Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) FORTINET-NSE123 Questions 151–225 | Page 3/4

151

MCQeasy

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

A.A keystroke injection attack using a compromised HID device.

B.A distributed denial-of-service attack originating from the keyboard firmware.

C.A hardware logic bomb that physically destroys the motherboard upon boot.

D.A physical RAM scraping attack reading volatile memory contents.

AnswerA

The device enumerates as a trusted USB human interface device but firmware emulates keystrokes, injecting commands the operating system treats as legitimate keyboard input. This is keystroke injection via a compromised HID device, executing without user interaction.

Why this answer

A USB keyboard that immediately executes automated command-line instructions is a classic keystroke injection attack, where the device presents itself as a Human Interface Device (HID) and sends pre-programmed keystrokes to the host. This is often achieved with devices like the USB Rubber Ducky, which emulate a keyboard and can execute scripts at high speed. The correct answer is a keystroke injection attack using a compromised HID device.

Exam trap

FORTINET-NSE123 often tests the confusion between keystroke injection and other hardware threats, such as logic bombs or RAM scraping, by describing a device that acts as a keyboard but performs malicious actions.

How to eliminate wrong answers

Option B is wrong because a DDoS attack involves overwhelming a target with traffic from multiple sources, which is not what a keyboard firmware does; a keyboard cannot generate network-level floods. Option C is wrong because a hardware logic bomb typically refers to malicious code that triggers under specific conditions, and it does not physically destroy the motherboard upon boot; physical destruction is not a standard logic bomb behavior. Option D is wrong because RAM scraping involves reading volatile memory to extract sensitive data, not executing command-line instructions; a keyboard cannot directly read RAM contents.

Full explanation →

152

Multi-Selecteasy

Which TWO security profiles can be attached to a FortiGate firewall policy to protect against malware and threats? (Choose two.)

Select 2 answers

A.Static route table

B.IPS sensor

C.DHCP server scope

D.DNS server forwarding list

E.Antivirus profile

AnswersB, E

An IPS sensor inspects traffic against signature and anomaly detection to block exploits and malicious activity, satisfying the stem's requirement for a malware and threat protection profile attachable to a firewall policy. It complements antivirus scanning, which targets files rather than network-level attack patterns.

Why this answer

Option B (IPS sensor) is correct because a FortiGate firewall policy can reference an IPS sensor in its security profiles section, enabling signature-based and anomaly-based inspection of traffic to detect and block intrusions and attacks. Option E (Antivirus profile) is correct because an antivirus profile can likewise be attached to a firewall policy to scan allowed traffic for viruses, worms, and other malware, with actions such as block or monitor. The remaining options are not security profiles: A (Static route table) is a routing construct for forwarding packets, C (DHCP server scope) defines address leases for clients, and D (DNS server forwarding list) configures DNS resolution behavior, none of which are attached to a policy for threat protection.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish security profiles (IPS, AV, Web Filter, App Control) from network configuration objects (routes, DHCP scopes, DNS settings) that cannot be attached to a firewall policy.

Full explanation →

153

Multi-Selecthard

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Select 2 answers

A.Complexity

B.Compliance

C.Concurrency

D.Integrity

E.Confidentiality

AnswersD, E

Integrity guarantees data remains accurate, complete and unaltered except by authorised parties, guarding against unauthorised modification. It is one of the three core CIA tenets, alongside confidentiality and availability, so it satisfies the stem's requirement for a foundational principle.

Why this answer

Option D (Integrity) is correct because the CIA triad's I stands for Integrity, meaning data must remain accurate, complete, and unaltered by unauthorized parties, whether in storage or in transit. Option E (Confidentiality) is correct because the C in the CIA triad stands for Confidentiality, ensuring information is disclosed only to authorized subjects through mechanisms such as encryption, access controls, and authentication. Together with Availability, these two principles form the three core security objectives of the CIA triad.

The unmarked options do not belong: Complexity (A) is a system design characteristic, not a security tenet; Compliance (B) is a regulatory or governance obligation that may support security but is not part of the triad; and Concurrency (C) is a computing property concerning simultaneous operations, unrelated to the CIA triad.

Exam trap

FORTINET-NSE123 often tests the CIA triad by including plausible-sounding but incorrect options like 'Compliance' or 'Complexity' to confuse candidates who might associate security with regulatory adherence or system complexity rather than the core principles of Confidentiality, Integrity, and Availability.

Full explanation →

154

Multi-Selectmedium

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

Select 3 answers

A.Availability, ensuring authorized users have reliable access to information and resources when needed.

B.Compliance, ensuring all regional government tax laws are strictly obeyed.

C.Confidentiality, ensuring sensitive data is accessible only to authorized individuals.

D.Cost-efficiency, ensuring security budgets remain minimal relative to operational revenue.

E.Integrity, ensuring data and systems are accurate and protected from unauthorized modification.

AnswersA, C, E

Availability ensures authorised users can reliably access information and resources whenever required, guarding against denial-of-service and outages. It is one of the three foundational CIA triad principles, alongside confidentiality and integrity, satisfying the stem's requirement.

Why this answer

The CIA Triad consists of Confidentiality, Integrity, and Availability. Option A (Availability) is correct because it ensures authorized users have reliable and timely access to information and resources, typically supported by redundancy, backups, and uptime controls. Option C (Confidentiality) is correct because it restricts sensitive data access to authorized individuals through mechanisms like encryption, access control lists, and authentication.

Option E (Integrity) is correct because it ensures data and systems remain accurate and protected from unauthorized modification via hashing, digital signatures, and version controls. Option B (Compliance) is not a foundational CIA Triad principle; it is a governance and regulatory requirement that may support security but is not one of the three core components. Option D (Cost-efficiency) is a business or financial objective, not a security principle of the CIA Triad.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse business/governance concepts like Compliance or Cost-efficiency with the actual technical pillars of the CIA Triad, so distractors that sound security-adjacent but are really management concerns are the classic trap.

Full explanation →

155

MCQhard

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

A.Network boundary defense

B.Asymmetric encryption key management

C.Controlled application execution (Whitelisting)

D.Principle of fail-secure

AnswerC

Whitelisting enforces controlled application execution by permitting only IT-approved software to run or install on endpoints. Users cannot install unverified applications because the policy allows only pre-approved binaries, directly satisfying the requirement that installations be centrally approved and pushed.

Why this answer

Controlled application execution, also called application whitelisting, enforces that only approved, signed, or centrally pushed applications can run on endpoints. By requiring IT to approve and deploy software, the organization prevents users from installing unverified applications, which is the definition of whitelisting. This principle directly reduces the attack surface from malicious or unauthorized software.

Exam trap

FORTINET-NSE123 often tests the confusion between perimeter controls (network boundary defense) and endpoint execution controls (whitelisting), so candidates who focus on network security miss that the policy is about what runs on the endpoint.

How to eliminate wrong answers

Option A is wrong because network boundary defense focuses on perimeter controls like firewalls and segmentation, not on which applications may execute on an endpoint. Option B is wrong because asymmetric encryption key management concerns public/private key handling for encryption and signing, not application installation control. Option D is wrong because fail-secure describes a system defaulting to a secure state on failure (e.g., locking a door when power is lost), not the policy of approving and pushing software centrally.

Full explanation →

156

MCQmedium

An administrator needs to protect internal servers against known vulnerability exploits and attack signatures traversing the network. Which security feature should be enabled in the firewall policy?

A.IPS sensor

B.Web Filtering profile

C.Application Control profile

D.Data Loss Prevention (DLP) sensor

AnswerA

An IPS sensor inspects traffic against signature and anomaly databases, detecting and blocking known vulnerability exploits and attack signatures. Applied in the firewall policy, it satisfies the administrator's requirement to protect internal servers from known exploits traversing the network.

Why this answer

An IPS sensor is the FortiGate feature that detects and blocks known vulnerability exploits and attack signatures. It inspects traffic against a signature database and can take action (block, monitor, reset) based on the matched signature, making it the correct choice for protecting internal servers from exploits.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse IPS (exploit/vulnerability signatures) with Application Control (application identification) or Web Filtering (URL categorization), especially when the scenario mentions 'attack signatures'.

How to eliminate wrong answers

Option B is wrong because Web Filtering profiles categorize and control web access (blocking categories, safe search), not exploit signature detection. Option C is wrong because Application Control identifies and controls applications (e.g., blocking BitTorrent) based on application signatures, not vulnerability exploits. Option D is wrong because DLP sensors detect and prevent leakage of sensitive data patterns (credit cards, SSNs) in traffic, not exploitation attempts against servers.

Full explanation →

157

MCQmedium

An administrator wants to prevent users from uploading confidential company documents to external cloud storage websites. Which Fortinet security profile feature inspects outbound traffic for specific file types or sensitive keywords?

A.Intrusion Prevention System (IPS) sensor

B.Antivirus profile

C.Web filtering profile

D.Data Loss Prevention (DLP) sensor

AnswerD

The DLP sensor inspects outbound traffic for file types, patterns and sensitive keywords, blocking or logging uploads of confidential documents. This directly satisfies the requirement to stop users sending company data to external cloud storage sites.

Why this answer

The Data Loss Prevention (DLP) sensor in FortiOS is specifically designed to inspect outbound traffic for sensitive data patterns, including file types (e.g., .docx, .pdf) and keywords (e.g., 'confidential'). It can be applied to firewall policies to block or log attempts to upload such data to external destinations. Unlike other profiles, DLP focuses on data exfiltration rather than malware or URL categorization.

Therefore, D is the correct answer.

Exam trap

The trap here is confusing DLP with Antivirus or Web Filtering, as all can inspect traffic, but only DLP is purpose-built for detecting and blocking sensitive data based on content and file types.

How to eliminate wrong answers

Option A is wrong because IPS sensors detect and block network intrusions and exploits based on signatures, not sensitive file content or keywords. Option B is wrong because Antivirus profiles scan for malware and viruses in files, not for confidential data patterns. Option C is wrong because Web filtering profiles categorize and control access to websites based on URL categories, but do not inspect file contents or keywords for data loss prevention.

Full explanation →

158

MCQeasy

Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?

A.Log & Report > System Events

B.Security Fabric > Audit

C.System > Advanced

D.Monitor > Routing Monitor

AnswerA

System Events aggregates FortiGate's administrative and system-level messages, including alerts, warnings and admin activity. This dashboard sits under Log & Report, giving administrators a single view of device health and configuration events rather than traffic or security logs.

Why this answer

System event logs, including system alerts, warning-level messages, and administrative event logs, are viewed under Log & Report > System Events in the FortiGate GUI. This section aggregates logs from the 'event' log category, which covers admin logins, configuration changes, HA events, and system warnings. The other menus do not display these event logs.

Exam trap

FORTINET-NSE123 often tests the distinction between event logs and traffic logs, and candidates may incorrectly choose Security Fabric > Audit or Monitor menus for system event viewing.

How to eliminate wrong answers

Option B is wrong because Security Fabric > Audit shows Fabric-related audit information, not the general system event log. Option C is wrong because System > Advanced contains system settings, not log viewing. Option D is wrong because Monitor > Routing Monitor displays routing table and protocol status, not event logs.

Full explanation →

159

Multi-Selectmedium

Which TWO settings are required when configuring a basic static route on a FortiGate? (Choose two.)

Select 2 answers

A.IPsec Phase 1 Pre-Shared Key

B.Gateway IP address (next-hop)

C.Destination IP address and netmask

D.Antivirus inspection profile

E.DHCP server IP pool range

AnswersB, C

A static route needs a next-hop to know where to forward matching traffic; without it, the FortiGate cannot resolve the path. Specifying the gateway IP address satisfies the stem's requirement for a basic static route, since destination and gateway are the two mandatory parameters, with interface and distance optional.

Why this answer

When configuring a basic static route on a FortiGate, the two required settings are the destination IP address and netmask (Option C) and the gateway IP address or next-hop (Option B). Option C is correct because a static route must specify the destination network (e.g., 10.0.0.0/24) that the route is intended to reach, defining the match criteria for traffic. Option B is correct because the FortiGate needs the next-hop gateway IP address (e.g., 192.168.1.1) to know where to forward matching packets, typically the upstream router's interface on the connected subnet.

The other options do not belong: an IPsec Phase 1 Pre-Shared Key (A) is only used when building a VPN tunnel, not a static route; an Antivirus inspection profile (D) is a security profile applied to firewall policies, not routing; and a DHCP server IP pool range (E) is unrelated to routing and is configured under the DHCP server settings.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish routing parameters (destination, gateway) from unrelated configuration items like VPN keys, security profiles, or DHCP pools — distractors are drawn from other configuration contexts.

Full explanation →

160

MCQeasy

An administrator wants to view active VPN tunnels and connected remote users on the dashboard. Which widget is designed for this purpose?

A.IPsec & SSL VPN widget

B.Remote Access Monitor

C.User Monitor

D.Network Interfaces

AnswerA

The IPsec & SSL VPN widget reports live tunnel status and currently connected remote users directly on the dashboard, satisfying the requirement to monitor active VPN sessions. Unlike traffic or log widgets, it aggregates both IPsec and SSL VPN connections, giving the administrator the real-time visibility the scenario demands.

