Knowledge + Practice

CCNA Nse 2 Technical Introduction To Fortinet Security Questions

30 of 105 questions · Page 2/2 · Nse 2 Technical Introduction To Fortinet Security topic · Answers revealed

Practice these questions Exam hub All questions

76

MCQmedium

A system administrator needs to update the signature databases for Antivirus and IPS on an isolated FortiGate that lacks direct internet connectivity. Which Fortinet product can be deployed locally on the network to act as an offline update distributor?

A.FortiClient EMS deployment server

B.FortiAuthenticator user database server

C.FortiWeb application firewall

D.FortiManager configured as a local FortiGuard distribution server

AnswerD

FortiManager can act as a local FortiGuard distribution server, hosting signature updates for FortiGate devices. This satisfies the isolated-network constraint, since the FortiGate pulls Antivirus and IPS database updates from FortiManager rather than requiring direct internet connectivity.

Why this answer

FortiManager can be configured as a local FortiGuard distribution server to provide signature updates to FortiGates that lack direct internet access. It downloads updates from FortiGuard and then serves them to managed devices on the isolated network. This allows offline updates for antivirus, IPS, and other security services.

Exam trap

FORTINET-NSE123 often tests the role of FortiManager beyond management, specifically its ability to act as a local FortiGuard server, so candidates may overlook this and choose other products.

How to eliminate wrong answers

Option A is wrong because FortiClient EMS is for endpoint management, not for distributing FortiGuard signature updates to FortiGates. Option B is wrong because FortiAuthenticator is for authentication and identity management, not update distribution. Option C is wrong because FortiWeb is a web application firewall, not an update server.

Practice this question →

77

MCQmedium

An administrator needs to back up the FortiGate configuration regularly and securely. Which method allows the administrator to encrypt the configuration file with a password before downloading it from the GUI?

A.Streaming raw system logs to FortiAnalyzer

B.Encrypting the backup configuration file with a password during export

C.Exporting the configuration as an unencrypted plain-text XML file

D.Using SNMP v1 to pull configuration binaries over UDP

AnswerB

FortiOS permits password-based encryption of the configuration file during GUI export, producing an encrypted backup that cannot be read without the passphrase. This satisfies the stem's requirement to back up regularly and securely by protecting the file in transit and at rest.

Why this answer

FortiGate allows administrators to encrypt the configuration backup file with a password during export from the GUI. This ensures that the configuration file, which contains sensitive information like passwords and keys, is protected if intercepted or stored insecurely. The option to encrypt with a password is available when performing a backup via System > Config > Backup.

Exam trap

FORTINET-NSE123 often tests the secure backup process, and candidates might confuse log streaming or SNMP with configuration backup, or overlook the encryption option in the GUI.

How to eliminate wrong answers

Option A is wrong because streaming raw system logs to FortiAnalyzer is for log management, not for backing up the configuration. Option C is wrong because exporting the configuration as an unencrypted plain-text XML file does not provide encryption; it leaves the configuration exposed. Option D is wrong because SNMP v1 is an insecure protocol for monitoring, not for pulling configuration binaries, and it does not support encryption.

Practice this question →

78

MCQhard

When configuring an IPsec VPN tunnel in FortiOS, what is the role of NAT Traversal (NAT-T)?

A.To assign dynamic DHCP addresses to SSL VPN mobile clients

B.To encapsulate ESP packets in UDP (port 4500) when NAT devices exist between VPN peers

C.To translate internal private web server IP addresses to public IPs for inbound users

D.To balance VPN traffic across multiple high availability cluster members

AnswerB

NAT-T encapsulates ESP packets inside UDP port 4500, satisfying the stem's requirement when NAT devices sit between VPN peers. Standard ESP lacks port numbers, so NAT cannot translate it; UDP encapsulation lets the NAT device track the flow and preserves IKE and ESP traversal.

Why this answer

NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams (typically UDP port 4500) so they can pass through NAT devices that would otherwise drop or mangle ESP traffic. This allows IPsec VPN peers behind NAT to establish and maintain tunnels.

Exam trap

FORTINET-NSE123 often tests the confusion between NAT-T and other NAT functions (destination NAT, SSL VPN DHCP) — candidates may pick an answer that describes generic NAT or SSL VPN behavior instead of the specific UDP encapsulation of ESP for IPsec.

How to eliminate wrong answers

Option A is wrong because NAT-T does not assign DHCP addresses to SSL VPN clients; that is a function of SSL VPN configuration and DHCP, unrelated to IPsec NAT-T. Option C is wrong because NAT-T does not perform destination NAT for inbound web servers; that is a separate NAT/port-forwarding function, not NAT-T. Option D is wrong because NAT-T does not balance VPN traffic across HA cluster members; HA load balancing is handled by FGCP, not NAT-T.

Practice this question →

79

MCQmedium

An administrator wants to block specific types of USB or removable storage devices from connecting to corporate laptops. Which Fortinet component manages endpoint device control policies?

A.FortiGate Antivirus profile

B.FortiSwitch port security settings

C.FortiAnalyzer reporting engine

D.FortiClient EMS Device Control profile

AnswerD

The Device Control profile in FortiClient EMS defines which USB and removable storage classes are permitted, blocked, or read-only, and pushes that policy to managed endpoints. This satisfies the stem's requirement to block specific device types on corporate laptops.

Why this answer

FortiClient EMS (Enterprise Management Server) delivers endpoint management profiles, including Device Control profiles that define which USB and removable storage classes are allowed, blocked, or read-only on managed endpoints. The profile is pushed to FortiClient agents on corporate laptops, enforcing the policy at the endpoint.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse network-layer enforcement (FortiGate profiles, FortiSwitch port security) with endpoint-layer enforcement (FortiClient EMS Device Control).

How to eliminate wrong answers

Option A is wrong because a FortiGate antivirus profile inspects traffic traversing the firewall; it cannot control physical USB device attachment on an endpoint. Option B is wrong because FortiSwitch port security governs switch port access (MAC limiting, 802.1X), not removable media on laptops. Option C is wrong because FortiAnalyzer is a logging, reporting, and analytics appliance — it has no endpoint device-control enforcement capability.

