Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) FORTINET-NSE123 Questions 1–75 | Page 1/4

MCQeasy

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

A.To deliver real-time threat intelligence updates and security signatures to Fortinet devices

B.To synchronize endpoint compliance policies with FortiClient EMS

C.To manage administrative user accounts across multiple tenants

D.To store archival system audit logs for regulatory compliance

AnswerA

FortiGuard delivers real-time threat intelligence and security signature updates to Fortinet devices, satisfying the stem's requirement for the distribution network's primary purpose. It pushes antivirus, IPS, web-filter and botnet signatures so FortiGates enforce current protections without manual intervention, distinct from FortiManager's configuration role.

Why this answer

The FortiGuard Distribution Network (FDN) is Fortinet's global threat intelligence infrastructure that pushes real-time updates — antivirus signatures, IPS signatures, web filter categories, and other security content — to FortiGate, FortiMail, FortiClient, and other Fortinet devices. It ensures devices have current protection against emerging threats without manual intervention.

Exam trap

FORTINET-NSE123 often tests the distinction between FortiGuard (threat intelligence delivery), FortiManager (centralized management), and FortiAnalyzer (logging/reporting) — candidates confuse these Fabric components.

How to eliminate wrong answers

Option B is wrong because endpoint compliance policy synchronization is handled by FortiClient EMS (Endpoint Management Server), not the FortiGuard Distribution Network. Option C is wrong because multi-tenant administrative account management is performed through FortiManager or the FortiGate's own admin configuration, not FDN. Option D is wrong because archival audit log storage is handled by FortiAnalyzer or syslog servers, not the FortiGuard distribution infrastructure.

Full explanation →

MCQmedium

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

A.Perform a hardware factory reset using the pinhole reset button.

B.Use the default factory IP address 192.168.1.99 via HTTPS.

C.Wait for the lockout timer to expire, which defaults to 24 hours.

D.Log in via the physical console port using the 'maintainer' login procedure during a device reboot.

AnswerD

The maintainer account is a hard-coded recovery login accepted only on the physical console during the boot sequence, so it bypasses the locked-out admin credentials entirely while leaving the saved configuration intact, satisfying the no-configuration-loss constraint.

Why this answer

The standard recovery method for a locked-out FortiGate administrator without losing configuration is to connect via the physical console port and use the 'maintainer' login procedure during a reboot. This involves rebooting the device, interrupting the boot process, and logging in with the maintainer account to reset the admin password or unlock the account while preserving the configuration.

Exam trap

FORTINET-NSE123 often tests the misconception that a factory reset or waiting for a lockout timer is the standard recovery method, when the maintainer console procedure is the correct non-destructive approach.

How to eliminate wrong answers

Option A is wrong because a hardware factory reset erases all configuration, which violates the requirement to recover access without losing the configuration. Option B is wrong because the default factory IP 192.168.1.99 is only available on a factory-reset device and does not help recover a locked-out configured device. Option C is wrong because the default lockout timer is not 24 hours; FortiGate lockout duration is configurable and typically much shorter, and waiting does not guarantee access if the lockout is indefinite or the admin account is disabled.

Full explanation →

MCQhard

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

A.Mass spam campaign

B.Whaling attack

C.MAC spoofing attack

D.Structured query language injection

AnswerB

Whaling specifically targets senior executives such as high-ranking officers, satisfying the stem's scenario of a weaponised PDF sent to an executive's personal account. It is a spear-phishing variant distinguished by the victim's seniority, unlike generic phishing or business email compromise.

Why this answer

A whaling attack is a highly targeted spear-phishing variant aimed specifically at senior executives ('big fish') such as CEOs, CFOs, or other high-ranking officials. The attacker here bypassed perimeter defenses by sending a weaponized PDF directly to the executive's personal email, which is a hallmark of whaling — personalized targeting of a high-value individual rather than mass distribution. The personal-account vector and executive target confirm this is whaling, not generic phishing or spam.

Exam trap

FORTINET-NSE123 often tests the distinction between broad phishing/spam and targeted executive-level attacks — candidates pick 'mass spam' because an email was involved, missing the 'high-ranking executive' and 'personal account' cues that define whaling.

How to eliminate wrong answers

Option A is wrong because a mass spam campaign is untargeted bulk email sent to thousands of recipients indiscriminately, whereas this attack was specifically crafted for one executive. Option C is wrong because MAC spoofing is a Layer 2 attack that forges a network interface's hardware address to bypass port security or impersonate another device — it has nothing to do with email-borne malware. Option D is wrong because SQL injection targets database-driven web applications by inserting malicious SQL statements into input fields, not email attachments delivered to an executive.

Full explanation →

Multi-Selectmedium

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

Select 2 answers

A.Administrator username

B.Firewall policy source IP object

C.Administrator access profile (defining permissions and privileges)

D.DHCP lease pool range

E.SSL VPN portal bookmark

AnswersA, C

The administrator username is the mandatory unique identifier required when creating any local administrator account on the FortiGate. Without it, the account cannot be created, satisfying the requirement to configure local administrator accounts with specific operational privileges.

Why this answer

When creating a new local administrator account, the administrator username (Option A) is a required element because it uniquely identifies the account on the device and is used for authentication and audit logging. The administrator access profile (Option C) is also required/configurable because it defines the permissions and privileges assigned to that account, such as read-only, read-write, or super-admin scope, which is exactly what the scenario demands for 'specific operational privileges.' Options B, D, and E are unrelated to local administrator account creation: a firewall policy source IP object (B) is used in security policy rules, a DHCP lease pool range (D) configures dynamic IP address assignment for clients, and an SSL VPN portal bookmark (E) defines web resources presented to remote VPN users, none of which are part of defining a local admin account's identity or privileges.

Exam trap

FORTINET-NSE123 often tests the confusion between administrator account attributes and unrelated network service configurations, so candidates might mistakenly select options like firewall policy source IP objects or DHCP pools that are not part of admin account creation.

Full explanation →

MCQmedium

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

A.execute ping-packet

B.execute trace-route

C.get system interface traffic

D.diagnose sniffer packet

AnswerD

The diagnose sniffer packet command captures live packets at the interface level from the CLI, letting the administrator inspect traffic on the specific interface. It directly satisfies the requirement to capture live packet data without external tools.

Why this answer

The FortiGate CLI command 'diagnose sniffer packet' captures live packets on a specified interface, allowing administrators to inspect traffic in real time. It supports filters, verbosity levels, and interface selection, making it the correct tool for troubleshooting intermittent latency at the packet level.

Exam trap

FORTINET-NSE123 often tests the exact CLI syntax for packet capture, and candidates may confuse 'diagnose sniffer packet' with non-existent commands like 'execute ping-packet' or 'get system interface traffic'.

How to eliminate wrong answers

Option A is wrong because 'execute ping-packet' is not a valid FortiGate CLI command; ping is executed via 'execute ping' or 'execute ping-options'. Option B is wrong because 'execute trace-route' is not a valid command; traceroute is performed with 'execute traceroute'. Option C is wrong because 'get system interface traffic' displays interface statistics and counters, not live packet captures.

Full explanation →

MCQmedium

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

A.Availability, because public networks are prone to high latency and packet loss.

B.Non-repudiation, because transactions cannot be cryptographically verified.

C.Confidentiality, because data in transit can be intercepted by third parties.

D.Integrity, because unauthorized users can modify corporate files in transit.

AnswerC

Traffic traversing the public Wi-Fi network is unencrypted, so anyone on that segment can capture credentials and corporate data. Confidentiality is the property breached, since the data remains intact and available but is exposed to interception by third parties.

Why this answer

Confidentiality is compromised because data transmitted over an unsecured public Wi-Fi network without a VPN can be intercepted by third parties (e.g., via packet sniffing or man-in-the-middle attacks). The lack of encryption means sensitive corporate information is exposed to unauthorized observers.

Exam trap

FORTINET-NSE123 often tests the distinction between confidentiality and integrity in network scenarios; candidates may incorrectly choose integrity when the primary risk is eavesdropping, which is a confidentiality breach.

How to eliminate wrong answers

Option A is wrong because availability concerns uptime and access to resources, not interception; latency and packet loss on public Wi-Fi do not primarily compromise a security principle in this scenario. Option B is wrong because non-repudiation relates to proving the origin and integrity of a transaction, which is not the main issue when data is simply intercepted. Option D is wrong because while integrity could be threatened by tampering, the primary and most direct compromise in this scenario is confidentiality, as the data is exposed to eavesdropping.

Full explanation →

MCQhard

An organization's security policy states that users should have only the access needed to perform their job, and that access should be reviewed regularly. A database administrator currently retains full administrative rights to a finance application even though her role changed six months ago and no longer requires those rights. Which principle is being violated?

A.Least privilege

B.Defense in depth

C.Non-repudiation

D.Separation of duties

AnswerA

Least privilege means granting users the minimum access necessary for their current duties, and revoking rights when roles change. Retaining full administrative rights after a role change directly violates this principle. Regular access reviews exist precisely to catch such accumulation of unnecessary privileges, which increases the attack surface if the account is compromised.

Why this answer

Least privilege requires that accounts hold only the rights their current job demands, with periodic reviews to remove stale entitlements. The administrator's retained full rights after a role change is a textbook violation. This principle is foundational in NSE 1 security concepts and underpins identity and access management controls such as role-based access and recertification campaigns.

Exam trap

The trap here is selecting separation of duties because it also concerns access control, when the scenario actually describes unused excessive rights rather than divided responsibilities.

Full explanation →

MCQhard

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

A.Share a single high-privileged service account credential among the entire team.

B.Grant read-only access to specific tables only for employees whose roles explicitly require that data.

C.Assign all department members permanent administrative rights to ensure uninterrupted workflow.

D.Provide full database access to all employees during onboarding, revoking it after one year.

AnswerB

Read-only access limited to specific tables satisfies least privilege by granting only the minimum permissions required for each role, rather than broad database or write access. This restricts employees to data their roles explicitly need, directly enforcing the principle within the sensitive customer records scenario.

Why this answer

Option B correctly implements the Principle of Least Privilege by granting only the minimum necessary access—read-only permissions to specific tables—and restricting it to employees whose roles explicitly require that data. This ensures users have no more privileges than needed to perform their job functions, reducing the attack surface and potential for data misuse. The granularity (specific tables) and read-only nature further limit exposure, aligning with the principle's core tenet of minimal rights.

Exam trap

The trap here is confusing least privilege with convenience or broad access, leading candidates to choose options that grant excessive rights (like full access or admin rights) under the guise of operational efficiency or onboarding simplicity.

How to eliminate wrong answers

Option A is wrong because sharing a single high-privileged service account violates least privilege by granting excessive, non-attributable access to all team members, increasing risk of credential compromise and insider threats. Option C is wrong because assigning permanent administrative rights to all department members grants far more privileges than necessary and fails to restrict access based on role requirements, directly contradicting least privilege. Option D is wrong because providing full database access to all employees during onboarding, even temporarily, violates least privilege by granting excessive rights unrelated to job needs, and the one-year revocation period is arbitrary and still exposes sensitive data unnecessarily.

Full explanation →

MCQhard

When configuring an IPsec VPN tunnel in FortiOS, what is the purpose of Phase 2 negotiation?

A.To assign dynamic IP addresses to remote dial-up users via DHCP relay

B.To verify the administrator credentials attempting to log into the FortiGate GUI

C.To negotiate the security parameters and encryption algorithms used to protect user data packets (IPsec SAs)

D.To establish the initial IKE handshake and peer authentication identity

AnswerC

Phase 2 negotiates the IPsec security associations that protect user data, agreeing encryption and authentication algorithms, plus lifetime parameters. This satisfies the stem's data-packet protection requirement, whereas Phase 1 only establishes the secure management tunnel for the IKE exchange itself.

Why this answer

IPsec Phase 2 negotiation establishes the IPsec Security Associations (SAs) that define how user data packets are encrypted and authenticated. It negotiates parameters like encryption algorithms (AES, 3DES), integrity algorithms (SHA-256), and Perfect Forward Secrecy (PFS) settings, creating the actual tunnel used for data transport.

Exam trap

FORTINET-NSE123 often tests the distinction between Phase 1 (peer authentication, IKE SA) and Phase 2 (data encryption parameters, IPsec SA) — candidates frequently swap their functions.

How to eliminate wrong answers

Option A is wrong because assigning dynamic IP addresses to dial-up users is handled by DHCP or FortiGate's IPsec DHCP configuration, not Phase 2 negotiation. Option B is wrong because verifying administrator credentials is an authentication function of the FortiGate GUI/CLI, unrelated to IPsec Phase 2. Option D is wrong because establishing the initial IKE handshake and peer authentication is the purpose of Phase 1 negotiation, not Phase 2.

Full explanation →

MCQeasy

An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?

A.Dashboard > System Information widget

B.Log & Report > System Events

C.Policy & Objects > Addresses

D.Network > Interfaces

AnswerA

The System Information widget on the dashboard displays the running firmware version, hostname, serial number and uptime immediately after login, satisfying the requirement to verify the current firmware version without navigating to separate configuration menus or running CLI commands.

Why this answer

The Dashboard's System Information widget displays the FortiGate's hostname, firmware version, serial number, uptime, and system resource usage immediately after login. This is the fastest way to verify the running firmware build.

Exam trap

The trap is that candidates may look for firmware under Log & Report or Network menus, not realizing the dashboard's System Information widget is the immediate, default source.

How to eliminate wrong answers

Option B is wrong because Log & Report > System Events contains event log entries, not a live firmware version display — you would only see firmware info there if it was logged during an upgrade. Option C is wrong because Policy & Objects > Addresses manages firewall address objects, unrelated to firmware version. Option D is wrong because Network > Interfaces shows interface configuration and status, not the FortiOS firmware build.

