CCNA Nse 3 Fortigate Operational Fundamentals Questions

MCQmedium

A junior administrator accidentally locked themselves out of the FortiGate CLI after multiple incorrect password attempts. What is the standard administrative method to recover access without losing the configuration?

A.Perform a hardware factory reset using the pinhole reset button.

B.Use the default factory IP address 192.168.1.99 via HTTPS.

C.Wait for the lockout timer to expire, which defaults to 24 hours.

D.Log in via the physical console port using the 'maintainer' login procedure during a device reboot.

AnswerD

The maintainer account is a hard-coded recovery login accepted only on the physical console during the boot sequence, so it bypasses the locked-out admin credentials entirely while leaving the saved configuration intact, satisfying the no-configuration-loss constraint.

Why this answer

The standard recovery method for a locked-out FortiGate administrator without losing configuration is to connect via the physical console port and use the 'maintainer' login procedure during a reboot. This involves rebooting the device, interrupting the boot process, and logging in with the maintainer account to reset the admin password or unlock the account while preserving the configuration.

Exam trap

FORTINET-NSE123 often tests the misconception that a factory reset or waiting for a lockout timer is the standard recovery method, when the maintainer console procedure is the correct non-destructive approach.

How to eliminate wrong answers

Option A is wrong because a hardware factory reset erases all configuration, which violates the requirement to recover access without losing the configuration. Option B is wrong because the default factory IP 192.168.1.99 is only available on a factory-reset device and does not help recover a locked-out configured device. Option C is wrong because the default lockout timer is not 24 hours; FortiGate lockout duration is configurable and typically much shorter, and waiting does not guarantee access if the lockout is indefinite or the admin account is disabled.

Practice this question →

Multi-Selectmedium

An administrator needs to configure local administrator accounts with specific operational privileges. Which TWO elements are required or configurable when creating a new local administrator account? (Choose two)

Select 2 answers

A.Administrator username

B.Firewall policy source IP object

C.Administrator access profile (defining permissions and privileges)

D.DHCP lease pool range

E.SSL VPN portal bookmark

AnswersA, C

The administrator username is the mandatory unique identifier required when creating any local administrator account on the FortiGate. Without it, the account cannot be created, satisfying the requirement to configure local administrator accounts with specific operational privileges.

Why this answer

When creating a new local administrator account, the administrator username (Option A) is a required element because it uniquely identifies the account on the device and is used for authentication and audit logging. The administrator access profile (Option C) is also required/configurable because it defines the permissions and privileges assigned to that account, such as read-only, read-write, or super-admin scope, which is exactly what the scenario demands for 'specific operational privileges.' Options B, D, and E are unrelated to local administrator account creation: a firewall policy source IP object (B) is used in security policy rules, a DHCP lease pool range (D) configures dynamic IP address assignment for clients, and an SSL VPN portal bookmark (E) defines web resources presented to remote VPN users, none of which are part of defining a local admin account's identity or privileges.

Exam trap

FORTINET-NSE123 often tests the confusion between administrator account attributes and unrelated network service configurations, so candidates might mistakenly select options like firewall policy source IP objects or DHCP pools that are not part of admin account creation.

Practice this question →

MCQmedium

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

A.execute ping-packet

B.execute trace-route

C.get system interface traffic

D.diagnose sniffer packet

AnswerD

The diagnose sniffer packet command captures live packets at the interface level from the CLI, letting the administrator inspect traffic on the specific interface. It directly satisfies the requirement to capture live packet data without external tools.

Why this answer

The FortiGate CLI command 'diagnose sniffer packet' captures live packets on a specified interface, allowing administrators to inspect traffic in real time. It supports filters, verbosity levels, and interface selection, making it the correct tool for troubleshooting intermittent latency at the packet level.

Exam trap

FORTINET-NSE123 often tests the exact CLI syntax for packet capture, and candidates may confuse 'diagnose sniffer packet' with non-existent commands like 'execute ping-packet' or 'get system interface traffic'.

How to eliminate wrong answers

Option A is wrong because 'execute ping-packet' is not a valid FortiGate CLI command; ping is executed via 'execute ping' or 'execute ping-options'. Option B is wrong because 'execute trace-route' is not a valid command; traceroute is performed with 'execute traceroute'. Option C is wrong because 'get system interface traffic' displays interface statistics and counters, not live packet captures.

Practice this question →

MCQeasy

An administrator needs to verify the current firmware version running on the FortiGate. Where can this information be found immediately upon logging into the dashboard?

A.Dashboard > System Information widget

B.Log & Report > System Events

C.Policy & Objects > Addresses

D.Network > Interfaces

AnswerA

The System Information widget on the dashboard displays the running firmware version, hostname, serial number and uptime immediately after login, satisfying the requirement to verify the current firmware version without navigating to separate configuration menus or running CLI commands.

Why this answer

The Dashboard's System Information widget displays the FortiGate's hostname, firmware version, serial number, uptime, and system resource usage immediately after login. This is the fastest way to verify the running firmware build.

Exam trap

The trap is that candidates may look for firmware under Log & Report or Network menus, not realizing the dashboard's System Information widget is the immediate, default source.

How to eliminate wrong answers

Option B is wrong because Log & Report > System Events contains event log entries, not a live firmware version display — you would only see firmware info there if it was logged during an upgrade. Option C is wrong because Policy & Objects > Addresses manages firewall address objects, unrelated to firmware version. Option D is wrong because Network > Interfaces shows interface configuration and status, not the FortiOS firmware build.

Practice this question →

MCQeasy

Where can an administrator view a summary of detected security threats, such as blocked malware and intrusion prevention events, in the FortiGate web-based manager?

A.Log & Report > Security Logs

B.System > FortiGuard

C.Dashboard > Threat Map

D.Policy & Objects > Security Profiles

AnswerA

Security Logs aggregate IPS, antivirus and other UTM event records, presenting blocked malware and intrusion detections in one view. It satisfies the stem's requirement to see a summary of detected threats in the web-based manager.

Why this answer

In the FortiGate web-based manager (GUI), security threat summaries—including blocked malware, IPS events, and other UTM logs—are found under Log & Report > Security Logs. This section aggregates logs from all security profiles (antivirus, IPS, web filter, etc.) and provides filtering, drill-down, and visualization of detected threats. It is the central location for reviewing security events in real time or historically.

Exam trap

The trap here is confusing the configuration location (Security Profiles) with the monitoring location (Security Logs), or assuming that the Threat Map provides detailed logs rather than just a visual overview.

How to eliminate wrong answers

Option B is wrong because System > FortiGuard is used to configure FortiGuard subscription services (e.g., license status, update schedules), not to view security logs. Option C is wrong because Dashboard > Threat Map is a widget that displays a geographical map of attacks, but it does not provide a detailed summary or log of detected threats; it is a high-level visualization. Option D is wrong because Policy & Objects > Security Profiles is where you configure security profiles (e.g., antivirus, IPS) and apply them to policies, not where you view logs of detected events.

Practice this question →

MCQmedium

An administrator needs to check the status of FortiCare registration and feature licenses. Where in the web-based manager is this license summary displayed?

A.Policy & Objects > Licenses

B.Security Fabric > Registration

C.System > FortiGuard

D.Log & Report > License Audit

AnswerC

System > FortiGuard displays the licence summary, including FortiCare registration status and the entitlements for each subscribed service. This satisfies the administrator's need to verify registration and feature licences from one page in the web-based manager, rather than checking separate per-feature configuration screens.

Why this answer

The System > FortiGuard page in the FortiGate web-based manager displays the FortiCare registration status along with the status and expiry of feature licenses such as FortiGuard security services (AV, IPS, Web Filtering, etc.). This is where administrators confirm that support and subscription entitlements are active.

Exam trap

The trap is that candidates may assume license information lives under a 'Licenses' or 'Registration' menu, when FortiOS actually consolidates FortiCare and FortiGuard subscription status under System > FortiGuard.

How to eliminate wrong answers

Option A is wrong because Policy & Objects > Licenses is not a valid FortiOS menu path — Policy & Objects deals with firewall policies, addresses, and services, not license status. Option B is wrong because Security Fabric > Registration does not exist as a license summary page; Security Fabric covers fabric topology and device authorization. Option D is wrong because Log & Report > License Audit is not a FortiOS menu — Log & Report handles logs, events, and reports, not license summaries.

Practice this question →

Multi-Selecteasy

Which TWO dashboard widgets are commonly used to monitor system performance and health on a FortiGate?

Select 2 answers

A.FortiView Source IPv4

B.System Information

C.System Resources

D.IPsec Monitor

E.DHCP Leases

AnswersB, C

The System Information widget displays uptime, hostname, firmware version and administrative status, giving a consolidated health snapshot. It satisfies the requirement to monitor system performance and health by surfacing core device state directly on the dashboard.

Why this answer

The System Information widget is correct because it displays core health data such as CPU usage, memory usage, uptime, and session count on the FortiGate dashboard. The System Resources widget is also correct because it provides real-time graphs of CPU, memory, and session usage, which are key indicators of system performance and health. FortiView Source IPv4 is not correct because it is a traffic-analysis view showing top source IPs, not a system health monitor.

IPsec Monitor is not correct because it tracks VPN tunnel status rather than overall system performance. DHCP Leases is not correct because it lists assigned DHCP addresses, which is a service detail, not a performance/health metric.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse traffic-analysis widgets (FortiView, IPsec Monitor) with device-health widgets (System Information, System Resources) — the exam expects you to separate 'what the box is doing' from 'what traffic is flowing'.

Practice this question →

MCQeasy

An administrator needs to quickly check the CPU and memory utilization of a FortiGate device directly from the web-based manager. Which dashboard widget provides this real-time system performance information by default?

A.FortiView Sessions

B.System Resources

C.License Information

D.Network Interfaces

AnswerB

The System Resources widget displays real-time CPU and memory utilisation directly on the FortiGate dashboard, satisfying the requirement to check performance from the web-based manager. It is enabled by default, unlike other widgets that require manual addition, so the administrator gains immediate visibility without further configuration.

Why this answer

The System Resources widget on the FortiGate web-based manager dashboard displays real-time CPU and memory utilization, along with other resource metrics like session count and log rate. It is included by default on the dashboard and is the standard place administrators check for immediate performance visibility. This directly answers the requirement to check CPU and memory from the GUI.

Exam trap

FORTINET-NSE123 often tests dashboard widget functions, and candidates confuse FortiView (traffic/session analytics) with System Resources (hardware performance metrics), picking the more familiar-sounding FortiView option.

How to eliminate wrong answers

Option A is wrong because FortiView Sessions shows detailed session and traffic analytics (top sources, destinations, applications), not system resource utilization. Option C is wrong because License Information displays support entitlements, contract expiry, and licensed features — not CPU or memory metrics. Option D is wrong because Network Interfaces shows interface status, IP addresses, and link state, not system-wide CPU or memory usage.

Practice this question →

MCQhard

An administrator suspects that a session is stuck in the FortiGate session table, preventing new connections. Which command allows viewing active sessions matching a specific source IP?

A.show firewall session [IP]

B.diagnose sys session filter src [IP] followed by diagnose sys session list

C.execute session clear [IP]

D.get system session list

AnswerB

The session filter command narrows the session table to entries matching the specified source IP, and the subsequent list command displays them. This isolates the suspected stuck session, letting the administrator confirm and clear it so new connections succeed.

Why this answer

The correct approach is to apply a session filter with 'diagnose sys session filter src <IP>' and then run 'diagnose sys session list' to display only sessions matching that source. This is the standard FortiOS diagnostic workflow for isolating stuck or problematic sessions without dumping the entire session table. The filter persists until cleared with 'diagnose sys session filter clear' or the session is closed.

Exam trap

FORTINET-NSE123 often tests whether candidates know that FortiOS session inspection requires the two-step 'diagnose sys session filter' + 'diagnose sys session list' pattern, not a single 'show' or 'get' command.

How to eliminate wrong answers

Option A is wrong because 'show firewall session' is not a valid FortiOS CLI command — session inspection is done via 'diagnose sys session' commands. Option C is wrong because 'execute session clear' is not a valid command; clearing sessions uses 'diagnose sys session clear' with filters, and it would destroy evidence rather than view it. Option D is wrong because 'get system session list' does not exist in FortiOS; 'get system session' commands relate to session helpers/expectations, not the live session table.

Practice this question →

Multi-Selectmedium

When setting up a new FortiGate device, an administrator needs to configure basic network parameters before deploying it in production. Which THREE parameters must be configured for basic network connectivity?