Practice this question →

80

MCQmedium

An administrator wants to allow remote workers to securely connect to the internal network using an SSL VPN web portal that presents a customized login page and bookmarks to internal resources. Which SSL VPN mode provides this browser-based access without requiring a pre-installed desktop client?

A.Explicit Proxy Mode

B.SSL VPN Web Mode

C.IPsec Client Mode

D.SSL VPN Tunnel Mode

AnswerB

SSL VPN web mode proxies internal HTTP/HTTPS resources through the FortiGate, rewriting links so users reach bookmarks and a customised portal entirely in a browser. This satisfies the stem's constraint of no pre-installed desktop client, unlike tunnel mode, which requires FortiClient and assigns a virtual adapter for full network-layer access.

Why this answer

SSL VPN Web Mode provides browser-based access through a portal that presents a customizable login page and bookmarks to internal resources (HTTP/HTTPS, RDP, SSH, etc.) without requiring any pre-installed client. It is designed exactly for the scenario described: remote users connecting via a web browser to reach internal resources.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse SSL VPN Web Mode (browser-based, no client) with Tunnel Mode (requires FortiClient) or with unrelated proxy/IPsec modes, causing them to pick Tunnel Mode despite the 'no pre-installed client' clue.

How to eliminate wrong answers

Option A is wrong because Explicit Proxy Mode is a forward-proxy configuration where clients are configured to send web traffic to the FortiGate; it is not an SSL VPN mode and does not provide a portal with bookmarks. Option C is wrong because IPsec Client Mode uses the FortiClient (or another IPsec client) and requires a pre-installed client, which contradicts the 'no pre-installed desktop client' requirement. Option D is wrong because SSL VPN Tunnel Mode requires FortiClient to establish a full tunnel and assign a virtual IP; it is client-based, not browser-based.

Practice this question →

81

MCQmedium

An administrator wants to ensure that internal users attempting to visit known phishing or malware-hosting domains are blocked automatically before establishing a connection. Which security profile should be added to the firewall policy?

A.Data Loss Prevention (DLP) sensor

B.Traffic Shaping rule profile

C.Antivirus signature profile in flow mode

D.Web Filtering profile with malicious domain blocking enabled

AnswerD

A web filtering profile with malicious domain blocking queries FortiGuard ratings and denies requests to known phishing or malware-hosting domains before the connection completes. This satisfies the stem's requirement to block such destinations automatically at the policy level.

Why this answer

A Web Filtering profile with malicious domain blocking enabled uses FortiGuard's categorized URL/domain database to intercept DNS/HTTP requests to known phishing and malware-hosting domains and block them before the connection is established. This is the only profile in the list designed specifically to evaluate destination reputation and deny access to malicious sites at the policy level.

Exam trap

The trap here is confusing 'malware' with antivirus — candidates see 'malware-hosting domains' and reach for the Antivirus profile, but domain-level blocking is a web filtering function, not a signature-scanning function.

How to eliminate wrong answers

Option A is wrong because a DLP sensor inspects outbound content for sensitive data patterns (credit cards, SSNs) and does not maintain a reputation database of phishing or malware domains. Option B is wrong because traffic shaping only prioritizes or throttles bandwidth by matching criteria; it has no concept of domain reputation and cannot block malicious destinations. Option C is wrong because an antivirus profile in flow mode scans file payloads for malware signatures after the connection is established — it does not block the initial connection to a phishing or malware-hosting domain.

Practice this question →

82

MCQeasy

Which Fortinet tool provides a centralized management pane of glass for provisioning, updating, and monitoring multiple FortiGate firewall policies and device configurations across an enterprise?

A.FortiAnalyzer

B.FortiAuthenticator

C.FortiSandbox

D.FortiManager

AnswerD

FortiManager is Fortinet's centralised single-pane-of-glass management platform, satisfying the stem's requirement to provision, update and monitor multiple FortiGate devices and policies enterprise-wide. It pushes configuration and policy packages to managed firewalls, unlike standalone device GUIs or FortiAnalyzer, which focuses on logging and reporting.

Why this answer

FortiManager is Fortinet's centralized management platform that provides a single pane of glass for provisioning, configuring, updating, and monitoring multiple FortiGate devices and their policies. It supports ADOMs to segment management domains and pushes policy packages to managed devices. This matches the described requirement exactly.

Exam trap

FORTINET-NSE123 often tests the FortiManager vs FortiAnalyzer distinction — candidates confuse centralized device/policy management with log analysis and reporting.

How to eliminate wrong answers

Option A is wrong because FortiAnalyzer is focused on log collection, analysis, reporting, and alerting — not device provisioning or policy management. Option B is wrong because FortiAuthenticator provides identity and access management (RADIUS, LDAP, MFA, SSO), not firewall policy management. Option C is wrong because FortiSandbox is a threat-detection/detonation platform for suspicious files and URLs, not a management console.

Practice this question →

83

MCQhard

An enterprise is configuring a redundant multi-WAN architecture on a FortiGate. Which feature allows the FortiGate to automatically measure latency, jitter, and packet loss on multiple internet connections and dynamically steer traffic over the best performing path?

A.RIPv2 hop-count metric calculation

B.SD-WAN Performance SLAs and Link Cost Rules

C.Equal-Cost Multi-Path (ECMP) round-robin hashing

D.Static routing administrative distance metrics

AnswerB

SD-WAN Performance SLAs define health-check probes measuring latency, jitter and packet loss per member link, while Link Cost Rules rank those links. Together they let the FortiGate dynamically steer traffic onto the best-performing path, directly satisfying the stem's requirement for automatic measurement and dynamic path selection across multiple WAN connections.