Full explanation →

MCQeasy

Where can an administrator view a summary of detected security threats, such as blocked malware and intrusion prevention events, in the FortiGate web-based manager?

A.Log & Report > Security Logs

B.System > FortiGuard

C.Dashboard > Threat Map

D.Policy & Objects > Security Profiles

AnswerA

Security Logs aggregate IPS, antivirus and other UTM event records, presenting blocked malware and intrusion detections in one view. It satisfies the stem's requirement to see a summary of detected threats in the web-based manager.

Why this answer

In the FortiGate web-based manager (GUI), security threat summaries—including blocked malware, IPS events, and other UTM logs—are found under Log & Report > Security Logs. This section aggregates logs from all security profiles (antivirus, IPS, web filter, etc.) and provides filtering, drill-down, and visualization of detected threats. It is the central location for reviewing security events in real time or historically.

Exam trap

The trap here is confusing the configuration location (Security Profiles) with the monitoring location (Security Logs), or assuming that the Threat Map provides detailed logs rather than just a visual overview.

How to eliminate wrong answers

Option B is wrong because System > FortiGuard is used to configure FortiGuard subscription services (e.g., license status, update schedules), not to view security logs. Option C is wrong because Dashboard > Threat Map is a widget that displays a geographical map of attacks, but it does not provide a detailed summary or log of detected threats; it is a high-level visualization. Option D is wrong because Policy & Objects > Security Profiles is where you configure security profiles (e.g., antivirus, IPS) and apply them to policies, not where you view logs of detected events.

Full explanation →

Multi-Selectmedium

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

Select 2 answers

A.Immediately notify the internal IT security or helpdesk team

B.Delete all files on the computer to erase evidence of the compromise

C.Post about the incident on public social media channels to warn friends

D.Change the password immediately from a secure, uncompromised device

E.Keep the incident secret to avoid getting in trouble with management

AnswersA, D

Reporting suspected compromise to IT security or the helpdesk triggers containment, such as session revocation and credential resets, limiting attacker dwell time. It satisfies the stem's requirement for an immediate end-user action following suspected credential compromise.

Why this answer

Option A is correct because promptly notifying the internal IT security or helpdesk team allows the organization to initiate incident response, such as revoking active sessions, resetting credentials, and checking for lateral movement or persistence mechanisms. Option D is correct because changing the password immediately from a secure, uncompromised device reduces the window in which an attacker can use the stolen credentials, and using a trusted device prevents malware or keyloggers from capturing the new password. Option B is not appropriate because deleting files destroys forensic evidence and does not remediate the credential compromise.

Option C is wrong because public social media disclosure can expose sensitive corporate information and does not follow proper incident reporting channels. Option E is wrong because concealing the incident delays response and increases the potential damage and scope of the compromise.

Exam trap

FORTINET-NSE123 often tests the misconception that users should 'clean up' or stay quiet — the correct behavior is always to report immediately and change credentials from a trusted device, never to delete evidence or hide the incident.

Full explanation →

MCQeasy

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

A.A rootkit that grants administrative privileges to remote attackers.

B.Ransomware that encrypts critical files and demands payment for access.

C.Adware that automatically displays unwanted promotional banners.

D.Spyware that covertly records keystrokes and captures screenshots.

AnswerB

Ransomware encrypts files and locks the screen with a payment demand, matching the reported symptoms exactly. The encryption of critical files plus the cryptocurrency extortion message is the defining behaviour, distinguishing it from other malware types that do not hold data hostage.

Why this answer

A locked screen displaying a cryptocurrency payment demand alongside encrypted files is the textbook signature of ransomware — malware that encrypts victim data and holds it hostage until a payment (often in Bitcoin or Monero) is made. The lock screen with payment instructions is the ransom note.

Exam trap

FORTINET-NSE123 often tests malware classification by symptom, so candidates who focus on 'screen locked' may wrongly pick rootkit or spyware instead of recognising the encryption-plus-ransom signature of ransomware.

How to eliminate wrong answers

Option A is wrong because a rootkit is designed for stealthy persistent privileged access, not for displaying a visible payment demand — rootkits hide themselves and typically leave no obvious screen message. Option C is wrong because adware displays unwanted advertisements or redirects browsers; it does not encrypt files or demand cryptocurrency. Option D is wrong because spyware covertly records keystrokes, screenshots, and credentials for exfiltration — it operates silently and never locks the screen with a payment demand.

Full explanation →

MCQmedium

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

A.A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

B.A password reused from personal social media accounts to ensure easy recall

C.A long passphrase consisting of random unrelated words and special characters

D.A short word combined with the current year, such as 'Summer2026!'

AnswerC

A long passphrase of random unrelated words plus special characters maximises length and unpredictability, satisfying the stem's requirement for the strongest creation standard. Length defeats brute-force and cracking attacks far more effectively than short complex strings, which remain vulnerable to dictionary and hybrid attacks.

Why this answer

A long passphrase made of random unrelated words plus special characters maximizes length and entropy while remaining memorable, which is the strongest practice among the options. Length is the primary defense against brute-force and dictionary attacks, and random unrelated words defeat predictable patterns. This aligns with modern guidance from NIST SP 800-63B, which emphasizes length over complexity.

Exam trap

FORTINET-NSE123 often tests password best practices by presenting options that look complex but are predictable — candidates may pick 'Summer2026!' because it has complexity, but the trap is that pattern-based passwords are weak regardless of symbol inclusion.

How to eliminate wrong answers

Option A is wrong because keyboard sequences like 'qwertyuiop123!' are easily guessed by attackers using keyboard-walk dictionaries and provide low entropy despite length. Option B is wrong because reusing a password from personal social media creates a single point of failure; if that site is breached, the privileged account is compromised, and it violates the principle of unique credentials. Option D is wrong because 'Summer2026!' follows a predictable pattern (season + year + symbol) that cracking tools and password dictionaries specifically target, and it is too short.

Full explanation →

MCQmedium

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

A.Utilize a secure VPN tunnel to the corporate network.

B.Enable browser-based spell check.

C.Ensure the laptop firewall is turned off to allow easier connectivity.

D.Use an unencrypted FTP connection for file transfers.

AnswerA

A VPN tunnel encrypts all traffic between the remote worker and the corporate network, defeating interception on the untrusted hotspot. This satisfies the constraint of protecting data in transit over a hostile medium, since the hotspot operator can otherwise capture credentials and session data.

Why this answer

A secure VPN tunnel encrypts all traffic between the remote worker and the corporate network, protecting it from interception on an untrusted public Wi-Fi hotspot. This ensures confidentiality and integrity of company data even if the Wi-Fi network is compromised. The other options either do not provide encryption or actively weaken security.

Exam trap

The trap here is confusing basic hygiene measures (like spell check or firewall settings) with actual traffic protection; candidates might think any security feature helps, but only encryption via VPN addresses the risk of unsecured Wi-Fi.

How to eliminate wrong answers

Option B is wrong because browser spell check has no security function and does not protect traffic. Option C is wrong because disabling the laptop firewall removes a critical layer of host-based protection, increasing exposure to attacks. Option D is wrong because unencrypted FTP transmits credentials and data in cleartext, which can be easily captured on a public network.

Full explanation →

MCQmedium

An administrator needs to check the status of FortiCare registration and feature licenses. Where in the web-based manager is this license summary displayed?

A.Policy & Objects > Licenses

B.Security Fabric > Registration

C.System > FortiGuard

D.Log & Report > License Audit

AnswerC

System > FortiGuard displays the licence summary, including FortiCare registration status and the entitlements for each subscribed service. This satisfies the administrator's need to verify registration and feature licences from one page in the web-based manager, rather than checking separate per-feature configuration screens.

Why this answer

The System > FortiGuard page in the FortiGate web-based manager displays the FortiCare registration status along with the status and expiry of feature licenses such as FortiGuard security services (AV, IPS, Web Filtering, etc.). This is where administrators confirm that support and subscription entitlements are active.

Exam trap

The trap is that candidates may assume license information lives under a 'Licenses' or 'Registration' menu, when FortiOS actually consolidates FortiCare and FortiGuard subscription status under System > FortiGuard.

How to eliminate wrong answers

Option A is wrong because Policy & Objects > Licenses is not a valid FortiOS menu path — Policy & Objects deals with firewall policies, addresses, and services, not license status. Option B is wrong because Security Fabric > Registration does not exist as a license summary page; Security Fabric covers fabric topology and device authorization. Option D is wrong because Log & Report > License Audit is not a FortiOS menu — Log & Report handles logs, events, and reports, not license summaries.

Full explanation →

MCQhard

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

A.MAC flooding attack

B.Distributed denial of service

C.Man-in-the-Middle attack

D.SQL injection exploit

AnswerC

The attacker sits inline between two hosts, relaying and altering traffic while both endpoints believe they communicate directly. This active interception and modification of the session is precisely the man-in-the-middle mechanism described in the stem.

Why this answer

A Man-in-the-Middle (MitM) attack occurs when an adversary secretly intercepts and relays communications between two parties who believe they are communicating directly. The attacker can eavesdrop, modify, or inject data while remaining undetected, often by exploiting ARP spoofing, DNS poisoning, or rogue Wi-Fi access points. This matches the scenario of relaying and modifying messages between two hosts.

Exam trap

The trap is confusing attacks that enable eavesdropping (MAC flooding) with the actual interception-and-modification attack — candidates may pick MAC flooding because it's a Layer 2 attack that facilitates sniffing, but it does not itself relay and modify traffic.

How to eliminate wrong answers

Option A is wrong because a MAC flooding attack overwhelms a switch's CAM table to force it into hub-like flooding behavior, which can enable eavesdropping but is not itself the described relay-and-modify attack. Option B is wrong because a DDoS attack aims to exhaust resources and deny service, not to stealthily intercept and alter communications. Option D is wrong because SQL injection targets database-driven applications by injecting malicious SQL statements, not intercepting host-to-host communications.

Full explanation →

MCQeasy

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

A.Forward the email to all colleagues as a warning, including the live clickable link.

B.Reply to the sender asking for clarification using the reply button.

C.Recognize the social engineering attempt and use the organization's phishing reporting tool.

D.Treat it as an urgent executive request and fulfill the purchase immediately.

AnswerC

The email exploits urgency and authority — classic pretexting — rather than any technical vulnerability, so the user must recognise the social engineering and report it through the organisation's phishing reporting tool, satisfying the stem's demand for both a concept and an immediate action.

Why this answer

The email is a classic business email compromise (BEC) or gift card scam, a form of social engineering. The user should recognize the attempt and report it via the organization's phishing reporting tool, which alerts security teams and helps prevent similar attacks.

Exam trap

FORTINET-NSE123 often tests social engineering awareness, and candidates may choose to reply or forward the email instead of reporting it, falling for the urgency trap.

How to eliminate wrong answers

Option A is wrong because forwarding the email with the live link to colleagues could spread the phishing attempt and cause others to click it. Option B is wrong because replying to the sender confirms the email address is active and may engage with the attacker. Option D is wrong because fulfilling the request would result in financial loss and is exactly what the attacker wants.

Full explanation →

Multi-Selecteasy

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Select 2 answers

A.Writing passwords on a physical notepad kept inside a locked desk drawer

B.Reusing the same strong master password across all banking and work systems for ease of recall

C.Storing passwords in an encrypted password manager application

D.Changing passwords every single week regardless of whether a compromise is suspected

E.Using a unique, complex password for every individual account

AnswersC, E

An encrypted password manager stores credentials under a single strong master secret, so unique complex passwords become practical without memorisation or reuse. Encryption protects the vault if the device is lost, satisfying the scenario's requirement for a foundational password security habit.

Why this answer

Option C is correct because an encrypted password manager securely stores credentials using strong encryption (e.g., AES-256) behind a single master passphrase, enabling users to maintain many distinct, high-entropy passwords without memorizing them or writing them in plaintext. Option E is correct because using a unique, complex password for every account prevents credential-stuffing and lateral movement: if one site is breached, the reused secret cannot unlock other systems, which is a foundational habit for both personal and corporate security. Option A is not recommended because a written notepad, even in a locked drawer, stores passwords in plaintext and is vulnerable to physical access, theft, or insider snooping.

Option B is wrong because reusing one master password across banking and work systems creates a single point of failure, so one breach compromises every account. Option D is wrong because arbitrary weekly rotation without evidence of compromise encourages weaker, predictable passwords and is not aligned with modern guidance (e.g., NIST) that favors unique credentials and rotation only on suspected compromise.

Exam trap

The trap is selecting the 'change passwords frequently' option because it sounds like strong security hygiene — but modern guidance (NIST) explicitly rejects arbitrary rotation, and the exam tests whether candidates know current best practices versus legacy myths.

Full explanation →

Multi-Selectmedium

Which TWO of the following characteristics differentiate SSL VPN from IPsec VPN when deploying remote access solutions on a FortiGate? (Choose two.)

Select 2 answers

A.IPsec VPN operates exclusively at Layer 7 of the OSI model using HTTP/HTTPS protocols.

B.SSL VPN requires Internet Key Exchange (IKE) phase 1 and phase 2 negotiation parameters.

C.IPsec VPN cannot be terminated on a FortiGate device without an active FortiClient EMS license.

D.SSL VPN commonly utilizes TCP port 443, making it easier to traverse restrictive outbound firewalls.

E.SSL VPN can provide clientless web-portal access without requiring a pre-installed VPN client application.

AnswersD, E

SSL VPN's use of TCP 443 lets FortiGate remote users tunnel through restrictive outbound firewalls that typically permit HTTPS, whereas IPsec relies on ESP, UDP 500 and 4500, which such firewalls often block. This directly satisfies the stem's remote-access constraint of traversing restrictive outbound filtering.