Select 3 answers

A.Interface IP address and subnet mask

B.DNS server IP addresses

C.BGP routing peer AS number

D.Default static route

E.SSL VPN portal customization

AnswersA, B, D

Assigning an interface IP address and subnet mask gives the FortiGate a routable identity on its network segment, satisfying the basic connectivity requirement. Without this layer-3 addressing, the device cannot communicate with gateways, DNS servers or management hosts, so it is one of the three mandatory parameters.

Why this answer

Option A is correct because every FortiGate interface that will carry traffic needs an IP address and subnet mask (configured via config system interface, e.g., set ip 192.168.1.99 255.255.255.0) to participate in IP networking at all. Option B is correct because DNS server IPs (config system dns, set primary/secondary) are required for the FortiGate to resolve hostnames for FortiGuard updates, NTP, and other name-based lookups. Option D is correct because a default static route (config router static, destination 0.0.0.0/0 with a gateway) is needed so the FortiGate can forward traffic to destinations outside its directly connected subnets, including the internet.

Option C is not required for basic connectivity since BGP is an advanced dynamic routing protocol only needed in specific multi-router topologies. Option E is not a basic network parameter; SSL VPN portal customization is an optional remote-access feature configured later, not part of initial connectivity.

Exam trap

The trap is that candidates see advanced features like BGP or SSL VPN and assume they are required for 'basic' setup, when the exam is really testing the minimal IP, route, and DNS triad.

Practice this question →

MCQeasy

An administrator wants to verify the amount of free space available on the system log disk. Which dashboard widget displays this metric?

A.Storage Usage widget

B.System Resources

C.Hard Drive Status

D.Log Disk widget

AnswerD

The Log Disk widget reports disk usage for the log partition, showing total capacity, used space and remaining free space. It satisfies the requirement to verify how much free space remains on the system log disk.

Why this answer

The Log Disk widget on the FortiGate dashboard displays the current usage and free space of the log disk (local storage used for logs). It shows a graphical representation of disk consumption, making it the correct widget for verifying free space on the system log disk.

Exam trap

The trap is confusing the Log Disk widget with generic storage or system resource widgets — candidates who haven't used the FortiGate dashboard may pick 'Storage Usage' or 'System Resources' because they sound plausible.

How to eliminate wrong answers

Option A is wrong because there is no 'Storage Usage' widget on the FortiGate dashboard — the correct widget is named Log Disk. Option B is wrong because System Resources shows CPU, memory, and session usage, not disk space. Option C is wrong because 'Hard Drive Status' is not a FortiGate dashboard widget; disk health is shown elsewhere (e.g., under System > FortiGuard or via CLI).

Practice this question →

MCQmedium

An administrator wants to verify the administrator access profile privileges assigned to a specific admin account. Where can access profiles be defined and edited?

A.Security Fabric > Profiles

B.System > Admin Profiles

C.System > Administrators > Profiles

D.Policy & Objects > Admin Profiles

AnswerB

System > Admin Profiles holds every access profile and its per-category read-write permissions, so an administrator can open a profile there to confirm exactly which privileges a given admin account inherits when that profile is assigned.

Why this answer

Administrator access profiles are defined and edited under System > Admin Profiles in the FortiOS GUI (config system accprofile in the CLI). This is where profiles like 'super_admin', 'prof_admin', and custom profiles are created with granular read/write permissions per functional area (firewall, VPN, system, etc.). Assigning a profile to an admin account controls exactly what that admin can view and modify.

Exam trap

FORTINET-NSE123 often tests the exact GUI path, so candidates confuse 'System > Administrators' (where profiles are assigned) with 'System > Admin Profiles' (where profiles are defined and edited).

How to eliminate wrong answers

Option A is wrong because Security Fabric > Profiles does not exist as an admin profile management location; the Security Fabric section deals with fabric connectors and authorization. Option C is wrong because System > Administrators > Profiles is not the actual GUI path; the Administrators page is where you assign profiles, but the profiles themselves are managed under System > Admin Profiles. Option D is wrong because Policy & Objects > Admin Profiles is not a valid FortiOS menu path; Policy & Objects deals with firewall addresses, services, and policies, not admin permissions.

Practice this question →

Multi-Selectmedium

An administrator wants to verify high availability (HA) cluster status and member synchronization. Which TWO commands or dashboard widgets provide this HA status? (Choose two)

Select 2 answers

A.get system ha status

B.get system interface physical

C.FortiView > HA Traffic

D.High Availability dashboard widget

E.Policy & Objects > HA Rules

AnswersA, D

Running `get system ha status` in the CLI queries the HA daemon directly, returning cluster member roles (primary/secondary), uptime, and synchronisation state. This satisfies the requirement to verify both cluster status and member synchronisation without relying on the GUI.

Why this answer

Option A, 'get system ha status', is correct because this FortiGate CLI command directly reports HA cluster health, including the HA mode, the primary/standby role of each member, and the synchronization (sync) status between cluster units. Option D, the 'High Availability dashboard widget', is correct because it is the GUI equivalent that displays HA cluster status, member roles, and configuration synchronization state at a glance. Option B, 'get system interface physical', only shows physical interface link and speed information and does not report HA membership or sync state.

Option C, 'FortiView > HA Traffic', is not a valid HA status widget and does not verify cluster synchronization. Option E, 'Policy & Objects > HA Rules', is not a real FortiGate HA status location; HA-related settings live under System > HA, not Policy & Objects.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact CLI syntax and GUI location for HA verification — distractors like 'HA Rules' or 'FortiView > HA Traffic' sound plausible but do not exist as HA status tools.

Practice this question →

Multi-Selectmedium

An administrator wants to view historical web filtering and traffic logs on the FortiGate. Which TWO methods can be used to search and analyze stored logs? (Choose two)

Select 2 answers

A.Log & Report menu in the web-based manager with filter and search options

B.Restarting the routing daemon (gated)

C.Editing the FortiOS kernel source code directly

D.FortiAnalyzer integration or local log viewer filters

E.Running execute factory-reset

AnswersA, D

The Log & Report menu provides the FortiGate's local log storage interface, letting administrators filter and search historical web filtering and traffic logs directly in the GUI. This satisfies the requirement to search and analyse stored logs without external infrastructure, using built-in filter criteria such as source, destination, and log type.

Why this answer

Option A is correct because the FortiGate GUI's Log & Report menu provides built-in filter and search controls that let an administrator query historical web filtering and traffic logs stored locally or on a disk. Option D is correct because FortiAnalyzer integration centralizes and indexes logs for advanced search and analysis, while the local log viewer filters also allow searching stored logs directly on the FortiGate. Option B is incorrect because restarting the routing daemon (gated) affects routing processes and does not provide any log search or analysis capability.

Option C is incorrect because editing FortiOS kernel source code is neither supported nor related to viewing historical logs. Option E is incorrect because 'execute factory-reset' erases the configuration and does not help search or analyze stored logs.

Exam trap

FORTINET-NSE123 often tests the distinction between log analysis methods and unrelated system operations, tricking candidates into selecting disruptive or destructive commands like factory-reset or daemon restarts instead of the proper GUI or FortiAnalyzer tools.

Practice this question →

MCQeasy

Which dashboard widget displays the status of connected FortiGate security fabric devices and fabric topology?

A.FortiView Threat Map

B.Security Fabric Rating

C.System Resources

D.Security Fabric > Topology

AnswerD

The Security Fabric > Topology widget renders the live fabric map, showing each connected FortiGate device and the links between them. It directly satisfies the requirement to display connected device status and fabric topology, unlike widgets that report only logs, traffic or licence states.

Why this answer

The Security Fabric > Topology widget on the FortiGate dashboard visually displays the connected Security Fabric devices, their roles (root, downstream FortiGates, FortiSwitches, FortiAPs, FortiAnalyzer, etc.), and the links between them. It provides a real-time view of fabric health and device connectivity, making it the correct place to monitor fabric status and topology.

Exam trap

FORTINET-NSE123 often tests the confusion between the Security Fabric Rating widget (a compliance score) and the Security Fabric Topology widget (the actual device map), so candidates must distinguish scoring from topology.

How to eliminate wrong answers

Option A is wrong because FortiView Threat Map shows geographic threat origins and attack destinations, not fabric device topology. Option B is wrong because Security Fabric Rating is a scoring widget that evaluates configuration best practices across the fabric, not a topology display. Option C is wrong because System Resources shows CPU, memory, and session utilization on the local FortiGate, not fabric device status.

Practice this question →

MCQhard

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

A.VPN > SSL-VPN Settings (Server Certificate field)

B.Policy & Objects > SSL Settings

C.System > Certificates > SSL-VPN

D.Security Fabric > VPN Settings

AnswerA

The Server Certificate field under VPN > SSL-VPN Settings binds the certificate presented to portal users, so replacing or verifying it there resolves the validation error. This is the only GUI location where the active SSL VPN server certificate is assigned.

Why this answer

The active SSL VPN server certificate is configured and can be verified or changed under VPN > SSL-VPN Settings in the Server Certificate field. This is where the administrator selects which certificate the FortiGate presents to SSL VPN clients. If users encounter certificate validation errors, checking this setting ensures the correct certificate is bound to the SSL VPN portal.

Exam trap

FORTINET-NSE123 often tests the specific menu path for SSL VPN certificate configuration, and candidates may confuse it with general certificate management under System > Certificates or SSL inspection settings.

How to eliminate wrong answers

Option B is wrong because Policy & Objects > SSL Settings does not exist as a menu for SSL VPN server certificate configuration; SSL inspection settings are under Policy & Objects > SSL Inspection, but that is for outbound inspection, not SSL VPN. Option C is wrong because System > Certificates > SSL-VPN is not a valid path; certificates are managed under System > Certificates, but the SSL VPN server certificate is assigned in the SSL-VPN settings, not in a dedicated SSL-VPN certificate section. Option D is wrong because Security Fabric > VPN Settings is not a standard menu; Security Fabric settings relate to fabric connectivity, not SSL VPN certificate configuration.

Practice this question →

MCQmedium

An administrator needs to export the current configuration of a FortiGate to a secure local file for backup purposes. Which menu path should the administrator navigate in the web-based manager?

A.System > Settings > Maintenance

B.Click the administrator profile name at the top right of the GUI > Configuration > Backup

C.Security Fabric > Settings > Export

D.Log & Report > Backup Settings

AnswerB

Clicking the administrator profile name at the top right exposes the Configuration submenu, where Backup exports the running configuration to a local encrypted file. This satisfies the requirement to save the FortiGate configuration securely for backup, since the GUI's profile menu is the only path offering the Backup action.

Why this answer

In the FortiGate web-based manager, the configuration backup option is accessed by clicking the administrator profile name at the top-right of the GUI and then selecting Configuration > Backup. This opens the backup page where the administrator can choose to encrypt the file with a password and download it locally. The other menu paths do not contain the configuration backup function.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact GUI navigation path for configuration backup, and candidates frequently guess System > Settings or Log & Report instead of the admin profile menu.

How to eliminate wrong answers

Option A is wrong because System > Settings > Maintenance does not exist as a backup path; maintenance tasks are under System > Config or via the admin profile menu. Option C is wrong because Security Fabric > Settings > Export is not a configuration backup location; Security Fabric settings relate to fabric topology and connectors. Option D is wrong because Log & Report > Backup Settings does not exist; log-related settings are under Log & Report > Log Settings, and they do not export the configuration.

Practice this question →

MCQeasy

Where can an administrator view real-time bandwidth consumption per interface on the FortiGate dashboard?

A.Network Interfaces widget on the Dashboard

B.FortiView > Interfaces

C.System > Network > Performance

D.Log & Report > Bandwidth Monitor

AnswerA

The Network Interfaces widget polls interface counters directly, displaying live throughput per port without drilling into logs. It satisfies the requirement to view real-time bandwidth consumption per interface on the dashboard itself, rather than historical or aggregate reporting.

Why this answer

The Network Interfaces widget on the FortiGate dashboard displays real-time bandwidth consumption per interface, showing throughput in and out for each physical or logical interface. This widget is specifically designed to provide a quick view of interface utilization directly on the dashboard. It is the correct location for monitoring per-interface bandwidth in real time.

Exam trap

FORTINET-NSE123 often tests the exact location of monitoring features, and candidates may incorrectly choose FortiView or Log & Report for bandwidth monitoring instead of the dashboard widget.

