FORTINET-NSE123 Practice Questions

Question 1

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment. Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 2

What is the primary function of a FortiAuthenticator device?

Accepted Answer

To centralize user authentication, identity services, and token management. FortiAuthenticator is Fortinet's dedicated identity and access management (IAM) appliance. Its core purpose is to centralize authentication (via RADIUS, LDAP, SAML, etc.), provide identity services such as user identification and group mapping, and manage tokens for two-factor authentication (2FA) and one-time passwords (OTP). It acts as a central point for enforcing authentication policies across the Fortinet Security Fabric and third-party devices. Unlike firewalls or sandboxes, it does not inspect traffic for threats or manage network infrastructure.

Answer

To scan incoming network traffic for virus signatures

Answer

To manage physical switch ports and VLANs via FortiLink

Answer

To analyze zero-day files in an isolated virtual sandbox

Question 3

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Accepted Answer

Rearrange existing widgets by dragging and dropping them into preferred positions.. Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget. Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Answer

Convert the dashboard into a command-line terminal emulator.

Answer

Delete physical firewall ports from the dashboard interface view.

Answer

Modify core FortiOS kernel code directly from the dashboard widget settings.

Question 4

When configuring dynamic routing on a FortiGate using OSPF, what is the purpose of defining OSPF areas?

Accepted Answer

To divide routing domains hierarchically, reducing routing overhead and limiting link-state update traffic. OSPF areas divide a routing domain into a two-level hierarchy (backbone Area 0 and other areas) to reduce routing overhead. By summarizing routes at area boundaries, OSPF limits the scope of link-state advertisements (LSAs), reducing CPU, memory, and bandwidth consumption on routers.

Answer

To balance SSL VPN tunnel connections across multiple cluster nodes

Answer

To assign IP addresses dynamically to connected client workstations

Answer

To encrypt firewall policy rules between different physical interfaces

Question 5

An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?

Accepted Answer

Dashboard > System Information widget (System Mode field). The operational mode (NAT vs. Transparent) is displayed in the Dashboard > System Information widget under the System Mode field. The System Information widget on the default dashboard shows key device details including hostname, firmware version, serial number, and the current system mode, making it the correct place to verify whether the FortiGate is in NAT or Transparent mode.

Answer

System > Feature Visibility > NAT Mode

Answer

Network > Operation Mode

Answer

Policy & Objects > Mode Settings

Question 6

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

Accepted Answer

Establish an authorized corporate VPN connection before accessing internal systems.. A corporate VPN creates an encrypted tunnel (typically IPsec or TLS) between the employee's device and the corporate gateway, so any data traversing the untrusted coffee shop Wi-Fi is protected from eavesdropping. Without this encryption layer, an attacker on the same hotspot can capture credentials, session tokens, and sensitive traffic using tools like Wireshark or a rogue AP. The VPN must be established before any internal resource is accessed so that no cleartext traffic leaks onto the public network.

Answer

Enable local file sharing to speed up document syncing over public connections.

Answer

Disable the operating system firewall to allow seamless packet routing through the hotspot.

Answer

Configure the web browser to accept all SSL certificates to bypass public portal warnings.

Question 7

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

Accepted Answer

Encrypting the backup configuration file with a password during export. FortiGate allows administrators to encrypt the configuration backup file with a password during export from the GUI. This ensures that the configuration file, which contains sensitive information like passwords and keys, is protected if intercepted or stored insecurely. The option to encrypt with a password is available when performing a backup via System > Config > Backup.

Answer

Streaming raw system logs to FortiAnalyzer

Answer

Exporting the configuration as an unencrypted plain-text XML file

Answer

Using SNMP v1 to pull configuration binaries over UDP

Question 8

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

Accepted Answer

A long passphrase consisting of random unrelated words and special characters. A long passphrase made of random unrelated words plus special characters maximizes length and entropy while remaining memorable, which is the strongest practice among the options. Length is the primary defense against brute-force and dictionary attacks, and random unrelated words defeat predictable patterns. This aligns with modern guidance from NIST SP 800-63B, which emphasizes length over complexity.

Answer

A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

Answer

A password reused from personal social media accounts to ensure easy recall

Answer

A short word combined with the current year, such as 'Summer2026!'

