VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

NSE 3 - FortiGate Operator Free Sample Questions

Description

Covers FortiGate fundamentals, interface and routing configuration, firewall policies and authentication, SSL inspection and web filtering, IPsec and SSL VPNs, and high availability.

12 free sample questions150 in the full practice test

Try simulator

NSE_3 Sample Questions

  1. Question 1

    Beginner

    System Administration and Monitoring · System Maintenance and Monitoring

    A junior administrator is configuring a new FortiGate device for a branch office. They need to ensure that the device's system time is accurate for log correlation with the central FortiAnalyzer. Which configuration setting should be prioritized to ensure time consistency across the Security Fabric?

    Answer and explanation

    Correct answer: B

    Accurate system time is critical for log correlation and certificate validation. Configuring a Network Time Protocol (NTP) server ensures the FortiGate synchronizes its clock with a reliable source. While manual setting works temporarily, it drifts over time.

  2. Question 2

    Intermediate

    Network Configuration · Configuring Interfaces and Routing

    A network operator is reviewing the routing table on a FortiGate. They observe two static routes to the same destination subnet. Route A has a Distance of 10 and a Priority of 10. Route B has a Distance of 10 and a Priority of 20. Which route will be installed in the routing table and used for traffic forwarding?

    Answer and explanation

    Correct answer: A

    When Administrative Distance is equal, FortiGate uses Priority to break ties. A lower Priority value is preferred. However, unless ECMP (Equal Cost Multi-Path) is specifically intended and priorities are equal (or ignored depending on config), the lower priority route is preferred.

  3. Question 3

    Beginner

    Firewall Policy Configuration · Firewall Policies and NAT

    When configuring a Firewall Policy, an administrator wants to ensure that a specific internal server is accessible from the internet using a public IP address. Which object must be created and referenced in the Destination field of the policy?

    Answer and explanation

    Correct answer: B

    A Virtual IP (VIP) is used for Destination NAT (DNAT). It maps a public IP address (and optionally a port) to an internal private IP address, allowing external access to internal resources.

  4. Question 4

    Intermediate

    Security Profiles - Content Inspection · SSL/TLS Traffic Inspection

    An organization requires that all traffic to a specific set of financial websites bypasses SSL Deep Inspection due to privacy regulations. The administrator is configuring the SSL/SSH Inspection profile. Which action should be taken to achieve this?

    Answer and explanation

    Correct answer: A

    SSL Inspection profiles include an exemption list. Adding reputable financial or healthcare sites to this list allows the FortiGate to bypass deep inspection for those destinations, preserving privacy and avoiding certificate pinning issues.

  5. Question 5

    Intermediate

    Virtual Private Networks (VPN) · IPsec VPN

    While troubleshooting a Site-to-Site IPsec VPN, the administrator notices that the Phase 1 negotiation is failing. The logs show a mismatch in the pre-shared key. Which status indicator in the IPsec Monitor would confirm that Phase 1 is down?

    Answer and explanation

    Correct answer: B

    If Phase 1 fails (e.g., due to PSK mismatch), the tunnel cannot be established at all. The IPsec Monitor will show the tunnel as Down/Inactive. Phase 2 cannot negotiate if Phase 1 is not established.

  6. Question 6

    Advanced

    User Authentication · Authenticating Network Users

    A FortiGate administrator is setting up User Authentication for internet access. They want to ensure that users are transparently authenticated using their Windows Active Directory credentials without seeing a login prompt. Which component is required to facilitate this FSSO (Fortinet Single Sign-On) deployment?

    Answer and explanation

    Correct answer: B

    For transparent FSSO, an FSSO Collector Agent is typically installed on a Windows server. It monitors AD domain controller logs for login events and forwards the username/IP mapping to the FortiGate.

Register free for 6 more questions

Or unlock all 150 NSE_3 questions with explanations, timed mode and flashcards.

Related practice tests

All Fortinet practice exams