How to eliminate wrong answers

Option B is wrong because FortiView > Interfaces is not a standard FortiGate GUI path; FortiView provides various monitoring views but not a dedicated 'Interfaces' section for real-time bandwidth per interface. Option C is wrong because System > Network > Performance is not a valid menu path in FortiOS; network performance monitoring is typically done via the dashboard widgets or CLI commands. Option D is wrong because Log & Report > Bandwidth Monitor is not a standard feature; bandwidth monitoring is not found under Log & Report, which is for log viewing and configuration.

Practice this question →

Multi-Selecthard

An administrator is reviewing log storage and management settings on the FortiGate. Which THREE storage options or destinations are supported for logging on a FortiGate? (Choose three)

Select 3 answers

A.Local disk (internal hard drive or flash storage)

B.FortiAnalyzer

C.Bluetooth pairing with a mobile phone

D.Local printer connected via USB

E.Syslog server

AnswersA, B, E

FortiGate appliances with an internal hard drive or flash storage can write logs locally, retaining them on the device itself. This satisfies the scenario's requirement for a supported log storage destination, distinct from external options such as FortiAnalyzer or syslog.

Why this answer

Option A (Local disk, internal hard drive or flash storage) is correct because FortiGates with an internal disk or flash can store logs locally, configured under config log disk setting and viewed via Log & Report. Option B (FortiAnalyzer) is correct because FortiAnalyzer is Fortinet's dedicated centralized log collection, analysis, and reporting appliance, configured on the FortiGate under config log fortianalyzer setting. Option E (Syslog server) is correct because the FortiGate supports sending logs to external syslog servers over UDP/TCP port 514 (or 6514 for reliable/TLS), configured under config log syslogd setting.

Option C (Bluetooth pairing with a mobile phone) is not a supported log destination; Bluetooth is used only for initial FortiExplorer setup, not log storage. Option D (Local printer connected via USB) is not supported, as FortiGate USB ports are used for modem or storage functions, not direct printer logging.

Exam trap

FORTINET-NSE123 often includes absurd options like Bluetooth or USB printer to test if candidates know the actual supported logging destinations, so picking them indicates a lack of familiarity with FortiGate logging capabilities.

Practice this question →

MCQeasy

Where can an administrator view a real-time list of top destination IP addresses accessed by internal users?

A.Log & Report > Destination Summary

B.Policy & Objects > Destinations

C.Monitor > Routing Table

D.FortiView > Destinations

AnswerD

FortiView > Destinations aggregates live session data by remote IP, ranking the top destinations internal users are currently reaching. This directly satisfies the stem's real-time requirement, unlike log-based reports that lag behind. The Destinations view draws from active traffic logs, so the list refreshes as sessions occur.

Why this answer

FortiView > Destinations is the built-in analytics view that aggregates log data in real time and displays the top destination IP addresses, countries, and domains accessed by internal users. It pulls from forward traffic logs and presents them in a sortable, drill-down dashboard, which is exactly what the question asks for. This is the standard location for monitoring user browsing destinations on a FortiGate.

Exam trap

The trap here is confusing configuration menus (Policy & Objects) with monitoring menus (FortiView), and inventing plausible-sounding but nonexistent log views like 'Destination Summary'.

How to eliminate wrong answers

Option A is wrong because 'Log & Report > Destination Summary' is not a standard FortiOS menu — Log & Report contains Forward Traffic, Local Traffic, and similar log views, not a 'Destination Summary' widget. Option B is wrong because 'Policy & Objects > Destinations' is where address objects are defined for use in policies, not a live traffic view. Option C is wrong because 'Monitor > Routing Table' shows the FIB (routing entries), not user traffic destinations.

Practice this question →

Multi-Selectmedium

An administrator is preparing to deploy a new FortiGate and needs to configure basic network parameters. Which TWO basic network settings must typically be configured on physical interfaces before deploying firewall policies? (Choose two)

Select 2 answers

A.Explicit proxy authentication realms

B.Administrative access settings (e.g., enabling HTTPS and ping for management)

C.BGP AS number and neighbor peer groups

D.IP address and subnet mask

E.SSL VPN client certificate revocation lists

AnswersB, D

Enabling HTTPS and ping on a physical interface permits management traffic to reach the FortiGate itself, which is required before policies can be administered. Without administrative access configured, the interface carries no management plane, blocking further configuration.

Why this answer

Option D is correct because every physical interface that will carry traffic must have an IP address and subnet mask assigned so the FortiGate can participate in the network and route packets between its interfaces before any firewall policy can meaningfully match traffic. Option B is correct because administrative access settings on an interface (for example enabling HTTPS, SSH, or ping for management) determine how the administrator can reach and manage the FortiGate, which is a basic interface-level configuration typically done during initial setup. Option A is incorrect because explicit proxy authentication realms are an advanced web-proxy feature configured under proxy settings, not a prerequisite interface parameter for firewall policies.

Option C is incorrect because BGP AS numbers and neighbor peer groups are dynamic routing configurations that are optional and only needed in environments using BGP, not part of basic interface setup. Option E is incorrect because SSL VPN client certificate revocation lists relate to VPN authentication and are configured later, not as a basic physical interface setting.

Exam trap

FORTINET-NSE123 often tests the difference between basic interface settings and advanced features like routing or VPN, and candidates may overthink and select routing protocols.

Practice this question →

MCQeasy

An administrator wants to view top talkers by bandwidth usage over the past hour. Which FortiView view should be accessed?

A.FortiView > Sources

B.Policy & Objects > Sources

C.Monitor > Top Talkers

D.Log & Report > Traffic Sources

AnswerA

FortiView > Sources ranks individual source IP addresses by traffic volume, so selecting the past-hour time range shows the top talkers by bandwidth. That directly answers the requirement to view top talkers over the past hour.

Why this answer

FortiView > Sources is the correct location because FortiView aggregates traffic logs and ranks source IP addresses by bandwidth, sessions, or applications. Selecting the Sources view and setting the time range to the past hour gives exactly the 'top talkers by bandwidth' report the administrator wants. It is a built-in analytics view, not a policy or log-report screen.

Exam trap

FORTINET-NSE123 often tests whether candidates look for top-talker data under Monitor or Log & Report instead of FortiView — the trap is assuming a 'Monitor' menu contains all monitoring views when FortiView is a separate top-level module.

How to eliminate wrong answers

Option B is wrong because Policy & Objects > Sources is not a monitoring view at all — it is part of firewall policy configuration where you define source address objects. Option C is wrong because there is no 'Monitor > Top Talkers' menu in FortiOS; top-talker data lives under FortiView, not a Monitor submenu. Option D is wrong because Log & Report > Traffic Sources does not exist as a top-talker analytics view; Log & Report is for raw log access and report generation, not ranked bandwidth analysis.

Practice this question →

MCQhard

An administrator needs to restore a saved configuration file to the FortiGate via the CLI. Which command is used to restore configuration settings from a backup file stored on a TFTP server?

A.execute restore config tftp [filename] [server-IP]

B.config restore tftp [server-IP] [filename]

C.system restore backup [filename]

D.upload config tftp [server-IP]

AnswerA

The 'execute restore config tftp' command retrieves a backup configuration file from a TFTP server and applies it, satisfying the requirement to restore via CLI from TFTP. It takes the filename and server IP as arguments, then reboots to load the restored configuration.

Why this answer

The correct CLI command to restore a configuration backup from a TFTP server on a FortiGate is 'execute restore config tftp [filename] [server-IP]'. This command initiates the restoration process, pulling the specified file from the TFTP server and applying it to the device. It is part of the 'execute' command family used for system-level operations.

Exam trap

FORTINET-NSE123 often tests the confusion between 'execute restore' and 'execute backup', as well as the correct order of arguments (filename before server IP).

How to eliminate wrong answers

Option B is wrong because 'config restore tftp' is not a valid FortiGate CLI command; 'config' is used to enter configuration mode, not to perform restore operations. Option C is wrong because 'system restore backup' does not exist; the correct syntax uses 'execute restore'. Option D is wrong because 'upload config tftp' is used to back up the configuration to a TFTP server, not to restore from one.

Practice this question →

MCQeasy

An administrator needs to view active hardware temperature and power supply statuses on the dashboard. Which widget should be added?

A.Device Inventory

B.Power Monitor

C.Hardware Status widget

D.System Resources

AnswerC

The Hardware Status widget polls the FortiGate's sensor subsystem directly, reporting live chassis temperature readings and PSU operational state on the dashboard. This satisfies the administrator's requirement to view active hardware temperature and power supply statuses, which no traffic, log, or session-based widget surfaces.

Why this answer

The Hardware Status widget on the FortiGate dashboard is specifically designed to display real-time hardware health information, including CPU/motherboard temperatures, fan speeds, and power supply status. Adding this widget gives the administrator immediate visibility into thermal and power conditions, which is exactly what the question asks for. Other widgets focus on traffic, sessions, or inventory rather than physical hardware sensors.

Exam trap

FORTINET-NSE123 often tests the confusion between the Hardware Status widget (physical sensors like temperature and PSU) and System Resources (CPU/memory/session utilization), causing candidates to pick the wrong monitoring widget.

How to eliminate wrong answers

Option A is wrong because Device Inventory lists managed devices and their basic information, not hardware sensor readings like temperature or PSU status. Option B is wrong because 'Power Monitor' is not a standard FortiGate dashboard widget name — power supply status is surfaced through the Hardware Status widget. Option D is wrong because System Resources shows CPU, memory, and session utilization, not physical hardware telemetry such as temperature or power supply health.

Practice this question →

Multi-Selecthard

An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?

Select 2 answers

A.diagnose debug flow filter

B.execute factory-reset

C.get system arps

D.execute ping <syslog-server-ip>

E.diagnose sniffer packet any 'port 514' 4

AnswersD, E

The execute ping command tests ICMP reachability to the syslog server, confirming whether routing, firewall policy or upstream connectivity is blocking traffic. It satisfies the requirement to verify connectivity from the FortiGate CLI before assuming the logging daemon itself is at fault.

Why this answer

Option D (execute ping <syslog-server-ip>) is correct because it verifies basic IP reachability to the remote syslog server from the FortiGate, confirming that routing and Layer 3 connectivity to the destination exist before investigating higher-layer log delivery issues. Option E (diagnose sniffer packet any 'port 514' 4) is correct because it captures live packets on UDP/TCP port 514 (the standard syslog port) with verbose interface-level detail, allowing the administrator to confirm whether log packets are actually being transmitted to and received from the syslog server. Option A (diagnose debug flow filter) is not correct here because debug flow only sets filters for the flow trace and does not itself display connectivity or log transmission; it must be paired with 'diagnose debug flow trace start' and is aimed at session/forwarding analysis rather than syslog verification.

Option B (execute factory-reset) is not correct because it erases the configuration and reboots the device, which is destructive and unrelated to troubleshooting log delivery. Option C (get system arps) is not correct because it only displays the ARP table and cannot verify end-to-end connectivity or syslog packet transmission.

Exam trap

FORTINET-NSE123 often tests command purpose recognition, and candidates may choose 'diagnose debug flow' because it sounds like a general troubleshooting command, but it is not the right tool for verifying syslog transmission.

Practice this question →

MCQmedium

An administrator needs to verify the current date and time settings on the FortiGate to ensure log timestamps are accurate. Which menu path in the web-based manager is used to configure system time and NTP settings?

A.System > Settings

B.System > FortiGuard

C.Monitor > System Time

D.Log & Report > Log Settings

AnswerA

System > Settings holds the system time, time zone and NTP server fields in the web-based manager, so accurate log timestamps can be verified and corrected there. This satisfies the requirement to locate where date and time are configured.

Why this answer

In the FortiGate web-based manager (GUI), system time and NTP configuration are located under System > Settings. This page allows the administrator to set the system time manually or configure NTP servers to synchronize the FortiGate's clock. Accurate time is critical for log timestamps, certificate validation, and scheduled tasks.

Exam trap

The trap here is confusing configuration menus with monitoring or logging menus; candidates might assume system time is under Log & Report because it affects logs, but it is actually a system setting.

How to eliminate wrong answers

Option B is wrong because System > FortiGuard is used to configure FortiGuard services such as antivirus, IPS, and web filtering updates, not system time. Option C is wrong because Monitor > System Time does not exist as a menu path in the FortiGate GUI; system time is not a monitoring function but a configuration setting. Option D is wrong because Log & Report > Log Settings is used to configure logging destinations, severity levels, and log storage, not the system clock or NTP.