Why this answer

Option D is correct because SSL VPN on a FortiGate typically listens on TCP port 443 (HTTPS), which is almost always permitted through restrictive outbound firewalls and NAT devices, whereas IPsec VPN relies on IKE (UDP 500/4500) and ESP (IP protocol 50), which are frequently blocked. Option E is correct because FortiGate SSL VPN supports a clientless web portal mode, allowing users to access internal web resources, bookmarks, and file shares through a browser without installing FortiClient or any pre-installed VPN client. Option A is wrong because IPsec operates at Layer 3 (network layer) and does not use HTTP/HTTPS; it is SSL VPN that leverages TLS/HTTPS at higher layers.

Option B is wrong because IKE phase 1 and phase 2 negotiations are characteristics of IPsec VPN, not SSL VPN, which uses TLS handshakes instead. Option C is wrong because a FortiGate can terminate IPsec VPN tunnels natively without any FortiClient EMS license; EMS is only relevant for managing FortiClient endpoints, not for basic IPsec termination.

Exam trap

FORTINET-NSE123 often tests the misconception that IPsec is application-layer or that SSL VPN needs IKE — candidates confuse the two stacks and pick options that swap their characteristics.

Full explanation →

Multi-Selecteasy

Which TWO protocols can be enabled on a FortiGate interface for secure administrative access? (Choose two.)

Select 2 answers

A.POP3

B.Telnet

C.HTTP

D.HTTPS

E.SSH

AnswersD, E

HTTPS encrypts the administrative GUI session with TLS, preventing credential and configuration data from being sent in clear text. It satisfies the stem's requirement for a secure protocol that can be enabled on a FortiGate interface for management access.

Why this answer

Option D (HTTPS) is correct because it encrypts administrative GUI/API traffic to the FortiGate interface using TLS on port 443, protecting credentials and session data from eavesdropping. Option E (SSH) is correct because it provides an encrypted CLI management channel, typically on TCP port 22, for secure administrative access. The other options do not belong: POP3 (A) is a mail retrieval protocol, not a management protocol; Telnet (B) is a management protocol but sends credentials and data in cleartext, so it is not secure; and HTTP (C) is an unencrypted web protocol, so it also fails the secure-access requirement.

Exam trap

FORTINET-NSE123 often tests the difference between secure and insecure management protocols, so candidates who pick HTTP or Telnet as 'secure' fall for the trap of confusing common protocols with encrypted ones.

Full explanation →

Multi-Selectmedium

Which TWO inspection modes are available on a FortiGate firewall for processing UTM security profiles? (Choose two.)

Select 2 answers

A.NAT routing inspection

B.Transparent bridging inspection

C.Flow-based inspection

D.Proxy-based inspection

E.Static gateway inspection

AnswersC, D

Flow-based inspection processes packets in a single pass using a fast-path architecture, delivering UTM scanning with lower latency and reduced memory use. It satisfies the scenario's requirement for one of the two FortiGate UTM inspection modes, pairing with proxy-based inspection as the alternative.

Why this answer

Flow-based inspection (C) is correct because FortiGate processes traffic using a single-pass, stream-based engine that scans packets as they flow through the firewall, applying UTM profiles with lower latency and higher throughput. Proxy-based inspection (D) is also correct because FortiGate can buffer and fully reassemble traffic at the application layer, allowing deeper content inspection, file scanning, and protocol validation. These two modes are the standard UTM inspection modes configured in FortiOS security profiles and firewall policies.

The other options do not belong: NAT routing inspection (A) and static gateway inspection (E) are not FortiGate UTM inspection modes, and transparent bridging inspection (B) describes a deployment/interface mode rather than a UTM processing mode.

Exam trap

FORTINET-NSE123 often tests the confusion between deployment modes (NAT/transparent) and inspection modes (flow/proxy), so candidates may select NAT or transparent thinking they are inspection types.

Full explanation →

MCQeasy

What is the primary function of a FortiGate hardware acceleration processor (FortiASIC)?

A.To offload firewall session processing and cryptographic operations, accelerating performance

B.To manage user identities and generate FortiToken push notifications

C.To provide wireless access point controller management via CAPWAP

D.To act as an external database for storing FortiAnalyzer log archives

AnswerA

FortiASIC processors are dedicated chips that offload firewall session handling and cryptographic operations from the main CPU. This hardware acceleration increases throughput and reduces latency for intensive tasks such as IPsec encryption and pattern matching, satisfying the stem's requirement to accelerate performance rather than perform software-based processing.

Why this answer

FortiASIC is Fortinet's custom silicon designed to offload computationally expensive operations — firewall session lookup, IPsec encryption/decryption, SSL inspection, and pattern matching — from the main CPU. This hardware acceleration dramatically increases throughput and reduces latency, which is why FortiGate appliances with FortiASIC can achieve multi-gigabit firewall and VPN performance.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse FortiASIC hardware acceleration with software features like user identity management or wireless controller functions that run on the FortiGate CPU.

How to eliminate wrong answers

Option B is wrong because user identity management and FortiToken push notifications are handled by FortiAuthenticator and FortiToken Cloud, not by the FortiASIC chip. Option C is wrong because CAPWAP wireless controller management is a software function of FortiOS on the FortiGate, not a hardware acceleration function. Option D is wrong because FortiAnalyzer log storage is a separate appliance/VM role; FortiASIC does not provide external database storage.

Full explanation →

MCQmedium

An administrator needs to restrict administrative access to the FortiGate CLI and GUI so that management connections are only accepted from a specific trusted internal management workstation subnet. Where is this source IP restriction configured?

A.Within the FortiGuard subscription server list

B.Inside the DHCP server IP pool range

C.On the administrator user account configuration (Trusted Hosts)

D.Inside the global DNS server settings

AnswerC

Trusted Hosts on the administrator account restricts CLI and GUI logins to specified source addresses or subnets. Configuring the management workstation subnet here satisfies the stem's constraint, blocking management connections originating from any other source before authentication is even attempted.

Why this answer

Administrative source IP restriction is configured on the administrator account itself using the 'Trusted Hosts' field (config system admin, set trusthost1/2/3). This limits which source subnets can authenticate to the FortiGate via HTTPS, SSH, Telnet, or FortiToken-based GUI/CLI access. Only connections originating from the listed trusted hosts are accepted, providing a strong first line of defense against brute-force and unauthorized management access.

Exam trap

FORTINET-NSE123 often tests the misconception that management access restrictions are configured on the interface or via an admin profile, when in fact the source IP filter lives on the administrator account's Trusted Hosts setting.

How to eliminate wrong answers

Option A is wrong because the FortiGuard subscription server list defines which FDS servers the FortiGate contacts for signature and rating updates, not who can manage the device. Option B is wrong because the DHCP server IP pool range defines addresses handed to clients on a subnet, unrelated to management access control. Option D is wrong because global DNS server settings only specify name resolution servers and have no bearing on administrative source filtering.

Full explanation →

MCQmedium

An administrator notices that the FortiGate system disk is filling up rapidly with log files. Which action should be taken to ensure local storage does not run out of space while retaining historical logs?

A.Disable all firewall policy rule logging permanently

B.Lower the physical interface MTU size across all WAN ports

C.Switch the FortiGate from NAT mode to Transparent mode

D.Configure remote logging to FortiAnalyzer or Syslog server and enable log overwriting

AnswerD

Offloading logs to FortiAnalyzer or a Syslog server preserves history remotely, while enabling log overwriting on local disk lets the oldest entries be recycled rather than halting logging. Together these satisfy the constraint of retaining historical logs without exhausting local storage.

Why this answer

The correct action is to configure remote logging to FortiAnalyzer or a Syslog server and enable log overwriting. Offloading logs to a remote server frees local disk space while preserving historical logs for analysis and compliance. Enabling log overwriting ensures that when the local disk reaches its configured threshold, the oldest logs are automatically deleted, preventing a full disk condition.

This approach maintains continuous logging without manual intervention.

Exam trap

The trap here is assuming that simply reducing logging or changing network settings will solve disk space issues, when the core requirement is to retain historical logs while preventing local storage exhaustion, which necessitates remote logging and log overwriting.

How to eliminate wrong answers

Option A is wrong because disabling all firewall policy rule logging permanently would stop the generation of new logs, but it does not address existing logs or retain historical logs; it also eliminates visibility, which is unacceptable for security and troubleshooting. Option B is wrong because lowering the MTU size on WAN ports affects packet fragmentation and network performance, not log storage; it has no impact on disk space usage. Option C is wrong because switching from NAT mode to Transparent mode changes the FortiGate's operating mode and how it handles traffic, but it does not directly manage log storage or retention; it may even complicate logging configurations.

Full explanation →

Multi-Selecteasy

Which TWO dashboard widgets are commonly used to monitor system performance and health on a FortiGate?

Select 2 answers

A.FortiView Source IPv4

B.System Information

C.System Resources

D.IPsec Monitor

E.DHCP Leases

AnswersB, C

The System Information widget displays uptime, hostname, firmware version and administrative status, giving a consolidated health snapshot. It satisfies the requirement to monitor system performance and health by surfacing core device state directly on the dashboard.

Why this answer

The System Information widget is correct because it displays core health data such as CPU usage, memory usage, uptime, and session count on the FortiGate dashboard. The System Resources widget is also correct because it provides real-time graphs of CPU, memory, and session usage, which are key indicators of system performance and health. FortiView Source IPv4 is not correct because it is a traffic-analysis view showing top source IPs, not a system health monitor.

IPsec Monitor is not correct because it tracks VPN tunnel status rather than overall system performance. DHCP Leases is not correct because it lists assigned DHCP addresses, which is a service detail, not a performance/health metric.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse traffic-analysis widgets (FortiView, IPsec Monitor) with device-health widgets (System Information, System Resources) — the exam expects you to separate 'what the box is doing' from 'what traffic is flowing'.

Full explanation →

MCQeasy

Which of the following scenarios describes a 'pretexting' social engineering attack?

A.An attacker leaves a malicious USB drive in the lobby.

B.An attacker uses automated software to guess passwords.

C.An attacker shoulder-surfs to capture a password.

D.An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.

AnswerD

Posing as an auditor fabricates a credible pretext, exploiting the employee's deference to authority to extract sensitive internal procedures. This satisfies the scenario's requirement for a fabricated identity and scenario that manipulates trust, distinguishing pretexting from phishing, baiting or quid pro quo attacks, which rely on different lures.

Why this answer

Pretexting is a social-engineering technique where the attacker invents a believable scenario or false identity (a pretext) to manipulate a victim into divulging information or performing an action. Posing as an auditor to convince an employee to disclose sensitive internal procedures is a textbook pretexting attack because it relies on a fabricated role and story to gain trust.

Exam trap

FORTINET-NSE123 often tests the distinction between pretexting (fabricated identity/scenario) and other social-engineering types like baiting, tailgating, or shoulder-surfing, which rely on physical or observational tactics.

How to eliminate wrong answers

Option A is wrong because leaving a malicious USB drive is baiting (a physical media drop attack), not pretexting — it exploits curiosity rather than a fabricated identity. Option B is wrong because automated password guessing is a brute-force/credential attack, a technical rather than social-engineering method. Option C is wrong because shoulder-surfing is observation-based eavesdropping to capture a password, which is a physical observation attack, not a pretext-based manipulation.

Full explanation →

Multi-Selectmedium

Which TWO of the following are considered 'social engineering' techniques?

Select 2 answers

A.Using a rainbow table to crack hashed passwords.

B.Baiting a victim with a 'free' USB drive that contains malware.

C.Tailgating into a secure office area by following an authorized employee.

D.Performing a denial of service attack on a web server.

E.Using a vulnerability scanner to find open ports.

AnswersB, C

Baiting exploits curiosity or greed, using a physical lure — here a malware-laden 'free' USB drive — to trick the victim into triggering infection. It manipulates human trust rather than exploiting a software flaw, which is the defining characteristic of social engineering.

Why this answer

Baiting a victim with a 'free' USB drive containing malware is a classic social engineering technique because it manipulates human curiosity or greed to trick the victim into physically connecting the malicious device, rather than exploiting a technical flaw. Tailgating into a secure office area by following an authorized employee is also social engineering, as it relies on the human tendency to hold doors open or avoid confrontation to bypass physical access controls. In contrast, using a rainbow table to crack hashed passwords is a technical cryptanalytic attack that exploits precomputed hash values, not human behavior.

A denial of service attack on a web server is a technical availability attack that floods resources, and using a vulnerability scanner to find open ports is a technical reconnaissance activity; neither depends on deceiving people.

Exam trap

The trap here is confusing technical attacks (like password cracking or DoS) with social engineering, which specifically involves manipulating people rather than systems.

Full explanation →

MCQeasy

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

A.FortiView Sessions

B.System Resources

C.License Information

D.Network Interfaces

AnswerB

The System Resources widget displays real-time CPU and memory utilisation directly on the FortiGate dashboard, satisfying the requirement to check performance from the web-based manager. It is enabled by default, unlike other widgets that require manual addition, so the administrator gains immediate visibility without further configuration.

Why this answer

The System Resources widget on the FortiGate web-based manager dashboard displays real-time CPU and memory utilization, along with other resource metrics like session count and log rate. It is included by default on the dashboard and is the standard place administrators check for immediate performance visibility. This directly answers the requirement to check CPU and memory from the GUI.

Exam trap

FORTINET-NSE123 often tests dashboard widget functions, and candidates confuse FortiView (traffic/session analytics) with System Resources (hardware performance metrics), picking the more familiar-sounding FortiView option.