Why this answer

SD-WAN Performance SLAs in FortiOS allow the FortiGate to continuously probe multiple WAN links for latency, jitter, and packet loss, then use Link Cost Rules to dynamically steer traffic to the best-performing path. This is the core mechanism for intelligent, application-aware WAN selection in a multi-WAN architecture. It goes beyond simple failover by making routing decisions based on real-time link quality.

Exam trap

FORTINET-NSE123 often tests the difference between static load balancing (ECMP) and dynamic performance-based steering (SD-WAN SLA), so candidates must recognize that only SD-WAN measures latency, jitter, and loss.

How to eliminate wrong answers

Option A is wrong because RIPv2 uses hop count as its metric and has no awareness of latency, jitter, or packet loss, making it unsuitable for performance-based WAN steering. Option C is wrong because ECMP performs static round-robin or hash-based load balancing across equal-cost paths without measuring link quality, so it cannot dynamically avoid a degraded link. Option D is wrong because static route administrative distance is a fixed preference value used only for failover when a route disappears, not for continuous performance-based selection.

Practice this question →

84

MCQeasy

When logging into the FortiGate Web-based Manager (GUI) for the first time, what is the default administrator username?

A.administrator

B.supervisor

C.admin

D.root

AnswerC

The FortiGate GUI ships with a single built-in super-admin account named `admin`, created automatically during initialisation with no password. This satisfies the stem's first-login constraint: no prior configuration or external authentication (such as LDAP or RADIUS) exists yet, so only the factory-defined local account can grant Web-based Manager access.

Why this answer

FortiGate appliances ship with a default administrator account whose username is 'admin' and which has no password initially (forcing a password change on first login in recent firmware). This is documented in Fortinet's default credentials and is required knowledge for initial device setup.

Exam trap

FORTINET-NSE123 often tests whether candidates assume a generic default like 'administrator' or 'root' — the trap is that FortiGate uniquely uses 'admin' with a blank initial password.

How to eliminate wrong answers

Option A is wrong because 'administrator' is the default username convention on some other platforms (e.g., Windows), not FortiGate. Option B is wrong because 'supervisor' is not a FortiGate default account. Option D is wrong because 'root' is the default superuser on Linux/Unix systems, not on FortiOS.

Practice this question →

85

MCQeasy

What is the primary function of a FortiSwitch port configured with FortiLink?

A.To connect external ISP routers via PPPoE authentication

B.To scan emails for spam and phishing attachments

C.To tunnel remote worker traffic via IPsec site-to-site protocols

D.To establish a secure management and data connection between a FortiGate and a FortiSwitch

AnswerD

A FortiLink port carries both the management channel and user data between the FortiGate and FortiSwitch, allowing the FortiGate to authorise, provision and monitor the switch. This satisfies the stem's requirement for a secure management and data connection between the two devices.

Why this answer

FortiLink is a protocol that enables a FortiGate to manage and control a FortiSwitch, providing a secure management and data connection between the two devices. It allows the FortiGate to push VLAN, policy, and security configurations to the FortiSwitch, effectively making the switch an extension of the FortiGate's security fabric.

Exam trap

FORTINET-NSE123 often tests the purpose of FortiLink versus other FortiGate interfaces — candidates may confuse it with WAN, VPN, or email security functions because they don't recognize FortiLink as a switch-management protocol.

How to eliminate wrong answers

Option A is wrong because connecting external ISP routers via PPPoE is a WAN interface function on the FortiGate, not a FortiLink port role. Option B is wrong because email scanning for spam and phishing is performed by FortiMail or the FortiGate's email security profiles, not by a FortiSwitch port. Option C is wrong because tunneling remote worker traffic via IPsec site-to-site is a VPN function on the FortiGate, unrelated to FortiLink.

Practice this question →

86

MCQeasy

What is the primary function of a firewall inspection mode that processes packets at Layer 3 and Layer 4 using packet headers without reassembling application streams?

A.Proxy-based inspection

B.Flow-based inspection

C.Deep SSL decryption inspection

D.Sandbox isolation inspection

AnswerB

Flow-based inspection examines packet headers at Layers 3 and 4 and forwards packets without reassembling application streams, unlike proxy-based inspection. This satisfies the stated constraint of processing headers only, delivering higher throughput with less latency.

Why this answer

Flow-based inspection processes packets at Layer 3 and Layer 4 using packet headers without reassembling the application data stream. It is optimized for performance and is the default inspection mode on most FortiGate models, especially those with NP (Network Processor) acceleration.

Exam trap

FORTINET-NSE123 often tests the trade-off between flow-based (performance, header-level) and proxy-based (depth, stream reassembly) inspection — candidates may confuse 'flow-based' with 'deep inspection' or assume proxy mode is always better.

How to eliminate wrong answers

Option A is wrong because proxy-based inspection reassembles and buffers the entire application stream at Layer 7, allowing deeper content inspection but at the cost of higher latency and lower throughput. Option C is wrong because deep SSL decryption inspection is a feature (SSL inspection) that can operate in either flow or proxy mode, not an inspection mode itself. Option D is wrong because sandbox isolation inspection refers to offloading suspicious files to FortiSandbox for detonation, not a packet-processing mode at Layers 3/4.

Practice this question →

87

Multi-Selectmedium

Which TWO threat intelligence services or features are delivered dynamically by the FortiGuard network? (Choose two.)

Select 2 answers

A.FortiClient EMS endpoint installation binaries

B.Web Filtering URL categorization database

C.Physical switch port VLAN assignment maps

D.Antivirus and IPS signature update feeds

E.Microsoft Active Directory user group membership

AnswersB, D

FortiGuard delivers its web filtering URL categorization database dynamically, pushing updated category ratings to FortiGate devices so web filtering policies reflect newly classified sites without manual intervention. This satisfies the stem's requirement for a threat intelligence service delivered dynamically by the FortiGuard network.

