FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts — 30 Questions

Question 1

Which THREE of the following actions are examples of good physical security practices in an office environment? (Choose three)

Accepted Answer

Locking your workstation screen every time you step away from your desk. Option A is correct because locking the workstation screen whenever you step away prevents unauthorized access to data and applications, a core physical/operational control often enforced via a screen-lock policy or timeout (e.g., Win+L on Windows). Option B is correct because visibly wearing an employee ID badge at all times on premises enables quick visual verification of authorized personnel and supports access-control enforcement. Option C is correct because challenging or reporting unbadged individuals in secure areas is a key element of a security-awareness program that detects and stops tailgating and unauthorized entry. Option D is not correct because leaving visitor logs and badges unattended allows anyone to take them, defeating visitor accountability and enabling impersonation. Option E is not correct because propping open secure exterior fire doors bypasses door access controls and compromises the perimeter, even if the intent is ventilation.

Answer

Leaving visitor logs and visitor badges unattended on the front reception desk for anyone to take

Answer

Propping open secure exterior fire doors to let fresh air into the building

Question 2

An enterprise security team implements Multi-Factor Authentication (MFA) across all employee accounts. Which combination of authentication factors represents the strongest implementation of MFA?

Accepted Answer

A password, a push notification sent to a physical mobile device, and a biometric thumbprint scan.. It combines three distinct authentication factor categories: something you know (password), something you have (push notification to a physical mobile device), and something you are (biometric thumbprint). This satisfies the strict definition of multi-factor authentication, which requires at least two different factor types, and here three are present. The push notification also adds a real-time possession check, making it resistant to replay and credential-stuffing attacks. This is the strongest implementation among the choices because it maximizes factor diversity and includes a biometric element that is difficult to replicate.

Answer

A smart card and a hardware security token.

Answer

A biometric fingerprint scan and a facial recognition scan.

Answer

A password and a PIN memorized by the user.

Question 3

Which THREE behaviors exemplify poor cybersecurity hygiene for remote workers operating from home? (Choose three.)

Accepted Answer

Accessing internal applications over an unsecured home Wi-Fi network without enabling a VPN.. Poor hygiene practices include using unsecured home Wi-Fi without VPNs, reusing corporate passwords, and writing down credentials.

Answer

Connecting to corporate systems through a secure enterprise VPN with MFA enforced.

Answer

Allowing family members to use the corporate laptop for personal web browsing and gaming.

Answer

Reusing the exact same corporate network password for personal social media and streaming accounts.

Question 4

When configuring an organization's email gateway, which security feature should be enabled to prevent attackers from spoofing the company domain?

Accepted Answer

Implementing SPF, DKIM, and DMARC records.. SPF, DKIM, and DMARC are the industry-standard mechanisms used to verify sender identity and prevent domain spoofing.

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

multi_select

Answer

Requiring all users to use digital signatures for internal emails only.

Answer

Enabling SMTP relaying for all internal users.

Answer

Disabling all attachments in incoming emails.

Question 5

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

Accepted Answer

Baiting. Baiting is a social engineering attack where the attacker leaves a physical item (like a USB drive) or offers something enticing to lure victims into compromising security. The branded USB drives labeled 'Confidential Salary Data 2026' exploit curiosity and the promise of valuable information, hoping employees plug them in and execute malicious payloads. This is the textbook definition of baiting.

Answer

Watering hole attack

Answer

Tailgating

Answer

Phishing

Question 6

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

Accepted Answer

Physical security. The scenario describes tampering with a badge reader and attaching an unauthorized recording device — both are attacks against the physical access control infrastructure of a building. Physical security encompasses the controls (badge readers, locks, cameras, guards) that protect facilities and hardware from unauthorized physical access. Since the threat targets the badge reader itself rather than any network, endpoint, or application component, it falls squarely under physical security.

Answer

Endpoint compliance

Answer

Network layer security

Answer

Application layer security

Question 7

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

Accepted Answer

Principle of least privilege. The Principle of Least Privilege requires that accounts be granted only the minimum permissions necessary to perform their function. A service account with full administrative rights across multiple disparate systems clearly exceeds its required scope, so least privilege was violated. This over-provisioning is exactly what enabled the attacker to pivot broadly after compromising the account.