How to eliminate wrong answers

Option A is wrong because FortiView Sessions shows detailed session and traffic analytics (top sources, destinations, applications), not system resource utilization. Option C is wrong because License Information displays support entitlements, contract expiry, and licensed features — not CPU or memory metrics. Option D is wrong because Network Interfaces shows interface status, IP addresses, and link state, not system-wide CPU or memory usage.

Full explanation →

MCQhard

An administrator suspects that a session is stuck in the FortiGate session table, preventing new connections. Which command allows viewing active sessions matching a specific source IP?

A.show firewall session [IP]

B.diagnose sys session filter src [IP] followed by diagnose sys session list

C.execute session clear [IP]

D.get system session list

AnswerB

The session filter command narrows the session table to entries matching the specified source IP, and the subsequent list command displays them. This isolates the suspected stuck session, letting the administrator confirm and clear it so new connections succeed.

Why this answer

The correct approach is to apply a session filter with 'diagnose sys session filter src <IP>' and then run 'diagnose sys session list' to display only sessions matching that source. This is the standard FortiOS diagnostic workflow for isolating stuck or problematic sessions without dumping the entire session table. The filter persists until cleared with 'diagnose sys session filter clear' or the session is closed.

Exam trap

FORTINET-NSE123 often tests whether candidates know that FortiOS session inspection requires the two-step 'diagnose sys session filter' + 'diagnose sys session list' pattern, not a single 'show' or 'get' command.

How to eliminate wrong answers

Option A is wrong because 'show firewall session' is not a valid FortiOS CLI command — session inspection is done via 'diagnose sys session' commands. Option C is wrong because 'execute session clear' is not a valid command; clearing sessions uses 'diagnose sys session clear' with filters, and it would destroy evidence rather than view it. Option D is wrong because 'get system session list' does not exist in FortiOS; 'get system session' commands relate to session helpers/expectations, not the live session table.

Full explanation →

MCQmedium

An administrator wants to configure a firewall policy so that specific internal users can only access the internet during non-work hours. Which object type should be added to the firewall policy to enforce this time restriction?

A.Firewall Schedule object

B.Virtual IP (VIP) object

C.Application Control signature

D.Traffic Shaper object

AnswerA

A firewall Schedule object defines recurring time windows, and attaching it to the policy restricts the specified internal users' internet access to non-work hours only. The schedule is the object type that enforces the time-based constraint in the stem.

Why this answer

A Firewall Schedule object is used in a firewall policy to define specific time periods during which the policy is active. By adding a schedule to the policy, the administrator can enforce that internal users can only access the internet during non-work hours. The schedule can be one-time or recurring, and it directly controls when the policy matches traffic.

Exam trap

FORTINET-NSE123 often tests the confusion between schedules (time-based) and traffic shapers (bandwidth-based), so candidates may incorrectly select Traffic Shaper for time restrictions.

How to eliminate wrong answers

Option B is wrong because a Virtual IP (VIP) object is used for destination NAT (DNAT) to map external IP addresses to internal servers; it has no time-based control. Option C is wrong because Application Control signatures identify and control applications, but they do not enforce time restrictions; they are used for application-level filtering. Option D is wrong because a Traffic Shaper object is used to limit bandwidth or prioritize traffic; it does not restrict access based on time.

Full explanation →

MCQmedium

An administrator needs to ensure that administrative sessions to the FortiGate GUI automatically terminate after 15 minutes of inactivity. Where is this idle timeout setting configured?

A.Inside the individual firewall policy rule settings

B.Inside the DHCP server IP lease settings

C.Under System Global settings (Administrator Idle Timeout)

D.Within the static routing table configuration

AnswerC

Administrator Idle Timeout sits under System Global settings and defines how long an administrative session may remain inactive before automatic termination. Setting it to 15 minutes satisfies the requirement that GUI sessions close after that period of inactivity.

Why this answer

The administrator idle timeout is a global system setting configured under System > Settings (System Global) in the FortiGate GUI, or via the CLI with 'config system global' then 'set admintimeout <minutes>'. It applies to all administrative sessions (GUI, SSH, Telnet, console) and defaults to 5 minutes on most FortiOS versions.

Exam trap

FORTINET-NSE123 often tests whether candidates know that admin idle timeout is a global system setting, not a per-policy or per-interface setting — candidates may incorrectly look for it inside firewall policies.

How to eliminate wrong answers

Option A is wrong because firewall policy rules control traffic flow and UTM inspection, not administrative session timeouts — there is no idle timeout field in a firewall policy. Option B is wrong because DHCP lease settings control IP address lease duration for DHCP clients, which is unrelated to admin session management. Option D is wrong because static routes define next-hop forwarding decisions for traffic, not administrative session behavior.

Full explanation →

Multi-Selectmedium

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

Select 3 answers

A.Interface IP address and subnet mask

B.DNS server IP addresses

C.BGP routing peer AS number

D.Default static route

E.SSL VPN portal customization

AnswersA, B, D

Assigning an interface IP address and subnet mask gives the FortiGate a routable identity on its network segment, satisfying the basic connectivity requirement. Without this layer-3 addressing, the device cannot communicate with gateways, DNS servers or management hosts, so it is one of the three mandatory parameters.

Why this answer

Option A is correct because every FortiGate interface that will carry traffic needs an IP address and subnet mask (configured via config system interface, e.g., set ip 192.168.1.99 255.255.255.0) to participate in IP networking at all. Option B is correct because DNS server IPs (config system dns, set primary/secondary) are required for the FortiGate to resolve hostnames for FortiGuard updates, NTP, and other name-based lookups. Option D is correct because a default static route (config router static, destination 0.0.0.0/0 with a gateway) is needed so the FortiGate can forward traffic to destinations outside its directly connected subnets, including the internet.

Option C is not required for basic connectivity since BGP is an advanced dynamic routing protocol only needed in specific multi-router topologies. Option E is not a basic network parameter; SSL VPN portal customization is an optional remote-access feature configured later, not part of initial connectivity.

Exam trap

The trap is that candidates see advanced features like BGP or SSL VPN and assume they are required for 'basic' setup, when the exam is really testing the minimal IP, route, and DNS triad.

Full explanation →

MCQeasy

An administrator wants to verify the amount of free space available on the system log disk. Which dashboard widget displays this metric?

A.Storage Usage widget

B.System Resources

C.Hard Drive Status

D.Log Disk widget

AnswerD

The Log Disk widget reports disk usage for the log partition, showing total capacity, used space and remaining free space. It satisfies the requirement to verify how much free space remains on the system log disk.

Why this answer

The Log Disk widget on the FortiGate dashboard displays the current usage and free space of the log disk (local storage used for logs). It shows a graphical representation of disk consumption, making it the correct widget for verifying free space on the system log disk.

Exam trap

The trap is confusing the Log Disk widget with generic storage or system resource widgets — candidates who haven't used the FortiGate dashboard may pick 'Storage Usage' or 'System Resources' because they sound plausible.

How to eliminate wrong answers

Option A is wrong because there is no 'Storage Usage' widget on the FortiGate dashboard — the correct widget is named Log Disk. Option B is wrong because System Resources shows CPU, memory, and session usage, not disk space. Option C is wrong because 'Hard Drive Status' is not a FortiGate dashboard widget; disk health is shown elsewhere (e.g., under System > FortiGuard or via CLI).

Full explanation →

MCQeasy

What is the primary function of a FortiGate static route?

A.To manually specify the next-hop gateway for routing traffic to specific destination networks

B.To translate private internal IP addresses to public WAN IP addresses

C.To inspect HTTP web traffic for malicious scripts

D.To authenticate remote VPN users against Active Directory

AnswerA

A static route manually defines the next-hop gateway for traffic destined to a specific network, satisfying the stem's requirement for its primary function. Administrators configure destination prefix and gateway explicitly, unlike dynamic routing protocols that learn paths automatically or policy routes that match on additional criteria.

Why this answer

A FortiGate static route is used to manually define a path for traffic to a specific destination network by specifying the next-hop gateway. This is a fundamental routing concept where the administrator explicitly sets the route rather than relying on dynamic routing protocols. Static routes are often used for simple networks or to override dynamic routing decisions.

Exam trap

FORTINET-NSE123 often tests basic routing concepts, and candidates might confuse static routing with NAT or security inspection, leading to incorrect answers.

How to eliminate wrong answers

Option B is wrong because translating private IP addresses to public WAN IP addresses is the function of NAT (Network Address Translation), not static routing. Option C is wrong because inspecting HTTP web traffic for malicious scripts is performed by the FortiGate's security profiles, such as antivirus or web filter, not by static routes. Option D is wrong because authenticating remote VPN users against Active Directory is handled by VPN configurations and authentication servers, not by static routes.

Full explanation →

MCQmedium

An administrator wants to ensure that all configuration changes made on a FortiGate are tracked with specific user accountability and revision history. Which Fortinet management tool provides centralized configuration revision control and rollback capabilities?

A.FortiAnalyzer

B.FortiClient EMS

C.FortiAuthenticator

D.FortiManager

AnswerD

FortiManager stores device configurations in its central database, recording each revision with the administrator account that committed it and permitting rollback to any prior revision. This satisfies the stem's demand for centralised configuration revision control with specific user accountability and rollback capability.

Why this answer

FortiManager is Fortinet's centralized management platform that maintains a revision history of all configuration changes pushed to managed FortiGates. It logs each change with the administrator's username, timestamp, and a diff of the modified objects, enabling granular rollback to any previous revision. This directly satisfies the requirement for user accountability and revision control.

Exam trap

FORTINET-NSE123 often tests the distinction between FortiManager (centralized configuration and revision control) and FortiAnalyzer (logging and reporting), causing candidates to confuse the two management tools.

How to eliminate wrong answers

Option A is wrong because FortiAnalyzer is a log collection, analysis, and reporting appliance; it stores logs and generates reports but does not provide configuration revision control or rollback of FortiGate settings. Option B is wrong because FortiClient EMS manages endpoint security (FortiClient) and does not handle FortiGate configuration revisions. Option C is wrong because FortiAuthenticator provides authentication, authorization, and accounting (AAA) services such as RADIUS, LDAP, and certificate management, not configuration revision control for FortiGates.

Full explanation →

MCQhard

When configuring FortiGate High Availability (HA) in active-passive mode, what is the role of the heartbeat interfaces?

A.To connect FortiClient EMS endpoints to the root FortiGate

B.To exchange keepalive health packets and synchronize session states and configurations between cluster members

C.To download daily antivirus signature updates from FortiGuard servers

D.To route user internet traffic across public WAN connections to the ISP

AnswerB

Heartbeat interfaces carry FGCP keepalives and synchronise session tables and configuration between cluster members, which is what active-passive HA requires. They detect peer failure so the standby can take over, satisfying the stem's need for stateful failover without dropping established sessions.

Why this answer

In FortiGate HA active-passive mode, heartbeat interfaces are dedicated links used to exchange keepalive packets (HELLO messages) that monitor cluster member health. They also synchronize session states and configuration changes between the primary and backup units, ensuring seamless failover. This communication is critical for maintaining cluster integrity and stateful failover.

Exam trap

FORTINET-NSE123 often tests the misconception that heartbeat interfaces carry user data or updates, confusing their role with data plane or management interfaces.

How to eliminate wrong answers

Option A is wrong because FortiClient EMS endpoints connect to the FortiGate for management and telemetry, not via HA heartbeat interfaces. Option C is wrong because antivirus signature updates are downloaded from FortiGuard servers over regular internet connections, not through heartbeat links. Option D is wrong because user internet traffic is routed via WAN interfaces, not heartbeat interfaces, which are for intra-cluster communication only.

Full explanation →

MCQmedium

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

A.Security Fabric > Profiles

B.System > Admin Profiles

C.System > Administrators > Profiles

D.Policy & Objects > Admin Profiles

AnswerB

System > Admin Profiles holds every access profile and its per-category read-write permissions, so an administrator can open a profile there to confirm exactly which privileges a given admin account inherits when that profile is assigned.

Why this answer

Administrator access profiles are defined and edited under System > Admin Profiles in the FortiOS GUI (config system accprofile in the CLI). This is where profiles like 'super_admin', 'prof_admin', and custom profiles are created with granular read/write permissions per functional area (firewall, VPN, system, etc.). Assigning a profile to an admin account controls exactly what that admin can view and modify.

Exam trap

FORTINET-NSE123 often tests the exact GUI path, so candidates confuse 'System > Administrators' (where profiles are assigned) with 'System > Admin Profiles' (where profiles are defined and edited).

How to eliminate wrong answers

Option A is wrong because Security Fabric > Profiles does not exist as an admin profile management location; the Security Fabric section deals with fabric connectors and authorization. Option C is wrong because System > Administrators > Profiles is not the actual GUI path; the Administrators page is where you assign profiles, but the profiles themselves are managed under System > Admin Profiles. Option D is wrong because Policy & Objects > Admin Profiles is not a valid FortiOS menu path; Policy & Objects deals with firewall addresses, services, and policies, not admin permissions.

Full explanation →

Multi-Selectmedium

An administrator wants to verify high availability (HA) cluster status and member synchronization. Which TWO commands or dashboard widgets provide this HA status? (Choose two)

Select 2 answers

A.get system ha status

B.get system interface physical

C.FortiView > HA Traffic

D.High Availability dashboard widget

E.Policy & Objects > HA Rules

AnswersA, D

Running `get system ha status` in the CLI queries the HA daemon directly, returning cluster member roles (primary/secondary), uptime, and synchronisation state. This satisfies the requirement to verify both cluster status and member synchronisation without relying on the GUI.