Why this answer

The IPsec & SSL VPN widget on the FortiGate dashboard is specifically designed to display active VPN tunnels and connected remote users. It shows both IPsec and SSL VPN connections, including user names, assigned IPs, and tunnel status. This directly matches the administrator's requirement.

Exam trap

FORTINET-NSE123 often tests dashboard widget functions — candidates may confuse 'User Monitor' with VPN monitoring, but the trap is that User Monitor shows all authenticated users, not specifically VPN tunnels.

How to eliminate wrong answers

Option B is wrong because 'Remote Access Monitor' is not a standard FortiGate dashboard widget; remote access monitoring is typically done via the IPsec & SSL VPN widget or log views. Option C is wrong because the User Monitor widget displays authenticated users and their activity but does not specifically show VPN tunnel status or remote user connections. Option D is wrong because Network Interfaces shows interface status and statistics, not VPN tunnel or remote user details.

Full explanation →

161

Multi-Selecteasy

Which TWO logging destinations can receive log data from a FortiGate firewall? (Choose two.)

Select 2 answers

A.FortiAuthenticator token server

B.External Syslog server

C.FortiClient EMS endpoint agent

D.Microsoft Active Directory domain controller

E.FortiAnalyzer

AnswersB, E

FortiGate natively forwards traffic, event and security logs to a remote syslog server over UDP, TCP or TLS on port 514 or 6514, satisfying the requirement for an external logging destination. This offloads storage from local disk and integrates with third-party SIEM platforms for centralised retention and correlation.

Why this answer

Option B (External Syslog server) is correct because FortiGate supports configuring remote logging to external syslog servers under Log & Report > Log Settings, sending logs in syslog format over UDP/TCP port 514 (or TLS 6514). Option E (FortiAnalyzer) is correct because FortiAnalyzer is Fortinet's dedicated log collection, analysis, and reporting appliance, and FortiGate natively supports sending logs to it via the FortiAnalyzer/FortiManager log protocol (often over port 514 or 443 with OFTP). Option A is incorrect because FortiAuthenticator is an authentication/token/CA server, not a log destination for FortiGate logs.

Option C is incorrect because FortiClient EMS manages endpoints and receives telemetry from FortiClient agents, not FortiGate log data. Option D is incorrect because a Microsoft Active Directory domain controller handles authentication and directory services, not syslog or FortiGate log ingestion.

Exam trap

The trap is choosing other Fortinet products (FortiAuthenticator, FortiClient EMS) just because they are 'Fortinet' — candidates assume any Fortinet appliance can receive logs, but only FortiAnalyzer and Syslog are valid FortiGate log destinations.

Full explanation →

162

MCQeasy

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

A.Ransomware infection

B.DDoS attack

C.Man-in-the-middle interception

D.SQL injection

AnswerA

Mass file-extension renaming plus a ransom note is the defining signature of ransomware: encryption payloads rename or append extensions, then drop instructions demanding payment. The sluggish workstation reflects heavy disk and CPU consumption during encryption, confirming ransomware rather than a worm, trojan or simple disk failure.

Why this answer

The symptoms — sluggish workstation performance, file extensions changed to an unfamiliar format, and a ransom text file — are the textbook signature of a ransomware infection. Ransomware encrypts user files (often renaming them with a new extension) and drops a ransom note demanding payment for the decryption key. The combination of file-extension mutation plus a ransom note is definitive.

Exam trap

FORTINET-NSE123 often tests symptom-to-attack mapping — candidates may confuse ransomware with a generic malware infection or DDoS, but the ransom note plus renamed extensions is the unique fingerprint that must be recognized.

How to eliminate wrong answers

Option B is wrong because a DDoS attack floods a service with traffic to make it unavailable, producing network/service outages rather than local file encryption and ransom notes. Option C is wrong because a man-in-the-middle attack silently intercepts or alters communications between two parties and does not rename or encrypt local files. Option D is wrong because SQL injection targets backend databases through vulnerable web input fields, not endpoint files on an employee workstation.

Full explanation →

163

MCQmedium

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

A.The risk of unauthorized physical entry to data centers

B.The risk of operational downtime caused by faulty updates

C.The risk of zero-day hardware manufacturing defects

D.The risk of social engineering attacks against helpdesk staff

AnswerB

Testing patches before production deployment directly mitigates the risk of faulty updates causing operational downtime, satisfying the policy's requirement for pre-deployment evaluation. Unlike security risks such as unpatched vulnerabilities, this control targets availability: a defective patch can crash systems or disrupt services, and staging it first confines that blast radius to non-production endpoints.

Why this answer

Testing patches in a staging environment before production deployment is a change-management control designed to catch defective or incompatible updates before they can cause outages. History is full of patches that broke production — a faulty update can crash services, corrupt data, or render systems unbootable — so the test environment acts as a canary. The policy's primary risk mitigation is therefore operational downtime caused by faulty updates.

Exam trap

The trap is over-thinking the question and picking a security-control answer (like physical access or social engineering) when the policy is explicitly about pre-deployment evaluation, which maps to change management and availability risk.

How to eliminate wrong answers

Option A is wrong because physical data-center entry is a facility security control addressed by badge access, biometrics, and mantraps, not by patch testing. Option C is wrong because zero-day hardware manufacturing defects are a supply-chain and hardware-assurance concern, not something a software patch test environment can detect. Option D is wrong because social engineering against helpdesk staff is mitigated by awareness training, verification procedures, and call-back policies, not by patch staging.

Full explanation →

164

MCQeasy

What is the primary function of a FortiGate firewall policy destination setting?

A.To determine the NTP time server synchronization interval

B.To configure the physical port speed and duplex mode

C.To specify the target IP addresses or subnets that traffic is allowed or denied to reach

D.To set the administrator GUI login timeout threshold

AnswerC

The destination setting identifies the target IP addresses or subnets that traffic is permitted or denied to reach, defining where the policy's matched traffic may go. This is the field that specifies the receiving endpoint of the connection.

Why this answer

In a FortiGate firewall policy, the destination setting defines the target IP addresses, subnets, or address objects that the policy matches on the receiving side of the traffic. It works together with source, service, and schedule to determine whether traffic is permitted or denied toward those destinations. This is the core function of the destination field in policy matching.

Exam trap

The trap here is confusing policy matching fields (source/destination/service) with system-level settings (NTP, interface speed, GUI timeout), so candidates who don't know the policy schema pick an unrelated administrative setting.

How to eliminate wrong answers

Option A is wrong because NTP synchronization is configured under system time settings (config system ntp), not in a firewall policy destination. Option B is wrong because physical port speed and duplex are set on the interface configuration (config system interface), not in a policy. Option D is wrong because the admin GUI login timeout is configured under system global or admin settings, unrelated to policy destination matching.

Full explanation →

165

MCQhard

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

A.diagnose ip route lookup [dest-IP]

B.show routing-table match [dest-IP]

C.get router route-check [dest-IP]

D.execute route-test [dest-IP]

AnswerA

The diagnose ip route lookup command simulates the routing decision for a given destination IP, showing the matched route, outgoing interface and gateway without sending traffic. This directly satisfies the requirement to verify which route the FortiGate would select.

Why this answer

The FortiGate CLI command 'diagnose ip route lookup' (or 'diagnose ip route lookup [dest-IP]') simulates a routing lookup for a specified destination IP and shows which route would be selected, including the outgoing interface and gateway. This is the standard tool for verifying route selection without generating actual traffic.

Exam trap

FORTINET-NSE123 often tests the confusion between 'diagnose ip route lookup' (simulation) and 'get router info routing-table' (display), tricking candidates into choosing a display command when a lookup simulation is required.

How to eliminate wrong answers

Option B is wrong because 'show routing-table match' is not a valid FortiGate command; the routing table is displayed with 'get router info routing-table all' or 'show router static'. Option C is wrong because 'get router route-check' does not exist; 'get router info' is used for routing protocol status, not lookup simulation. Option D is wrong because 'execute route-test' is not a FortiGate command; 'execute' commands are for system operations like ping, traceroute, and reboot, not route lookup.

Full explanation →

166

MCQeasy

An administrator wants to see a real-time list of top applications generating traffic on the network. Which FortiView tab should be opened?

A.Monitor > Application Control

B.FortiView > Applications

C.Log & Report > Application Logs

D.Policy & Objects > Applications

AnswerB

FortiView > Applications provides a real-time, drill-down view of traffic grouped by application, refreshed live as sessions are logged. Opening this tab satisfies the requirement for a real-time list of top applications generating traffic on the network.

Why this answer

FortiView > Applications is the dedicated real-time analytics view that aggregates live traffic by application, showing top applications, bandwidth consumed, sessions, and source/destination breakdowns. It pulls from the session and UTM logs in real time, so it directly answers 'which applications are generating traffic right now.' This is the correct location for real-time application visibility on a FortiGate.

Exam trap

FORTINET-NSE123 often tests the distinction between real-time monitoring (FortiView) and historical log review (Log & Report), so candidates who pick 'Application Logs' confuse live analytics with stored logs.

How to eliminate wrong answers

Option A is wrong because Monitor > Application Control is not a FortiView tab and does not provide the real-time top-applications dashboard; application control monitoring lives under FortiView or Log & Report. Option C is wrong because Log & Report > Application Logs shows historical log entries, not a real-time aggregated top-applications view. Option D is wrong because Policy & Objects > Applications is where application signatures/objects are defined for use in policies, not where live traffic is monitored.

Full explanation →

167

MCQhard

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

A.Confidentiality across all states of data (transit and rest)

B.Availability and Non-repudiation

C.Authenticity and Authorization

D.Confidentiality and Integrity

AnswerA

Encrypting data in transit (TLS over the internet) and at rest (server-side encryption) prevents unauthorised disclosure in both states, satisfying confidentiality. The mandate targets only secrecy, not integrity or availability, so confidentiality is the pillar primarily met.

Why this answer

Encrypting data in transit (e.g., TLS during upload) and at rest (e.g., AES-256 on storage) directly satisfies the Confidentiality pillar of the CIA triad by ensuring unauthorized parties cannot read the data in either state. The measure does not address Integrity (tamper detection), Availability (uptime/access), or Non-repudiation (proof of origin), so Confidentiality is the primary pillar satisfied.

Exam trap

FORTINET-NSE123 often tests whether candidates can map a control to the correct CIA pillar — encryption is almost always Confidentiality, but candidates sometimes pick Integrity because they conflate encryption with tamper-proofing.

How to eliminate wrong answers

Option B is wrong because Availability concerns uptime and access, and Non-repudiation concerns proof of action — encryption does not provide either. Option C is wrong because Authenticity (verifying identity) and Authorization (granting permissions) are access-control concepts, not encryption outcomes, though encryption may support them indirectly. Option D is wrong because while encryption can support Integrity via authenticated modes (e.g., AES-GCM), the question specifies encryption for confidentiality in transit and at rest, not integrity verification — and the best answer is the one that captures both states of data.

Full explanation →

168

MCQmedium

An administrator needs to monitor bandwidth consumption across different applications on the FortiGate. Which feature allows the administrator to view real-time traffic bandwidth by application and enforce traffic shaping guarantees?

A.Static routing administrative distance tables

B.Traffic Shaping and FortiView Application monitors

C.Antivirus quarantine logs

D.High availability cluster heartbeat monitors

AnswerB

Traffic shaping enforces bandwidth guarantees per application through the FortiGate's shaping policies, while FortiView Application monitors provide real-time visibility into consumption by application category. Together they satisfy both requirements in the stem: monitoring live bandwidth per application and enforcing guaranteed rates, which standalone logging or flow export cannot achieve.

Why this answer

Traffic Shaping on a FortiGate allows the administrator to define guaranteed and maximum bandwidth limits per application or traffic type, while FortiView Application monitors provide real-time visibility into bandwidth consumption broken down by application. Together, these features satisfy both the monitoring and enforcement requirements. Traffic shaping policies can be applied via firewall policies or shaping profiles, and FortiView aggregates NetFlow-like data from the session table to display per-application bandwidth.

This combination is the standard Fortinet solution for application-aware bandwidth management.

Exam trap

FORTINET-NSE123 often tests the confusion between monitoring features (like FortiView) and enforcement features (like traffic shaping), leading candidates to select a single tool when the question requires both capabilities.

How to eliminate wrong answers

Option A is wrong because static routing administrative distance tables control path selection for routing, not bandwidth monitoring or traffic shaping. Option C is wrong because antivirus quarantine logs record files isolated by AV scanning, not bandwidth usage or shaping enforcement. Option D is wrong because HA cluster heartbeat monitors track device health and failover, not application bandwidth or traffic shaping.

Full explanation →

169

MCQeasy

What is the primary purpose of defining zones (interface zones) in FortiOS firewall configurations?

