Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) (FORTINET-NSE123) — Questions 226–296

An administrator needs to change the management IP address of the internal interface (e.g., port1) via the CLI. Which sequence of configuration commands is correct?

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

An administrator wants to check the status of HA (High Availability) synchronization between primary and secondary FortiGate units. Which CLI command should be used?

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

Which THREE of the following are common indicators that a system has been compromised by malware?

An administrator needs to verify whether a specific security profile (such as an Antivirus or Web Filter profile) is currently referenced by any firewall policy. Which CLI command helps trace object dependencies?

A network administrator is troubleshooting traffic passing through a FortiGate using the CLI command 'diagnose debug flow'. Before capturing traffic, what command must be executed to ensure the debug output appears in the current CLI session?

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

An administrator wants to view real-time CPU utilization per system process. Which dashboard widget or view helps identify which process is consuming CPU resources?

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

An administrator is troubleshooting a packet flow issue and needs to capture live traffic on the FortiGate CLI. Which THREE parameters or options must be specified when configuring the diagnose sniffer packet command? (Choose three)

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

An administrator needs to verify whether a specific security profile (e.g., Antivirus) is actively inspecting traffic matching a firewall policy. Which CLI command displays the detailed runtime statistics and counter hits for security profiles bound to a policy ID?

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

Which dashboard widget displays the current status and capacity of local storage (hard drive or log disk) on the FortiGate?

An administrator is configuring a new local administrator account with restricted privileges. Where in the web-based manager are administrator accounts and access profiles created and managed?

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

What is the primary function of a FortiSwitch port configured with FortiLink?

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

An administrator wants to flush all current entries from the FortiGate session table to resolve a stubborn state synchronization issue. Which CLI command achieves this?

Which THREE of the following are recognized signs of a potential phishing attempt?

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

An administrator needs to verify the license status and serial number of a managed FortiSwitch connected to the FortiGate. Where can managed switches be viewed in the web-based manager?

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

Which TWO threat intelligence services or features are delivered dynamically by the FortiGuard network? (Choose two.)

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

Which dashboard widget displays the overall hardware status, serial number, firmware version, and system uptime of the FortiGate?

An administrator needs to test whether a specific TCP port is open on a remote server directly from the FortiGate CLI. Which command can be used to test TCP connectivity?

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

What is the primary function of a FortiGate firewall policy source interface setting?

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

An administrator wants to verify the operational status and packet error rates of a specific physical interface (e.g., port2) via CLI. Which command should be used?

An administrator needs to perform a firmware upgrade on a standalone FortiGate. Which TWO best practices should be followed before initiating the upgrade? (Choose two)

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

What is the primary purpose of FortiToken in a Fortinet security solution?

An administrator needs to verify DNS and time synchronization settings to ensure accurate log timestamps and FortiGuard connectivity. Which THREE settings or commands should be verified? (Choose three)

An organization wants to implement the Fortinet Security Fabric to gain centralized visibility across multiple distributed security devices. Which core protocol is utilized by Security Fabric devices to discover, authenticate, and securely communicate with the root FortiGate?

An administrator is troubleshooting a FortiGate device where traffic passing through a specific firewall policy is failing. Which TWO dashboard widgets or monitoring views should the administrator inspect to verify live traffic status and policy hits? (Choose two)

An administrator wants to view a chronological list of all administrator logins, configuration changes, and system alerts. Which log category contains this information?

An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

An administrator needs to verify the status of hardware acceleration (NP processors) and check whether traffic is offloaded to the NP chips. Which CLI command displays NP processor status and offloaded session counters?

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

What is the primary objective of a 'DDoS' attack?

An administrator wants to deploy a wireless network across a corporate campus managed directly by the FortiGate firewall. Which Fortinet technology enables the FortiGate to control and provision FortiAPs directly?

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

When configuring an IPsec VPN tunnel between two FortiGate devices, what is the specific role of Phase 1 negotiation?

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

What is the primary function of a FortiGate interface configured in NAT mode?

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?