Why this answer

Option A, 'get system ha status', is correct because this FortiGate CLI command directly reports HA cluster health, including the HA mode, the primary/standby role of each member, and the synchronization (sync) status between cluster units. Option D, the 'High Availability dashboard widget', is correct because it is the GUI equivalent that displays HA cluster status, member roles, and configuration synchronization state at a glance. Option B, 'get system interface physical', only shows physical interface link and speed information and does not report HA membership or sync state.

Option C, 'FortiView > HA Traffic', is not a valid HA status widget and does not verify cluster synchronization. Option E, 'Policy & Objects > HA Rules', is not a real FortiGate HA status location; HA-related settings live under System > HA, not Policy & Objects.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact CLI syntax and GUI location for HA verification — distractors like 'HA Rules' or 'FortiView > HA Traffic' sound plausible but do not exist as HA status tools.

Full explanation →

MCQhard

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

A.The Web Filtering license on the FortiGate has expired, causing HTTPS inspection to fail open.

B.The firewall policy is configured with proxy-based inspection instead of flow-based inspection.

C.The Antivirus database update failed, preventing the FortiGate from decrypting TLS 1.3 handshakes.

D.The FortiGate CA certificate has not been installed in the trusted root certificate store of the client endpoints.

AnswerD

HTTPS inspection requires FortiGate to re-sign traffic with its own CA certificate. If that CA is absent from each endpoint's trusted root store, browsers cannot chain the forged certificate to a trusted authority, so they raise security warnings for the internal web applications.

Why this answer

When FortiGate performs deep inspection of HTTPS traffic, it acts as a man-in-the-middle and re-signs the server's certificate with its own FortiGate CA certificate. For browsers to trust this re-signed certificate without warnings, the FortiGate CA certificate must be installed in the trusted root certificate store of each client endpoint. Without it, browsers flag the certificate as untrusted, producing security warnings.

Exam trap

FORTINET-NSE123 often tests the misconception that enabling deep inspection alone is sufficient, confusing the need for client-side CA trust with license or inspection mode issues.

How to eliminate wrong answers

Option A is wrong because an expired Web Filtering license does not cause HTTPS inspection to fail open; typically it disables web filtering features but does not generate certificate warnings. Option B is wrong because proxy-based versus flow-based inspection affects how traffic is processed, not whether the certificate is trusted; both modes require the CA certificate to be trusted. Option C is wrong because antivirus database updates are unrelated to TLS handshake decryption; the FortiGate uses its own CA for decryption, not AV signatures.

Full explanation →

Multi-Selecthard

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Select 2 answers

A.Conducting regular security awareness training and simulated phishing tests for all staff.

B.Implementing multi-factor authentication (MFA) to protect user accounts even if credentials are exposed.

C.Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.

D.Instructing employees to comply immediately with any urgent executive request received via personal email.

E.Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.

AnswersA, B

Regular security awareness training combined with simulated phishing tests directly targets the human element that technical controls cannot fully address. Repeated exposure to realistic pretexts builds pattern recognition, satisfying the stem's requirement for an effective social engineering defence by reducing the likelihood that staff disclose credentials or click malicious links.

Why this answer

Option A is correct because regular security awareness training combined with simulated phishing tests conditions staff to recognize pretexting and phishing lures, report suspicious messages, and avoid handing over credentials or sensitive data, directly reducing the human factor these attacks exploit. Option B is correct because MFA adds a second authentication factor beyond the password, so even if a phishing or pretexting attack captures valid credentials, the attacker cannot complete login without the additional factor (e.g., TOTP code, push approval, or FIDO2 key), breaking account takeover. Option C is wrong because unrestricted, unscanned personal USB drives enable malware introduction and data exfiltration, increasing rather than defending against social-engineering-driven compromise.

Option D is wrong because blindly complying with urgent executive requests via personal email is exactly the pretexting behavior attackers exploit; such requests must be verified through out-of-band channels. Option E is wrong because disabling spam and email filtering removes a key technical control that blocks phishing messages, making users more exposed to social engineering.

Exam trap

FORTINET-NSE123 often tests social engineering defenses, and candidates might select options that seem convenient but actually increase risk, such as disabling filters or trusting urgent requests.

Full explanation →

MCQhard

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

A.Integrity is violated; remediation involves enabling packet checksum validation on all switches.

B.Non-repudiation is violated; remediation involves implementing digital signatures on email traffic.

C.Availability is violated; remediation involves upgrading uplink port speeds to 10Gbps.

D.Confidentiality is violated; remediation involves migrating to encrypted management protocols like SSH and HTTPS.

AnswerD

Telnet and HTTP transmit credentials and management data in clear text, so anyone capturing traffic can read them, breaching confidentiality. Migrating to SSH and HTTPS encrypts these sessions, directly satisfying the remediation the scenario requires.

Why this answer

Telnet and HTTP transmit data — including credentials and management commands — in clear text, meaning anyone with network visibility (packet capture, span port, MITM) can read them. This directly violates confidentiality, the security principle ensuring data is only accessible to authorized parties. The correct remediation is migrating to encrypted equivalents: SSH replaces Telnet, and HTTPS (TLS) replaces HTTP.

Exam trap

The trap is that candidates confuse the CIA triad pillars — clear-text protocols are almost always a confidentiality violation, but candidates sometimes pick integrity because they think 'tampering' is the main risk, when the primary exposure is unauthorized reading.

How to eliminate wrong answers

Option A is wrong because integrity concerns unauthorized modification, not unauthorized reading — checksum validation doesn't hide clear-text credentials from a sniffer. Option B is wrong because non-repudiation concerns proving who performed an action (digital signatures, audit trails), which is unrelated to clear-text transmission. Option C is wrong because availability concerns uptime and access to resources; upgrading uplink speeds does nothing to protect credentials exposed in clear text.

Full explanation →

MCQhard

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

A.MAC address filtering on the local switch.

B.Local static IP filtering.

C.Dynamic URL filtering with reputation-based feeds.

D.Disabling cookies in the browser.

AnswerC

Reputation-based dynamic URL filtering consults real-time threat intelligence feeds, blocking newly identified malicious sites at the point of request rather than relying on static categories. This satisfies the stem's requirement for real-time identification by a threat intelligence database.

Why this answer

Dynamic URL filtering with reputation-based feeds queries real-time threat intelligence databases (such as FortiGuard web filter rating service) to classify URLs and block malicious sites as they are identified. This provides up-to-date protection against newly discovered malicious domains, unlike static lists. Local static IP filtering and MAC filtering cannot keep pace with rapidly changing malicious URLs.

Exam trap

FORTINET-NSE123 often tests the misconception that static IP or MAC filtering can substitute for dynamic URL reputation filtering — candidates may choose local static IP filtering thinking it blocks malicious sites, but it cannot adapt to real-time threat intelligence.

How to eliminate wrong answers

Option A is wrong because MAC address filtering operates at Layer 2 and only permits/denies specific hardware addresses; it cannot identify malicious websites by URL or reputation. Option B is wrong because local static IP filtering relies on manually maintained IP lists and cannot dynamically track malicious domains that change IPs or use CDNs. Option D is wrong because disabling cookies in the browser is a client-side privacy measure, not a network security control, and does nothing to block malicious sites at the gateway.

Full explanation →

MCQeasy

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

A.Drive-by download

B.Denial of service

C.Phishing via email

D.Vishing (Voice Phishing)

AnswerD

Vishing is voice-based social engineering conducted over a phone call, where the attacker impersonates IT staff and leverages urgency to extract credentials. This matches the scenario precisely, distinguishing it from email-based phishing or SMS-based smishing.

Why this answer

Vishing (voice phishing) is the correct answer because the attack is delivered over a phone call, where the attacker impersonates IT staff and uses urgency to extract credentials. This is a social-engineering technique that exploits human trust rather than a technical vulnerability. The phone channel is the defining characteristic that separates vishing from email-based phishing.

Exam trap

FORTINET-NSE123 often tests the distinction between delivery channels in social-engineering attacks — candidates see 'phishing' and pick the email option without noticing the scenario specifies a phone call, which makes it vishing.

How to eliminate wrong answers

Option A is wrong because a drive-by download is a malicious file or script that installs automatically when a user visits a compromised or malicious website — no phone call is involved. Option B is wrong because a denial of service (DoS) attack floods a system or network with traffic to make it unavailable, which is an availability attack, not a credential-theft social-engineering attack. Option C is wrong because phishing via email uses fraudulent email messages to trick recipients into clicking links or revealing data; the scenario explicitly involves a phone call, not email.

Full explanation →

MCQmedium

An administrator configures a firewall policy with Web Filtering. When a user tries to access a newly created website whose category is unknown by the FortiGate, how does FortiGate handle the rating request?

A.It sends a real-time rating query to the FortiGuard servers to classify the URL

B.It forwards the page to FortiSandbox for zero-day file execution

C.It automatically blocks the website as a high-risk security threat

D.It quarantines the user's workstation inside FortiClient EMS

AnswerA

When a URL's category is unknown locally, FortiGate forwards a real-time rating query to the FortiGuard servers, which classify the URL and return the category. FortiGate then applies the matching web filter action, satisfying the requirement to handle newly created sites.

Why this answer

When a FortiGate encounters a URL whose category is unknown, it sends a real-time rating query to FortiGuard servers to obtain the category. This is part of the FortiGuard Web Filtering service, which maintains a vast database of URLs and their categories. The FortiGate then applies the appropriate action based on the web filter profile.

Exam trap

FORTINET-NSE123 often tests the misconception that unknown URLs are automatically blocked or sent to sandbox, when in fact FortiGate queries FortiGuard for real-time rating.

How to eliminate wrong answers

Option B is wrong because FortiSandbox is used for advanced threat detection by executing suspicious files in a sandbox; it does not classify URLs for web filtering. Option C is wrong because unknown URLs are not automatically blocked as high-risk; the FortiGate queries FortiGuard to determine the category, and the action depends on the web filter profile (which could be allow, block, or monitor). Option D is wrong because FortiClient EMS is an endpoint management server; it does not quarantine workstations based on URL rating requests.

Full explanation →

MCQeasy

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

A.A man-in-the-middle attack intercepting and modifying transit data.

B.A distributed denial-of-service attack flooding servers.

C.A zero-day exploit leveraging unpatched software code.

D.A brute-force attack guessing login credentials.

AnswerA

A man-in-the-middle attack places the adversary between two communicating parties, relaying traffic while impersonating each endpoint. The attacker can read and alter message content in transit, matching the stem's description of modified messages and mutual impersonation.

Why this answer

A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, intercepting and potentially altering traffic while each side believes they are talking directly to the other. The scenario describes exactly this: interception plus modification plus mutual impersonation. This is the defining triad of MITM — confidentiality and integrity of the session are both compromised.

Exam trap

The trap is that candidates see 'impersonating' and think phishing or spoofing, but the key differentiator is that the attacker sits in the middle of an active session and modifies data in transit — that is MITM, not phishing.

How to eliminate wrong answers

Option B is wrong because a DDoS attack aims to exhaust availability by flooding a target with traffic, not to intercept or modify communications between two parties. Option C is wrong because a zero-day exploit abuses an undisclosed software vulnerability to execute code or escalate privileges — the scenario describes no software flaw, only traffic interception. Option D is wrong because brute-force attacks systematically guess credentials; here the attacker never guesses anything, they insert themselves into an already-authenticated session.

Full explanation →

MCQmedium

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

A.An attacker installs a keylogger on an unattended physical workstation in an office.

B.An attacker floods a web server with synthetic traffic to crash the service.

C.An attacker calls the helpdesk posing as a new executive claiming to have lost their password, requesting a reset.

D.An attacker sends mass emails containing a malicious macro-enabled attachment.

AnswerC

Pretexting relies on a fabricated identity and scenario to manipulate the victim into complying. Posing as a new executive who lost their password exploits authority and urgency, pressuring the helpdesk into an unauthorised reset. The invented backstory is the pretext, satisfying the scenario's requirement for a social-engineering ruse rather than technical exploitation.

Why this answer

Pretexting is a social engineering technique where the attacker invents a believable scenario (the pretext) to manipulate a victim into divulging information or performing an action. The helpdesk call impersonating a new executive who lost their password is a classic pretext — the attacker leverages authority and urgency to obtain a password reset. This relies on human trust and process gaps rather than technical exploits.

Exam trap

FORTINET-NSE123 often tests the boundary between pretexting and phishing, causing candidates to choose mass-email scenarios when the question specifically describes a fabricated identity or scenario used to manipulate a specific target.

How to eliminate wrong answers

Option A is wrong because installing a keylogger on an unattended workstation is a physical/technical attack (sometimes called baiting or physical intrusion), not pretexting — no fabricated scenario is used to manipulate a person. Option B is wrong because flooding a web server with synthetic traffic is a Denial-of-Service (DoS/DDoS) attack, which is purely technical and involves no social manipulation. Option D is wrong because mass emails with malicious macro attachments describe phishing (specifically a macro-based phishing campaign), which is a broader category; pretexting is a distinct technique focused on a fabricated identity/scenario, not mass email delivery.

Full explanation →

Multi-Selecthard

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Select 2 answers

A.Running a temporary calculation script inside an isolated browser incognito tab.

B.Running an optional software update diagnostic tool provided by the hardware manufacturer.

C.Installing a kernel-level rootkit that hooks into core operating system processes.

D.Clearing the system browser cache and emptying the local operating system recycle bin.

E.Modifying operating system startup registry keys or creating automated scheduled tasks.

AnswersC, E

A kernel-level rootkit hooks core operating system processes, so it loads before or alongside the kernel and survives reboots, giving attackers persistent privileged access. This satisfies the requirement for a mechanism retaining access after a system restart.