A.To enforce static routing protocols across distinct subnets

B.To group multiple interfaces into a single entity for simplified firewall policy management

C.To increase the physical bandwidth capacity of aggregated switch ports

D.To assign dynamic IP addresses to connected client workstations

AnswerB

Zones group multiple interfaces into one logical entity, so firewall policies reference the zone rather than each interface individually. This satisfies the stem's purpose by simplifying policy management and reducing rule duplication when interfaces share identical security requirements.

Why this answer

In FortiOS, a zone is a logical grouping of one or more physical or virtual interfaces that can be referenced as a single object in firewall policies. This lets an administrator write one policy for 'LAN-to-WAN' instead of duplicating rules for every interface, dramatically simplifying policy management and reducing rule sprawl. Zones are a policy-abstraction feature, not a routing, bandwidth, or DHCP mechanism.

Exam trap

The trap is confusing zones with interface aggregation for bandwidth or with routing/DHCP functions, because all involve 'grouping interfaces' but only zones provide policy-simplification abstraction.

How to eliminate wrong answers

Option A is wrong because static routing is configured in the router's routing table and is independent of zone definitions — zones do not enforce or propagate routing protocols. Option C is wrong because increasing physical bandwidth is achieved through link aggregation (LACP/802.3ad) or interface bonding, not through zone grouping. Option D is wrong because dynamic IP assignment is the function of a DHCP server configured on an interface, not of the zone abstraction.

Full explanation →

170

MCQeasy

A security analyst is reviewing logs from a FortiGate and notices numerous entries indicating that traffic from the internal network to a specific external IP is being blocked by a firewall policy. The analyst wants to quickly identify which firewall policy is responsible for the block. Which FortiGate log field should the analyst examine to find the policy ID that matched the traffic?

A.srcintf

B.policyid

C.action

D.dstip

AnswerB

The policyid field in FortiGate traffic logs explicitly shows the ID number of the firewall policy that matched the session. By examining this field, the analyst can directly identify the policy responsible for the block. This is a standard field in both forward and local traffic logs and is essential for troubleshooting policy-related issues.

Why this answer

In FortiGate traffic logs, the policyid field contains the unique identifier of the firewall policy that matched the session. This allows administrators to quickly locate the policy in the configuration and understand why the traffic was blocked. Other fields like source interface, destination IP, and action provide context but do not directly identify the policy.

Exam trap

The trap here is confusing the action field (which shows allow/deny) with the policyid field that actually identifies the policy; the action alone does not tell you which policy was matched.

Full explanation →

171

MCQmedium

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

A.Separation of Duties

B.Security by Obscurity

C.Defense in Depth

D.Principle of Least Privilege

AnswerD

Least privilege grants each account only the minimum access needed for its job function, directly matching the stem's restriction to required data and applications. It limits blast radius if credentials are compromised, unlike role-based or discretionary models that grant broader standing access.

Why this answer

The Principle of Least Privilege (PoLP) mandates that users are granted only the minimum access rights necessary to perform their job functions—nothing more. Restricting access to specific data and applications directly implements this principle by limiting the blast radius of compromised accounts and reducing insider threat risk. Fortinet products like FortiGate and FortiManager enforce PoLP through role-based access control (RBAC) profiles and administrative profiles that define granular permissions.

Exam trap

FORTINET-NSE123 often tests the confusion between Principle of Least Privilege and Separation of Duties, where candidates mistakenly choose Separation of Duties because both involve restricting access, but Separation of Duties focuses on dividing tasks to prevent conflict of interest, not on limiting access to job-specific resources.

How to eliminate wrong answers

Option A is wrong because Separation of Duties divides critical tasks among multiple users to prevent fraud (e.g., one admin creates a firewall policy, another approves it), not about limiting access to job-specific resources. Option B is wrong because Security by Obscurity relies on hiding system details (e.g., non-standard ports, secret URLs) as a primary defense, which is not a true security principle and does not restrict access based on job function. Option C is wrong because Defense in Depth uses multiple layered controls (firewalls, IPS, endpoint protection) to protect assets, but it does not define the scope of a user's access rights.

Full explanation →

172

Multi-Selecthard

When configuring firewall policies on a FortiGate device, an administrator must define matching criteria and actions. Which THREE elements are mandatory components of a standard IPv4 firewall policy in FortiOS? (Choose three.)

Select 3 answers

A.An active FortiSandbox cloud subscription registration key.

B.Source Interface and Destination Interface

C.A mandatory Web Filtering security profile attached directly to the policy.

D.Source Address and Destination Address objects

E.Service objects (protocols and port numbers)

AnswersB, D, E

Every FortiOS IPv4 policy requires ingress and egress interfaces, since the firewall must know which zone or port traffic enters and leaves through. Omitting either prevents the policy from being saved, making these mandatory matching components.

Why this answer

In FortiOS, a standard IPv4 firewall policy must specify the traffic's ingress and egress points, so option B (Source Interface and Destination Interface) is required to tell the FortiGate which interfaces the policy applies to. Option D (Source Address and Destination Address objects) is also mandatory because the policy must match traffic based on the originating and receiving IP addresses or address groups. Option E (Service objects, i.e., protocols and port numbers) is required as well, since FortiOS needs to know which TCP/UDP/ICMP services the policy permits or denies.

Option A is not a policy component; FortiSandbox cloud registration is a separate licensing/subscription setting, not a per-policy matching criterion. Option C is incorrect because security profiles such as Web Filtering are optional and can be attached to a policy, but they are not mandatory for the policy to exist or function.

Exam trap

The trap is that candidates assume UTM profiles (Web Filter, AV, IPS) or subscription features are mandatory policy components, when in fact they are optional add-ons to the core five match elements.

Full explanation →

173

Multi-Selecthard

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Select 2 answers

A.Forward the suspicious file to all external clients as a warning alert.

B.Delete all system logs and temporary files to clear up disk space for the virus scanner.

C.Download and execute unverified registry cleaner utilities from pop-up advertisements.

D.Notify the internal IT security or incident response team without delay.

E.Immediately disconnect the laptop from both wired and wireless network connections.

AnswersD, E

Prompt reporting lets the incident response team isolate the endpoint and contain lateral movement before the malware spreads. This satisfies the stem's "immediately" constraint, since early notification triggers the organisation's detection and containment workflow while forensic evidence on the laptop remains intact.

Why this answer

Option D is correct because promptly notifying the internal IT security or incident response team ensures trained personnel can begin containment, triage, and forensic investigation, which is a core step of any incident response process. Option E is correct because immediately disconnecting the laptop from both wired (Ethernet) and wireless (Wi-Fi) network connections isolates the potentially infected host, preventing malware from spreading laterally, exfiltrating data, or communicating with command-and-control servers. Option A is not appropriate because forwarding a suspicious file to external clients could propagate malware and breach confidentiality, rather than containing the incident.

Option B is wrong because deleting system logs and temporary files destroys forensic evidence needed for investigation and may violate retention policies. Option C is wrong because downloading and executing unverified registry cleaners from pop-up advertisements is a common malware delivery vector and would likely worsen the compromise.

Exam trap

FORTINET-NSE123 often tests incident response priorities, so candidates may choose 'delete logs' or 'scan first' options that sound helpful but actually destroy evidence or delay containment.

Full explanation →

174

MCQhard

An administrator needs to test reachability and path MTU to a destination IP using ICMP packets with the Don't Fragment (DF) bit set. Which CLI command allows this?

A.set ping df-bit enable

B.execute ping-options df-bit yes followed by execute ping [dest-IP]

C.ping -M do [dest-IP]

D.diagnose ping df [dest-IP]

AnswerB

Setting df-bit yes configures ping-options so subsequent execute ping packets carry the Don't Fragment flag, forcing path MTU discovery and revealing where fragmentation would occur. This satisfies the requirement to test reachability and path MTU using ICMP with DF set.

Why this answer

FortiOS uses the two-step 'execute ping-options' then 'execute ping' pattern. Setting 'execute ping-options df-bit yes' enables the Don't Fragment bit on subsequent pings, and 'execute ping <dest-IP>' sends them. This allows path MTU discovery by observing whether large packets are dropped with an ICMP 'fragmentation needed' response.

Exam trap

FORTINET-NSE123 often tests CLI syntax familiarity — candidates confuse Linux 'ping -M do' or generic 'set' syntax with FortiOS's 'execute ping-options' two-step pattern.

How to eliminate wrong answers

Option A is wrong because 'set ping df-bit enable' is not valid FortiOS syntax — 'set' is used in config context, not for ping options. Option C is wrong because 'ping -M do' is Linux/BSD syntax, not FortiOS. Option D is wrong because 'diagnose ping df' is not a real FortiOS command; diagnose commands do not include a ping subcommand with df.

Full explanation →

175

Multi-Selecthard

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

Select 2 answers

A.Relying entirely on a single powerful perimeter firewall with no internal security controls

B.Implementing network segmentation to restrict lateral movement between departments

C.Requiring multi-factor authentication for all remote and privileged user access

D.Eliminating all system logs and monitoring to maximize user privacy

E.Disabling all endpoint antivirus solutions to improve computer processing speed

AnswersB, C

Network segmentation restricts lateral movement between departments, satisfying the stem's requirement for an effective Defence in Depth measure. By dividing the network into zones with enforced inter-zone controls, a compromised host cannot freely reach other segments, limiting breach propagation and supporting least-privilege access.

Why this answer

Option B is correct because network segmentation (e.g., VLANs, subnets, or microsegmentation) limits lateral movement so that a compromised host in one department cannot freely reach systems in another, adding an internal control layer beyond the perimeter. Option C is correct because requiring multi-factor authentication for all remote and privileged access enforces an additional identity-verification factor (something you know plus something you have/are), directly mitigating credential theft and unauthorized privileged use. These measures align with Defense in Depth by layering preventive controls across network and identity domains rather than trusting a single boundary.

Option A is wrong because relying solely on one perimeter firewall creates a single point of failure and ignores insider threats and internal lateral movement. Option D is wrong because deleting logs and monitoring destroys detection, auditing, and incident-response capabilities. Option E is wrong because disabling endpoint antivirus removes a critical host-level control and exposes systems to malware.

Exam trap

FORTINET-NSE123 often tests the misconception that a single strong perimeter control is sufficient, when Defense in Depth requires multiple overlapping layers including segmentation and MFA.

Full explanation →

176

MCQmedium

An administrator needs to set up log forwarding from the FortiGate to a remote Syslog server. Which menu path in the web-based manager is used to configure remote logging?

A.Log & Report > Log Settings

B.System > Syslog Server

C.Policy & Objects > Logging

D.Security Fabric > Log Forwarding

AnswerA

Log & Report > Log Settings holds the remote logging configuration, where you enable Syslog and specify the server address, port, facility and severity threshold. This is the specific menu path that satisfies the requirement to forward FortiGate logs to a remote Syslog server.

Why this answer

Remote Syslog forwarding on FortiGate is configured under Log & Report > Log Settings, where the administrator enables 'Send logs to Syslog' and specifies the Syslog server IP, port, and facility. This is the standard GUI path for configuring remote logging destinations including Syslog, FortiAnalyzer, and FortiManager.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact GUI menu path for log forwarding — many assume it lives under System or Security Fabric, but it is consistently under Log & Report > Log Settings.

How to eliminate wrong answers

Option B is wrong because there is no System > Syslog Server menu in the FortiGate GUI — Syslog configuration is not under System. Option C is wrong because Policy & Objects > Logging does not exist as a menu; logging is configured per-policy but the remote destination is set under Log & Report. Option D is wrong because Security Fabric > Log Forwarding is not the menu used for Syslog server configuration; Security Fabric settings deal with fabric connectors, not Syslog destinations.

Full explanation →

177

MCQmedium

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

A.USB baiting exploiting human curiosity and physical media.

B.Man-in-the-middle interception of wireless frames.

C.Cross-site scripting executed within a browser session.

D.Watering hole attack targeting web browsing habits.

AnswerA

Dropping a labelled drive exploits curiosity to bypass technical controls, since the user voluntarily connects the device. Once plugged in, malicious firmware or autorun payloads execute, making this a physical-media social-engineering vector rather than a network-based intrusion.

Why this answer

The scenario describes a USB flash drive deliberately left in a parking lot with an enticing label ('Q4 Salary Adjustments') to lure a curious employee into plugging it into a corporate laptop. This is the textbook definition of USB baiting — a physical social-engineering attack that exploits human curiosity and removable media to deliver malware or gain access.

Exam trap

FORTINET-NSE123 often tests the confusion between physical social-engineering vectors (USB baiting) and network-based attacks (MITM, XSS, watering hole), so candidates must match the scenario's physical-media detail to the correct vector.

How to eliminate wrong answers

Option B is wrong because man-in-the-middle interception involves an attacker positioning between two communicating parties (e.g., ARP spoofing, rogue Wi-Fi AP) to capture or alter traffic; no wireless interception occurs in this scenario. Option C is wrong because cross-site scripting is a web application vulnerability where malicious scripts execute in a victim's browser session; it has nothing to do with a physical USB drive. Option D is wrong because a watering hole attack compromises a website frequently visited by a target group, infecting visitors via drive-by download; it does not involve physical media or parking-lot drops.