Practice this question →

Multi-Selectmedium

An administrator needs to back up the FortiGate configuration and ensure that sensitive passwords are protected. Which TWO statements regarding FortiGate configuration backups are correct? (Choose two)

Select 2 answers

A.Configuration files are saved in plain text XML format that cannot be encrypted.

B.Configuration backups can only be performed by connecting a console cable.

C.Backups can be encrypted with a password to protect sensitive information such as VPN pre-shared keys and user passwords.

D.Configuration backups can be exported via the web-based manager or CLI.

E.Backups automatically include historical log databases by default.

AnswersC, D

Encrypting the backup file with a password protects secrets such as VPN pre-shared keys and stored user passwords, which otherwise appear in plaintext. This satisfies the requirement to safeguard sensitive credentials within the configuration backup.

Why this answer

Option C is correct because FortiGate configuration backups can be password-encrypted, which protects sensitive data such as VPN pre-shared keys, user passwords, and other credentials stored in the configuration. Option D is correct because administrators can export the configuration either through the GUI (System > Configuration > Backup) or via CLI commands such as 'execute backup config', making both methods valid. Option A is incorrect because, while FortiGate configuration files are text-based, they can be encrypted with a password, so the claim that they cannot be encrypted is false.

Option B is incorrect because console access is not the only way to perform backups; GUI and CLI over network connections are supported. Option E is incorrect because configuration backups do not automatically include historical log databases by default; logs are backed up separately.

Exam trap

FORTINET-NSE123 often tests the misconception that XML configuration files cannot be encrypted, or that backups automatically include logs, leading candidates to select the wrong statements.

Practice this question →

Multi-Selecthard

An administrator is investigating a network performance degradation issue and needs to check hardware sensor health on a high-end FortiGate unit. Which THREE hardware parameters or components can be monitored via FortiGate hardware status commands or widgets? (Choose three)

Select 3 answers

A.Power supply unit (PSU) status

B.Internal chassis or CPU temperature sensors

C.Active BGP peer uptime metrics

D.Fan operational status and speeds

E.SSL VPN tunnel encryption keys

AnswersA, B, D

PSU status is exposed through hardware sensor monitoring, reporting whether each power supply is present, healthy or failed. On high-end chassis units this directly satisfies the requirement to check hardware sensor health when diagnosing performance degradation.

Why this answer

Options A, B, and D are correct because FortiGate hardware status commands (such as 'get system status', 'diagnose hardware deviceinfo', and the Hardware Status dashboard widget) expose physical chassis telemetry: A (PSU status) reports whether each power supply is present, powered, and functioning; B (internal chassis/CPU temperature sensors) reports thermal readings used to detect overheating that can throttle performance; and D (fan operational status and speeds) reports fan RPM and failure states that directly affect cooling and stability. These are exactly the hardware parameters FortiOS surfaces for high-end appliances during performance troubleshooting. Option C (BGP peer uptime) is incorrect because BGP is a Layer 3 routing protocol monitored via routing/neighbor commands like 'get router info bgp summary', not hardware sensors.

Option E (SSL VPN tunnel encryption keys) is incorrect because encryption keys are cryptographic session material, not a monitorable hardware component or sensor.

Exam trap

FORTINET-NSE123 often tests the distinction between hardware health monitoring and logical/software metrics, so candidates may incorrectly select BGP uptime or SSL VPN keys as hardware parameters.

Practice this question →

MCQhard

An administrator needs to reboot the FortiGate device remotely during a maintenance window without causing data corruption. Which CLI command should be executed?

A.execute factory-reset

B.system restart

C.execute reboot

D.config system global set reboot

AnswerC

The execute reboot command performs a graceful shutdown of FortiGate processes and flushes cached data before restarting, avoiding corruption. This satisfies the stem's constraint of rebooting remotely during a maintenance window without risking data integrity.

Why this answer

'execute reboot' is the correct FortiGate CLI command to perform a clean, graceful reboot that flushes buffers and stops services properly, avoiding filesystem or configuration corruption. It is the standard maintenance command used during scheduled windows and prompts for confirmation before restarting.

Exam trap

NSE123 often tests the confusion between 'execute reboot' (graceful restart) and 'execute factory-reset' (destructive wipe) — candidates must recognize that only 'execute reboot' preserves configuration.

How to eliminate wrong answers

Option A is wrong because 'execute factory-reset' wipes the configuration and returns the device to defaults — it is a destructive reset, not a reboot. Option B is wrong because 'system restart' is not a valid FortiGate CLI command; 'system' is a configuration branch, not an execute command for rebooting. Option D is wrong because 'config system global set reboot' is not a real command — there is no 'reboot' setting under system global, and this syntax would fail.

Practice this question →

MCQhard

An administrator is troubleshooting a DHCP server issue on the FortiGate and needs to see active IP address leases assigned by the built-in DHCP server. Which CLI command provides this information?

A.execute dhcp lease-list

B.diagnose system dhcp list

C.get router info dhcp

D.get system dhcp-server lease

AnswerA

The execute dhcp lease-list command queries the FortiGate's built-in DHCP server and returns currently active leases with IP, MAC and expiry details. It directly satisfies the requirement to view active IP address leases assigned by the built-in server.

Why this answer

The correct command is `execute dhcp lease-list`. This command is part of FortiOS's `execute` command tree, which contains operational commands for viewing dynamic runtime information. It queries the built-in DHCP server's lease database and displays active leases, including IP address, MAC address, hostname, lease expiry, and interface.

It is the standard, documented way to verify DHCP assignments on a FortiGate without needing to inspect individual client devices.

Exam trap

FORTINET-NSE123 often tests the distinction between `execute`, `diagnose`, and `get` command families, tricking candidates into choosing a plausible-sounding but non-existent command like `diagnose system dhcp list` or `get system dhcp-server lease`.

How to eliminate wrong answers

Option B is wrong because `diagnose system dhcp list` is not a valid FortiOS command; `diagnose` commands are used for debugging and packet capture, not for listing DHCP leases. Option C is wrong because `get router info dhcp` is not a valid command; `get router info` commands typically display routing table or protocol information (e.g., `get router info routing-table`), not DHCP lease data. Option D is wrong because `get system dhcp-server lease` is not a valid command; `get system` commands are used to display configuration objects, not dynamic lease information, and there is no `dhcp-server lease` subcommand under `get system`.

Practice this question →

Multi-Selecthard

An administrator is examining the FortiGate routing table via the CLI. Which THREE types of routes can appear in the active routing table? (Choose three)

Select 3 answers

A.Dynamic routes (learned via protocols such as OSPF, BGP, or RIP)

B.Firewall policy object routes

C.Security Fabric telemetry routes

D.Connected routes (directly attached subnets)

E.Static routes (manually configured routes)

AnswersA, D, E

OSPF, BGP and RIP populate the active routing table as dynamic entries, installed by the routing daemon when a route is selected as best. This satisfies the stem's requirement, since dynamic routes are one of the route types visible in the FortiGate routing table.

Why this answer

The FortiGate active routing table (viewed with 'get router info routing-table all' or 'database') contains three fundamental route sources. Option A is correct because dynamic routes learned through routing protocols such as OSPF, BGP, or RIP are installed in the routing table and marked with their protocol code (O, B, R). Option D is correct because connected routes represent directly attached subnets on FortiGate interfaces and appear automatically with the C code.

Option E is correct because static routes manually configured by the administrator are installed in the routing table and marked with the S code. Options B and C are incorrect because firewall policy objects and Security Fabric telemetry do not generate routing table entries; firewall policies control traffic forwarding decisions but are not routes, and Security Fabric telemetry is a logging/visibility feature, not a routing source.

Exam trap

FORTINET-NSE123 often tests the misconception that firewall policy objects or Security Fabric components appear as route types, tricking candidates into selecting non-route entries.

Practice this question →

MCQhard

An administrator is reviewing firewall policies and notices that traffic matching a specific policy is being logged, but no traffic logs are appearing in Log & Report > Forward Traffic. FortiGate is configured to send logs to FortiAnalyzer. Where are the traffic logs being stored?

A.They are stored in the FortiGate system memory ring buffer.

B.They are buffered in RAM and will only flush when the FortiGate reboots.

C.They are discarded because local logging is automatically disabled when remote logging is active.

D.They are stored exclusively on the remote FortiAnalyzer and not on the local FortiGate storage.

AnswerD

When a FortiGate logs to FortiAnalyzer, the traffic logs reside on the remote analyser's storage; local disk logging is not enabled for that traffic. This satisfies the scenario where logs are absent from the local Log & Report view.

Why this answer

When a FortiGate is configured to send logs to FortiAnalyzer and local disk logging is not enabled, the traffic logs are transmitted to the remote FortiAnalyzer and are not retained on the FortiGate's local storage. That is why the administrator sees nothing under Log & Report > Forward Traffic on the FortiGate itself — the logs exist, but on FortiAnalyzer. The correct answer reflects that remote logging destinations receive the logs exclusively when local storage is not configured.

Exam trap

The trap is assuming that configuring FortiAnalyzer logging automatically keeps a local copy — candidates must remember that log destinations are independent and local storage must be explicitly enabled.

How to eliminate wrong answers

Option A is wrong because the memory ring buffer is only used when logging to memory is explicitly enabled; it is not the default destination when FortiAnalyzer is configured. Option B is wrong because logs are not buffered in RAM awaiting reboot — they are streamed to the configured remote log server in near real time. Option C is wrong because local logging is not automatically disabled when remote logging is active; both can coexist if local disk logging is enabled, so the logs are not 'discarded' — they are simply sent remotely.

Practice this question →

MCQhard

An administrator is troubleshooting a packet loss issue and needs to inspect the kernel buffer drops and interface error counters. Which CLI command provides a summary of interface drop statistics?

A.execute interface-test drops

B.diagnose hardware deviceinfo nic [interface]

C.show interface drops

D.get system drop-stats

AnswerB

`diagnose hardware deviceinfo nic` queries the network interface driver directly, reporting kernel-level buffer drops alongside interface error counters such as RX/TX errors and overruns. This satisfies the stem's requirement to inspect kernel buffer drops and interface error counters in one summary view.

Why this answer

The correct CLI command to inspect kernel buffer drops and interface error counters is 'diagnose hardware deviceinfo nic [interface]'. This command provides detailed NIC-level statistics including RX/TX errors, drops, and buffer-related counters for the specified interface.

Exam trap

FORTINET-NSE123 often tests the exact CLI syntax for interface diagnostics, so candidates pick plausible but invalid commands like 'show interface drops' or 'get system drop-stats' instead of the correct 'diagnose hardware deviceinfo nic'.

How to eliminate wrong answers

Option A is wrong because 'execute interface-test drops' is not a valid FortiGate CLI command. Option C is wrong because 'show interface drops' is not a valid FortiGate command for drop statistics. Option D is wrong because 'get system drop-stats' is not a valid FortiGate CLI command for interface-level drop counters.

Practice this question →

MCQmedium

An administrator wants to verify whether the FortiGate device is operating in NAT mode or Transparent mode. Where can this operational mode be checked in the web-based manager?

A.System > Feature Visibility > NAT Mode

B.Network > Operation Mode

C.Policy & Objects > Mode Settings

D.Dashboard > System Information widget (System Mode field)

AnswerD

The System Information widget on the Dashboard displays a System Mode field, which explicitly reports whether the FortiGate is running in NAT mode or Transparent mode. This directly satisfies the administrator's requirement to verify the operational mode through the web-based manager, without navigating to network interface or system settings pages.

Why this answer

The operational mode (NAT vs. Transparent) is displayed in the Dashboard > System Information widget under the System Mode field. The System Information widget on the default dashboard shows key device details including hostname, firmware version, serial number, and the current system mode, making it the correct place to verify whether the FortiGate is in NAT or Transparent mode.

Exam trap

FORTINET-NSE123 often tests GUI navigation — candidates look for a dedicated 'Operation Mode' page, but the mode is only shown in the Dashboard's System Information widget (or via CLI 'get system status').

How to eliminate wrong answers

Option A is wrong because System > Feature Visibility controls which features are visible in the GUI; it does not display the operational mode, and 'NAT Mode' is not a feature visibility toggle. Option B is wrong because Network > Operation Mode is not a valid path in the FortiGate GUI for checking the mode; the mode is set during initial configuration or via CLI, and the GUI does not have a Network > Operation Mode page for viewing it. Option C is wrong because Policy & Objects > Mode Settings does not exist; Policy & Objects is for firewall policies, addresses, and services.