Why this answer

Option C is correct because a kernel-level rootkit loads at boot, hooks into core OS processes, and hides itself from normal detection, giving the attacker durable privileged access that survives reboots. Option E is correct because modifying startup registry keys (e.g., Run/RunOnce keys) or creating scheduled tasks causes attacker code to execute automatically each time the system starts or a trigger fires, a classic persistence technique. Option A is not persistence: an incognito browser tab is temporary and isolated, and closing the browser or rebooting destroys it.

Option B is not persistence: a legitimate manufacturer diagnostic tool is a benign utility, not an attacker mechanism. Option D is not persistence: clearing the browser cache and recycle bin removes data and does not create any recurring execution or access.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse cleanup actions (clearing cache, emptying recycle bin) with true persistence mechanisms — the exam expects you to recognize that persistence specifically means surviving a reboot.

Full explanation →

Multi-Selectmedium

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Select 2 answers

A.Permitting HTTP plaintext transmission for login forms to speed up authentication.

B.Allowing users to share identical passwords to reduce password fatigue.

C.Implementing account lockout policies after a threshold of failed login attempts.

D.Enforcing Multi-Factor Authentication (MFA) across all authentication portals.

E.Disabling logging mechanisms to prevent server storage bloat.

AnswersC, D

Account lockout thresholds halt repeated authentication attempts after a set number of failures, rendering automated brute-force and credential-stuffing runs ineffective. This directly satisfies the constraint of defending user accounts against high-volume credential-based attacks without relying on password complexity alone.

Why this answer

Option C is correct because an account lockout policy that triggers after a defined threshold of failed login attempts (e.g., 5 attempts) blocks automated brute-force and credential-stuffing tools from making unlimited password guesses, throttling the attack and protecting the account. Option D is correct because enforcing Multi-Factor Authentication (MFA) across all authentication portals adds a second verification factor beyond the password, so even valid credentials obtained from credential stuffing or brute-forcing cannot alone grant access. Option A is wrong because permitting HTTP plaintext transmission exposes credentials to interception and does not defend against credential-based attacks.

Option B is wrong because allowing identical shared passwords increases the blast radius of credential stuffing and worsens password fatigue risks. Option E is wrong because disabling logging removes the audit trail needed to detect and respond to brute-force or credential-stuffing attempts.

Exam trap

FORTINET-NSE123 often tests the misconception that password complexity or frequent rotation alone stops credential attacks, when the real defenses are lockout thresholds and MFA that neutralize reused or guessed passwords.

Full explanation →

MCQeasy

An administrator needs to ensure that internal network users cannot bypass corporate security policies by using unauthorized peer-to-peer file sharing or gaming applications. Which FortiGate security feature is specifically designed to identify and take action against these types of network protocols?

A.Application Control

B.Antivirus Profile

C.NAT IP Pool

D.Static Route Table

AnswerA

Application Control identifies peer-to-peer file sharing and gaming protocols through deep inspection and signatures, then applies the configured action to block them. It directly addresses the requirement to stop users bypassing security policies via these application types.

Why this answer

FortiGate's Application Control feature is specifically designed to identify and control applications and protocols, including peer-to-peer file sharing, gaming, and other non-business traffic. It uses deep packet inspection and application signatures to detect applications regardless of port or encryption, and can then allow, block, or shape that traffic. This directly addresses the requirement to prevent users from bypassing security policies via unauthorized applications.

Exam trap

The trap is assuming Antivirus or IP Reputation handles application-level blocking; Application Control is the specific feature for identifying and acting on application protocols like P2P and gaming.

How to eliminate wrong answers

Option B is wrong because an Antivirus Profile scans for malware in files and traffic but does not identify or block application categories like P2P or gaming. Option C is wrong because a NAT IP Pool is used for source NAT address translation, not for application identification or control. Option D is wrong because a Static Route Table determines packet forwarding paths based on destination networks, not application-level policy enforcement.

Full explanation →

MCQeasy

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

A.Preventing structured SQL injection attacks against web databases.

B.Mitigating brute-force and credential-guessing attacks.

C.Preventing physical theft of laptop hardware.

D.Ensuring high network bandwidth availability for video conferencing.

AnswerB

Complex character requirements expand the search space an attacker must exhaust, directly raising the cost of brute-force and dictionary-based credential guessing. This satisfies the stem's constraint of complex password policies, since length and character diversity together determine resistance to exhaustive guessing rather than any single composition rule alone.

Why this answer

Complex password policies increase the search space an attacker must cover, making brute-force and credential-guessing attacks computationally expensive. Requiring uppercase, lowercase, digits, and special characters raises the number of possible combinations per character position, so even a short password becomes far harder to crack. The objective is to slow down or defeat automated guessing, not to address application-layer or physical threats.

Exam trap

The trap is confusing authentication hardening (password complexity) with application-layer defenses (SQL injection) or physical controls, because all are 'security' topics and the wrong answers sound plausible at a glance.

How to eliminate wrong answers

Option A is wrong because SQL injection is mitigated by parameterized queries, input validation, and WAF rules — password complexity has no bearing on how a database parses malicious SQL. Option C is wrong because physical laptop theft is addressed by full-disk encryption, cable locks, and asset tracking, not by password character requirements. Option D is wrong because network bandwidth for video conferencing is a QoS and capacity concern, entirely unrelated to authentication policy.

Full explanation →

Multi-Selecthard

Which THREE components or protocols are involved in establishing and maintaining a FortiGate High Availability (HA) cluster using FGCP? (Choose three.)

Select 3 answers

A.Session synchronization and session pickup settings

B.BGP exterior routing protocol peer autonomous systems

C.RADIUS authentication server token polling

D.FGCP heartbeat keepalive packets and hello messages

E.Dedicated HA heartbeat interfaces

AnswersA, D, E

FGCP clusters synchronise connection and session state between members, and session pickup lets the new primary inherit existing sessions after failover. This satisfies the scenario's requirement for a component involved in establishing and maintaining the HA cluster.

Why this answer

Option A is correct because FGCP HA relies on session synchronization and session pickup to replicate firewall and NAT session state between cluster members, so that a failover preserves existing connections. Option D is correct because FGCP uses heartbeat keepalive packets and hello messages over the HA link to detect member liveness and negotiate cluster state. Option E is correct because FortiGate HA clusters use dedicated HA heartbeat interfaces (physical or VLAN) to carry FGCP heartbeats and synchronization traffic, isolating it from production data.

Option B is not required, since BGP is an exterior routing protocol and FGCP HA does not depend on BGP peer autonomous systems. Option C is not required, since RADIUS authentication token polling is unrelated to FGCP cluster formation or maintenance.

Exam trap

FORTINET-NSE123 often tests the confusion between HA-specific protocols (FGCP, heartbeat, session pickup) and unrelated routing/authentication protocols (BGP, RADIUS) — candidates may pick BGP thinking it's needed for HA routing, or RADIUS thinking it's part of cluster authentication.

Full explanation →

Multi-Selectmedium

An administrator wants to view historical web filtering and traffic logs on the FortiGate. Which TWO methods can be used to search and analyze stored logs? (Choose two)

Select 2 answers

A.Log & Report menu in the web-based manager with filter and search options

B.Restarting the routing daemon (gated)

C.Editing the FortiOS kernel source code directly

D.FortiAnalyzer integration or local log viewer filters

E.Running execute factory-reset

AnswersA, D

The Log & Report menu provides the FortiGate's local log storage interface, letting administrators filter and search historical web filtering and traffic logs directly in the GUI. This satisfies the requirement to search and analyse stored logs without external infrastructure, using built-in filter criteria such as source, destination, and log type.

Why this answer

Option A is correct because the FortiGate GUI's Log & Report menu provides built-in filter and search controls that let an administrator query historical web filtering and traffic logs stored locally or on a disk. Option D is correct because FortiAnalyzer integration centralizes and indexes logs for advanced search and analysis, while the local log viewer filters also allow searching stored logs directly on the FortiGate. Option B is incorrect because restarting the routing daemon (gated) affects routing processes and does not provide any log search or analysis capability.

Option C is incorrect because editing FortiOS kernel source code is neither supported nor related to viewing historical logs. Option E is incorrect because 'execute factory-reset' erases the configuration and does not help search or analyze stored logs.

Exam trap

FORTINET-NSE123 often tests the distinction between log analysis methods and unrelated system operations, tricking candidates into selecting disruptive or destructive commands like factory-reset or daemon restarts instead of the proper GUI or FortiAnalyzer tools.

Full explanation →

MCQeasy

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

A.FortiView Threat Map

B.Security Fabric Rating

C.System Resources

D.Security Fabric > Topology

AnswerD

The Security Fabric > Topology widget renders the live fabric map, showing each connected FortiGate device and the links between them. It directly satisfies the requirement to display connected device status and fabric topology, unlike widgets that report only logs, traffic or licence states.

Why this answer

The Security Fabric > Topology widget on the FortiGate dashboard visually displays the connected Security Fabric devices, their roles (root, downstream FortiGates, FortiSwitches, FortiAPs, FortiAnalyzer, etc.), and the links between them. It provides a real-time view of fabric health and device connectivity, making it the correct place to monitor fabric status and topology.

Exam trap

FORTINET-NSE123 often tests the confusion between the Security Fabric Rating widget (a compliance score) and the Security Fabric Topology widget (the actual device map), so candidates must distinguish scoring from topology.

How to eliminate wrong answers

Option A is wrong because FortiView Threat Map shows geographic threat origins and attack destinations, not fabric device topology. Option B is wrong because Security Fabric Rating is a scoring widget that evaluates configuration best practices across the fabric, not a topology display. Option C is wrong because System Resources shows CPU, memory, and session utilization on the local FortiGate, not fabric device status.

Full explanation →

MCQhard

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

A.VPN > SSL-VPN Settings (Server Certificate field)

B.Policy & Objects > SSL Settings

C.System > Certificates > SSL-VPN

D.Security Fabric > VPN Settings

AnswerA

The Server Certificate field under VPN > SSL-VPN Settings binds the certificate presented to portal users, so replacing or verifying it there resolves the validation error. This is the only GUI location where the active SSL VPN server certificate is assigned.

Why this answer

The active SSL VPN server certificate is configured and can be verified or changed under VPN > SSL-VPN Settings in the Server Certificate field. This is where the administrator selects which certificate the FortiGate presents to SSL VPN clients. If users encounter certificate validation errors, checking this setting ensures the correct certificate is bound to the SSL VPN portal.

Exam trap

FORTINET-NSE123 often tests the specific menu path for SSL VPN certificate configuration, and candidates may confuse it with general certificate management under System > Certificates or SSL inspection settings.

How to eliminate wrong answers

Option B is wrong because Policy & Objects > SSL Settings does not exist as a menu for SSL VPN server certificate configuration; SSL inspection settings are under Policy & Objects > SSL Inspection, but that is for outbound inspection, not SSL VPN. Option C is wrong because System > Certificates > SSL-VPN is not a valid path; certificates are managed under System > Certificates, but the SSL VPN server certificate is assigned in the SSL-VPN settings, not in a dedicated SSL-VPN certificate section. Option D is wrong because Security Fabric > VPN Settings is not a standard menu; Security Fabric settings relate to fabric connectivity, not SSL VPN certificate configuration.

Full explanation →

MCQmedium

An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?

A.System > Settings > Maintenance

B.Click the administrator profile name at the top right of the GUI > Configuration > Backup

C.Security Fabric > Settings > Export

D.Log & Report > Backup Settings

AnswerB

Clicking the administrator profile name at the top right exposes the Configuration submenu, where Backup exports the running configuration to a local encrypted file. This satisfies the requirement to save the FortiGate configuration securely for backup, since the GUI's profile menu is the only path offering the Backup action.

Why this answer

In the FortiGate web-based manager, the configuration backup option is accessed by clicking the administrator profile name at the top-right of the GUI and then selecting Configuration > Backup. This opens the backup page where the administrator can choose to encrypt the file with a password and download it locally. The other menu paths do not contain the configuration backup function.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact GUI navigation path for configuration backup, and candidates frequently guess System > Settings or Log & Report instead of the admin profile menu.

How to eliminate wrong answers

Option A is wrong because System > Settings > Maintenance does not exist as a backup path; maintenance tasks are under System > Config or via the admin profile menu. Option C is wrong because Security Fabric > Settings > Export is not a configuration backup location; Security Fabric settings relate to fabric topology and connectors. Option D is wrong because Log & Report > Backup Settings does not exist; log-related settings are under Log & Report > Log Settings, and they do not export the configuration.

Full explanation →

MCQhard

An enterprise is deploying FortiGate High Availability (HA) in active-active mode. How does active-active mode differ from active-passive mode regarding session handling?

A.Active-active requires manual administrator failover, while active-passive is fully automated

B.Active-active disables all firewall security profiles to maximize raw throughput

C.Active-active distributes session processing across multiple cluster units, whereas active-passive processes all traffic on a single primary unit

D.Active-active eliminates the need for heartbeat cables between cluster units

AnswerC

Active-active forwards sessions across all cluster units simultaneously, so processing load is shared, whereas active-passive funnels every session through one primary unit while standby units only take over on failure. This satisfies the stem's session-handling comparison.

Why this answer

In FortiGate FGCP active-active HA, all cluster members actively process traffic, and sessions are distributed across units using load-balancing algorithms (such as source-destination IP hashing or weighted distribution). Session synchronization ensures that session state is shared between members so that any unit can handle the traffic if another fails. Active-passive, by contrast, has only the primary unit processing all traffic while the subordinate(s) remain on standby, ready to take over on failover.

Exam trap

FORTINET-NSE123 often tests the misconception that active-active HA disables security inspection or eliminates heartbeat requirements — candidates confuse load distribution with reduced security or think heartbeat cables are only for active-passive.