Full explanation →

178

MCQmedium

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

A.Inadequate identity and access lifecycle offboarding procedures

B.Failure to implement adequate endpoint antivirus software

C.Absence of hardware token multi-factor authentication

D.Lack of network segmentation between departments

AnswerA

Deprovisioning accounts promptly on termination is the core identity lifecycle control. Leaving credentials active weeks after departure means the offboarding process failed to revoke access, directly enabling the former employee's unauthorised logins to collaboration tools.

Why this answer

The exposure stems from a failure in identity and access lifecycle management — specifically, offboarding procedures that should have disabled or deleted the former employee's credentials immediately upon departure. Active credentials weeks after termination indicate the offboarding process was not executed or not enforced.

Exam trap

FORTINET-NSE123 often tests whether candidates pick a technical control (MFA, antivirus, segmentation) when the scenario clearly describes a process/governance failure (offboarding), which is the actual root cause.

How to eliminate wrong answers

Option B is wrong because endpoint antivirus protects against malware, not against unauthorized access using valid credentials; antivirus would not prevent a former employee from logging in. Option C is wrong because MFA would add a layer of protection, but the primary failure is that the account was never disabled — MFA absence is a secondary control gap, not the root cause of stale credentials. Option D is wrong because network segmentation limits lateral movement but does not address the fact that a terminated user still has valid credentials to collaboration tools; segmentation is irrelevant to this identity lifecycle failure.

Full explanation →

179

MCQeasy

An administrator wants to check the operational status of FortiGate HA clustering. Which dashboard widget provides an overview of HA member health and role status?

A.Security Fabric Status

B.System Topology

C.Cluster Monitor

D.High Availability widget

AnswerD

The High Availability widget on the dashboard lists each cluster member with its role (primary or subordinate) and health indicators, so operational status is visible at a glance. This satisfies the requirement for an overview of HA member health and role.

Why this answer

The High Availability widget on the FortiGate dashboard is the dedicated pane that shows HA cluster membership, each member's role (primary/secondary), and health indicators such as heartbeat status and uptime. It gives administrators an at-a-glance view of cluster health without navigating to system HA status pages.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse the HA-specific dashboard widget with broader fabric or topology widgets that also appear on the FortiGate dashboard.

How to eliminate wrong answers

Option A is wrong because Security Fabric Status shows fabric topology and device connectivity, not HA cluster member roles. Option B is wrong because System Topology is a physical/logical topology map, not an HA health monitor. Option C is wrong because 'Cluster Monitor' is not the FortiOS dashboard widget name for HA — the correct widget is labeled High Availability.

Full explanation →

180

MCQmedium

A hospital's security team deploys network segmentation so that the radiology imaging VLAN cannot directly reach the billing VLAN. A vendor's maintenance laptop connected to the imaging VLAN is later found to be infected with ransomware. Which security benefit of segmentation does this design primarily provide in this situation?

A.It encrypts all traffic between the imaging and billing VLANs.

B.It automatically removes ransomware from the vendor laptop.

C.It reduces the lateral movement path available to the ransomware.

D.It authenticates the vendor laptop before granting network access.

AnswerC

Segmentation limits which systems can communicate, so an infected device on the imaging VLAN cannot freely reach billing hosts. This constrains lateral movement, the phase where malware spreads from an initial foothold to other systems. In Fortinet terms, internal segmentation firewalls and VLAN separation enforce policy between zones, containing the blast radius even when endpoint protection fails on one device.

Why this answer

By preventing the imaging VLAN from directly reaching the billing VLAN, the design blocks a compromised device from pivoting into other sensitive systems. This containment of lateral movement is the core security value of segmentation, especially in environments like healthcare where flat networks magnify ransomware impact. Fortinet teaches segmentation and internal firewalling as key techniques for limiting breach scope.

Exam trap

The trap here is crediting segmentation with endpoint cleanup or traffic encryption, when its primary security value is restricting which systems an attacker can reach.

Full explanation →

181

MCQhard

When configuring a FortiGate interface to connect to an external ISP network that utilizes dynamic IP assignment via DHCP, which setting must be enabled on the interface parameters?

A.Set Addressing Mode to DHCP

B.Enable Secondary IP addressing

C.Configure a Static Virtual IP (VIP) mapping

D.Enable PPPoE client emulation mode

AnswerA

Setting the interface addressing mode to DHCP makes the FortiGate act as a DHCP client, requesting an address, gateway and DNS from the ISP. This satisfies the dynamic IP assignment requirement, unlike manual or PPPoE modes which need static or credential input.

Why this answer

When a FortiGate interface connects to an ISP that assigns IP addresses dynamically via DHCP, the interface's Addressing Mode must be set to DHCP. This enables the FortiGate to act as a DHCP client, automatically obtaining an IP address, subnet mask, default gateway, and DNS servers from the ISP's DHCP server. Without this setting, the interface would use a static IP and fail to obtain the dynamic address.

Exam trap

FORTINET-NSE123 often tests the confusion between DHCP addressing mode and PPPoE mode, so candidates must identify whether the ISP uses plain DHCP (no authentication) or PPPoE (requires credentials) based on the question wording.

How to eliminate wrong answers

Option B is wrong because Secondary IP addressing is used to add additional static IP addresses to an interface that already has a primary IP — it does not enable DHCP client functionality. Option C is wrong because a Static Virtual IP (VIP) mapping is a destination NAT construct used to publish internal servers to external networks, not a method for obtaining a dynamic IP from an ISP. Option D is wrong because PPPoE client emulation mode is used for ISPs that require PPPoE authentication (common with DSL), not for standard DHCP-based dynamic IP assignment.

Full explanation →

182

MCQhard

When configuring an SSL VPN portal on a FortiGate, what is the primary operational difference between SSL VPN Web Mode and Tunnel Mode?

A.Web mode is browser-based with bookmarks, while tunnel mode assigns a virtual IP and requires FortiClient

B.Web mode encrypts traffic with IPsec, while tunnel mode uses unencrypted HTTP connections

C.Tunnel mode only supports Windows XP, while web mode supports modern mobile browsers

D.Web mode requires a hardware FortiToken, while tunnel mode requires no authentication

AnswerA

Web mode proxies internal resources through browser bookmarks with no client software or IP assignment. Tunnel mode installs FortiClient, assigns the client a virtual IP from the portal range, and routes traffic through an encrypted tunnel, giving full network-layer access.

Why this answer

SSL VPN Web Mode is browser-based and provides access to internal web applications through bookmarks and a reverse-proxy portal, requiring no client software. Tunnel Mode, in contrast, assigns the client a virtual IP from a configured pool and requires FortiClient (or a compatible client) to establish a full network tunnel, giving access to any internal resource as if on the LAN.

Exam trap

FORTINET-NSE123 often tests the misconception that Web Mode is unencrypted or that Tunnel Mode requires special hardware, so candidates must remember that both are encrypted and the key difference is browser-based reverse proxy vs. client-based virtual IP tunnel.

How to eliminate wrong answers

Option B is wrong because Web Mode uses TLS/SSL encryption, not IPsec, and Tunnel Mode is also encrypted, not unencrypted HTTP. Option C is wrong because Tunnel Mode supports modern Windows, macOS, Linux, iOS, and Android via FortiClient, not just Windows XP. Option D is wrong because neither mode inherently requires a hardware FortiToken; authentication methods (local, LDAP, RADIUS, 2FA) are configured independently of the mode.

Full explanation →

183

MCQmedium

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

A.It adds a layer of defense even if the primary password is stolen.

B.It prevents all forms of social engineering.

C.It eliminates the need for strong password policies.

D.It automatically encrypts all outgoing email traffic.

AnswerA

MFA requires a second factor beyond the password, so a stolen or phished credential alone cannot authenticate. This directly satisfies the stem's constraint: the password compromise no longer grants access, breaking credential-replay and password-spraying attacks.

Why this answer

MFA requires a second factor beyond the password, so even if an attacker steals or guesses the password through phishing, credential stuffing, or a breach, they still cannot authenticate without the additional factor. This directly mitigates the impact of password compromise, which is the most common initial access vector.

Exam trap

FORTINET-NSE123 often tests whether candidates overstate MFA's benefits — the trap is choosing an answer that claims MFA stops all social engineering or removes the need for password hygiene, both of which are false.

How to eliminate wrong answers

Option B is wrong because MFA does not prevent social engineering — attackers can still trick users into approving a push notification (MFA fatigue) or into revealing an OTP. Option C is wrong because MFA complements, rather than replaces, strong password policies; weak passwords still increase risk of other attacks. Option D is wrong because MFA has nothing to do with encrypting outgoing email traffic — that is handled by TLS/S-MIME.

Full explanation →

184

Multi-Selecthard

An administrator wants to secure administrative access to the FortiGate. Which THREE best practices should be implemented?

Select 3 answers

A.Set the administrative idle timeout to unlimited for convenience.

B.Use default admin credentials across all deployed firewalls.

C.Configure trusted hosts for administrator accounts to limit access to specific IP ranges.

D.Disable HTTP administrative access and enforce HTTPS only.

E.Disable Telnet access and use SSH for secure CLI management.

AnswersC, D, E

Trusted hosts bind each administrator account to permitted source IP addresses, so authentication attempts from any other address are rejected before password checking. This directly restricts management access to known networks, satisfying the requirement to secure administrative access.

Why this answer

Option C is correct because configuring trusted hosts on administrator accounts restricts login attempts to specified source IP addresses or subnets, blocking brute-force and unauthorized access from untrusted networks. Option D is correct because HTTP transmits credentials and session data in cleartext, so disabling HTTP administrative access and enforcing HTTPS (TLS-encrypted GUI access) protects management traffic from eavesdropping and tampering. Option E is correct because Telnet sends CLI credentials and commands unencrypted, whereas SSH provides an encrypted channel for secure CLI management.

Option A is wrong because an unlimited idle timeout leaves authenticated sessions open indefinitely, inviting session hijacking; best practice is a short idle timeout (e.g., 5-15 minutes). Option B is wrong because default admin credentials are publicly known and must be changed immediately, with unique strong passwords per device.

Exam trap

FORTINET-NSE123 often tests security best practices by including obviously insecure options like unlimited timeout and default credentials, so candidates must recognize that these are never recommended despite any convenience they might offer.

Full explanation →

185

MCQeasy

What is the primary function of a FortiSwitch unit when integrated into the Fortinet Security Fabric?

A.To act as an external DNS and DHCP server for client workstations

B.To provide secure Layer 2 network access managed directly from the FortiGate

C.To scan inbound email attachments for spam and phishing attacks

D.To provide SSL VPN portal access for remote mobile workers

AnswerB

A FortiSwitch integrated into the Security Fabric operates as a managed Layer 2 access device, with VLANs, ports and policies provisioned from the FortiGate over FortiLink. This satisfies the stem's requirement for secure Layer 2 network access managed directly from the FortiGate.

Why this answer

When a FortiSwitch is integrated into the Fortinet Security Fabric, it is managed directly by the FortiGate, which acts as the Fabric's central controller. The FortiSwitch provides secure Layer 2 network access for wired clients, with the FortiGate pushing VLAN, port, and security policies down to the switch. This tight integration allows the FortiGate to enforce unified security and network policies across both wired and wireless edges, eliminating the need for separate switch management.

Exam trap

FORTINET-NSE123 often tests the misconception that FortiSwitch can perform advanced security functions like email scanning or SSL VPN, confusing it with other Fortinet products such as FortiMail or FortiGate.

How to eliminate wrong answers

Option A is wrong because FortiSwitch units are Layer 2 switches and do not function as external DNS or DHCP servers; those services are typically provided by the FortiGate or dedicated servers. Option C is wrong because email scanning for spam and phishing is a function of FortiMail or the FortiGate's email security features, not a FortiSwitch. Option D is wrong because SSL VPN portal access is a FortiGate feature for remote workers, not a capability of a FortiSwitch.

Full explanation →

186

MCQmedium

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

A.A SQL injection exploit

B.A distributed denial-of-service attack

C.A legitimate endpoint telemetry notification

D.A tech support scam

AnswerD

The pop-up fabricates an infection and pushes a toll-free number, relying on fear and urgency to make the victim call and hand over payment or remote access. That social-engineering mechanism, not actual malware, defines a tech support scam.

Why this answer

A tech support scam is a social engineering attack where a fake pop-up or alert claims the user's system is infected and urges them to call a toll-free number, where scammers then charge for fake 'fixes' or steal remote access. The scenario describes exactly this: a browser pop-up warning of infection with an urgent phone number. No exploitation of code, traffic flooding, or legitimate telemetry is involved — the threat is deception targeting the user.

Exam trap

The trap here is confusing a user-facing social-engineering lure with an actual technical exploit — candidates see 'virus' and 'pop-up' and jump to malware or exploit categories instead of recognizing the phone-call element as the defining trait of a tech support scam.

How to eliminate wrong answers

Option A is wrong because SQL injection is a code-injection attack against a database-driven application's input fields, not a browser pop-up directed at an end user. Option B is wrong because a DDoS attack floods a target with traffic to exhaust resources, whereas here nothing is being flooded — the user is being socially manipulated. Option C is wrong because legitimate endpoint telemetry notifications come from managed security agents (e.g., FortiClient or EDR consoles) and never instruct users to call a toll-free number.