Practice this question →

MCQmedium

An administrator needs to modify the hostname of the FortiGate via the CLI. Which configuration context and command are used?

A.config system settings > set name [name] > end

B.set hostname [name]

C.config system global > set hostname [name] > end

D.execute hostname [name]

AnswerC

Hostname is a global device setting, so it lives under 'config system global', where 'set hostname [name]' assigns the new name, then 'end' applies it. This context and command pair satisfies the requirement to modify the FortiGate hostname via the CLI.

Why this answer

The hostname of a FortiGate is configured under the system global configuration context. The correct sequence is to enter 'config system global', then use 'set hostname [name]', and finally 'end' to apply the change. This is the standard method for setting the device's hostname via the CLI, as documented in Fortinet's administration guide.

Exam trap

FORTINET-NSE123 often tests the distinction between 'config system global' and 'config system settings', as both are global contexts but serve different purposes; candidates may incorrectly choose 'system settings' for hostname configuration.

How to eliminate wrong answers

Option A is wrong because 'config system settings' is used for system-wide settings like DNS or timeouts, not the hostname; the correct context is 'system global'. Option B is wrong because 'set hostname [name]' is only valid after entering the correct configuration context; it cannot be executed directly from the top-level CLI. Option D is wrong because 'execute hostname [name]' is not a valid FortiGate command; 'execute' is used for actions like reboot or backup, not for setting the hostname.

Practice this question →

MCQmedium

An administrator wants to check the operational status of all physical and logical interfaces in a summary table view. Which menu path in the web-based manager should be opened?

A.Policy & Objects > Interfaces

B.Monitor > Interface Summary

C.Network > Interfaces

D.System > Interfaces

AnswerC

Network > Interfaces is the central page for every interface type on a FortiGate: physical ports, VLAN subinterfaces, aggregates, redundant interfaces, software switches, loopbacks and IPsec tunnel interfaces. The table shows link status, IP address, type, role and administrative access, and can be grouped or filtered. Opening an interface lets you edit its settings, so it serves both monitoring and configuration.

Why this answer

In FortiGate's web-based manager, the operational status of all physical and logical interfaces is displayed in a summary table under Network > Interfaces. This page shows real-time link status, IP addresses, speed/duplex, and traffic statistics for each interface. It is the central location for monitoring and configuring interface settings, not just configuration.

Exam trap

FORTINET-NSE123 often tests the distinction between configuration and monitoring menus, and candidates may confuse the Network > Interfaces page with a non-existent monitoring path like Monitor > Interface Summary, or incorrectly assume interface status is under System.

How to eliminate wrong answers

Option A is wrong because Policy & Objects > Interfaces does not exist; interface configuration is under Network, and Policy & Objects deals with firewall policies and objects. Option B is wrong because Monitor > Interface Summary is not a valid menu path; monitoring is typically under Dashboard or dedicated monitor menus, but interface summary is not there. Option D is wrong because System > Interfaces is not a valid path; System covers administrative settings like administrators, config, and HA, not interface status.

Practice this question →

MCQmedium

A network administrator is troubleshooting an intermittent connectivity issue on a FortiGate 100F running FortiOS 7.2. They suspect that the problem is related to the session table filling up. Which CLI command should they use to view the current session count and the maximum session limit?

A.get system session status

B.show system session info

C.diagnose sys session stat

D.diagnose netlink session list

AnswerC

This command displays statistics about the session table, including the current number of sessions and the maximum session limit. It is the correct tool to quickly assess session table utilization and determine if the table is near capacity, which could cause new sessions to be dropped and lead to intermittent connectivity issues.

Why this answer

The correct command is 'diagnose sys session stat', which provides a summary of session table usage, including current and maximum session counts. This allows the administrator to quickly determine if the session table is exhausted, a common cause of intermittent connectivity. Other options are either invalid commands or do not provide the necessary information.

Exam trap

The trap here is confusing the 'diagnose sys session' command family with non-existent 'get' or 'show' commands for session statistics.

Practice this question →

MCQeasy

How can an administrator quickly verify whether the FortiGate unit has a valid and active FortiCare support contract from the GUI?

A.Network > Interfaces

B.Policy & Objects > Objects

C.Log & Report > Event Log

D.System > FortiGuard

AnswerD

System > FortiGuard displays the FortiGuard licence status, including the FortiCare support contract's validity and expiry date, directly in the GUI. This satisfies the requirement to verify an active contract quickly, without CLI commands or external portal checks, since the licence widget reflects the unit's registered entitlement.

Why this answer

The FortiGuard page under System > FortiGuard displays the FortiGate's entitlement status, including the FortiCare support contract, license validity, and individual security service subscriptions (AV, IPS, Web Filter, etc.). Administrators can view the support level, expiry date, and registration status directly from this GUI page. This is the single pane where FortiGate reports its FortiCare registration and service license state.

Exam trap

The trap here is confusing general system/event logging pages with the dedicated FortiGuard licensing page — candidates often pick Log & Report because they assume license errors appear there.

How to eliminate wrong answers

Option A is wrong because Network > Interfaces only shows interface configuration (IP, role, status) and has nothing to do with FortiCare licensing. Option B is wrong because Policy & Objects > Objects is where address, service, and VIP objects are defined, not license status. Option C is wrong because Log & Report > Event Log shows system events and audit records but is not the authoritative place to verify an active FortiCare contract.

Practice this question →

MCQmedium

An administrator needs to test DNS resolution directly from the FortiGate command line interface to troubleshoot a FortiGuard connectivity issue. Which command should be used?

A.execute dns-lookup [hostname]

B.ping [hostname]

C.get system dns

D.diagnose test resolv [hostname]

AnswerA

The execute dns-lookup command queries a DNS server directly from the FortiGate CLI, returning the resolved address or failure needed to diagnose FortiGuard name resolution. It satisfies the requirement to test DNS resolution from the command line.

Why this answer

The correct command is `execute dns-lookup [hostname]` because it directly queries the FortiGate's configured DNS servers to resolve a hostname, providing the exact IP resolution result needed to troubleshoot FortiGuard connectivity. This command uses the FortiGate's DNS resolver settings and returns the resolved IP address or an error, making it the most direct tool for DNS resolution testing. Other commands either perform ICMP checks, display DNS configuration, or are not valid FortiOS commands.

Exam trap

FORTINET-NSE123 often tests the distinction between commands that display DNS configuration versus those that actively perform a DNS query, and candidates may incorrectly choose `ping` because it also resolves hostnames, but it does not isolate DNS resolution.

How to eliminate wrong answers

Option B is wrong because `ping [hostname]` tests ICMP reachability and may trigger DNS resolution as a side effect, but it does not isolate DNS resolution and can be blocked by ICMP filters, leading to misleading results. Option C is wrong because `get system dns` only displays the configured DNS servers and settings, not the actual resolution of a hostname. Option D is wrong because `diagnose test resolv [hostname]` is not a valid FortiOS command; the correct diagnose command for DNS resolution is `diagnose test application dnsproxy` or similar, but not this syntax.

Practice this question →

MCQhard

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

A.It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.

B.It immediately reboots the device to clear RAM.

C.It wipes all historical log files from local disk storage.

D.It automatically initiates a firmware rollback to the previous stable version.

AnswerA

Conserve mode triggers FortiOS to halt memory allocation for non-essential cache operations and refuse new non-administrative connections, preserving memory for critical processes. This directly addresses the high memory utilisation constraint, keeping the FortiGate responsive and administrative access available.

Why this answer

When FortiOS enters conserve mode, it stops allocating memory for non-essential cache operations and may block new non-administrative connection attempts (e.g., new sessions that would consume memory) to protect the device from a full memory exhaustion that could crash it. Administrative access is preserved so the admin can remediate. This is a protective degradation, not a reboot or data wipe.

Exam trap

FORTINET-NSE123 often tests the exact automatic behavior of conserve mode — candidates assume a reboot or log wipe, but the real action is halting cache allocation and blocking new non-admin connections.

How to eliminate wrong answers

Option B is wrong because FortiOS does not auto-reboot on entering conserve mode — a reboot is a manual remediation an admin might choose, but it is not the automatic action. Option C is wrong because wiping historical logs is not part of conserve mode; log rolling/overwriting may occur under disk pressure, but that's a separate mechanism (log disk full behavior), not memory conserve mode. Option D is wrong because firmware rollback is never automatic and is unrelated to memory pressure — it's a manual recovery action for failed upgrades.

Practice this question →

MCQeasy

Where in the FortiGate web-based manager can an administrator view current system alerts, warning logs, and administrative event logs?

A.Log & Report > System Events

B.Security Fabric > Audit

C.System > Advanced

D.Monitor > Routing Monitor

AnswerA

System Events aggregates FortiGate's administrative and system-level messages, including alerts, warnings and admin activity. This dashboard sits under Log & Report, giving administrators a single view of device health and configuration events rather than traffic or security logs.

Why this answer

System event logs, including system alerts, warning-level messages, and administrative event logs, are viewed under Log & Report > System Events in the FortiGate GUI. This section aggregates logs from the 'event' log category, which covers admin logins, configuration changes, HA events, and system warnings. The other menus do not display these event logs.

Exam trap

FORTINET-NSE123 often tests the distinction between event logs and traffic logs, and candidates may incorrectly choose Security Fabric > Audit or Monitor menus for system event viewing.

How to eliminate wrong answers

Option B is wrong because Security Fabric > Audit shows Fabric-related audit information, not the general system event log. Option C is wrong because System > Advanced contains system settings, not log viewing. Option D is wrong because Monitor > Routing Monitor displays routing table and protocol status, not event logs.

Practice this question →

MCQeasy

An administrator wants to view active VPN tunnels and connected remote users on the dashboard. Which widget is designed for this purpose?

A.IPsec & SSL VPN widget

B.Remote Access Monitor

C.User Monitor

D.Network Interfaces

AnswerA

The IPsec & SSL VPN widget reports live tunnel status and currently connected remote users directly on the dashboard, satisfying the requirement to monitor active VPN sessions. Unlike traffic or log widgets, it aggregates both IPsec and SSL VPN connections, giving the administrator the real-time visibility the scenario demands.

Why this answer

The IPsec & SSL VPN widget on the FortiGate dashboard is specifically designed to display active VPN tunnels and connected remote users. It shows both IPsec and SSL VPN connections, including user names, assigned IPs, and tunnel status. This directly matches the administrator's requirement.

Exam trap

FORTINET-NSE123 often tests dashboard widget functions — candidates may confuse 'User Monitor' with VPN monitoring, but the trap is that User Monitor shows all authenticated users, not specifically VPN tunnels.

How to eliminate wrong answers

Option B is wrong because 'Remote Access Monitor' is not a standard FortiGate dashboard widget; remote access monitoring is typically done via the IPsec & SSL VPN widget or log views. Option C is wrong because the User Monitor widget displays authenticated users and their activity but does not specifically show VPN tunnel status or remote user connections. Option D is wrong because Network Interfaces shows interface status and statistics, not VPN tunnel or remote user details.

Practice this question →

MCQhard

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

A.diagnose ip route lookup [dest-IP]

B.show routing-table match [dest-IP]

C.get router route-check [dest-IP]

D.execute route-test [dest-IP]

AnswerA

The diagnose ip route lookup command simulates the routing decision for a given destination IP, showing the matched route, outgoing interface and gateway without sending traffic. This directly satisfies the requirement to verify which route the FortiGate would select.

Why this answer

The FortiGate CLI command 'diagnose ip route lookup' (or 'diagnose ip route lookup [dest-IP]') simulates a routing lookup for a specified destination IP and shows which route would be selected, including the outgoing interface and gateway. This is the standard tool for verifying route selection without generating actual traffic.

Exam trap

FORTINET-NSE123 often tests the confusion between 'diagnose ip route lookup' (simulation) and 'get router info routing-table' (display), tricking candidates into choosing a display command when a lookup simulation is required.

How to eliminate wrong answers

Option B is wrong because 'show routing-table match' is not a valid FortiGate command; the routing table is displayed with 'get router info routing-table all' or 'show router static'. Option C is wrong because 'get router route-check' does not exist; 'get router info' is used for routing protocol status, not lookup simulation. Option D is wrong because 'execute route-test' is not a FortiGate command; 'execute' commands are for system operations like ping, traceroute, and reboot, not route lookup.