Why this answer

Option B is correct because the FortiGuard network dynamically delivers the Web Filtering URL categorization database, which FortiGate devices query in real time (or via locally cached ratings) to classify websites and enforce web filter policies. Option D is correct because FortiGuard also dynamically pushes Antivirus and IPS signature update feeds, allowing FortiGate/FortiClient to receive the latest malware and intrusion prevention signatures without manual intervention. Option A is not delivered by FortiGuard; FortiClient EMS installation binaries are obtained from Fortinet support/EMS deployment packages, not as a dynamic FortiGuard threat intelligence service.

Option C is unrelated, as VLAN assignment maps are configured locally on switches or via management platforms, not provided by FortiGuard. Option E is also unrelated, since Active Directory group membership is provided by on-premises or cloud AD services, not by the FortiGuard network.

Exam trap

FORTINET-NSE123 often tests the distinction between FortiGuard-delivered threat intelligence (URL categories, AV/IPS signatures) and locally-sourced or management-plane data (EMS binaries, VLAN maps, AD groups), so candidates confuse management services with threat feeds.

Practice this question →

88

MCQhard

An organization is deploying an SD-WAN architecture on a FortiGate. When multiple WAN interfaces are combined into an SD-WAN zone, how do firewall policies reference the destination or source of the traffic?

A.Firewall policies must only use static routing next-hop IP addresses

B.Firewall policies are disabled entirely when SD-WAN is enabled

C.Firewall policies reference the SD-WAN zone name instead of individual physical interfaces

D.Firewall policies must reference every physical WAN interface individually in separate rules

AnswerC

Firewall policies reference the SD-WAN zone name, not individual physical interfaces, satisfying the requirement that policies remain stable when member links change. FortiOS abstracts the underlying WAN members behind the zone, so traffic steering, failover and load balancing occur without rewriting rules. This decouples policy from physical topology, which is the core SD-WAN design goal.

Why this answer

When WAN interfaces are members of an SD-WAN zone, firewall policies reference the SD-WAN zone name as the source or destination interface rather than individual physical interfaces. This abstraction lets SD-WAN rules dynamically select the best member link per session without rewriting policies.

Exam trap

The trap is assuming SD-WAN requires per-interface policies or static next-hops, when the whole point of the SD-WAN zone is to abstract member links behind a single logical interface name.

How to eliminate wrong answers

Option A is wrong because SD-WAN policies do not rely solely on static next-hop IPs — SD-WAN rules use performance SLAs, priority, and load-balancing algorithms to choose members dynamically. Option B is wrong because enabling SD-WAN does not disable firewall policies; policies simply reference the SD-WAN zone. Option D is wrong because referencing every physical WAN interface in separate rules defeats the purpose of SD-WAN abstraction and is operationally unmanageable.

Practice this question →

89

MCQeasy

What is the primary function of a FortiGate firewall policy source interface setting?

A.To assign dynamic IP addresses to wireless clients via DHCP

B.To specify the interface from which incoming traffic must originate to match the policy

C.To configure the IPsec VPN Phase 1 encryption keys

D.To determine the MAC address of the destination web server

AnswerB

Traffic must arrive on the named interface for the policy to match, so the source interface acts as a matching criterion rather than a routing or NAT setting. This satisfies the stem's requirement to identify where incoming traffic originates before the policy is evaluated.

Why this answer

The source interface setting in a FortiGate firewall policy specifies which incoming interface traffic must originate from to match the policy. This is a fundamental match criterion: only traffic entering the FortiGate on that interface will be evaluated against the policy. It helps control traffic flow based on network topology.

Exam trap

FORTINET-NSE123 often tests the confusion between source interface and destination interface, or between interface roles in policy matching versus other functions like DHCP.

How to eliminate wrong answers

Option A is wrong because DHCP address assignment is handled by DHCP server settings on an interface, not by firewall policy source interface. Option C is wrong because IPsec VPN Phase 1 encryption keys are configured in VPN settings, not in firewall policies. Option D is wrong because determining the MAC address of a destination server is not the function of a source interface; that is handled by ARP and routing.

Practice this question →

90

Multi-Selectmedium

Which TWO features or protocols are used in Fortinet SD-WAN deployments to optimize multi-path traffic routing? (Choose two.)

Select 2 answers

A.SD-WAN Performance SLAs (monitoring latency, jitter, and packet loss)

B.Telnet remote terminal management protocol

C.POP3 email retrieval protocol

D.SNMP v1 network monitoring traps

E.SD-WAN rules for dynamic path selection

AnswersA, E

Performance SLAs actively probe each WAN link for latency, jitter and packet loss, giving SD-WAN the measurements needed to steer traffic. Without these health metrics, dynamic path selection cannot detect degradation, so the SLA monitoring satisfies the multi-path optimisation requirement.

Why this answer

Option A, SD-WAN Performance SLAs, is correct because FortiGate SD-WAN uses SLA probes (e.g., ICMP, HTTP, or UDP echo) to continuously measure latency, jitter, and packet loss per WAN link, and these live metrics are the foundation for deciding whether a link meets the required quality threshold. Option E, SD-WAN rules for dynamic path selection, is correct because SD-WAN rules define the matching criteria (source/destination, application, user, etc.) and the strategy (best quality, lowest cost, load balance, or SLA-based) that tells the FortiGate which member link to steer traffic over, enabling dynamic multi-path routing. Option B, Telnet, is an insecure cleartext remote terminal protocol unrelated to path selection or WAN link quality measurement.

Option C, POP3, is a mail retrieval protocol with no role in SD-WAN traffic steering. Option D, SNMP v1 traps, is a legacy monitoring/notification mechanism and does not perform the per-link SLA measurement or dynamic path selection that Fortinet SD-WAN relies on.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse generic network-management protocols (SNMP, Telnet, POP3) with the SD-WAN-specific SLA and rule constructs that actually drive multi-path routing decisions.

Practice this question →

91

MCQmedium

A security analyst needs to ensure that endpoints connected to the corporate network have an active, up-to-date FortiClient security agent installed before granting network access. Which Fortinet component manages endpoint compliance and synchronization with the Fortinet Security Fabric?