Question 9

What is the primary purpose of the FortiGuard distribution network in the Fortinet Security Fabric?

Accepted Answer

To deliver real-time threat intelligence updates and security signatures to Fortinet devices. The FortiGuard Distribution Network (FDN) is Fortinet's global threat intelligence infrastructure that pushes real-time updates — antivirus signatures, IPS signatures, web filter categories, and other security content — to FortiGate, FortiMail, FortiClient, and other Fortinet devices. It ensures devices have current protection against emerging threats without manual intervention.

Answer

To synchronize endpoint compliance policies with FortiClient EMS

Answer

To manage administrative user accounts across multiple tenants

Answer

To store archival system audit logs for regulatory compliance

Question 10

An administrator configures a firewall policy with Antivirus enabled in flow-based inspection mode. When a user attempts to download an infected file, how does the FortiGate handle the transfer?

Accepted Answer

It aborts the connection immediately and displays a replacement message to the user. In flow-based inspection mode, when the FortiGate detects an infected file, it aborts the connection immediately and displays a replacement message to the user. This is because flow-based inspection does not buffer the entire file; it scans as data streams and can terminate the session upon detection. The replacement message informs the user why the download failed.

Answer

It drops the packet silently without notifying the user or generating a log

Answer

It buffers the entire file to disk, cleans the file, and then emails the cleaned file to the user

Answer

It allows the download to complete and then quarantines the file locally on the client endpoint

Question 11

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

Accepted Answer

Bandwidth widget. The Bandwidth widget on the FortiGate dashboard is specifically designed to display a historical graph of bandwidth usage (ingress and egress) over selectable time ranges including the last 24 hours. It samples interface throughput counters and renders them as a time-series chart, making it the correct answer for viewing historical traffic trends. This widget is available on the default dashboard and can be customized per admin.

Answer

FortiView Summary

Answer

System > Performance Graphs

Answer

Log & Report > Traffic Graph

Question 12

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Accepted Answer

Leave macros disabled unless the source is fully verified and trusted. The correct action is to leave macros disabled unless the source is fully verified and trusted. Macro-enabled documents are a common attack vector for malware delivery, as macros can execute arbitrary code when enabled. Since the email came from an external partner and the user cannot be certain of its legitimacy, the safest practice is to keep macros disabled and verify the sender through a separate channel before taking any further action.

Answer

Forward the spreadsheet to all company contacts for collaborative viewing

Answer

Print the spreadsheet immediately to a physical printer

Answer

Enable macros immediately so the file displays properly

Question 13

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access. Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 14

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

Accepted Answer

They are stored exclusively on the remote FortiAnalyzer and not on the local FortiGate storage.. When a FortiGate is configured to send logs to FortiAnalyzer and local disk logging is not enabled, the traffic logs are transmitted to the remote FortiAnalyzer and are not retained on the FortiGate's local storage. That is why the administrator sees nothing under Log & Report > Forward Traffic on the FortiGate itself — the logs exist, but on FortiAnalyzer. The correct answer reflects that remote logging destinations receive the logs exclusively when local storage is not configured.

Answer

They are stored in the FortiGate system memory ring buffer.

Answer

They are buffered in RAM and will only flush when the FortiGate reboots.

Answer

They are discarded because local logging is automatically disabled when remote logging is active.

Question 15

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

Accepted Answer

System Resources. The System Resources widget on the FortiGate dashboard is specifically designed to display real-time CPU and memory usage, along with other system-level metrics such as session count and log rate. Adding this widget provides administrators with an at-a-glance view of resource utilization directly on the dashboard. It is the correct choice for monitoring CPU and memory in real time.

Answer

FortiView Sessions

Answer

Log Rate

Answer

License Information

Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) FORTINET-NSE123 practice test

Three ways to study

Study FORTINET-NSE123 by domain

Study FORTINET-NSE123 by topic

Nse 3 Fortigate Operational Fundamentals practice questions

Nse 1 Foundational Cybersecurity Concepts practice questions

Nse 2 Technical Introduction TO Fortinet Security practice questions

FORTINET-NSE123 fundamentals practice questions

FORTINET-NSE123 scenario practice questions

FORTINET-NSE123 troubleshooting practice questions

Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) practice questions