Practice this question →

MCQeasy

An administrator wants to see a real-time list of top applications generating traffic on the network. Which FortiView tab should be opened?

A.Monitor > Application Control

B.FortiView > Applications

C.Log & Report > Application Logs

D.Policy & Objects > Applications

AnswerB

FortiView > Applications provides a real-time, drill-down view of traffic grouped by application, refreshed live as sessions are logged. Opening this tab satisfies the requirement for a real-time list of top applications generating traffic on the network.

Why this answer

FortiView > Applications is the dedicated real-time analytics view that aggregates live traffic by application, showing top applications, bandwidth consumed, sessions, and source/destination breakdowns. It pulls from the session and UTM logs in real time, so it directly answers 'which applications are generating traffic right now.' This is the correct location for real-time application visibility on a FortiGate.

Exam trap

FORTINET-NSE123 often tests the distinction between real-time monitoring (FortiView) and historical log review (Log & Report), so candidates who pick 'Application Logs' confuse live analytics with stored logs.

How to eliminate wrong answers

Option A is wrong because Monitor > Application Control is not a FortiView tab and does not provide the real-time top-applications dashboard; application control monitoring lives under FortiView or Log & Report. Option C is wrong because Log & Report > Application Logs shows historical log entries, not a real-time aggregated top-applications view. Option D is wrong because Policy & Objects > Applications is where application signatures/objects are defined for use in policies, not where live traffic is monitored.

Practice this question →

MCQhard

An administrator needs to test reachability and path MTU to a destination IP using ICMP packets with the Don't Fragment (DF) bit set. Which CLI command allows this?

A.set ping df-bit enable

B.execute ping-options df-bit yes followed by execute ping [dest-IP]

C.ping -M do [dest-IP]

D.diagnose ping df [dest-IP]

AnswerB

Setting df-bit yes configures ping-options so subsequent execute ping packets carry the Don't Fragment flag, forcing path MTU discovery and revealing where fragmentation would occur. This satisfies the requirement to test reachability and path MTU using ICMP with DF set.

Why this answer

FortiOS uses the two-step 'execute ping-options' then 'execute ping' pattern. Setting 'execute ping-options df-bit yes' enables the Don't Fragment bit on subsequent pings, and 'execute ping <dest-IP>' sends them. This allows path MTU discovery by observing whether large packets are dropped with an ICMP 'fragmentation needed' response.

Exam trap

FORTINET-NSE123 often tests CLI syntax familiarity — candidates confuse Linux 'ping -M do' or generic 'set' syntax with FortiOS's 'execute ping-options' two-step pattern.

How to eliminate wrong answers

Option A is wrong because 'set ping df-bit enable' is not valid FortiOS syntax — 'set' is used in config context, not for ping options. Option C is wrong because 'ping -M do' is Linux/BSD syntax, not FortiOS. Option D is wrong because 'diagnose ping df' is not a real FortiOS command; diagnose commands do not include a ping subcommand with df.

Practice this question →

MCQmedium

An administrator needs to set up log forwarding from the FortiGate to a remote Syslog server. Which menu path in the web-based manager is used to configure remote logging?

A.Log & Report > Log Settings

B.System > Syslog Server

C.Policy & Objects > Logging

D.Security Fabric > Log Forwarding

AnswerA

Log & Report > Log Settings holds the remote logging configuration, where you enable Syslog and specify the server address, port, facility and severity threshold. This is the specific menu path that satisfies the requirement to forward FortiGate logs to a remote Syslog server.

Why this answer

Remote Syslog forwarding on FortiGate is configured under Log & Report > Log Settings, where the administrator enables 'Send logs to Syslog' and specifies the Syslog server IP, port, and facility. This is the standard GUI path for configuring remote logging destinations including Syslog, FortiAnalyzer, and FortiManager.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact GUI menu path for log forwarding — many assume it lives under System or Security Fabric, but it is consistently under Log & Report > Log Settings.

How to eliminate wrong answers

Option B is wrong because there is no System > Syslog Server menu in the FortiGate GUI — Syslog configuration is not under System. Option C is wrong because Policy & Objects > Logging does not exist as a menu; logging is configured per-policy but the remote destination is set under Log & Report. Option D is wrong because Security Fabric > Log Forwarding is not the menu used for Syslog server configuration; Security Fabric settings deal with fabric connectors, not Syslog destinations.

Practice this question →

MCQeasy

An administrator wants to check the operational status of FortiGate HA clustering. Which dashboard widget provides an overview of HA member health and role status?

A.Security Fabric Status

B.System Topology

C.Cluster Monitor

D.High Availability widget

AnswerD

The High Availability widget on the dashboard lists each cluster member with its role (primary or subordinate) and health indicators, so operational status is visible at a glance. This satisfies the requirement for an overview of HA member health and role.

Why this answer

The High Availability widget on the FortiGate dashboard is the dedicated pane that shows HA cluster membership, each member's role (primary/secondary), and health indicators such as heartbeat status and uptime. It gives administrators an at-a-glance view of cluster health without navigating to system HA status pages.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse the HA-specific dashboard widget with broader fabric or topology widgets that also appear on the FortiGate dashboard.

How to eliminate wrong answers

Option A is wrong because Security Fabric Status shows fabric topology and device connectivity, not HA cluster member roles. Option B is wrong because System Topology is a physical/logical topology map, not an HA health monitor. Option C is wrong because 'Cluster Monitor' is not the FortiOS dashboard widget name for HA — the correct widget is labeled High Availability.

Practice this question →

Multi-Selecthard

An administrator wants to secure administrative access to the FortiGate. Which THREE best practices should be implemented?

Select 3 answers

A.Set the administrative idle timeout to unlimited for convenience.

B.Use default admin credentials across all deployed firewalls.

C.Configure trusted hosts for administrator accounts to limit access to specific IP ranges.

D.Disable HTTP administrative access and enforce HTTPS only.

E.Disable Telnet access and use SSH for secure CLI management.

AnswersC, D, E

Trusted hosts bind each administrator account to permitted source IP addresses, so authentication attempts from any other address are rejected before password checking. This directly restricts management access to known networks, satisfying the requirement to secure administrative access.

Why this answer

Option C is correct because configuring trusted hosts on administrator accounts restricts login attempts to specified source IP addresses or subnets, blocking brute-force and unauthorized access from untrusted networks. Option D is correct because HTTP transmits credentials and session data in cleartext, so disabling HTTP administrative access and enforcing HTTPS (TLS-encrypted GUI access) protects management traffic from eavesdropping and tampering. Option E is correct because Telnet sends CLI credentials and commands unencrypted, whereas SSH provides an encrypted channel for secure CLI management.

Option A is wrong because an unlimited idle timeout leaves authenticated sessions open indefinitely, inviting session hijacking; best practice is a short idle timeout (e.g., 5-15 minutes). Option B is wrong because default admin credentials are publicly known and must be changed immediately, with unique strong passwords per device.

Exam trap

FORTINET-NSE123 often tests security best practices by including obviously insecure options like unlimited timeout and default credentials, so candidates must recognize that these are never recommended despite any convenience they might offer.

Practice this question →

Multi-Selectmedium

An administrator wants to customize the dashboard view on the FortiGate web-based manager. Which TWO actions can the administrator perform to personalize the dashboard? (Choose two)

Select 2 answers

A.Rearrange existing widgets by dragging and dropping them into preferred positions.

B.Convert the dashboard into a command-line terminal emulator.

C.Delete physical firewall ports from the dashboard interface view.

D.Modify core FortiOS kernel code directly from the dashboard widget settings.

E.Add new widgets using the 'Add Widget' option.

AnswersA, E

Dragging widgets reorders the dashboard layout without altering underlying configuration, satisfying the personalisation requirement. FortiGate's GUI stores each administrator's widget positions per account, so the arrangement persists across sessions. This directly fulfils the stem's demand to customise the dashboard view, unlike actions that change monitoring data or system settings.

Why this answer

Option A is correct because the FortiGate web-based manager (GUI) dashboard is fully customizable through drag-and-drop: an administrator can click and hold a widget's title bar and move it to any position on the dashboard, and the layout is saved per administrator account. Option E is correct because the dashboard provides an 'Add Widget' button that opens a menu of available widgets (such as System Information, License Information, Logs, Top Sessions, and Interfaces) that the administrator can insert into the dashboard. Option B is wrong because the dashboard is a graphical monitoring and configuration surface, not a CLI terminal emulator; CLI access is provided through the console or SSH, not by converting a widget.

Option C is wrong because physical firewall ports are configured under Network > Interfaces, not deleted from the dashboard view; the dashboard only displays interface status widgets. Option D is wrong because FortiOS kernel code cannot be modified from any GUI widget setting, and doing so would violate the supported firmware model.

Exam trap

FORTINET-NSE123 often tests whether candidates know the dashboard is purely a monitoring/customization surface — distractors claim it can alter interfaces or firmware, which it cannot.

Practice this question →

MCQhard

An administrator needs to verify the status of certificate inspection and CA certificates installed on the FortiGate. Where are SSL/SSH inspection profiles and local certificates managed in the web-based manager?

A.Log & Report > Certificate Logs

B.Policy & Objects > SSL/SSH Inspection and System > Certificates

C.VPN > Certificate Manager

D.Security Fabric > Inspection Settings

AnswerB

SSL/SSH inspection profiles define certificate inspection behaviour, while System > Certificates holds the local CA and server certificates the FortiGate presents. Together these locations satisfy the need to verify certificate inspection status and installed CA certificates.

Why this answer

SSL/SSH inspection profiles are configured under Policy & Objects > SSL/SSH Inspection, where you define which traffic is deep-inspected, which categories are exempt, and which CA certificate is used for re-signing. Local CA and server certificates, along with their private keys, are managed under System > Certificates. Together these two locations cover the full certificate inspection workflow on a FortiGate.

Exam trap

FORTINET-NSE123 often tests the split between inspection profile configuration (Policy & Objects) and certificate/key storage (System > Certificates) — candidates assume everything certificate-related lives in one menu.

How to eliminate wrong answers

Option A is wrong because Log & Report only stores and displays log entries (including certificate-related events) — it does not manage certificates or inspection profiles. Option C is wrong because VPN > Certificate Manager is not a valid FortiGate GUI path; VPN menus handle IPsec/SSL VPN tunnels, not certificate stores. Option D is wrong because Security Fabric > Inspection Settings does not exist as a certificate management location; Security Fabric covers fabric connectors, automation, and device integration.

Practice this question →

MCQmedium

An administrator needs to back up the current FortiGate configuration securely to a local PC via the GUI. Which option should the administrator select?

A.System > Firmware > Backup

B.Log & Report > Log Settings > Backup

C.System > Settings > Backup Configuration

D.Security Fabric > Settings > Export

AnswerC

System > Settings > Backup Configuration exports the full configuration file through the GUI, satisfying the requirement to back up locally to a PC. It also offers an encrypted option, protecting sensitive credentials such as passwords and pre-shared keys, which meets the stem's secure-backup constraint without needing CLI access or external tooling.

Why this answer

In FortiOS GUI, the configuration backup is performed via System > Settings > Backup Configuration, which allows the administrator to download the current configuration file (encrypted or plain text) to a local PC. This is the standard, documented path for secure configuration backup through the web-based manager.

Exam trap

FORTINET-NSE123 often tests GUI menu path memorization, and candidates frequently confuse the Firmware section (for upgrades) with the Settings section (for configuration backup), leading them to pick the wrong menu.

How to eliminate wrong answers

Option A is wrong because System > Firmware > Backup does not exist as a configuration backup path — the Firmware section is for firmware management and upgrade, not config backup. Option B is wrong because Log & Report > Log Settings > Backup relates to log storage and archiving settings, not configuration file backup. Option D is wrong because Security Fabric > Settings > Export is not a configuration backup function; the Security Fabric section deals with fabric topology and integration, not device config export.

Practice this question →

MCQeasy

An administrator needs to view a graphical representation of bandwidth usage over the last 24 hours. Which dashboard widget provides this historical traffic graph?

A.FortiView Summary

B.Bandwidth widget

C.System > Performance Graphs

D.Log & Report > Traffic Graph

AnswerB

The Bandwidth widget plots historical throughput over a selected period, including the last 24 hours, satisfying the graphical traffic-history requirement. It differs from the real-time interface monitor, which shows only current utilisation without retained historical graphing.