Full explanation →

187

Multi-Selectmedium

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Select 3 answers

A.An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal

B.An organization implements strict role-based access control and regular auditing

C.A network administrator configures automated offboarding checklists for departed employees

D.An attacker drops infected USB flash drives in a company parking lot to entice curious employees

E.A user sees a pop-up browser alert claiming their PC is infected and instructing them to call a fraudulent support line

AnswersA, D, E

Credential phishing via a spoofed IT-support email and fake login portal is a social-engineering attack targeting the end user directly, exploiting trust rather than software vulnerabilities. It satisfies the stem's requirement for a common attack scenario against end users.

Why this answer

Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment.

Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Exam trap

FORTINET-NSE123 often tests the confusion between attack scenarios and defensive controls, so candidates must recognize that options describing security best practices (RBAC, offboarding) are not attacks.

Full explanation →

188

MCQeasy

What is the primary function of a FortiAuthenticator device?

A.To scan incoming network traffic for virus signatures

B.To centralize user authentication, identity services, and token management

C.To manage physical switch ports and VLANs via FortiLink

D.To analyze zero-day files in an isolated virtual sandbox

AnswerB

FortiAuthenticator acts as a centralised identity and authentication server, consolidating RADIUS, LDAP and SAML authentication, certificate-based identity services, and hardware or software token management. This directly fulfils the stem's requirement to centralise user authentication, identity services and token management rather than distributing them across individual firewalls.

Why this answer

FortiAuthenticator is Fortinet's dedicated identity and access management (IAM) appliance. Its core purpose is to centralize authentication (via RADIUS, LDAP, SAML, etc.), provide identity services such as user identification and group mapping, and manage tokens for two-factor authentication (2FA) and one-time passwords (OTP). It acts as a central point for enforcing authentication policies across the Fortinet Security Fabric and third-party devices.

Unlike firewalls or sandboxes, it does not inspect traffic for threats or manage network infrastructure.

Exam trap

The trap here is confusing FortiAuthenticator with other Fortinet products like FortiSandbox or FortiSwitch, as candidates may not clearly recall the specific function of each appliance in the Security Fabric.

How to eliminate wrong answers

Option A is wrong because scanning incoming network traffic for virus signatures is the function of an antivirus gateway or a FortiGate with antivirus profiles, not FortiAuthenticator. Option C is wrong because managing physical switch ports and VLANs via FortiLink is a capability of FortiSwitch and FortiGate, not FortiAuthenticator. Option D is wrong because analyzing zero-day files in an isolated virtual sandbox is the role of FortiSandbox, not FortiAuthenticator.

Full explanation →

189

Multi-Selectmedium

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Select 3 answers

A.They always require advanced kernel-level debugging tools to execute

B.They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes

C.They are entirely preventable by installing a standard graphics card driver update

D.They often impersonate authority figures, IT support, or trusted brands

E.They primarily exploit human psychology and trust rather than software code vulnerabilities

AnswersB, D, E

Manufacturing false urgency or panic pushes targets into rushed decisions, bypassing the verification steps that would otherwise expose the deception. This satisfies the stem's characteristic requirement by naming the pressure tactic: time compression suppresses deliberate scrutiny, making compliance more likely than reasoned refusal.

Why this answer

Option B is correct because social engineering attacks commonly fabricate urgency or panic (e.g., a fake account-lockout or invoice-due warning) to short-circuit a victim's normal verification and critical-thinking process. Option D is correct because attackers routinely spoof authority figures, IT support staff, or well-known brands through phishing emails, vishing calls, or pretexting to make their requests appear legitimate and trusted. Option E is correct because social engineering fundamentally targets human psychology and trust rather than exploiting memory-corruption or code-level flaws, which is why it bypasses many technical controls.

Option A is incorrect because kernel-level debugging tools are used for low-level software analysis, not for manipulating people, and social engineering requires no such tooling. Option C is incorrect because a graphics card driver update addresses only a specific hardware/software component and cannot prevent deception-based attacks that operate entirely through human interaction.

Exam trap

FORTINET-NSE123 often tests the misconception that social engineering requires sophisticated technical exploits, when in fact the entire category is defined by psychological manipulation of people rather than code.

Full explanation →

190

MCQmedium

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

A.Event logs (System Event logs)

B.Antivirus quarantine logs

C.Web filtering browsing logs

D.DHCP lease assignment logs

AnswerA

System Event logs record HA state transitions, including the reason for failover such as heartbeat loss, link failure or monitored-interface down. This satisfies the stem's requirement to investigate the cause of the HA state transition rather than examining traffic or attack logs.

Why this answer

HA state transitions (failover, role changes, heartbeat failures) are recorded in the System Event logs, which capture cluster membership changes, interface monitoring failures, and HA daemon events. Checking Event logs on the FortiGate or FortiAnalyzer reveals the exact cause and timestamp of the failover. This is the correct log category for diagnosing HA behavior.

Exam trap

FORTINET-NSE123 often tests log category selection, and candidates pick traffic-related logs (web filter, AV) because they are more familiar, missing that HA events are classified under System Event logs.

How to eliminate wrong answers

Option B is wrong because Antivirus quarantine logs record files isolated by AV scanning, which is unrelated to HA cluster state changes. Option C is wrong because Web filtering browsing logs record HTTP/HTTPS URL access decisions, not HA events. Option D is wrong because DHCP lease assignment logs record IP address leases given to clients, which has no connection to HA failover diagnostics.

Full explanation →

191

Multi-Selectmedium

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Select 2 answers

A.Rearrange existing widgets by dragging and dropping them into preferred positions.

B.Convert the dashboard into a command-line terminal emulator.

C.Delete physical firewall ports from the dashboard interface view.

D.Modify core FortiOS kernel code directly from the dashboard widget settings.

E.Add new widgets using the 'Add Widget' option.

AnswersA, E

Dragging widgets reorders the dashboard layout without altering underlying configuration, satisfying the personalisation requirement. FortiGate's GUI stores each administrator's widget positions per account, so the arrangement persists across sessions. This directly fulfils the stem's demand to customise the dashboard view, unlike actions that change monitoring data or system settings.

Why this answer

Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget.

Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Exam trap

FORTINET-NSE123 often tests whether candidates know the dashboard is purely a monitoring/customization surface — distractors claim it can alter interfaces or firmware, which it cannot.

Full explanation →

192

MCQhard

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

A.To balance SSL VPN tunnel connections across multiple cluster nodes

B.To assign IP addresses dynamically to connected client workstations

C.To encrypt firewall policy rules between different physical interfaces

D.To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic

AnswerD

OSPF areas partition the routing domain into a two-level hierarchy around area 0, so routers within an area exchange detailed link-state data while area border routers summarise routes outward. This reduces routing overhead and confines link-state update traffic to each area.

Why this answer

OSPF areas divide a routing domain into a two-level hierarchy (backbone Area 0 and other areas) to reduce routing overhead. By summarizing routes at area boundaries, OSPF limits the scope of link-state advertisements (LSAs), reducing CPU, memory, and bandwidth consumption on routers.

Exam trap

FORTINET-NSE123 often tests OSPF fundamentals — candidates confuse area hierarchy benefits with unrelated features like VPN load balancing or DHCP.

How to eliminate wrong answers

Option A is wrong because SSL VPN tunnel load balancing is handled by FortiGate's SSL VPN configuration and load-balancing features, not OSPF areas. Option B is wrong because dynamic IP assignment to clients is done by DHCP, not OSPF. Option C is wrong because firewall policy encryption is handled by IPsec/SSL, not OSPF areas, which are purely a routing concept.

Full explanation →

193

MCQmedium

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

A.FortiClient EMS deployment server

B.FortiAuthenticator user database server

C.FortiWeb application firewall

D.FortiManager configured as a local FortiGuard distribution server

AnswerD

FortiManager can act as a local FortiGuard distribution server, hosting signature updates for FortiGate devices. This satisfies the isolated-network constraint, since the FortiGate pulls Antivirus and IPS database updates from FortiManager rather than requiring direct internet connectivity.

Why this answer

FortiManager can be configured as a local FortiGuard distribution server to provide signature updates to FortiGates that lack direct internet access. It downloads updates from FortiGuard and then serves them to managed devices on the isolated network. This allows offline updates for antivirus, IPS, and other security services.

Exam trap

FORTINET-NSE123 often tests the role of FortiManager beyond management, specifically its ability to act as a local FortiGuard server, so candidates may overlook this and choose other products.

How to eliminate wrong answers

Option A is wrong because FortiClient EMS is for endpoint management, not for distributing FortiGuard signature updates to FortiGates. Option B is wrong because FortiAuthenticator is for authentication and identity management, not update distribution. Option C is wrong because FortiWeb is a web application firewall, not an update server.

Full explanation →

194

MCQmedium

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

A.Enable local file sharing to speed up document syncing over public connections.

B.Disable the operating system firewall to allow seamless packet routing through the hotspot.

C.Establish an authorized corporate VPN connection before accessing internal systems.

D.Configure the web browser to accept all SSL certificates to bypass public portal warnings.

AnswerC

Public Wi-Fi is unencrypted, so traffic is exposed to eavesdropping. An authorised corporate VPN establishes an encrypted tunnel to the corporate gateway before any internal resource is accessed, protecting data-in-transit regardless of the hostile underlying network.

Why this answer

A corporate VPN creates an encrypted tunnel (typically IPsec or TLS) between the employee's device and the corporate gateway, so any data traversing the untrusted coffee shop Wi-Fi is protected from eavesdropping. Without this encryption layer, an attacker on the same hotspot can capture credentials, session tokens, and sensitive traffic using tools like Wireshark or a rogue AP. The VPN must be established before any internal resource is accessed so that no cleartext traffic leaks onto the public network.

Exam trap

FORTINET-NSE123 often tests the misconception that HTTPS alone is sufficient on public Wi-Fi, leading candidates to pick browser-related options instead of recognizing that an authorized VPN tunnel is the required first control for data-in-transit protection.

How to eliminate wrong answers

Option A is wrong because enabling local file sharing exposes the endpoint's files to other hosts on the public Wi-Fi segment, increasing the attack surface rather than protecting data-in-transit. Option B is wrong because disabling the host firewall removes a critical endpoint defense and does nothing to encrypt traffic — it actually makes the device more vulnerable to inbound attacks on the hotspot. Option D is wrong because accepting all SSL certificates defeats certificate validation, enabling man-in-the-middle attacks and removing the very trust assurance TLS is meant to provide.

Full explanation →

195

MCQmedium

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

A.Streaming raw system logs to FortiAnalyzer

B.Encrypting the backup configuration file with a password during export

C.Exporting the configuration as an unencrypted plain-text XML file

D.Using SNMP v1 to pull configuration binaries over UDP

AnswerB

FortiOS permits password-based encryption of the configuration file during GUI export, producing an encrypted backup that cannot be read without the passphrase. This satisfies the stem's requirement to back up regularly and securely by protecting the file in transit and at rest.

Why this answer

FortiGate allows administrators to encrypt the configuration backup file with a password during export from the GUI. This ensures that the configuration file, which contains sensitive information like passwords and keys, is protected if intercepted or stored insecurely. The option to encrypt with a password is available when performing a backup via System > Config > Backup.

Exam trap

FORTINET-NSE123 often tests the secure backup process, and candidates might confuse log streaming or SNMP with configuration backup, or overlook the encryption option in the GUI.

How to eliminate wrong answers

Option A is wrong because streaming raw system logs to FortiAnalyzer is for log management, not for backing up the configuration. Option C is wrong because exporting the configuration as an unencrypted plain-text XML file does not provide encryption; it leaves the configuration exposed. Option D is wrong because SNMP v1 is an insecure protocol for monitoring, not for pulling configuration binaries, and it does not support encryption.

Full explanation →

196

MCQmedium

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

A.It ensures that compromised credentials alone are insufficient for an attacker to gain access

B.It guarantees complete encryption of all local workstation files

C.It prevents all forms of social engineering attacks against remote workers

D.It entirely eliminates the need for strong passwords on corporate accounts

AnswerA

Requiring a password plus a push notification means a stolen or phished password alone cannot grant access; the attacker must also control the registered mobile device. This satisfies the stem's multi-factor constraint, where knowledge-based credentials are combined with a possession factor, directly mitigating credential-compromise attacks.

Why this answer

Multi-factor authentication (MFA) combines something the user knows (password) with something the user possesses (mobile push token), so a stolen or phished password alone cannot grant access. The push notification acts as a second independent factor that an attacker would also need to compromise, defeating credential-stuffing and password-reuse attacks. This is the core security benefit of the dual-step approach.

Exam trap

FORTINET-NSE123 often tests the misconception that MFA 'prevents' attacks outright, when in reality it only raises the bar — candidates who pick 'prevents all social engineering' or 'eliminates the need for strong passwords' fall for the absolute-language trap.