A.FortiSandbox

B.FortiAnalyzer

C.FortiManager

D.FortiClient EMS

AnswerD

FortiClient EMS centrally manages endpoint compliance and synchronises telemetry with the Security Fabric, so the FortiGate can verify an active, up-to-date FortiClient before granting access. This satisfies the stem's requirement for compliance checking and Fabric synchronisation.

Why this answer

FortiClient EMS (Endpoint Management Server) is the centralized management platform specifically designed to manage FortiClient endpoints, enforce compliance policies (such as requiring an active, up-to-date FortiClient agent), and synchronize endpoint security status with the Fortinet Security Fabric. It acts as the authoritative source for endpoint compliance, enabling integration with FortiGate and other Fabric components to grant or deny network access based on endpoint posture. Unlike other Fortinet products, EMS is purpose-built for endpoint management and compliance enforcement.

Exam trap

The trap here is confusing FortiManager (which manages network devices like FortiGate) with FortiClient EMS (which manages endpoints), as both are centralized management solutions but for different targets.

How to eliminate wrong answers

Option A is wrong because FortiSandbox is a threat detection and analysis appliance that detonates suspicious files in a sandbox environment; it does not manage endpoint agents or compliance. Option B is wrong because FortiAnalyzer is a log collection, analysis, and reporting platform; it provides visibility and forensic data but does not enforce endpoint compliance or synchronize endpoint agents. Option C is wrong because FortiManager is a centralized management tool for FortiGate devices and other network security appliances, not for endpoint agents like FortiClient; it handles device configuration and policy for firewalls, not endpoint posture.

Practice this question →

92

MCQmedium

A network administrator is deploying FortiGate next-generation firewalls at the perimeter and wants to inspect encrypted traffic for malware without breaking user privacy for banking and healthcare sites. The administrator plans to use SSL inspection but needs to avoid decrypting sensitive categories. Which FortiGate feature should be used to selectively bypass decryption for specific website categories?

A.SSL inspection exemption list based on FortiGuard categories

B.Deep packet inspection with protocol anomaly detection

C.Web filter profile with category-based blocking

D.Application control with SSL inspection enabled for all applications

AnswerA

The SSL inspection exemption list allows administrators to specify FortiGuard web filter categories or specific URLs that should not be decrypted. This meets the requirement to bypass decryption for banking and healthcare sites while still inspecting other traffic. It is configured under Security Profiles > SSL/SSH Inspection and is the correct approach for selective SSL inspection.

Why this answer

Selective SSL inspection is achieved by configuring an SSL inspection profile with an exemption list that includes FortiGuard categories such as Finance and Health. This allows the FortiGate to skip decryption for those categories while still decrypting and inspecting other traffic. The other options either do not involve decryption or lack category-based exemption capabilities.

Exam trap

The trap here is assuming that a web filter profile alone can control SSL decryption, when decryption exemptions are configured separately in the SSL inspection profile.

Practice this question →

93

MCQeasy

What is the primary purpose of FortiToken in a Fortinet security solution?

A.To accelerate encryption performance for IPsec VPN tunnels

B.To cache web filtering categories locally on the firewall

C.To quarantine infected endpoints automatically

D.To provide two-factor authentication (2FA) for secure user logins

AnswerD

FortiToken generates time-based one-time passwords or push approvals, supplying the second authentication factor alongside a user's password. This delivers two-factor authentication for FortiGate, FortiClient and Microsoft Entra ID logins, satisfying the stem's requirement for secure user logins by preventing credential-only compromise.

Why this answer

FortiToken is Fortinet's hardware or software one-time password (OTP) token that generates time-based codes for two-factor authentication. It integrates with FortiGate and FortiAuthenticator to add a second factor beyond username/password, securing VPN, SSL-VPN, and administrative logins. The token uses TOTP (RFC 6238) or HOTP (RFC 4226) to produce codes that are validated against the FortiGate's token seed, ensuring only the legitimate token holder can authenticate.

Exam trap

The trap here is confusing FortiToken with other Fortinet security fabric components that handle encryption, web filtering, or endpoint quarantine, so candidates must remember that FortiToken is strictly an authentication token for 2FA.

How to eliminate wrong answers

Option A is wrong because encryption acceleration for IPsec VPN tunnels is handled by dedicated hardware such as FortiASIC NP processors or software offload, not by FortiToken, which is an authentication token. Option B is wrong because local caching of web filtering categories is a function of the FortiGuard web filter cache on the FortiGate, not FortiToken; FortiToken has no role in content filtering. Option C is wrong because automatic endpoint quarantine is performed by FortiClient EMS or FortiNAC through endpoint compliance and remediation policies, not by FortiToken, which only provides OTP codes for authentication.

Practice this question →

94

MCQmedium

A security administrator is configuring a FortiGate to inspect traffic for malicious files. The administrator wants to ensure that files are analyzed in a sandbox environment to detect zero-day threats. Which Fortinet product should be integrated with the FortiGate to provide this sandboxing capability?

A.FortiClient

B.FortiManager

C.FortiSandbox

D.FortiAnalyzer

AnswerC

FortiSandbox is Fortinet's dedicated sandboxing solution that detonates suspicious files in a safe, isolated environment to detect zero-day malware and advanced threats. When integrated with a FortiGate, it receives files for analysis and returns verdicts, enabling the FortiGate to block malicious content. This directly fulfills the requirement for sandbox analysis of files.

Why this answer

FortiSandbox is the Fortinet product designed for sandboxing suspicious files. Integration with FortiGate allows automatic submission of files for analysis, and verdicts are used to block zero-day attacks. FortiAnalyzer, FortiManager, and FortiClient do not provide sandboxing, so they are incorrect for this scenario.

Exam trap

The trap here is assuming that any Fortinet security product can perform sandboxing, when in fact only FortiSandbox is purpose-built for that function.

Practice this question →

95

MCQeasy

An administrator notices that users are accessing unauthorized social media websites during work hours. Which security profile feature should be configured on the FortiGate to block access to these specific categories of websites?