How to eliminate wrong answers

Option A is wrong because both active-active and active-passive modes support automatic failover via FGCP heartbeats — manual failover is not a defining characteristic of either mode. Option B is wrong because active-active mode does not disable security profiles; UTM/security inspection still applies, though traffic is distributed across units, and disabling profiles would defeat the purpose of the firewall. Option D is wrong because heartbeat interfaces (or heartbeat cables) are required in all FGCP HA modes, including active-active, to exchange hello/keepalive packets and synchronize state.

Full explanation →

MCQeasy

An organization is deploying FortiGate firewalls to segment internal network zones. What is the default action of a newly created firewall policy when traffic matches neither this policy nor any other rule?

A.Drop and send ICMP destination unreachable

B.Redirect to Captive Portal

C.Implicit Deny

D.Implicit Accept

AnswerC

Any traffic not matched by explicit policies is blocked by the implicit deny rule at the bottom of the policy table.

Why this answer

FortiGate firewall policies have an implicit deny at the end of the policy list. If traffic does not match any configured policy, it is dropped by default. This is a fundamental security principle and cannot be overridden unless you explicitly create a permit-all policy.

Exam trap

FORTINET-NSE123 often tests the default action of the implicit deny and whether it sends any response — candidates may confuse it with a reject action.

How to eliminate wrong answers

Option A is wrong because the implicit deny silently drops traffic; it does not send ICMP destination unreachable. Option B is wrong because captive portal redirection only occurs if a policy explicitly enables it. Option D is wrong because implicit accept would be a severe security risk and is not the default behavior.

Full explanation →

Multi-Selecteasy

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

Select 2 answers

A.Forward suspicious attachments to all coworkers to see if anyone recognizes them

B.Immediately open executable attachments (.exe) to check what program they run

C.Refrain from opening files with double extensions like .pdf.exe or unexpected script formats

D.Verify the legitimacy of the attachment by contacting the sender through an independent, trusted communication channel

E.Disable your antivirus software temporarily so it does not block the file download

AnswersC, D

Double extensions such as .pdf.exe exploit Windows' habit of hiding the final extension, so the file executes as a program rather than opening as a document. Refraining from opening these, and unexpected script formats, satisfies the stem's requirement to handle suspicious attachments safely before any sandbox or antivirus inspection occurs.

Why this answer

Option C is correct because files with double extensions such as .pdf.exe or unexpected script formats (.js, .vbs, .ps1) are classic malware-delivery tricks that exploit Windows' hiding of known file extensions, so refraining from opening them prevents execution of a disguised payload. Option D is correct because verifying the attachment's legitimacy via an independent, trusted channel (e.g., a phone call or a separate known email address) confirms the sender actually intended to send the file and defeats spoofed or compromised-account attacks. Option A is wrong because forwarding suspicious attachments to coworkers propagates potential malware and phishing to others instead of reporting it to IT/security.

Option B is wrong because opening .exe attachments directly executes untrusted code, which is exactly how ransomware and trojans are installed. Option E is wrong because disabling antivirus removes a key detection layer and increases the risk that the malicious file is downloaded and run.

Exam trap

The trap is that some options sound like 'due diligence' (forwarding to coworkers, opening to check) but actually increase risk; candidates must distinguish between actions that verify safety through trusted channels versus actions that interact with the payload.

Full explanation →

MCQhard

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

A.The user installed a legitimate browser extension.

B.The user's local firewall is performing a full system scan.

C.The system is performing a routine background update.

D.The host is infected with malware and participating in a botnet.

AnswerD

Sustained slowness plus large volumes of encrypted traffic to an unknown external IP indicate command-and-control beaconing and participation in a botnet, where malware encrypts its channel to evade inspection. This combination distinguishes botnet infection from ordinary hardware or application performance problems.

Why this answer

The combination of a slow workstation, large volumes of encrypted outbound traffic to an unknown external IP, and no legitimate business justification is a textbook indicator of malware command-and-control (C2) beaconing or botnet participation. Malware commonly encrypts its traffic (TLS/custom crypto) to evade deep packet inspection and blends into normal HTTPS flows. The host is likely part of a botnet performing DDoS, spam relay, or crypto-mining tasks, which explains both the CPU/performance degradation and the sustained encrypted egress.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish benign high-bandwidth activity (updates, backups, extensions) from malicious beaconing by focusing on the destination reputation and encryption pattern rather than just the volume of traffic.

How to eliminate wrong answers

Option A is wrong because a legitimate browser extension does not generate sustained large volumes of encrypted traffic to an unknown external IP, nor would it typically cause system-wide slowness. Option B is wrong because a local firewall full system scan is a local, CPU/disk-bound activity that does not produce large outbound encrypted flows to a remote IP. Option C is wrong because routine background updates go to known vendor endpoints (Microsoft, Apple, etc.) over predictable schedules and would not present as an unknown external IP with continuous encrypted traffic.

Full explanation →

MCQeasy

What is the primary function of a FortiGate firewall policy action set to 'Accept'?

A.To redirect the user browser to a captive portal authentication page

B.To permit matching traffic to traverse the FortiGate

C.To encapsulate the packet inside an IPsec VPN tunnel

D.To drop the matching packet silently without logging

AnswerB

An Accept firewall policy action permits matching traffic to pass through the FortiGate, subject to any applied security profiles. This satisfies the stem's requirement to permit matching traffic, as opposed to Deny, which silently drops it, or IPsec, which tunnels it.

Why this answer

In FortiOS, a firewall policy action of 'Accept' (shown as ACCEPT in the GUI) permits matching traffic to pass through the FortiGate after all UTM profiles and security inspections are applied. It is the fundamental allow action, and without it no traffic traverses the device. The other common action is DENY, which drops the traffic.

Exam trap

The trap is conflating the policy action with UTM or authentication behaviors — candidates may pick captive portal or VPN options thinking those are 'actions' when they are actually separate policy settings.

How to eliminate wrong answers

Option A is wrong because captive portal redirection is triggered by authentication settings on the policy (e.g., 'Redirect to Authentication Portal' or an authentication rule), not by the Accept action itself. Option C is wrong because IPsec encapsulation is handled by an IPsec VPN tunnel configuration and a policy that references the tunnel interface — the Accept action alone does not encapsulate traffic. Option D is wrong because 'drop silently without logging' describes the DENY action (or a deny with logging disabled), which is the opposite of Accept.

Full explanation →

Multi-Selecteasy

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Select 3 answers

A.Conducting personal online banking without checking for HTTPS or using a VPN

B.Disabling automatic connection to open Wi-Fi networks on your mobile device

C.Accepting all unknown certificate warnings when browsing on public hotspots

D.Using a trusted corporate Virtual Private Network (VPN) for all internet traffic

E.Avoiding access to highly sensitive corporate accounts unless an encrypted tunnel is active

AnswersB, D, E

Disabling auto-connect stops the device silently joining rogue or spoofed hotspots broadcasting familiar SSIDs. This removes the opportunity for an attacker to intercept traffic without the user's deliberate action, directly satisfying the safe-habit requirement for public Wi-Fi use.

Why this answer

Option B is correct because disabling automatic connection to open Wi-Fi networks prevents a mobile device from silently joining rogue or evil-twin hotspots that spoof a legitimate SSID, thereby removing an attacker's opportunity to intercept traffic. Option D is correct because a trusted corporate VPN establishes an encrypted tunnel (e.g., IPsec or TLS-based) that protects all internet traffic from eavesdropping and man-in-the-middle manipulation on an untrusted hotspot. Option E is correct because restricting access to highly sensitive corporate accounts to situations where an encrypted tunnel is active ensures credentials and session data are never exposed over the open, unencrypted wireless medium.

Option A is not safe because banking without verifying HTTPS or using a VPN exposes credentials and session cookies to interception. Option C is not safe because accepting unknown certificate warnings enables man-in-the-middle attacks by trusting a fraudulent certificate.

Exam trap

The trap is that some options sound convenient or harmless (like banking without checking HTTPS), but any action that skips encryption or certificate validation on public Wi-Fi is unsafe.

Full explanation →

Multi-Selecteasy

Which TWO of the following are core components of the Fortinet Security Fabric architecture? (Choose two.)

Select 2 answers

A.VMware ESXi hypervisor

B.Microsoft Active Directory

C.FortiAnalyzer

D.Cisco Catalyst Switch

E.FortiGate

AnswersC, E

FortiAnalyzer is a core Security Fabric component, collecting, correlating and retaining logs and events from FortiGate and other fabric devices to deliver centralised visibility, analytics and reporting. This satisfies the stem's architecture requirement by providing the telemetry and analysis layer that underpins fabric-wide detection.

Why this answer

FortiGate (E) is correct because it is the foundational security appliance of the Fortinet Security Fabric, providing the firewall, IPS, and other security functions that anchor the fabric's core. FortiAnalyzer (C) is correct because it is a native Fortinet component that collects, correlates, and analyzes logs and events from fabric devices, delivering the visibility and reporting layer of the architecture. VMware ESXi (A) is a third-party hypervisor that can host virtual FortiGate instances but is not itself a Security Fabric component.

Microsoft Active Directory (B) is an external directory service used for authentication integration, not a core fabric element. Cisco Catalyst Switch (D) is third-party networking hardware that can be integrated via Fabric Connectors but is not part of the Fortinet Security Fabric architecture.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish Fortinet-native fabric components from third-party infrastructure that merely integrates with the fabric, causing them to select generic IT products.

Full explanation →

MCQeasy

Which Fortinet product acts as the centralized log management and reporting server that aggregates log data from multiple FortiGate devices across an enterprise network?

A.FortiSandbox

B.FortiAuthenticator

C.FortiAnalyzer

D.FortiWeb

AnswerC

FortiAnalyzer is Fortinet's dedicated centralised log management, analytics and reporting appliance. It aggregates, stores and correlates logs from multiple FortiGate devices, providing enterprise-wide visibility and compliance reporting. This satisfies the stem's requirement for a central server consolidating log data across distributed firewalls, unlike local logging on each device.

Why this answer

FortiAnalyzer is Fortinet's centralized log management, analytics, and reporting appliance (physical or VM) that aggregates logs from FortiGate, FortiMail, FortiWeb, and other Fortinet devices. It provides dashboards, compliance reports, and forensic search across the enterprise.

Exam trap

The trap is confusing FortiAnalyzer (logging/reporting) with FortiManager (configuration management) or with FortiSIEM, since all three play roles in centralized management.

How to eliminate wrong answers

Option A is wrong because FortiSandbox is a threat-detection appliance that detonates suspicious files and URLs in a sandbox, not a log aggregation server. Option B is wrong because FortiAuthenticator provides identity and access management (RADIUS, LDAP proxy, certificate authority, 2FA), not centralized logging. Option D is wrong because FortiWeb is a web application firewall (WAF) that protects web servers, not a log management platform.

Full explanation →

MCQmedium

A network engineer wants to inspect web traffic for malicious downloads and web-based threats passing through a FortiGate device. Where must this inspection profile be applied to take effect?

A.Directly under the physical interface configuration

B.Inside an IPv4 firewall policy matching the traffic

C.Inside the static routing table configuration

D.Under the Global System Settings menu

AnswerB

Security profiles only act on traffic matched by a firewall policy; the profile is attached within that policy, not globally. Applying it inside the IPv4 policy satisfies the stem's requirement that inspection actually take effect on the passing web traffic.

Why this answer

In FortiOS, security profiles such as antivirus, IPS, web filter, and application control are enforced only when referenced inside a firewall policy that matches the traffic. The policy is the enforcement point where inspection profiles are attached and applied to flows traversing the FortiGate. Applying a profile anywhere else (interface, routing, global settings) does not trigger inspection of matching sessions.

Exam trap

FORTINET-NSE123 often tests the misconception that security profiles can be bound to interfaces or global settings, when in FortiOS they only take effect when referenced inside a firewall policy.

How to eliminate wrong answers

Option A is wrong because physical interfaces in FortiOS do not host security profiles; they only define Layer 1/2/3 connectivity and cannot enforce UTM inspection. Option C is wrong because the static routing table only determines next-hop forwarding decisions and has no mechanism to attach or execute inspection profiles. Option D is wrong because Global System Settings control device-wide parameters (admin, logging, HA, etc.) and do not apply UTM profiles to specific traffic flows.

Full explanation →

MCQhard

An administrator is configuring a FortiGate firewall and needs to ensure that packets matching an explicit allow policy are also logged. Where should the administrator enable logging for this specific policy?

A.Inside the static route next-hop configuration

B.Within the physical interface administrative access profile

C.Inside the specific firewall policy rule settings under Log Allowed Traffic

D.Under the global system time zone and NTP settings

AnswerC

Enabling Log Allowed Traffic within the individual firewall policy activates per-policy traffic logging, so only packets matching that explicit allow rule are recorded. This directly satisfies the requirement to log traffic for one specific policy without altering global logging settings or affecting other rules.

Why this answer

Logging for traffic that matches a firewall policy is enabled per-policy inside the policy's settings, specifically by enabling the 'Log Allowed Traffic' option and choosing whether to log All Sessions or only Security Events. This ensures every packet permitted by that explicit allow rule generates a log entry for auditing and troubleshooting. The setting is scoped to the individual policy, so it does not affect other rules on the FortiGate.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse per-policy logging with interface-level or global logging settings, so the trap is selecting an interface or system-level option instead of the policy's own 'Log Allowed Traffic' toggle.

How to eliminate wrong answers

Option A is wrong because static route next-hop configuration only defines the gateway and outgoing interface for routing decisions and has no logging capability. Option B is wrong because the physical interface administrative access profile controls which management protocols (HTTPS, SSH, PING, etc.) are permitted on the interface, not traffic logging. Option D is wrong because global time zone and NTP settings only affect timestamps on log entries, not whether traffic is logged at all.

