

Which TWO dashboard widgets are commonly used to monitor system performance and health on a FortiGate?

An administrator wants to search for a specific user's web browsing logs from earlier in the day. Which menu should they open in the web-based manager?

Which of the following scenarios describes a 'pretexting' social engineering attack?

Which TWO of the following are considered 'social engineering' techniques?

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

An administrator needs to verify the hardware sensor status (fans, power supplies, temperatures) of a high-end FortiGate unit. Which command provides this hardware health status?

An enterprise security team implements Multi-Factor Authentication (MFA) across all employee accounts. Which combination of authentication factors represents the strongest implementation of MFA?

An administrator suspects that a session is stuck in the FortiGate session table, preventing new connections. Which command allows viewing active sessions matching a specific source IP?

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

An administrator needs to ensure that administrative sessions to the FortiGate GUI automatically terminate after 15 minutes of inactivity. Where is this idle timeout setting configured?

An administrator is troubleshooting a policy match issue and needs to inspect a specific security policy's hit count and ID directly from the CLI. Which CLI command should the administrator use to list all firewall policies with their internal IDs and rule details?

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

An administrator wants to verify the amount of free space available on the system log disk. Which dashboard widget displays this metric?

What is the primary function of a FortiGate static route?

An administrator wants to ensure that all configuration changes made on a FortiGate are tracked with specific user accountability and revision history. Which Fortinet management tool provides centralized configuration revision control and rollback capabilities?

Which THREE of the following actions are examples of good physical security practices in an office environment? (Choose three)

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

An administrator wants to verify high availability (HA) cluster status and member synchronization. Which TWO commands or dashboard widgets provide this HA status? (Choose two)

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

Where can an administrator view a summary of system alerts and warning messages directly in the web-based manager without navigating to full log reports?

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

An administrator needs to configure an idle timeout for administrative web GUI sessions to enhance security. Where is this setting located?

An administrator notices that the FortiGate configuration changes made during troubleshooting were lost after an unexpected power outage. Where should the administrator check to ensure that the current running configuration is permanently saved?

An administrator needs to ensure that internal network users cannot bypass corporate security policies by using unauthorized peer-to-peer file sharing or gaming applications. Which FortiGate security feature is specifically designed to identify and take action against these types of network protocols?

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

An administrator wants to view historical web filtering and traffic logs on the FortiGate. Which TWO methods can be used to search and analyze stored logs? (Choose two)

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

Which TWO firewall operational modes can be configured on a FortiGate device? (Choose two.)

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

An administrator wants to check the connection status of Security Fabric telemetry between the root FortiGate and downstream devices. Where is the Security Fabric status viewed?

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

What is the primary function of a FortiGate firewall policy action set to 'Accept'?

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?