A.DNS Filter profile

B.Web Filtering profile

C.IPS sensor

D.Antivirus profile

AnswerB

A web filtering profile inspects HTTP and HTTPS requests and blocks them by URL category, so social media categories can be denied during work hours. It is the FortiGate feature that classifies and controls access to specific website categories.

Why this answer

A Web Filtering profile on the FortiGate allows administrators to block or allow access to specific website categories, such as social media, based on FortiGuard categories or custom URL lists. It is the correct feature to enforce acceptable use policies and restrict unauthorized browsing.

Exam trap

FORTINET-NSE123 often tests the difference between Web Filtering and DNS Filter, and candidates may choose DNS Filter for category-based blocking when Web Filtering is the correct profile.

How to eliminate wrong answers

Option A is wrong because DNS Filter profile blocks malicious or unwanted domains based on DNS queries, but it is not designed for granular category-based web blocking. Option C is wrong because an IPS sensor detects and prevents network intrusions and exploits, not website categorization. Option D is wrong because an Antivirus profile scans for malware in files and traffic, not for website categories.

Practice this question →

96

Multi-Selectmedium

Which TWO of the following statements correctly describe core concepts of the Fortinet Security Fabric? (Choose two.)

Select 2 answers

A.It relies entirely on offline flat-file backups for threat intelligence exchange.

B.It provides broad visibility, automated threat detection, and synchronized remediation across distributed security devices.

C.It requires manual command-line scripting on every downstream device to share threat intelligence feeds.

D.It only supports Fortinet hardware appliances and excludes integration with third-party APIs or virtual machines.

E.It integrates disparate security solutions into a single collaborative architecture to reduce operational complexity.

AnswersB, E

The Security Fabric delivers broad visibility, automated threat detection, and synchronised remediation across distributed security devices. This matches the stem's core-concept requirement by describing the Fabric's integrated detection and response capability spanning the entire network, rather than a single-device function.

Why this answer

Option B is correct because the Fortinet Security Fabric is designed to deliver broad network visibility, automated threat detection, and coordinated, synchronized remediation across distributed security devices through Fabric-enabled products and the Fabric Connectors/automation stitches. Option E is correct because the Security Fabric integrates disparate security solutions—FortiGate, FortiAnalyzer, FortiManager, FortiSandbox, endpoint, and third-party products via APIs—into a single collaborative architecture that centralizes management and reduces operational complexity. The unmarked options do not belong: A is wrong because threat intelligence exchange in the Fabric is real-time and automated, not based on offline flat-file backups; C is wrong because the Fabric uses automated Fabric Connectors and Security Fabric automation rather than manual CLI scripting on every downstream device; and D is wrong because the Fabric supports virtual machines, public cloud, and third-party API integrations, not only Fortinet hardware appliances.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse the Security Fabric's automated, API-driven integration model with legacy manual approaches like flat-file threat feeds or per-device CLI scripting.

Practice this question →

97

Multi-Selecthard

Which THREE protocols or technologies are commonly used to establish secure remote access VPNs on a FortiGate? (Choose three.)

Select 3 answers

A.Telnet plain-text management

C.FortiClient VPN tunneling

D.HTTP unencrypted web browsing

AnswersB, C, E

SSL VPN runs over TLS on TCP 443, letting remote users reach internal resources through a browser or FortiClient without a separate IPsec client. It satisfies the stem's requirement for a secure remote access VPN technology supported on FortiGate.

Why this answer

SSL VPN (B) is correct because FortiGate supports TLS-based SSL VPN portals and tunnel mode, allowing remote users to access internal resources securely over HTTPS (TCP 443). FortiClient VPN tunneling (C) is correct because FortiClient is Fortinet's endpoint client that establishes both SSL VPN and IPsec VPN tunnels to a FortiGate, providing encrypted remote access with features like split tunneling and two-factor authentication. IPsec VPN (E) is correct because FortiGate natively supports IPsec site-to-site and dial-up VPNs using IKE (UDP 500/4500) and ESP, which is a standard secure remote access technology.

Telnet (A) is not a VPN technology and transmits management traffic in plain text, so it provides no encryption or secure remote access. HTTP unencrypted web browsing (D) is likewise a cleartext application protocol, not a tunneling or VPN technology, and cannot establish a secure remote access tunnel.

Exam trap

FORTINET-NSE123 often tests the protocols used for VPNs, and candidates might include insecure protocols like Telnet or HTTP, or miss that FortiClient VPN tunneling is a distinct method.

Practice this question →

98

MCQhard

When configuring an IPsec VPN tunnel between two FortiGate devices, what is the specific role of Phase 1 negotiation?

A.To assign dynamic virtual IP addresses to remote SSL VPN client workstations

B.To authenticate the two VPN peers and establish a secure management channel (ISAKMP SA)

C.To encrypt actual user data packets traversing the VPN using IPsec ESP protocols

D.To perform DNS name resolution for remote peer public IP addresses

AnswerB

Phase 1 performs IKE peer authentication and negotiates the ISAKMP SA, creating the secure management channel that protects Phase 2. This satisfies the stem's requirement by establishing the encrypted tunnel over which subsequent Quick Mode exchanges securely negotiate the actual IPsec data SAs.

Why this answer

IPsec Phase 1 (IKE Phase 1) negotiates and authenticates the two VPN peers, establishing the ISAKMP Security Association (SA) that protects subsequent Phase 2 negotiations. It uses main mode or aggressive mode to agree on encryption/hashing algorithms, perform authentication (pre-shared key or certificates), and derive keys for the management tunnel. Only after Phase 1 succeeds can Phase 2 build the actual IPsec SAs for data.

Exam trap

FORTINET-NSE123 often tests the Phase 1 vs Phase 2 distinction — candidates incorrectly attribute data encryption (ESP) to Phase 1 when that is actually Phase 2's job.