Why this answer

The Bandwidth widget on the FortiGate dashboard is specifically designed to display a historical graph of bandwidth usage (ingress and egress) over selectable time ranges including the last 24 hours. It samples interface throughput counters and renders them as a time-series chart, making it the correct answer for viewing historical traffic trends. This widget is available on the default dashboard and can be customized per admin.

Exam trap

The trap is that candidates look for a 'Traffic Graph' under Log & Report or System, when the actual historical bandwidth visualization lives as a dashboard widget named simply 'Bandwidth'.

How to eliminate wrong answers

Option A is wrong because 'FortiView Summary' shows top sources, destinations, applications, and threats — not a bandwidth-over-time graph. Option C is wrong because 'System > Performance Graphs' is not a FortiOS dashboard widget; performance data is surfaced through the dashboard widgets and FortiView, not a System menu graph. Option D is wrong because 'Log & Report > Traffic Graph' does not exist as a menu item — Log & Report contains log views, not graphical bandwidth charts.

Practice this question →

MCQhard

An administrator is investigating a network routing issue on the FortiGate and needs to see the current active kernel routing table entries. Which CLI command provides this information?

A.execute traceroute

B.get system interface

C.get router info routing-table all

D.diagnose firewall IP-antibot list

AnswerC

`get router info routing-table all` queries the FortiGate's active kernel routing table directly, dumping every installed route rather than filtering by protocol or prefix. This satisfies the administrator's requirement to view current active entries, unlike configuration-oriented commands that display static route definitions without confirming which routes the kernel actually selected.

Why this answer

The command 'get router info routing-table all' displays the complete active kernel routing table on a FortiGate, including all routes (connected, static, dynamic) with their attributes. It is the standard CLI method for verifying routing entries and troubleshooting routing issues.

Exam trap

FORTINET-NSE123 often tests the exact CLI command for viewing the routing table, and candidates may confuse it with 'get system interface' or 'diagnose firewall IP-antibot list'.

How to eliminate wrong answers

Option A is wrong because 'execute traceroute' is used to trace the path to a destination, not to display the routing table. Option B is wrong because 'get system interface' shows interface configuration and status, not routing entries. Option D is wrong because 'diagnose firewall IP-antibot list' displays IP reputation and botnet entries, unrelated to routing.

Practice this question →

MCQmedium

An administrator needs to change the management IP address of the internal interface (e.g., port1) via the CLI. Which sequence of configuration commands is correct?

A.config router interface > edit port1 > set address [IP] > end

B.config system interface > edit port1 > set ip [IP] [netmask] > end

C.set interface port1 ip [IP] > save

D.execute set ip port1 [IP]

AnswerB

Entering the interface configuration context, selecting port1, setting the IP and netmask, then ending applies the new management address. This sequence satisfies the stem's CLI requirement, since 'set ip' only accepts values inside 'config system interface'.

Why this answer

The correct sequence is 'config system interface > edit port1 > set ip [IP] [netmask] > end'. This enters the system interface configuration context, selects the port1 interface, sets the IP address and netmask, and saves the configuration. This is the standard FortiOS CLI syntax for changing an interface IP.

Exam trap

FORTINET-NSE123 often tests the correct CLI hierarchy, trapping candidates who confuse 'config system interface' with invalid paths like 'config router interface' or non-existent 'execute' commands.

How to eliminate wrong answers

Option A is wrong because 'config router interface' is not a valid FortiOS command path for interface IP configuration; the correct path is 'config system interface'. Option C is wrong because 'set interface port1 ip [IP] > save' is not valid FortiOS syntax; FortiOS uses 'config' and 'edit' contexts, not a single 'set' command with 'save'. Option D is wrong because 'execute set ip port1 [IP]' is not a valid FortiOS command; 'execute' commands are for actions like reboot or ping, not interface configuration.

Practice this question →

MCQhard

An administrator wants to check the status of HA (High Availability) synchronization between primary and secondary FortiGate units. Which CLI command should be used?

A.diagnose ha group list

B.show HA cluster

C.get system status HA

D.get system ha status

AnswerD

get system ha status reports HA mode, cluster members, primary election and synchronisation state, directly satisfying the requirement to check HA sync between primary and secondary units. It is a read-only diagnostic command, unlike execute commands that modify cluster behaviour.

Why this answer

The correct CLI command to check HA synchronization status between primary and secondary FortiGate units is 'get system ha status'. This command displays the HA cluster status, including the primary unit, synchronization state, and member information.

Exam trap

FORTINET-NSE123 often tests the exact CLI syntax for HA status, so candidates pick plausible-sounding but invalid commands like 'show HA cluster' or 'get system status HA' instead of the correct 'get system ha status'.

How to eliminate wrong answers

Option A is wrong because 'diagnose ha group list' is not a valid FortiGate HA status command. Option B is wrong because 'show HA cluster' is not a valid FortiGate CLI command for HA status. Option C is wrong because 'get system status HA' is not the correct syntax — 'get system status' shows general system status, not HA-specific synchronization details.

Practice this question →

MCQhard

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

A.Security Fabric > Audit Logs

B.FortiView > Command History

C.Log & Report > System Events (Admin Login and CLI Command Logs)

D.Log & Report > CLI History

AnswerC

Log & Report > System Events captures administrative CLI command execution through the Admin Login and CLI Command Logs sub-category, recording each command an administrator runs on the FortiGate. This directly satisfies the requirement to review exact CLI commands executed during a troubleshooting session or audit history, unlike traffic or event logs that omit command-level detail.

Why this answer

Administrative CLI command execution is recorded under Log & Report > System Events, specifically in the Admin Login and CLI Command log subtypes. These logs capture the admin username, source IP, the exact command string, and the timestamp, making them the authoritative source for audit and troubleshooting history.

Exam trap

FORTINET-NSE123 often tests whether candidates know the exact menu path (Log & Report > System Events) for CLI command logs, versus inventing plausible-sounding paths like 'CLI History' or 'Audit Logs.'

How to eliminate wrong answers

Option A is wrong because Security Fabric > Audit Logs records Fabric topology and connector events, not per-command CLI execution. Option B is wrong because FortiView > Command History is not a standard FortiGate log view — FortiView focuses on traffic and threat analytics, not CLI audit trails. Option D is wrong because 'Log & Report > CLI History' is not a real menu path in FortiOS; the correct location is System Events with the CLI Command subtype.

Practice this question →

MCQeasy

An administrator needs to monitor real-time CPU and memory usage from the FortiGate GUI dashboard. Which widget should be added to the dashboard for this purpose?

A.FortiView Sessions

B.System Resources

C.Log Rate

D.License Information

AnswerB

The System Resources widget polls live CPU and memory counters from the FortiGate's kernel and displays them as real-time graphs on the dashboard, directly satisfying the requirement to monitor current utilisation rather than historical or per-interface statistics.

Why this answer

The System Resources widget on the FortiGate dashboard is specifically designed to display real-time CPU and memory usage, along with other system-level metrics such as session count and log rate. Adding this widget provides administrators with an at-a-glance view of resource utilization directly on the dashboard. It is the correct choice for monitoring CPU and memory in real time.

Exam trap

FORTINET-NSE123 often tests the specific widget names and their purposes, so candidates may confuse the System Resources widget with the Log Rate or FortiView Sessions widgets when asked about CPU and memory monitoring.

How to eliminate wrong answers

Option A is wrong because FortiView Sessions is a monitoring console that shows session details (source, destination, application, etc.), not CPU or memory usage. Option C is wrong because the Log Rate widget displays the volume of logs being generated per second, which is unrelated to CPU and memory metrics. Option D is wrong because the License Information widget shows license status and expiration dates, not system resource utilization.

Practice this question →

MCQeasy

An administrator wants to view real-time CPU utilization per system process. Which dashboard widget or view helps identify which process is consuming CPU resources?

A.Monitor > Performance Log

B.FortiView > Processes

C.System Resources widget (Process list)

D.Log & Report > CPU Logs

AnswerC

The System Resources widget's process list enumerates individual processes with live CPU consumption, satisfying the requirement to identify the specific process consuming CPU resources. Unlike aggregate CPU graphs, which show only total utilisation, this view attributes usage per process in real time, directly answering which process is responsible.

Why this answer

The System Resources widget includes a process list that shows real-time CPU and memory consumption per process on the FortiGate. This is the correct place to identify which daemon (e.g., ipsengine, wad, miglogd) is consuming CPU. It updates live and can be sorted by CPU usage.

Exam trap

FORTINET-NSE123 often tests the difference between live per-process monitoring (System Resources widget) and historical or traffic-based views (Performance Log, FortiView), catching candidates who pick FortiView for process-level data.

How to eliminate wrong answers

Option A is wrong because Monitor > Performance Log stores historical performance statistics, not a live per-process CPU breakdown. Option B is wrong because FortiView > Processes is not a standard FortiGate view — FortiView focuses on traffic, sources, destinations, and applications, not OS processes. Option D is wrong because Log & Report > CPU Logs does not exist as a per-process CPU view; logs capture events, not live process utilization.

Practice this question →

Multi-Selectmedium

An administrator wants to ensure that administrative access to the FortiGate web-based manager is secure. Which TWO configuration steps should be implemented? (Choose two)

Select 2 answers

A.Enable Telnet for administrative CLI access.

B.Configure Trusted Hosts on the administrator account to restrict management login to specific IP addresses.

C.Use default admin accounts with blank passwords.

D.Disable password complexity requirements globally.

E.Disable HTTP administrative access and enforce HTTPS only.

AnswersB, E

Trusted Hosts binds each administrator account to permitted source IP addresses, so management logins from any other address are rejected before authentication. This directly satisfies the stem's requirement to secure web-based manager access by limiting where administrative sessions may originate.

Why this answer

Option B is correct because configuring Trusted Hosts on an administrator account restricts management logins to specific, pre-approved source IP addresses, which prevents unauthorized hosts from even attempting to authenticate to the FortiGate web-based manager. Option E is correct because disabling HTTP administrative access and enforcing HTTPS only ensures that all management traffic to the web-based manager is encrypted with TLS, protecting credentials and session data from interception or tampering. Options A, C, and D are incorrect because Telnet transmits credentials in cleartext, default accounts with blank passwords are trivially exploitable, and disabling password complexity weakens rather than strengthens administrative security.

Exam trap

FORTINET-NSE123 often tests the difference between hardening steps and insecure legacy options, tricking candidates into selecting Telnet or default/blank-password settings as if they were valid security measures.

Practice this question →

MCQeasy

Which dashboard widget displays the current status and capacity of local storage (hard drive or log disk) on the FortiGate?

A.System Resources

B.Log Disk

C.Storage Manager

D.Hardware Status

AnswerB

The Log Disk widget reports the local storage device's status and capacity, showing used and free space for logs. This satisfies the stem's requirement, as it is the dashboard widget dedicated to local hard drive or log disk information.

Why this answer

The Log Disk widget on the FortiGate dashboard displays the current status and capacity of local storage used for logs (hard drive or log disk). It shows used versus total space, making it the correct widget for monitoring local storage capacity.

Exam trap

The trap is confusing the Log Disk widget with other system widgets like System Resources or Hardware Status — candidates who haven't explored the dashboard may pick a generic-sounding widget instead of the specific Log Disk one.

How to eliminate wrong answers

Option A is wrong because System Resources shows CPU, memory, and session counts, not disk capacity. Option C is wrong because 'Storage Manager' is not a FortiGate dashboard widget; storage configuration is under System > Settings or Log & Report. Option D is wrong because 'Hardware Status' is not a dashboard widget for disk capacity; hardware sensors are shown elsewhere.

Practice this question →

MCQmedium

An administrator is configuring a new local administrator account with restricted privileges. Where in the web-based manager are administrator accounts and access profiles created and managed?

A.Policy & Objects > Admins

B.Security Fabric > Access Control

C.User & Authentication > Administrator Users

D.System > Administrators

AnswerD

System > Administrators is where local administrator accounts are created and bound to access profiles, which define permitted read/write scope per administrative domain. This satisfies the restricted-privileges requirement by letting you assign a limited profile rather than the super_admin profile.

Why this answer

Administrator accounts and their associated access profiles (permission sets) are created and managed under System > Administrators in the FortiGate GUI. This is the central location where you define local admin users, assign admin profiles, restrict trusted hosts, and configure authentication methods such as LDAP, RADIUS, or local passwords. The access profile itself is also defined here, controlling which VDOMs and functional areas each admin can view or modify.

Exam trap

FORTINET-NSE123 often tests the confusion between end-user objects under User & Authentication and administrator accounts under System > Administrators — candidates pick the 'User' menu because the word 'administrator' sounds like a user object.

