FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts — 25 Questions

Question 1

Which THREE behaviors exemplify poor cybersecurity hygiene for remote workers operating from home? (Choose three.)

Accepted Answer

Accessing internal applications over an unsecured home Wi-Fi network without enabling a VPN.. Poor hygiene practices include using unsecured home Wi-Fi without VPNs, reusing corporate passwords, and writing down credentials.

Answer

Connecting to corporate systems through a secure enterprise VPN with MFA enforced.

Answer

Allowing family members to use the corporate laptop for personal web browsing and gaming.

Answer

Reusing the exact same corporate network password for personal social media and streaming accounts.

Question 2

When configuring an organization's email gateway, which security feature should be enabled to prevent attackers from spoofing the company domain?

Accepted Answer

Implementing SPF, DKIM, and DMARC records.. SPF, DKIM, and DMARC are the industry-standard mechanisms used to verify sender identity and prevent domain spoofing.

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

Enabling SMTP relaying for all internal users.

Answer

multi_select

Answer

Disabling all attachments in incoming emails.

Answer

Requiring all users to use digital signatures for internal emails only.

Question 3

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

Accepted Answer

Baiting. Baiting involves leaving physical media in places where targets are likely to find them, playing on curiosity or greed.

Answer

Watering hole attack

Answer

Tailgating

Answer

Phishing

Question 4

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

Accepted Answer

Physical security. Physical security controls protect the physical plant, equipment, and media from unauthorized access, theft, or tampering.

Answer

Endpoint compliance

Answer

Network layer security

Answer

Application layer security

Question 5

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

Accepted Answer

Principle of least privilege. The principle of least privilege dictates that accounts and users should only have the minimum necessary access to perform their required functions, minimizing the blast radius of a compromise.

Answer

Separation of duties

Answer

Defense in depth

Answer

Security through obscurity

Question 6

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

Accepted Answer

A tech support scam. Tech support scams use fear and false urgency via deceptive alerts to trick users into paying for unnecessary services or granting remote access to their machines.

Answer

A SQL injection exploit

Answer

A distributed denial-of-service attack

Answer

A legitimate endpoint telemetry notification

Question 7

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

Accepted Answer

It ensures that compromised credentials alone are insufficient for an attacker to gain access. Multi-factor authentication (MFA) significantly reduces the risk of unauthorized access even if a primary password is compromised via phishing or credential stuffing.

Answer

It guarantees complete encryption of all local workstation files

Answer

It prevents all forms of social engineering attacks against remote workers

Answer

It entirely eliminates the need for strong passwords on corporate accounts

Question 8

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

Accepted Answer

Maintaining immutable, offline data backups. Regularly tested backups provide an authoritative recovery copy of data, rendering ransomware extortion ineffective.

Answer

Enforcing mandatory password complexity rules

Answer

Implementing strict egress firewall filtering

Answer

Deploying host-based intrusion detection systems

Question 9

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

Accepted Answer

Confidentiality. Confidentiality ensures that data is readable only by intended parties, which is achieved through encryption, preventing casual sniffing on shared segments.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 10

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

Accepted Answer

Report the email using the organization's designated phishing reporting mechanism. Reporting the email using the organization's official phishing reporting tool is the safest and correct action, as it alerts the security team without interacting with the malicious link.

Answer

Click the link to verify if the website looks authentic before reporting it

Answer

Forward the email to all colleagues as a warning

Answer

Reply to the sender asking for verbal confirmation of their identity

Question 11

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

Accepted Answer

Smishing. Smishing is a portmanteau of SMS and phishing, representing phishing attacks conducted through mobile text messaging.

Answer

Spear phishing

Answer

Vishing

Answer

Whaling

Question 12

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

Accepted Answer

A long passphrase consisting of random unrelated words and special characters. Using a long passphrase with a combination of character types provides high entropy, making it extremely difficult to crack via brute-force or dictionary methods.

Answer

A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

Answer

A password reused from personal social media accounts to ensure easy recall

Answer

A short word combined with the current year, such as 'Summer2026!'

Question 13

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

Accepted Answer

Lock the workstation screen. Locking the workstation prevents unauthorized physical access to sensitive open applications and data while the user is away.

Answer

Unplug the Ethernet network cable

Answer

Power down the computer completely

Answer

Minimize all open web browser windows

Question 14

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

Accepted Answer

Separation of duties. Separation of duties ensures that critical tasks require authorization from multiple distinct individuals to prevent misuse or error.

Answer

Mandatory access control labeling

Answer

Single sign-on federation

Answer

Role-based access auditing

Question 15

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

Accepted Answer

Inadequate identity and access lifecycle offboarding procedures. Poor offboarding and lifecycle management processes fail to promptly revoke access when personnel leave the organization.

Answer

Failure to implement adequate endpoint antivirus software

Answer

Absence of hardware token multi-factor authentication

Answer

Lack of network segmentation between departments

Question 16

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

Accepted Answer

Controlled application execution (Whitelisting). Application whitelisting or controlled application execution ensures that only pre-approved, trusted software can run on endpoints.

Answer

Network boundary defense

Answer

Asymmetric encryption key management

Answer

Principle of fail-secure

Question 17

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

Accepted Answer

Human psychology and helpfulness. Social engineering exploits human psychology, such as helpfulness, fear, or authority, rather than technical software flaws.

Answer

Misconfigured firewall security policies

Answer

Cryptographic weak implementation

Answer

Unpatched operating system kernel bugs

Question 18

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

Accepted Answer

Vishing (Voice Phishing). Vishing (voice phishing) uses telephone communication to manipulate individuals into divulging confidential information.

Answer

Drive-by download

Answer

Denial of service

Answer

Phishing via email

Question 19

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

Accepted Answer

Confidentiality across all states of data (transit and rest). Encryption protects data confidentiality during transit and at rest, ensuring unauthorized parties cannot read it.

Answer

Availability and Non-repudiation

Answer

Authenticity and Authorization

Answer

Confidentiality and Integrity

Question 20

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

Accepted Answer

Impossible travel anomaly. Impossible travel indicates that credentials are likely compromised and being used simultaneously by an attacker elsewhere.

Answer

Bandwidth saturation anomaly

Answer

Hardware failure indicator

Answer

DNS poisoning event