Full explanation →

MCQeasy

Where can an administrator view real-time bandwidth consumption per interface on the FortiGate dashboard?

A.Network Interfaces widget on the Dashboard

B.FortiView > Interfaces

C.System > Network > Performance

D.Log & Report > Bandwidth Monitor

AnswerA

The Network Interfaces widget polls interface counters directly, displaying live throughput per port without drilling into logs. It satisfies the requirement to view real-time bandwidth consumption per interface on the dashboard itself, rather than historical or aggregate reporting.

Why this answer

The Network Interfaces widget on the FortiGate dashboard displays real-time bandwidth consumption per interface, showing throughput in and out for each physical or logical interface. This widget is specifically designed to provide a quick view of interface utilization directly on the dashboard. It is the correct location for monitoring per-interface bandwidth in real time.

Exam trap

FORTINET-NSE123 often tests the exact location of monitoring features, and candidates may incorrectly choose FortiView or Log & Report for bandwidth monitoring instead of the dashboard widget.

How to eliminate wrong answers

Option B is wrong because FortiView > Interfaces is not a standard FortiGate GUI path; FortiView provides various monitoring views but not a dedicated 'Interfaces' section for real-time bandwidth per interface. Option C is wrong because System > Network > Performance is not a valid menu path in FortiOS; network performance monitoring is typically done via the dashboard widgets or CLI commands. Option D is wrong because Log & Report > Bandwidth Monitor is not a standard feature; bandwidth monitoring is not found under Log & Report, which is for log viewing and configuration.

Full explanation →

Multi-Selectmedium

Which TWO actions should an end-user take to protect their physical workstation security?

Select 2 answers

A.Disable the screensaver to ensure the system is always visible.

B.Store sensitive documents in a locked drawer when not in use.

C.Leave the workstation unlocked during lunch breaks to save time.

D.Write the BIOS password on a post-it note attached to the monitor.

E.Lock the computer screen before walking away from the desk.

AnswersB, E

A locked drawer provides a physical access control barrier, preventing unauthorised individuals from reading, photographing or removing sensitive documents left on a desk. This addresses the physical security requirement by removing exposed hardcopy data from the immediate reach of visitors or intruders.

Why this answer

Option B is correct because physically securing sensitive documents in a locked drawer when they are not in use prevents unauthorized individuals from reading, photographing, or removing confidential information, which is a core element of physical workstation security. Option E is correct because locking the computer screen before walking away (e.g., via Windows+L or Ctrl+Alt+L on Linux) enforces access control at the session level, ensuring that an unattended workstation cannot be used by someone passing by. The unmarked options do not belong: disabling the screensaver (A) leaves the display exposed and removes a basic lock trigger, leaving the workstation unlocked during lunch (C) invites unauthorized access, and writing the BIOS password on a post-it note on the monitor (D) directly defeats the purpose of that password by exposing it to anyone nearby.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse physical security best practices with convenience habits, so options that sound time-saving (leaving unlocked, disabling screensaver) are the traps.

Full explanation →

MCQmedium

An enterprise network architect is designing a site-to-site VPN architecture to connect a branch office to headquarters using FortiGate devices. The branch office relies on a dynamic broadband connection with a frequently changing public IP address. Which VPN configuration approach should be implemented?

A.Implement Virtual Domain (VDOM) links to bridge the branch office directly to headquarters across Layer 2.

B.Configure static IPsec phase 1 parameters specifying the exact public IP address of the branch office on the headquarters FortiGate.

C.Configure an SSL VPN web portal on the branch office FortiGate.

D.Configure a site-to-site IPsec VPN with the headquarters acting as the dial-up server and the branch acting as the dial-up client.

AnswerD

Dial-up IPsec lets the branch initiate the tunnel to headquarters, so its changing public IP is irrelevant; the headquarters acts as responder and authenticates the branch by preshared key or certificate rather than fixed peer address. This satisfies the dynamic broadband constraint that static peer IPs cannot.

Why this answer

When the branch has a dynamic public IP, the headquarters FortiGate cannot be configured with a fixed remote gateway, so the standard design is a dial-up IPsec VPN: HQ acts as the dial-up server (with a static IP and a dial-up tunnel accepting dynamic peers), and the branch acts as the dial-up client that initiates the tunnel. This lets the branch's changing IP be learned dynamically via IKE, and the tunnel re-establishes automatically when the ISP reassigns an address.

Exam trap

FORTINET-NSE123 often tests the misconception that you can statically peer with a dynamic-IP branch — candidates pick the static phase 1 option without realizing the IP will change and break the tunnel.

How to eliminate wrong answers

Option A is wrong because VDOMs are virtual firewall instances on a single FortiGate — they do not bridge Layer 2 across sites and have nothing to do with solving dynamic-IP VPN peering. Option B is wrong because specifying the branch's exact public IP in a static phase 1 will break the moment the ISP changes that address; static peers require stable IPs on both ends. Option C is wrong because an SSL VPN web portal is a remote-user access method, not a site-to-site tunnel, and it would not provide transparent branch-to-HQ LAN connectivity.

Full explanation →

Multi-Selecthard

An administrator is reviewing log storage and management settings on the FortiGate. Which THREE storage options or destinations are supported for logging on a FortiGate? (Choose three)

Select 3 answers

A.Local disk (internal hard drive or flash storage)

B.FortiAnalyzer

C.Bluetooth pairing with a mobile phone

D.Local printer connected via USB

E.Syslog server

AnswersA, B, E

FortiGate appliances with an internal hard drive or flash storage can write logs locally, retaining them on the device itself. This satisfies the scenario's requirement for a supported log storage destination, distinct from external options such as FortiAnalyzer or syslog.

Why this answer

Option A (Local disk, internal hard drive or flash storage) is correct because FortiGates with an internal disk or flash can store logs locally, configured under config log disk setting and viewed via Log & Report. Option B (FortiAnalyzer) is correct because FortiAnalyzer is Fortinet's dedicated centralized log collection, analysis, and reporting appliance, configured on the FortiGate under config log fortianalyzer setting. Option E (Syslog server) is correct because the FortiGate supports sending logs to external syslog servers over UDP/TCP port 514 (or 6514 for reliable/TLS), configured under config log syslogd setting.

Option C (Bluetooth pairing with a mobile phone) is not a supported log destination; Bluetooth is used only for initial FortiExplorer setup, not log storage. Option D (Local printer connected via USB) is not supported, as FortiGate USB ports are used for modem or storage functions, not direct printer logging.

Exam trap

FORTINET-NSE123 often includes absurd options like Bluetooth or USB printer to test if candidates know the actual supported logging destinations, so picking them indicates a lack of familiarity with FortiGate logging capabilities.

Full explanation →

Multi-Selecthard

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

Select 3 answers

A.Storing master credentials in a plain-text document on the desktop for quick reference.

B.Promptly installing operating system and application security patches.

C.Disabling endpoint antivirus agents to maximize system performance during video calls.

D.Verifying software legitimacy before downloading and installing third-party applications.

E.Locking the workstation screen whenever stepping away from the desk.

AnswersB, D, E

Prompt patching closes known vulnerabilities in operating systems and applications before attackers can exploit them, removing a primary endpoint compromise vector. It satisfies the stem's hygiene requirement by keeping corporate endpoints current against published threats.

Why this answer

Option B is correct because promptly installing operating system and application security patches closes known vulnerabilities (e.g., CVEs) that attackers actively exploit, making patch management a core endpoint hygiene practice. Option D is correct because verifying software legitimacy before downloading and installing third-party applications prevents malware, trojans, and supply-chain compromises introduced via untrusted or spoofed sources. Option E is correct because locking the workstation screen whenever stepping away enforces access control, preventing unauthorized physical use of an authenticated session and mitigating insider or walk-by threats.

Option A is not acceptable hygiene because storing master credentials in plain text on the desktop exposes them to any local user or malware, violating secure credential handling. Option C is not acceptable because disabling endpoint antivirus agents removes malware detection and response capabilities, trading essential protection for marginal performance gains.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish genuine hygiene practices from convenience-driven anti-patterns like disabling antivirus or storing plain-text credentials, which are always wrong.

Full explanation →

MCQeasy

Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?

A.Log & Report > Destination Summary

B.Policy & Objects > Destinations

C.Monitor > Routing Table

D.FortiView > Destinations

AnswerD

FortiView > Destinations aggregates live session data by remote IP, ranking the top destinations internal users are currently reaching. This directly satisfies the stem's real-time requirement, unlike log-based reports that lag behind. The Destinations view draws from active traffic logs, so the list refreshes as sessions occur.

Why this answer

FortiView > Destinations is the built-in analytics view that aggregates log data in real time and displays the top destination IP addresses, countries, and domains accessed by internal users. It pulls from forward traffic logs and presents them in a sortable, drill-down dashboard, which is exactly what the question asks for. This is the standard location for monitoring user browsing destinations on a FortiGate.

Exam trap

The trap here is confusing configuration menus (Policy & Objects) with monitoring menus (FortiView), and inventing plausible-sounding but nonexistent log views like 'Destination Summary'.

How to eliminate wrong answers

Option A is wrong because 'Log & Report > Destination Summary' is not a standard FortiOS menu — Log & Report contains Forward Traffic, Local Traffic, and similar log views, not a 'Destination Summary' widget. Option B is wrong because 'Policy & Objects > Destinations' is where address objects are defined for use in policies, not a live traffic view. Option C is wrong because 'Monitor > Routing Table' shows the FIB (routing entries), not user traffic destinations.

Full explanation →

MCQmedium

A company's security team notices a sudden spike in authentication failures for many user accounts within a short window, followed by successful logins from unfamiliar geographic locations using valid credentials. Which attack best matches this pattern?

A.A brute-force attack guessing random passwords for a single account

B.A man-in-the-middle attack intercepting session tokens

C.Credential stuffing using passwords leaked from another breach

D.A password spray using a small set of common passwords across many accounts

AnswerC

Credential stuffing takes username and password pairs stolen from one service and replays them against other services, producing many failed attempts followed by occasional successes. The unfamiliar locations and valid credentials fit this pattern because attackers automate logins from distributed sources, succeeding wherever users reused passwords across sites.

Why this answer

The combination of widespread authentication failures and subsequent successes using valid credentials from unfamiliar locations is characteristic of credential stuffing. Attackers replay breached username-password pairs across services, capitalizing on password reuse. Defenses include multi-factor authentication, breached-password screening, and monitoring for anomalous login patterns—topics covered in NSE 1 foundational security awareness.

Exam trap

The trap here is confusing credential stuffing with password spraying, since both cause many failures, but stuffing relies on previously breached valid pairs while spraying uses a few common guesses.

Full explanation →

Multi-Selectmedium

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

Select 2 answers

A.Explicit proxy authentication realms

B.Administrative access settings (e.g., enabling HTTPS and ping for management)

C.BGP AS number and neighbor peer groups

D.IP address and subnet mask

E.SSL VPN client certificate revocation lists

AnswersB, D

Enabling HTTPS and ping on a physical interface permits management traffic to reach the FortiGate itself, which is required before policies can be administered. Without administrative access configured, the interface carries no management plane, blocking further configuration.

Why this answer

Option D is correct because every physical interface that will carry traffic must have an IP address and subnet mask assigned so the FortiGate can participate in the network and route packets between its interfaces before any firewall policy can meaningfully match traffic. Option B is correct because administrative access settings on an interface (for example enabling HTTPS, SSH, or ping for management) determine how the administrator can reach and manage the FortiGate, which is a basic interface-level configuration typically done during initial setup. Option A is incorrect because explicit proxy authentication realms are an advanced web-proxy feature configured under proxy settings, not a prerequisite interface parameter for firewall policies.

Option C is incorrect because BGP AS numbers and neighbor peer groups are dynamic routing configurations that are optional and only needed in environments using BGP, not part of basic interface setup. Option E is incorrect because SSL VPN client certificate revocation lists relate to VPN authentication and are configured later, not as a basic physical interface setting.

Exam trap

FORTINET-NSE123 often tests the difference between basic interface settings and advanced features like routing or VPN, and candidates may overthink and select routing protocols.

Full explanation →

MCQeasy

An administrator wants to view top talkers by bandwidth usage over the past hour. Which FortiView view should be accessed?

A.FortiView > Sources

B.Policy & Objects > Sources

C.Monitor > Top Talkers

D.Log & Report > Traffic Sources

AnswerA

FortiView > Sources ranks individual source IP addresses by traffic volume, so selecting the past-hour time range shows the top talkers by bandwidth. That directly answers the requirement to view top talkers over the past hour.

Why this answer

FortiView > Sources is the correct location because FortiView aggregates traffic logs and ranks source IP addresses by bandwidth, sessions, or applications. Selecting the Sources view and setting the time range to the past hour gives exactly the 'top talkers by bandwidth' report the administrator wants. It is a built-in analytics view, not a policy or log-report screen.

Exam trap

FORTINET-NSE123 often tests whether candidates look for top-talker data under Monitor or Log & Report instead of FortiView — the trap is assuming a 'Monitor' menu contains all monitoring views when FortiView is a separate top-level module.

How to eliminate wrong answers

Option B is wrong because Policy & Objects > Sources is not a monitoring view at all — it is part of firewall policy configuration where you define source address objects. Option C is wrong because there is no 'Monitor > Top Talkers' menu in FortiOS; top-talker data lives under FortiView, not a Monitor submenu. Option D is wrong because Log & Report > Traffic Sources does not exist as a top-talker analytics view; Log & Report is for raw log access and report generation, not ranked bandwidth analysis.

Full explanation →

Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) (FORTINET-NSE123) — Questions 1–75