How to eliminate wrong answers

Option A is wrong because Policy & Objects is used for firewall policies, addresses, services, and virtual IPs — not admin accounts. Option B is wrong because Security Fabric groups features like fabric connectors, device detection, and automation stitches, not administrator identity management. Option C is wrong because User & Authentication is for end-user objects (local users, groups, LDAP/RADIUS servers) used in firewall authentication and FSSO, not for FortiGate administrators.

Practice this question →

Multi-Selectmedium

When navigating the FortiGate GUI, which THREE main functional areas or menu categories are typically visible in the standard menu tree?

Select 3 answers

A.Dashboard

B.Kernel Debugger

C.Policy & Objects

D.Log & Report

E.BIOS Utility

AnswersA, C, D

Dashboard appears as a top-level menu category in the FortiGate GUI tree, satisfying the stem's requirement for one of the three main functional areas. It aggregates widgets such as system status, licence information, and security fabric topology, confirming its standing as a primary navigation entry rather than a nested submenu item.

Why this answer

The FortiGate GUI's standard menu tree includes Dashboard (A), which is the default landing page showing widgets for system status, licenses, and resource usage. Policy & Objects (C) is a core menu category where firewall policies, addresses, services, and other object definitions are configured. Log & Report (D) is also a standard menu area that provides access to log viewing, forwarding, and report generation.

Kernel Debugger (B) is not a GUI menu category; it is a CLI diagnostic tool accessed via commands like 'diagnose debug' or 'diagnose sys top'. BIOS Utility (E) is not part of the FortiGate GUI at all; it is a low-level firmware/hardware setup interface accessed outside FortiOS.

Exam trap

FORTINET-NSE123 often tests whether candidates mistake CLI-only or hardware-level tools (Kernel Debugger, BIOS Utility) for GUI menu categories.

Practice this question →

MCQeasy

Which dashboard widget displays the overall hardware status, serial number, firmware version, and system uptime of the FortiGate?

A.License Information

B.System Information

C.Network Interface Monitor

D.CLI Console

AnswerB

System Information aggregates device-level telemetry — hardware health, serial number, firmware version and uptime — into a single widget, directly satisfying the stem's requirement for overall hardware status plus identifying details. Other dashboard widgets report traffic, threats or interface statistics rather than chassis inventory, so they cannot surface serial number or firmware version.

Why this answer

The System Information widget is the dashboard element that surfaces hostname, serial number, firmware version, system uptime, and overall hardware/HA status. It is the default top widget on a fresh FortiGate dashboard.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse License Information (contracts/entitlements) with System Information (hardware, firmware, uptime) — both appear at the top of the dashboard and look similar.

How to eliminate wrong answers

Option A is wrong because the License Information widget shows support contract status, license expiry dates, and VM resource entitlements — not serial number, firmware, or uptime. Option C is wrong because the Network Interface Monitor widget displays per-interface link state, IP, speed, and throughput, with no hardware or firmware details. Option D is wrong because the CLI Console widget is an embedded terminal for running CLI commands, not a status display of hardware or firmware.

Practice this question →

MCQhard

An administrator needs to test whether a specific TCP port is open on a remote server directly from the FortiGate CLI. Which command can be used to test TCP connectivity?

A.diagnose tcp-test [server-IP] [port]

B.ping -p [port] [server-IP]

C.traceroute -port [port] [server-IP]

D.execute telnet [server-IP] [port]

AnswerD

The `execute telnet` command opens a direct TCP connection from the FortiGate CLI to the specified server and port, satisfying the requirement to test TCP connectivity without leaving the device. Unlike ICMP-based tools such as ping, it confirms the target port is listening and reachable through the firewall's own network stack.

Why this answer

The FortiGate CLI command 'execute telnet [server-IP] [port]' initiates a TCP connection to the specified IP and port, allowing the administrator to test whether that TCP port is reachable and open. If the connection succeeds, the port is open; if it fails or times out, the port is blocked or the service is down. This is the standard CLI method for TCP port testing on FortiGate.

Exam trap

FORTINET-NSE123 often tests the misconception that ping or traceroute can test TCP ports, when in fact only 'execute telnet' performs a TCP handshake test on FortiGate.

How to eliminate wrong answers

Option A is wrong because 'diagnose tcp-test' is not a valid FortiGate CLI command — while 'diagnose' commands exist for many purposes, there is no 'tcp-test' subcommand for port connectivity. Option B is wrong because 'ping -p [port]' is not valid syntax on FortiGate; ping uses ICMP and does not test TCP ports, and the -p flag is not used for port specification in FortiOS. Option C is wrong because 'traceroute -port' is not a valid FortiGate command — traceroute uses ICMP/UDP to map hops and does not accept a port parameter for TCP port testing.

Practice this question →

MCQmedium

An administrator wants to verify the operational status and packet error rates of a specific physical interface (e.g., port2) via CLI. Which command should be used?

A.get system interface physical [interface-name] or diagnostics hardware deviceinfo nic [interface-name]

B.show interface port2 stats

C.get system interface port2

D.execute interface check port2

AnswerA

The physical subcommand queries the NIC driver directly, returning link state, speed, duplex and hardware packet error counters for that port. This satisfies the stem's requirement to verify operational status and error rates for a specific physical interface such as port2, which logical interface commands cannot expose.

Why this answer

The correct command to verify operational status and packet error rates of a physical interface in FortiOS is 'get system interface physical [interface-name]' or 'diagnostics hardware deviceinfo nic [interface-name]'. The first command provides a summary of physical interface status, including link state, speed, duplex, and error counters. The second command gives detailed NIC-level statistics, including packet errors, drops, and other hardware-level counters.

These are the standard FortiGate CLI commands for physical interface diagnostics.

Exam trap

FORTINET-NSE123 often tests the distinction between 'get system interface' (logical configuration) and 'diagnose hardware deviceinfo nic' (physical layer statistics), and candidates may incorrectly assume that 'show interface' (common in other vendors) works in FortiOS.

How to eliminate wrong answers

Option B is wrong because 'show interface port2 stats' is not a valid FortiOS CLI command; FortiOS uses 'get' or 'diagnose' for interface status, not 'show'. Option C is wrong because 'get system interface port2' displays logical interface configuration (IP, mask, administrative status) but not physical layer status or packet error rates. Option D is wrong because 'execute interface check port2' is not a valid FortiOS command; 'execute' is used for system-level actions like reboot or ping, not interface diagnostics.

Practice this question →

Multi-Selectmedium

An administrator needs to perform a firmware upgrade on a standalone FortiGate. Which TWO best practices should be followed before initiating the upgrade? (Choose two)

Select 2 answers

A.Back up the current FortiGate configuration file.

B.Perform a factory reset immediately after upgrading without saving configurations.

C.Review the official FortiOS release notes and verified upgrade paths.

D.Unplug all physical network interfaces during the upgrade.

E.Downgrade the FortiGuard license contract.

AnswersA, C

Backing up the configuration preserves all policies, routes and settings, allowing restoration if the firmware upgrade fails or introduces regressions. This satisfies the stated best-practise requirement of safeguarding the standalone FortiGate before initiating the upgrade.

Why this answer

Option A is correct because backing up the current FortiGate configuration file before a firmware upgrade preserves all settings and allows restoration if the upgrade fails or introduces issues. Option C is correct because reviewing the official FortiOS release notes and verified upgrade paths ensures compatibility, identifies known issues, and confirms the proper sequence for moving between firmware versions. Option B is incorrect because a factory reset immediately after upgrading without saving configurations would erase the existing configuration and is not a recommended pre-upgrade best practice.

Option D is incorrect because unplugging all physical network interfaces is unnecessary and could disrupt management access needed to perform and verify the upgrade. Option E is incorrect because downgrading the FortiGuard license contract is unrelated to preparing for a firmware upgrade and would not support the process.

Exam trap

FORTINET-NSE123 often tests the misconception that a factory reset is a standard post-upgrade step or that physical disconnection is required, when in fact backup and release note review are the key pre-upgrade best practices.

Practice this question →

MCQeasy

An administrator wants to view a chronological list of all administrator logins, configuration changes, and system alerts. Which log category contains this information?

A.Log & Report > Forward Traffic

B.Dashboard > Event Summary

C.Log & Report > System Events

D.FortiView > Admins

AnswerC

System Events captures administrator logins, configuration changes and system alerts in chronological order, exactly the audit trail the administrator needs. It is distinct from traffic and security logs, which record forwarded sessions and threat detections rather than management-plane activity.

Why this answer

Log & Report > System Events is the correct location because it aggregates administrative activity logs, configuration change logs, and system-level alerts into a single chronological view. FortiGate categorizes these as 'event' logs, which include admin logins, config changes, and system events such as HA transitions or interface up/down. This is the only option that directly provides a unified, time-ordered list of these specific event types.

Exam trap

The trap here is confusing traffic logs with event logs, or assuming that FortiView or Dashboard widgets provide the same detailed chronological list as the dedicated System Events log.

How to eliminate wrong answers

Option A is wrong because Forward Traffic logs contain session-level data (source/destination IP, ports, bytes, application) for traffic passing through the FortiGate, not administrative or system events. Option B is wrong because Dashboard > Event Summary provides a high-level widget-based summary of recent events, not a full chronological log list, and it does not include configuration changes. Option D is wrong because FortiView > Admins is a visualization tool that shows admin login activity but does not include configuration changes or system alerts, and it is not a log category.

Practice this question →

MCQeasy

An administrator wants to view top bandwidth-consuming applications on the FortiGate dashboard. Which feature or view provides this aggregated application visibility?

A.FortiView > Applications

B.Log & Report > Forward Traffic

C.Security Fabric > Topology

D.System > FortiGuard

AnswerA

FortiView > Applications aggregates traffic by application identity, using FortiGate's application control signatures to rank top bandwidth consumers. This directly satisfies the requirement for aggregated application visibility on the dashboard, showing which applications consume the most bandwidth across the network.

Why this answer

FortiView > Applications provides aggregated application visibility, showing top applications by bandwidth, sessions, and other metrics. FortiView is FortiGate's built-in analytics dashboard that aggregates log data into visual widgets, and the Applications view specifically ranks applications by traffic volume, making it the correct place to see top bandwidth-consuming applications.

Exam trap

FORTINET-NSE123 often tests the difference between FortiView (aggregated analytics) and Log & Report (raw logs) — candidates pick Forward Traffic because it contains application data, but it is not aggregated.

How to eliminate wrong answers

Option B is wrong because Log & Report > Forward Traffic shows raw or filtered traffic log entries, not an aggregated application-level ranking; it is useful for detailed forensics but not for top-application visibility. Option C is wrong because Security Fabric > Topology displays the physical/logical topology of devices in the fabric, not application bandwidth statistics. Option D is wrong because System > FortiGuard is where FortiGuard service settings (licenses, updates) are configured, not where traffic analytics are viewed.

Practice this question →

MCQhard

An administrator suspects that a specific firewall policy rule is dropping legitimate traffic due to an incorrect security profile or action. Where can the administrator check the hit counters for each individual firewall policy in the web-based manager?

A.FortiView > Policies view

B.System > Feature Visibility > Policy Statistics

C.Policy & Objects > Firewall Policy view, by checking the 'Hit Count' column

D.Log & Report > Traffic Log Summary

AnswerC

The Firewall Policy view under Policy & Objects displays a Hit Count column showing how many times each policy matched traffic. This directly satisfies the scenario by letting the administrator confirm whether the suspect policy is actually being hit.

Why this answer

In the FortiGate GUI, per-policy hit counters are displayed directly in the Policy & Objects > Firewall Policy view as a 'Hit Count' column (sometimes labeled 'Hits' or shown as bytes/packets). This lets an administrator quickly see which policies are matching traffic and which are not, making it the correct place to verify whether a specific rule is being hit.

Exam trap

The trap here is confusing monitoring/analytics views (FortiView, Log & Report) with the actual configuration view where the hit counter column lives — candidates often assume any 'policy' related menu will show the counter.

How to eliminate wrong answers

Option A is wrong because FortiView > Policies is an analytics/monitoring view that shows traffic summaries and top policies, not the raw per-policy hit counter column used for troubleshooting. Option B is wrong because System > Feature Visibility controls which GUI features are displayed, not policy statistics. Option D is wrong because Log & Report > Traffic Log Summary shows logged traffic events, not the cumulative hit counter maintained per policy.

Practice this question →