How to eliminate wrong answers

Option B is wrong because MFA has nothing to do with encrypting local workstation files — full-disk encryption (BitLocker, FileVault) is the control that addresses that. Option C is wrong because MFA does not prevent social engineering; attackers can still phish users into approving a push (MFA fatigue) or trick them into revealing codes, so it only reduces the impact of some social-engineering outcomes. Option D is wrong because MFA is a compensating control, not a replacement for strong passwords — weak passwords still enable credential stuffing against other services and can be brute-forced if MFA is misconfigured or bypassed.

Full explanation →

197

MCQhard

An administrator needs to verify the status of certificate inspection and CA certificates installed on the FortiGate. Where are SSL/SSH inspection profiles and local certificates managed in the web-based manager?

A.Log & Report > Certificate Logs

B.Policy & Objects > SSL/SSH Inspection and System > Certificates

C.VPN > Certificate Manager

D.Security Fabric > Inspection Settings

AnswerB

SSL/SSH inspection profiles define certificate inspection behaviour, while System > Certificates holds the local CA and server certificates the FortiGate presents. Together these locations satisfy the need to verify certificate inspection status and installed CA certificates.

Why this answer

SSL/SSH inspection profiles are configured under Policy & Objects > SSL/SSH Inspection, where you define which traffic is deep-inspected, which categories are exempt, and which CA certificate is used for re-signing. Local CA and server certificates, along with their private keys, are managed under System > Certificates. Together these two locations cover the full certificate inspection workflow on a FortiGate.

Exam trap

FORTINET-NSE123 often tests the split between inspection profile configuration (Policy & Objects) and certificate/key storage (System > Certificates) — candidates assume everything certificate-related lives in one menu.

How to eliminate wrong answers

Option A is wrong because Log & Report only stores and displays log entries (including certificate-related events) — it does not manage certificates or inspection profiles. Option C is wrong because VPN > Certificate Manager is not a valid FortiGate GUI path; VPN menus handle IPsec/SSL VPN tunnels, not certificate stores. Option D is wrong because Security Fabric > Inspection Settings does not exist as a certificate management location; Security Fabric covers fabric connectors, automation, and device integration.

Full explanation →

198

MCQhard

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

A.Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

B.Every user account is automatically granted local administrator rights on their assigned workstation by default.

C.Users and services are granted only the bare minimum permissions required to perform their explicit functions.

D.All administrators share a single root account with full access to simplify password management.

AnswerC

Least privilege means granting identities only the minimum rights needed for their explicit duties, with no standing excess permissions. This applies equally to user and service accounts, satisfying the stem's requirement by limiting each account's access scope to its defined function.

Why this answer

The principle of least privilege (PoLP) requires that users and service accounts are granted only the minimum permissions necessary to perform their explicit job functions. This limits the blast radius of compromised accounts and reduces the risk of accidental or malicious misuse. Applying PoLP to service accounts means avoiding over-privileged accounts that can perform unrelated administrative tasks.

Exam trap

FORTINET-NSE123 often tests whether candidates understand that least privilege applies to both human and service accounts, and distractors promote convenience over security.

How to eliminate wrong answers

Option A is wrong because granting domain administrator privileges to service accounts violates least privilege and creates a massive security risk if the account is compromised. Option B is wrong because automatically granting local administrator rights to every user account is the opposite of least privilege and increases attack surface. Option D is wrong because sharing a single root account eliminates accountability and violates least privilege by giving everyone full access.

Full explanation →

199

MCQmedium

An administrator needs to back up the current FortiGate configuration securely to a local PC via the GUI. Which option should the administrator select?

A.System > Firmware > Backup

B.Log & Report > Log Settings > Backup

C.System > Settings > Backup Configuration

D.Security Fabric > Settings > Export

AnswerC

System > Settings > Backup Configuration exports the full configuration file through the GUI, satisfying the requirement to back up locally to a PC. It also offers an encrypted option, protecting sensitive credentials such as passwords and pre-shared keys, which meets the stem's secure-backup constraint without needing CLI access or external tooling.

Why this answer

In FortiOS GUI, the configuration backup is performed via System > Settings > Backup Configuration, which allows the administrator to download the current configuration file (encrypted or plain text) to a local PC. This is the standard, documented path for secure configuration backup through the web-based manager.

Exam trap

FORTINET-NSE123 often tests GUI menu path memorization, and candidates frequently confuse the Firmware section (for upgrades) with the Settings section (for configuration backup), leading them to pick the wrong menu.

How to eliminate wrong answers

Option A is wrong because System > Firmware > Backup does not exist as a configuration backup path — the Firmware section is for firmware management and upgrade, not config backup. Option B is wrong because Log & Report > Log Settings > Backup relates to log storage and archiving settings, not configuration file backup. Option D is wrong because Security Fabric > Settings > Export is not a configuration backup function; the Security Fabric section deals with fabric topology and integration, not device config export.

Full explanation →

200

MCQeasy

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

A.FortiView Summary

B.Bandwidth widget

C.System > Performance Graphs

D.Log & Report > Traffic Graph

AnswerB

The Bandwidth widget plots historical throughput over a selected period, including the last 24 hours, satisfying the graphical traffic-history requirement. It differs from the real-time interface monitor, which shows only current utilisation without retained historical graphing.

Why this answer

The Bandwidth widget on the FortiGate dashboard is specifically designed to display a historical graph of bandwidth usage (ingress and egress) over selectable time ranges including the last 24 hours. It samples interface throughput counters and renders them as a time-series chart, making it the correct answer for viewing historical traffic trends. This widget is available on the default dashboard and can be customized per admin.

Exam trap

The trap is that candidates look for a 'Traffic Graph' under Log & Report or System, when the actual historical bandwidth visualization lives as a dashboard widget named simply 'Bandwidth'.

How to eliminate wrong answers

Option A is wrong because 'FortiView Summary' shows top sources, destinations, applications, and threats — not a bandwidth-over-time graph. Option C is wrong because 'System > Performance Graphs' is not a FortiOS dashboard widget; performance data is surfaced through the dashboard widgets and FortiView, not a System menu graph. Option D is wrong because 'Log & Report > Traffic Graph' does not exist as a menu item — Log & Report contains log views, not graphical bandwidth charts.

Full explanation →

201

MCQhard

An administrator is investigating a network routing issue on the FortiGate and needs to see the current active kernel routing table entries. Which CLI command provides this information?

A.execute traceroute

B.get system interface

C.get router info routing-table all

D.diagnose firewall IP-antibot list

AnswerC

`get router info routing-table all` queries the FortiGate's active kernel routing table directly, dumping every installed route rather than filtering by protocol or prefix. This satisfies the administrator's requirement to view current active entries, unlike configuration-oriented commands that display static route definitions without confirming which routes the kernel actually selected.

Why this answer

The command 'get router info routing-table all' displays the complete active kernel routing table on a FortiGate, including all routes (connected, static, dynamic) with their attributes. It is the standard CLI method for verifying routing entries and troubleshooting routing issues.

Exam trap

FORTINET-NSE123 often tests the exact CLI command for viewing the routing table, and candidates may confuse it with 'get system interface' or 'diagnose firewall IP-antibot list'.

How to eliminate wrong answers

Option A is wrong because 'execute traceroute' is used to trace the path to a destination, not to display the routing table. Option B is wrong because 'get system interface' shows interface configuration and status, not routing entries. Option D is wrong because 'diagnose firewall IP-antibot list' displays IP reputation and botnet entries, unrelated to routing.

Full explanation →

202

MCQeasy

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

A.Forward the spreadsheet to all company contacts for collaborative viewing

B.Print the spreadsheet immediately to a physical printer

C.Enable macros immediately so the file displays properly

D.Leave macros disabled unless the source is fully verified and trusted

AnswerD

Macro-enabled documents are a primary malware delivery vector, and 'Enable Content' executes embedded code. Leaving macros disabled unless the sender and file are independently verified blocks this execution path, satisfying the best-practice constraint the scenario tests.

Why this answer

The correct action is to leave macros disabled unless the source is fully verified and trusted. Macro-enabled documents are a common attack vector for malware delivery, as macros can execute arbitrary code when enabled. Since the email came from an external partner and the user cannot be certain of its legitimacy, the safest practice is to keep macros disabled and verify the sender through a separate channel before taking any further action.

Exam trap

FORTINET-NSE123 often tests the principle of least privilege and user awareness, where the trap is assuming that a file from a known external partner is automatically safe, leading candidates to choose enabling macros for convenience over security.

How to eliminate wrong answers

Option A is wrong because forwarding a potentially malicious spreadsheet to all company contacts would propagate the threat across the organization, increasing the attack surface and risking widespread compromise. Option B is wrong because printing the spreadsheet does not neutralize the macro threat; the malicious code remains in the file and could still execute if the document is later opened with macros enabled. Option C is wrong because enabling macros immediately bypasses the security control designed to prevent unauthorized code execution, directly exposing the system to potential malware infection.

Full explanation →

203

MCQmedium

An administrator needs to change the management IP address of the internal interface (e.g., port1) via the CLI. Which sequence of configuration commands is correct?

A.config router interface > edit port1 > set address [IP] > end

B.config system interface > edit port1 > set ip [IP] [netmask] > end

C.set interface port1 ip [IP] > save

D.execute set ip port1 [IP]

AnswerB

Entering the interface configuration context, selecting port1, setting the IP and netmask, then ending applies the new management address. This sequence satisfies the stem's CLI requirement, since 'set ip' only accepts values inside 'config system interface'.

Why this answer

The correct sequence is 'config system interface > edit port1 > set ip [IP] [netmask] > end'. This enters the system interface configuration context, selects the port1 interface, sets the IP address and netmask, and saves the configuration. This is the standard FortiOS CLI syntax for changing an interface IP.

Exam trap

FORTINET-NSE123 often tests the correct CLI hierarchy, trapping candidates who confuse 'config system interface' with invalid paths like 'config router interface' or non-existent 'execute' commands.

How to eliminate wrong answers

Option A is wrong because 'config router interface' is not a valid FortiOS command path for interface IP configuration; the correct path is 'config system interface'. Option C is wrong because 'set interface port1 ip [IP] > save' is not valid FortiOS syntax; FortiOS uses 'config' and 'edit' contexts, not a single 'set' command with 'save'. Option D is wrong because 'execute set ip port1 [IP]' is not a valid FortiOS command; 'execute' commands are for actions like reboot or ping, not interface configuration.

Full explanation →

204

MCQhard

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

A.To assign dynamic DHCP addresses to SSL VPN mobile clients

B.To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers

C.To translate internal private web server IP addresses to public IPs for inbound users

D.To balance VPN traffic across multiple high availability cluster members

AnswerB

NAT-T encapsulates ESP packets inside UDP port 4500, satisfying the stem's requirement when NAT devices sit between VPN peers. Standard ESP lacks port numbers, so NAT cannot translate it; UDP encapsulation lets the NAT device track the flow and preserves IKE and ESP traversal.

Why this answer

NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams (typically UDP port 4500) so they can pass through NAT devices that would otherwise drop or mangle ESP traffic. This allows IPsec VPN peers behind NAT to establish and maintain tunnels.

Exam trap

FORTINET-NSE123 often tests the confusion between NAT-T and other NAT functions (destination NAT, SSL VPN DHCP) — candidates may pick an answer that describes generic NAT or SSL VPN behavior instead of the specific UDP encapsulation of ESP for IPsec.

How to eliminate wrong answers

Option A is wrong because NAT-T does not assign DHCP addresses to SSL VPN clients; that is a function of SSL VPN configuration and DHCP, unrelated to IPsec NAT-T. Option C is wrong because NAT-T does not perform destination NAT for inbound web servers; that is a separate NAT/port-forwarding function, not NAT-T. Option D is wrong because NAT-T does not balance VPN traffic across HA cluster members; HA load balancing is handled by FGCP, not NAT-T.

Full explanation →

205

MCQhard

An administrator wants to check the status of HA (High Availability) synchronization between primary and secondary FortiGate units. Which CLI command should be used?

A.diagnose ha group list

B.show HA cluster

C.get system status HA

D.get system ha status

AnswerD

get system ha status reports HA mode, cluster members, primary election and synchronisation state, directly satisfying the requirement to check HA sync between primary and secondary units. It is a read-only diagnostic command, unlike execute commands that modify cluster behaviour.

Why this answer

The correct CLI command to check HA synchronization status between primary and secondary FortiGate units is 'get system ha status'. This command displays the HA cluster status, including the primary unit, synchronization state, and member information.

Exam trap

FORTINET-NSE123 often tests the exact CLI syntax for HA status, so candidates pick plausible-sounding but invalid commands like 'show HA cluster' or 'get system status HA' instead of the correct 'get system ha status'.

How to eliminate wrong answers

Option A is wrong because 'diagnose ha group list' is not a valid FortiGate HA status command. Option B is wrong because 'show HA cluster' is not a valid FortiGate CLI command for HA status. Option C is wrong because 'get system status HA' is not the correct syntax — 'get system status' shows general system status, not HA-specific synchronization details.