How to eliminate wrong answers

Option A is wrong because assigning virtual IPs to SSL VPN clients is a function of SSL VPN portal configuration, not IPsec Phase 1. Option C is wrong because encrypting user data with ESP happens in Phase 2, which establishes the IPsec SAs using the protected channel built in Phase 1. Option D is wrong because DNS resolution is a general networking function and is not part of IKE Phase 1 negotiation.

Practice this question →

99

Multi-Selecthard

Which THREE parameters must be configured identically on both peers to successfully establish an IPsec Phase 1 tunnel? (Choose three.)

Select 3 answers

A.System time zone offset in hours

B.Encryption and hashing algorithms (e.g., AES-256 and SHA-256)

C.Authentication method and Pre-Shared Key (or certificates)

D.Diffie-Hellman (DH) group

E.FortiGate administrator username

AnswersB, C, D

Phase 1 negotiation fails unless both peers propose matching encryption and hashing algorithms for the IKE security association. Identical values such as AES-256 and SHA-256 satisfy the stem's constraint, since mismatched proposals cause the tunnel to fail during negotiation.

Why this answer

In IPsec Phase 1 (IKE SA negotiation), both peers must agree on the encryption and hashing algorithms (e.g., AES-256 and SHA-256), so option B is correct because mismatched proposals cause the IKE negotiation to fail. Option C is correct because the authentication method (pre-shared key or certificates) and the matching PSK/certificate credentials must be identical or mutually trusted on both peers for authentication to succeed. Option D is correct because the Diffie-Hellman group determines the key exchange parameters and must match on both sides to derive the shared secret.

Option A is not required because IKE uses timestamps/anti-replay windows rather than requiring identical time zone offsets, and option E is irrelevant since the FortiGate administrator username is a local management credential, not an IPsec Phase 1 parameter.

Exam trap

FORTINET-NSE123 often tests whether candidates include irrelevant items like time zone or admin username as required matching parameters, when only the cryptographic proposal, authentication, and DH group must match.

Practice this question →

100

MCQeasy

What is the primary function of a FortiGate interface configured in NAT mode?

A.To route traffic between different subnets and perform Network Address Translation (NAT)

B.To provide wireless access point management via CAPWAP

C.To bridge Ethernet frames at Layer 2 without performing routing or IP translation

D.To act as a dedicated storage volume for FortiAnalyzer log archives

AnswerA

A NAT-mode interface operates at layer 3, routing packets between distinct subnets while translating source or destination IP addresses. This satisfies the stem's requirement for both inter-subnet forwarding and address translation, unlike transparent mode, which bridges traffic at layer 2 without altering IP headers.

Why this answer

A FortiGate interface in NAT mode is a Layer 3 routed interface — it holds an IP address, participates in routing decisions, and applies source NAT (and optionally destination NAT via VIPs) to traffic crossing it. This is the default and most common interface mode on a FortiGate, and it is what allows the device to act as a firewall/router between the LAN and WAN.

Exam trap

The trap here is confusing NAT mode with transparent mode — candidates who see 'bridge Ethernet frames' or 'no IP translation' may incorrectly associate those with NAT mode when they actually describe transparent mode.

How to eliminate wrong answers

Option B is wrong because CAPWAP management of FortiAPs is handled by the FortiGate's wireless controller function, not by the NAT-mode property of an interface; an interface can be NAT mode without any wireless role. Option C is wrong because bridging Ethernet frames at Layer 2 without routing or IP translation describes an interface in transparent mode, which is the opposite of NAT mode. Option D is wrong because FortiAnalyzer log storage is a separate appliance/VM function; FortiGate interfaces do not serve as storage volumes for FortiAnalyzer archives.

Practice this question →

101

MCQmedium

An administrator needs to ensure that critical administrative login events and firewall configuration changes generate an immediate real-time alert email. Where are email alert settings configured on the FortiGate?

A.Inside the individual firewall policy rule settings

B.Inside the FortiGuard subscription server parameters

C.Within the static routing table configuration

D.Under System > Alert Email settings

AnswerD

System > Alert Email settings defines the mail server and recipient addresses, and enables categories such as administrative login events and configuration changes to trigger immediate notification. This satisfies the stem's real-time alerting requirement without relying on scheduled log reports or FortiAnalyzer queries.

Why this answer

FortiGate alert email settings are configured globally under System > Alert Email, where the administrator defines the SMTP server, recipient addresses, and which event categories (such as admin login events and configuration changes) trigger an email. This centralized location allows the FortiGate to send real-time notifications for critical events without needing per-policy configuration. The alert email feature is a built-in logging and notification mechanism that operates independently of firewall policies.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse global system-level notification settings with per-policy or per-interface logging options, leading them to pick a policy-based answer.

How to eliminate wrong answers

Option A is wrong because firewall policy rules control traffic flow and security profiles, not global alert email delivery; there is no email alert configuration inside a policy. Option B is wrong because FortiGuard subscription parameters relate to signature and database updates, not email notification settings. Option C is wrong because the static routing table only defines next-hop paths for packets and has nothing to do with alert email generation or delivery.

Practice this question →

102

Multi-Selecthard

Which THREE features are provided by FortiClient EMS when integrated into the Fortinet Security Fabric? (Choose three.)

Select 3 answers

A.Endpoint compliance and quarantine enforcement

B.Centralized FortiGate firewall policy compilation

C.Syslog server log aggregation for routers

D.Endpoint vulnerability scanning

E.Security Fabric endpoint telemetry sharing

AnswersA, D, E

FortiClient EMS enforces endpoint compliance by assessing each endpoint against configured posture rules, then triggering quarantine through the Security Fabric when a device fails. This satisfies the stem's compliance enforcement requirement, isolating non-compliant endpoints via dynamic address groups and Fabric connectors rather than relying on manual remediation.