Full explanation →

206

MCQhard

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

A.Security Fabric > Audit Logs

B.FortiView > Command History

C.Log & Report > System Events (Admin Login and CLI Command Logs)

D.Log & Report > CLI History

AnswerC

Log & Report > System Events captures administrative CLI command execution through the Admin Login and CLI Command Logs sub-category, recording each command an administrator runs on the FortiGate. This directly satisfies the requirement to review exact CLI commands executed during a troubleshooting session or audit history, unlike traffic or event logs that omit command-level detail.

Why this answer

Administrative CLI command execution is recorded under Log & Report > System Events, specifically in the Admin Login and CLI Command log subtypes. These logs capture the admin username, source IP, the exact command string, and the timestamp, making them the authoritative source for audit and troubleshooting history.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact menu path (Log & Report > System Events) for CLI command logs, versus inventing plausible-sounding paths like 'CLI History' or 'Audit Logs.'

How to eliminate wrong answers

Option A is wrong because Security Fabric > Audit Logs records Fabric topology and connector events, not per-command CLI execution. Option B is wrong because FortiView > Command History is not a standard FortiGate log view — FortiView focuses on traffic and threat analytics, not CLI audit trails. Option D is wrong because 'Log & Report > CLI History' is not a real menu path in FortiOS; the correct location is System Events with the CLI Command subtype.

Full explanation →

207

Multi-Selecthard

Which THREE of the following are common indicators that a system has been compromised by malware?

Select 3 answers

A.An unexpected increase in outbound network traffic.

B.Frequent, unexplained system crashes or freezes.

C.The system boot time remains consistent with previous months.

D.The computer performs regular daily virus definition updates.

E.Automatic creation of new, unrecognized administrative accounts.

AnswersA, B, E

Malware command-and-control and data exfiltration generate outbound connections to external hosts, so a sudden traffic spike beyond the established baseline indicates compromise. This satisfies the indicator criterion because normal user activity rarely produces sustained, unexplained egress growth.

Why this answer

Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access.

Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse normal system behaviors (like consistent boot time or regular updates) with indicators of compromise, leading them to select incorrect options.

Full explanation →

208

MCQeasy

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

A.FortiView Sessions

B.System Resources

C.Log Rate

D.License Information

AnswerB

The System Resources widget polls live CPU and memory counters from the FortiGate's kernel and displays them as real-time graphs on the dashboard, directly satisfying the requirement to monitor current utilisation rather than historical or per-interface statistics.

Why this answer

The System Resources widget on the FortiGate dashboard is specifically designed to display real-time CPU and memory usage, along with other system-level metrics such as session count and log rate. Adding this widget provides administrators with an at-a-glance view of resource utilization directly on the dashboard. It is the correct choice for monitoring CPU and memory in real time.

Exam trap

FORTINET-NSE123 often tests the specific widget names and their purposes, so candidates may confuse the System Resources widget with the Log Rate or FortiView Sessions widgets when asked about CPU and memory monitoring.

How to eliminate wrong answers

Option A is wrong because FortiView Sessions is a monitoring console that shows session details (source, destination, application, etc.), not CPU or memory usage. Option C is wrong because the Log Rate widget displays the volume of logs being generated per second, which is unrelated to CPU and memory metrics. Option D is wrong because the License Information widget shows license status and expiration dates, not system resource utilization.

Full explanation →

209

MCQeasy

An administrator wants to view real-time CPU utilization per system process. Which dashboard widget or view helps identify which process is consuming CPU resources?

A.Monitor > Performance Log

B.FortiView > Processes

C.System Resources widget (Process list)

D.Log & Report > CPU Logs

AnswerC

The System Resources widget's process list enumerates individual processes with live CPU consumption, satisfying the requirement to identify the specific process consuming CPU resources. Unlike aggregate CPU graphs, which show only total utilisation, this view attributes usage per process in real time, directly answering which process is responsible.

Why this answer

The System Resources widget includes a process list that shows real-time CPU and memory consumption per process on the FortiGate. This is the correct place to identify which daemon (e.g., ipsengine, wad, miglogd) is consuming CPU. It updates live and can be sorted by CPU usage.

Exam trap

FORTINET-NSE123 often tests the difference between live per-process monitoring (System Resources widget) and historical or traffic-based views (Performance Log, FortiView), catching candidates who pick FortiView for process-level data.

How to eliminate wrong answers

Option A is wrong because Monitor > Performance Log stores historical performance statistics, not a live per-process CPU breakdown. Option B is wrong because FortiView > Processes is not a standard FortiGate view — FortiView focuses on traffic, sources, destinations, and applications, not OS processes. Option D is wrong because Log & Report > CPU Logs does not exist as a per-process CPU view; logs capture events, not live process utilization.

Full explanation →

210

Multi-Selectmedium

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

Select 2 answers

A.Enable Telnet for administrative CLI access.

B.Configure Trusted Hosts on the administrator account to restrict management login to specific IP addresses.

C.Use default admin accounts with blank passwords.

D.Disable password complexity requirements globally.

E.Disable HTTP administrative access and enforce HTTPS only.

AnswersB, E

Trusted Hosts binds each administrator account to permitted source IP addresses, so management logins from any other address are rejected before authentication. This directly satisfies the stem's requirement to secure web-based manager access by limiting where administrative sessions may originate.

Why this answer

Option B is correct because configuring Trusted Hosts on an administrator account restricts management logins to specific, pre-approved source IP addresses, which prevents unauthorized hosts from even attempting to authenticate to the FortiGate web-based manager. Option E is correct because disabling HTTP administrative access and enforcing HTTPS only ensures that all management traffic to the web-based manager is encrypted with TLS, protecting credentials and session data from interception or tampering. Options A, C, and D are incorrect because Telnet transmits credentials in cleartext, default accounts with blank passwords are trivially exploitable, and disabling password complexity weakens rather than strengthens administrative security.

Exam trap

FORTINET-NSE123 often tests the difference between hardening steps and insecure legacy options, tricking candidates into selecting Telnet or default/blank-password settings as if they were valid security measures.

Full explanation →

211

MCQmedium

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

A.FortiGate Antivirus profile

B.FortiSwitch port security settings

C.FortiAnalyzer reporting engine

D.FortiClient EMS Device Control profile

AnswerD

The Device Control profile in FortiClient EMS defines which USB and removable storage classes are permitted, blocked, or read-only, and pushes that policy to managed endpoints. This satisfies the stem's requirement to block specific device types on corporate laptops.

Why this answer

FortiClient EMS (Enterprise Management Server) delivers endpoint management profiles, including Device Control profiles that define which USB and removable storage classes are allowed, blocked, or read-only on managed endpoints. The profile is pushed to FortiClient agents on corporate laptops, enforcing the policy at the endpoint.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse network-layer enforcement (FortiGate profiles, FortiSwitch port security) with endpoint-layer enforcement (FortiClient EMS Device Control).

How to eliminate wrong answers

Option A is wrong because a FortiGate antivirus profile inspects traffic traversing the firewall; it cannot control physical USB device attachment on an endpoint. Option B is wrong because FortiSwitch port security governs switch port access (MAC limiting, 802.1X), not removable media on laptops. Option C is wrong because FortiAnalyzer is a logging, reporting, and analytics appliance — it has no endpoint device-control enforcement capability.

Full explanation →

212

MCQmedium

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

A.Explicit Proxy Mode

B.SSL VPN Web Mode

C.IPsec Client Mode

D.SSL VPN Tunnel Mode

AnswerB

SSL VPN web mode proxies internal HTTP/HTTPS resources through the FortiGate, rewriting links so users reach bookmarks and a customised portal entirely in a browser. This satisfies the stem's constraint of no pre-installed desktop client, unlike tunnel mode, which requires FortiClient and assigns a virtual adapter for full network-layer access.

Why this answer

SSL VPN Web Mode provides browser-based access through a portal that presents a customizable login page and bookmarks to internal resources (HTTP/HTTPS, RDP, SSH, etc.) without requiring any pre-installed client. It is designed exactly for the scenario described: remote users connecting via a web browser to reach internal resources.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse SSL VPN Web Mode (browser-based, no client) with Tunnel Mode (requires FortiClient) or with unrelated proxy/IPsec modes, causing them to pick Tunnel Mode despite the 'no pre-installed client' clue.

How to eliminate wrong answers

Option A is wrong because Explicit Proxy Mode is a forward-proxy configuration where clients are configured to send web traffic to the FortiGate; it is not an SSL VPN mode and does not provide a portal with bookmarks. Option C is wrong because IPsec Client Mode uses the FortiClient (or another IPsec client) and requires a pre-installed client, which contradicts the 'no pre-installed desktop client' requirement. Option D is wrong because SSL VPN Tunnel Mode requires FortiClient to establish a full tunnel and assign a virtual IP; it is client-based, not browser-based.

Full explanation →

213

MCQmedium

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

A.Data Loss Prevention (DLP) sensor

B.Traffic Shaping rule profile

C.Antivirus signature profile in flow mode

D.Web Filtering profile with malicious domain blocking enabled

AnswerD

A web filtering profile with malicious domain blocking queries FortiGuard ratings and denies requests to known phishing or malware-hosting domains before the connection completes. This satisfies the stem's requirement to block such destinations automatically at the policy level.

Why this answer

A Web Filtering profile with malicious domain blocking enabled uses FortiGuard's categorized URL/domain database to intercept DNS/HTTP requests to known phishing and malware-hosting domains and block them before the connection is established. This is the only profile in the list designed specifically to evaluate destination reputation and deny access to malicious sites at the policy level.

Exam trap

The trap here is confusing 'malware' with antivirus — candidates see 'malware-hosting domains' and reach for the Antivirus profile, but domain-level blocking is a web filtering function, not a signature-scanning function.

How to eliminate wrong answers

Option A is wrong because a DLP sensor inspects outbound content for sensitive data patterns (credit cards, SSNs) and does not maintain a reputation database of phishing or malware domains. Option B is wrong because traffic shaping only prioritizes or throttles bandwidth by matching criteria; it has no concept of domain reputation and cannot block malicious destinations. Option C is wrong because an antivirus profile in flow mode scans file payloads for malware signatures after the connection is established — it does not block the initial connection to a phishing or malware-hosting domain.

Full explanation →

214

Multi-Selectmedium

A retail company wants to reduce the risk that stolen customer credit card numbers can be used if its database is breached. Which TWO practices best support this goal? (Choose two.)

Select 2 answers

A.Store card numbers in a plaintext file on the web server for quick reference by support staff.

B.Tokenize stored card numbers so the database holds non-sensitive tokens instead of the actual values.

C.Increase the database server's RAM so queries returning card numbers run faster.

D.Enable verbose SQL error messages so developers can debug database queries faster.

E.Encrypt the card number column with keys stored in a separate, access-controlled key management system.

AnswersB, E

Tokenization replaces sensitive card data with surrogate values that are useless outside the tokenization system. If the database is stolen, the tokens cannot be used to conduct transactions, directly reducing the value of the breach. This aligns with data-protection principles in NSE 1 foundational content, where minimizing the storage of sensitive data limits impact.

Why this answer

Both tokenization and strong encryption with separated key management ensure that exfiltrated card data cannot be directly used for fraud. Tokenization removes the sensitive value entirely from the database, while encryption keeps it unreadable without keys held elsewhere. Together they embody the principle of reducing the value of stolen data, a foundational concept in the NSE 1 curriculum.

Exam trap

The trap here is choosing operational or debugging conveniences such as verbose errors or extra memory, which do nothing to make stolen card data unusable.

Full explanation →

215

MCQeasy

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

A.FortiAnalyzer

B.FortiAuthenticator

C.FortiSandbox

D.FortiManager

AnswerD

FortiManager is Fortinet's centralised single-pane-of-glass management platform, satisfying the stem's requirement to provision, update and monitor multiple FortiGate devices and policies enterprise-wide. It pushes configuration and policy packages to managed firewalls, unlike standalone device GUIs or FortiAnalyzer, which focuses on logging and reporting.

Why this answer

FortiManager is Fortinet's centralized management platform that provides a single pane of glass for provisioning, configuring, updating, and monitoring multiple FortiGate devices and their policies. It supports ADOMs to segment management domains and pushes policy packages to managed devices. This matches the described requirement exactly.

Exam trap

FORTINET-NSE123 often tests the FortiManager vs FortiAnalyzer distinction — candidates confuse centralized device/policy management with log analysis and reporting.

How to eliminate wrong answers

Option A is wrong because FortiAnalyzer is focused on log collection, analysis, reporting, and alerting — not device provisioning or policy management. Option B is wrong because FortiAuthenticator provides identity and access management (RADIUS, LDAP, MFA, SSO), not firewall policy management. Option C is wrong because FortiSandbox is a threat-detection/detonation platform for suspicious files and URLs, not a management console.

Full explanation →

216

MCQhard

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

A.Separation of duties

B.Defense in depth

C.Security through obscurity

D.Principle of least privilege

AnswerD

The service account held administrative rights across multiple disparate systems, far beyond its routine function, directly breaching least privilege. This principle demands granting only the minimum access necessary for a defined task, so excessive standing privileges enabled the attacker's broad compromise.

Why this answer

The Principle of Least Privilege requires that accounts be granted only the minimum permissions necessary to perform their function. A service account with full administrative rights across multiple disparate systems clearly exceeds its required scope, so least privilege was violated. This over-provisioning is exactly what enabled the attacker to pivot broadly after compromising the account.

Exam trap

The trap is conflating 'least privilege' with 'separation of duties' — both are access-control principles, but only least privilege addresses the scope of permissions granted to a single account.

How to eliminate wrong answers

Option A is wrong because separation of duties concerns dividing critical tasks among different people to prevent fraud/error — it is not the principle that directly governs how much privilege a single account should hold. Option B is wrong because defense in depth is about layering multiple overlapping controls; the scenario describes excessive privilege on one account, not a missing layer. Option C is wrong because security through obscurity relies on hiding implementation details, which is unrelated to granting excessive permissions.

Full explanation →

217

MCQeasy

Which dashboard widget displays the current status and capacity of local storage (hard drive or log disk) on the FortiGate?

A.System Resources

B.Log Disk

C.Storage Manager

D.Hardware Status

AnswerB

The Log Disk widget reports the local storage device's status and capacity, showing used and free space for logs. This satisfies the stem's requirement, as it is the dashboard widget dedicated to local hard drive or log disk information.

Why this answer

The Log Disk widget on the FortiGate dashboard displays the current status and capacity of local storage used for logs (hard drive or log disk). It shows used versus total space, making it the correct widget for monitoring local storage capacity.

Exam trap

The trap is confusing the Log Disk widget with other system widgets like System Resources or Hardware Status — candidates who haven't explored the dashboard may pick a generic-sounding widget instead of the specific Log Disk one.

How to eliminate wrong answers

Option A is wrong because System Resources shows CPU, memory, and session counts, not disk capacity. Option C is wrong because 'Storage Manager' is not a FortiGate dashboard widget; storage configuration is under System > Settings or Log & Report. Option D is wrong because 'Hardware Status' is not a dashboard widget for disk capacity; hardware sensors are shown elsewhere.

Full explanation →

218

MCQmedium

An administrator is configuring a new local administrator account with restricted privileges. Where in the web-based manager are administrator accounts and access profiles created and managed?

A.Policy & Objects > Admins

B.Security Fabric > Access Control

C.User & Authentication > Administrator Users

D.System > Administrators

AnswerD

System > Administrators is where local administrator accounts are created and bound to access profiles, which define permitted read/write scope per administrative domain. This satisfies the restricted-privileges requirement by letting you assign a limited profile rather than the super_admin profile.

Why this answer

Administrator accounts and their associated access profiles (permission sets) are created and managed under System > Administrators in the FortiGate GUI. This is the central location where you define local admin users, assign admin profiles, restrict trusted hosts, and configure authentication methods such as LDAP, RADIUS, or local passwords. The access profile itself is also defined here, controlling which VDOMs and functional areas each admin can view or modify.

Exam trap

FORTINET-NSE123 often tests the confusion between end-user objects under User & Authentication and administrator accounts under System > Administrators — candidates pick the 'User' menu because the word 'administrator' sounds like a user object.

How to eliminate wrong answers

Option A is wrong because Policy & Objects is used for firewall policies, addresses, services, and virtual IPs — not admin accounts. Option B is wrong because Security Fabric groups features like fabric connectors, device detection, and automation stitches, not administrator identity management. Option C is wrong because User & Authentication is for end-user objects (local users, groups, LDAP/RADIUS servers) used in firewall authentication and FSSO, not for FortiGate administrators.

Full explanation →

219

MCQhard

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

A.RIPv2 hop-count metric calculation

B.SD-WAN Performance SLAs and Link Cost Rules

C.Equal-Cost Multi-Path (ECMP) round-robin hashing

D.Static routing administrative distance metrics

AnswerB

SD-WAN Performance SLAs define health-check probes measuring latency, jitter and packet loss per member link, while Link Cost Rules rank those links. Together they let the FortiGate dynamically steer traffic onto the best-performing path, directly satisfying the stem's requirement for automatic measurement and dynamic path selection across multiple WAN connections.

Why this answer

SD-WAN Performance SLAs in FortiOS allow the FortiGate to continuously probe multiple WAN links for latency, jitter, and packet loss, then use Link Cost Rules to dynamically steer traffic to the best-performing path. This is the core mechanism for intelligent, application-aware WAN selection in a multi-WAN architecture. It goes beyond simple failover by making routing decisions based on real-time link quality.

Exam trap

FORTINET-NSE123 often tests the difference between static load balancing (ECMP) and dynamic performance-based steering (SD-WAN SLA), so candidates must recognize that only SD-WAN measures latency, jitter, and loss.

How to eliminate wrong answers

Option A is wrong because RIPv2 uses hop count as its metric and has no awareness of latency, jitter, or packet loss, making it unsuitable for performance-based WAN steering. Option C is wrong because ECMP performs static round-robin or hash-based load balancing across equal-cost paths without measuring link quality, so it cannot dynamically avoid a degraded link. Option D is wrong because static route administrative distance is a fixed preference value used only for failover when a route disappears, not for continuous performance-based selection.

Full explanation →

220

MCQeasy

A new employee at a small accounting firm receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to avoid account suspension. The email address looks slightly misspelled, and the link points to a domain that is not the bank's real website. What type of attack is this?

A.A man-in-the-middle attack

B.A phishing attack

C.A brute-force attack

D.A denial-of-service attack

AnswerB

This is phishing because the email impersonates a trusted bank and tries to trick the employee into revealing credentials through a fraudulent link and misspelled sender address. Phishing is a social-engineering attack delivered electronically, and the combination of urgency, spoofed branding, and a deceptive URL matches the classic credential-harvesting pattern that Fortinet NSE 1 describes as a common initial access technique.

Why this answer

The email impersonates a trusted financial institution, creates urgency about account suspension, uses a look-alike sender address, and directs the recipient to a fraudulent domain to capture credentials. These are the defining traits of phishing, a social-engineering technique that targets the human element rather than a technical vulnerability. Recognizing the mismatched domain and unusual request is the key defensive skill.

Exam trap

The trap here is assuming that any suspicious email must be malware, when the scenario describes credential theft through deception rather than malicious code execution.

Full explanation →

221

MCQeasy

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

A.administrator

B.supervisor

C.admin

D.root

AnswerC

The FortiGate GUI ships with a single built-in super-admin account named `admin`, created automatically during initialisation with no password. This satisfies the stem's first-login constraint: no prior configuration or external authentication (such as LDAP or RADIUS) exists yet, so only the factory-defined local account can grant Web-based Manager access.

Why this answer

FortiGate appliances ship with a default administrator account whose username is 'admin' and which has no password initially (forcing a password change on first login in recent firmware). This is documented in Fortinet's default credentials and is required knowledge for initial device setup.

Exam trap

FORTINET-NSE123 often tests whether candidates assume a generic default like 'administrator' or 'root' — the trap is that FortiGate uniquely uses 'admin' with a blank initial password.

How to eliminate wrong answers

Option A is wrong because 'administrator' is the default username convention on some other platforms (e.g., Windows), not FortiGate. Option B is wrong because 'supervisor' is not a FortiGate default account. Option D is wrong because 'root' is the default superuser on Linux/Unix systems, not on FortiOS.

Full explanation →

222

MCQeasy

What is the primary function of a FortiSwitch port configured with FortiLink?

A.To connect external ISP routers via PPPoE authentication

B.To scan emails for spam and phishing attachments

C.To tunnel remote worker traffic via IPsec site-to-site protocols

D.To establish a secure management and data connection between a FortiGate and a FortiSwitch

AnswerD

A FortiLink port carries both the management channel and user data between the FortiGate and FortiSwitch, allowing the FortiGate to authorise, provision and monitor the switch. This satisfies the stem's requirement for a secure management and data connection between the two devices.

Why this answer

FortiLink is a protocol that enables a FortiGate to manage and control a FortiSwitch, providing a secure management and data connection between the two devices. It allows the FortiGate to push VLAN, policy, and security configurations to the FortiSwitch, effectively making the switch an extension of the FortiGate's security fabric.

Exam trap

FORTINET-NSE123 often tests the purpose of FortiLink versus other FortiGate interfaces — candidates may confuse it with WAN, VPN, or email security functions because they don't recognize FortiLink as a switch-management protocol.

How to eliminate wrong answers

Option A is wrong because connecting external ISP routers via PPPoE is a WAN interface function on the FortiGate, not a FortiLink port role. Option B is wrong because email scanning for spam and phishing is performed by FortiMail or the FortiGate's email security profiles, not by a FortiSwitch port. Option C is wrong because tunneling remote worker traffic via IPsec site-to-site is a VPN function on the FortiGate, unrelated to FortiLink.

Full explanation →

223

Multi-Selectmedium

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

Select 3 answers

A.Dashboard

B.Kernel Debugger

C.Policy & Objects

D.Log & Report

E.BIOS Utility

AnswersA, C, D

Dashboard appears as a top-level menu category in the FortiGate GUI tree, satisfying the stem's requirement for one of the three main functional areas. It aggregates widgets such as system status, licence information, and security fabric topology, confirming its standing as a primary navigation entry rather than a nested submenu item.

Why this answer

The FortiGate GUI's standard menu tree includes Dashboard (A), which is the default landing page showing widgets for system status, licenses, and resource usage. Policy & Objects (C) is a core menu category where firewall policies, addresses, services, and other object definitions are configured. Log & Report (D) is also a standard menu area that provides access to log viewing, forwarding, and report generation.

Kernel Debugger (B) is not a GUI menu category; it is a CLI diagnostic tool accessed via commands like 'diagnose debug' or 'diagnose sys top'. BIOS Utility (E) is not part of the FortiGate GUI at all; it is a low-level firmware/hardware setup interface accessed outside FortiOS.

Exam trap

FORTINET-NSE123 often tests whether candidates mistake CLI-only or hardware-level tools (Kernel Debugger, BIOS Utility) for GUI menu categories.

Full explanation →

224

Multi-Selecteasy

Which THREE of the following are recognized signs of a potential phishing attempt?

Select 3 answers

A.The email is sent during standard business hours.

B.The email uses urgent or threatening language to demand immediate action.

C.The sender's email address domain does not match the organization they claim to represent.

D.The email contains an unexpected attachment from an unknown sender.

E.The email is addressed to the employee by their correct first name.

AnswersB, C, D

Urgent or threatening language is a recognised social-engineering indicator, because phishing relies on manufactured time pressure to bypass the recipient's normal scrutiny before they verify the sender or link. This directly satisfies the stem's requirement for a behavioural sign of a potential phishing attempt, independent of any technical header or domain evidence.

Why this answer

Option B is correct because phishing emails frequently employ urgency or threats (e.g., "your account will be closed in 24 hours") to pressure victims into acting before they verify the request. Option C is correct because a mismatch between the sender's domain and the organization they claim to represent (e.g., support@paypa1-secure.com instead of paypal.com) is a classic spoofing indicator, since legitimate organizations send from their own registered domains. Option D is correct because an unexpected attachment from an unknown sender is a common malware delivery vector, often using weaponized files like .exe, .scr, or macro-enabled Office documents.

Option A is not a reliable indicator, since attackers routinely schedule phishing campaigns during business hours to blend in with normal traffic. Option E is also not a sign, because attackers often harvest the recipient's correct first name from social media or breached data to make the message appear more legitimate.

Exam trap

FORTINET-NSE123 often tests the ability to distinguish between common email characteristics and actual phishing indicators, such as mistaking a personalized greeting for a sign of legitimacy or assuming that business-hours sending is suspicious.

Full explanation →

225

MCQeasy

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

A.Unplug the Ethernet network cable

B.Lock the workstation screen

C.Power down the computer completely

D.Minimize all open web browser windows

AnswerB

Locking the workstation screen immediately prevents physical access to the active session, satisfying the requirement to secure the unattended endpoint during a short absence. Unlike logging off, which terminates applications and sessions, locking preserves the worker's state while requiring re-authentication, making it the proportionate action for a 15-minute break.

Why this answer

Locking the workstation screen (e.g., via Windows+L or Ctrl+Alt+Del) immediately prevents unauthorized physical access to the session while the user is away. It is the fastest, most critical action to protect sensitive data and maintain accountability, and it does not disrupt ongoing work or network connectivity.

Exam trap

FORTINET-NSE123 often tests basic security hygiene, and candidates may overthink by choosing disruptive actions like unplugging cables or powering down instead of the simple, effective screen lock.

How to eliminate wrong answers

Option A is wrong because unplugging the Ethernet cable does not secure the local session; an attacker could still access the unlocked workstation and potentially reconnect the cable. Option C is wrong because powering down the computer is disruptive, may lose unsaved work, and is unnecessary for a short break; locking is sufficient. Option D is wrong because minimizing browser windows does not prevent access to the desktop or other applications, leaving the system vulnerable.

Full explanation →

Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) (FORTINET-NSE123) — Questions 151–225