Why this answer

Option A is correct because FortiClient EMS acts as the endpoint management server that evaluates endpoints against compliance profiles (for example, antivirus, patch, and OS requirements) and can trigger quarantine actions—such as dynamic address group assignment or restricted access—when an endpoint fails compliance. Option D is correct because FortiClient EMS provides endpoint vulnerability scanning, using FortiClient's vulnerability scan engine to detect missing patches and vulnerable software on managed endpoints and report those findings to the EMS console. Option E is correct because, when integrated into the Fortinet Security Fabric, FortiClient EMS shares endpoint telemetry (identity, compliance status, and threat information) with FortiGate and other Fabric devices via the Fabric connector, enabling coordinated enforcement and visibility.

Option B is not correct because firewall policy compilation is performed locally by FortiGate (or centrally via FortiManager), not by FortiClient EMS. Option C is not correct because syslog aggregation for routers is a logging function typically handled by FortiAnalyzer or a dedicated syslog server, not by FortiClient EMS.

Exam trap

FORTINET-NSE123 often tests Security Fabric component roles — candidates attribute FortiManager or FortiAnalyzer functions (policy compilation, Syslog aggregation) to FortiClient EMS.

Practice this question →

103

MCQeasy

An administrator is setting up a FortiGate firewall and needs to define the security posture for traffic flowing from the internal network to the external Internet. Which object type should the administrator configure to enforce unified threat management features such as Antivirus, Web Filtering, and Intrusion Prevention on that traffic?

A.Virtual Domain (VDOM)

B.Security Profile

C.Interface Zone

D.Firewall Schedule

AnswerB

Security profiles bind Antivirus, Web Filtering and Intrusion Prevention into a single UTM policy component, then get attached to a firewall policy governing the internal-to-external flow. This directly satisfies the stem's requirement to enforce unified threat management on that traffic, since the profile itself holds the inspection settings the policy applies.

Why this answer

A Security Profile is the object type that bundles UTM features such as Antivirus, Web Filtering, and Intrusion Prevention (IPS) and is applied to a firewall policy to enforce unified threat management on matching traffic. It allows the administrator to define the security posture for traffic from internal to external. This is the correct object for enforcing UTM on a policy.

Exam trap

FORTINET-NSE123 often tests the difference between policy objects (security profiles) and structural objects (VDOMs, zones, schedules), so candidates who pick VDOM or Interface Zone confuse logical partitioning with UTM enforcement.

How to eliminate wrong answers

Option A is wrong because a Virtual Domain (VDOM) is a logical partitioning of the FortiGate, not a UTM enforcement object. Option C is wrong because an Interface Zone groups interfaces for policy convenience, not for applying UTM profiles. Option D is wrong because a Firewall Schedule defines when a policy is active, not the UTM security features applied to traffic.

Practice this question →

104

MCQmedium

An administrator wants to ensure that specific internal users can access the internet while others cannot, based on their Active Directory group membership. How can this access control be implemented on a FortiGate?

A.By modifying the physical interface speed settings

B.By editing the static routing table metrics

C.By adding the AD user group to the source field of the firewall policy

D.By applying an Antivirus security profile to the interface

AnswerC

Referencing the Active Directory user group in the policy's source field makes the FortiGate evaluate group membership, permitting only matching users outbound. This satisfies the stem's requirement that access be granted or denied based on AD group membership.

Why this answer

On a FortiGate, firewall policies can use Active Directory user groups as the source, allowing the device to enforce access based on AD group membership. When a user authenticates (via FSSO, LDAP, or captive portal), the FortiGate maps the user to their AD groups and matches the policy accordingly. This lets you permit internet access for one group while denying it for another without changing routing or interface settings.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse identity-based firewall policies with interface or routing configurations, leading them to pick options that alter traffic flow rather than user authorization.

How to eliminate wrong answers

Option A is wrong because physical interface speed settings affect link negotiation (e.g., 100 Mbps vs 1 Gbps) and have no bearing on user-based access control. Option B is wrong because static route metrics influence path selection for routing decisions, not which users are allowed to pass traffic. Option D is wrong because an Antivirus security profile inspects traffic for malware but does not perform identity-based access control — it applies to traffic that is already permitted by a policy.

Practice this question →

105

MCQhard

An enterprise requires authentication of remote users connecting via SSL VPN against a Microsoft Active Directory server. Which Fortinet component can be deployed to synchronize user credentials and provide single sign-on (SSO) services?

A.FortiAuthenticator

B.FortiWeb application firewall

C.FortiAnalyzer reporting engine

D.FortiManager policy server

AnswerA

FortiAuthenticator synchronises users from Microsoft Active Directory via LDAP or FSSO agents, then brokers Kerberos-based SSO for SSL VPN authentication. It satisfies the stem's requirement to both sync credentials and deliver SSO, unlike FortiGate local groups or RADIUS-only setups, which authenticate without directory synchronisation or single sign-on.

Why this answer

FortiAuthenticator is Fortinet's dedicated identity and access management appliance, designed to integrate with external directories such as Microsoft Active Directory via LDAP/RADIUS. It synchronizes user credentials and can act as an SSO (Single Sign-On) provider, issuing tokens and supporting protocols like SAML, Kerberos, and RADIUS for SSL VPN authentication. This makes it the correct component for authenticating remote SSL VPN users against AD with SSO.

Exam trap

FORTINET-NSE123 often tests the confusion between FortiAuthenticator (identity/SSO) and FortiManager (centralized device management), so candidates may incorrectly pick FortiManager for user authentication tasks.

How to eliminate wrong answers

Option B is wrong because FortiWeb is a web application firewall (WAF) that protects web servers from attacks like SQL injection and XSS; it does not provide user credential synchronization or SSO for SSL VPN. Option C is wrong because FortiAnalyzer is a logging, reporting, and analytics appliance; it collects and correlates logs but has no role in authenticating users or synchronizing AD credentials. Option D is wrong because FortiManager is a centralized management platform for FortiGate devices; it pushes policies and configurations but does not perform user authentication or SSO services.

Practice this question →

← PreviousPage 2 of 2 · 105 questions total

Ready to test yourself?

Try a timed practice session using only Nse 2 Technical Introduction To Fortinet Security questions.

Start 20-question session