Answer

Separation of duties

Answer

Defense in depth

Answer

Security through obscurity

Question 8

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

Accepted Answer

A tech support scam. A tech support scam is a social engineering attack where a fake pop-up or alert claims the user's system is infected and urges them to call a toll-free number, where scammers then charge for fake 'fixes' or steal remote access. The scenario describes exactly this: a browser pop-up warning of infection with an urgent phone number. No exploitation of code, traffic flooding, or legitimate telemetry is involved — the threat is deception targeting the user.

Answer

A SQL injection exploit

Answer

A distributed denial-of-service attack

Answer

A legitimate endpoint telemetry notification

Question 9

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

Accepted Answer

It ensures that compromised credentials alone are insufficient for an attacker to gain access. Multi-factor authentication (MFA) combines something the user knows (password) with something the user possesses (mobile push token), so a stolen or phished password alone cannot grant access. The push notification acts as a second independent factor that an attacker would also need to compromise, defeating credential-stuffing and password-reuse attacks. This is the core security benefit of the dual-step approach.

Answer

It guarantees complete encryption of all local workstation files

Answer

It prevents all forms of social engineering attacks against remote workers

Answer

It entirely eliminates the need for strong passwords on corporate accounts

Question 10

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

Accepted Answer

Maintaining immutable, offline data backups. Immutable, offline backups allow the organization to restore encrypted data without paying the ransom because the backup copies are isolated from the ransomware's reach. Ransomware typically encrypts files on connected systems and network shares, but cannot modify offline or write-once media. This is why the 3-2-1 backup rule (3 copies, 2 media types, 1 offsite) and air-gapped/immutable storage are foundational resilience controls.

Answer

Enforcing mandatory password complexity rules

Answer

Implementing strict egress firewall filtering

Answer

Deploying host-based intrusion detection systems

Question 11

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

Accepted Answer

Confidentiality. Encrypting communication protocols like HTTPS and SSH ensures that data in transit is protected from unauthorized eavesdropping. This directly addresses the security principle of confidentiality, which ensures that information is not disclosed to unauthorized individuals. By encrypting traffic, even if an attacker sniffs the shared network segment, they cannot read the contents.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 12

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

Accepted Answer

Report the email using the organization's designated phishing reporting mechanism. The email exhibits classic phishing indicators: urgency, authority impersonation (HR), and a request for sensitive financial data. Per foundational security awareness best practices (and frameworks like NIST SP 800-50 and Fortinet's own training), the correct initial action is to report the suspicious email via the organization's designated phishing reporting mechanism (e.g., a 'Report Phish' button or dedicated mailbox). This allows the security team to analyze, block, and remove the threat from other inboxes, and it avoids any interaction that could compromise the user or network.

Answer

Click the link to verify if the website looks authentic before reporting it

Answer

Forward the email to all colleagues as a warning

Answer

Reply to the sender asking for verbal confirmation of their identity

Question 13

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

Accepted Answer

Smishing. Smishing is the specific term for phishing conducted via SMS text messages. The attacker impersonates a trusted entity (the bank) and uses a short link to lure the victim into clicking, which is the defining characteristic of SMS-based phishing. The 'SMS' + 'phishing' combination gives the term 'smishing'.

Answer

Spear phishing

Answer

Vishing

Answer

Whaling

Question 14

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

Accepted Answer

A long passphrase consisting of random unrelated words and special characters. A long passphrase made of random unrelated words plus special characters maximizes length and entropy while remaining memorable, which is the strongest practice among the options. Length is the primary defense against brute-force and dictionary attacks, and random unrelated words defeat predictable patterns. This aligns with modern guidance from NIST SP 800-63B, which emphasizes length over complexity.

Answer

A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

Answer

A password reused from personal social media accounts to ensure easy recall

Answer

A short word combined with the current year, such as 'Summer2026!'

Question 15

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

Accepted Answer

Lock the workstation screen. Locking the workstation screen (e.g., via Windows+L or Ctrl+Alt+Del) immediately prevents unauthorized physical access to the session while the user is away. It is the fastest, most critical action to protect sensitive data and maintain accountability, and it does not disrupt ongoing work or network connectivity.

Answer

Unplug the Ethernet network cable

Answer

Power down the computer completely

Answer

Minimize all open web browser windows

Question 16

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the governance control that splits a high-risk process across multiple roles so no single administrator can both author and approve/deploy a change. By requiring a different person to approve firewall rule changes than the one who drafts them, the organization prevents unilateral, unchecked authority. This is a foundational ITIL/COBIT and ISO 27001 control for change management.

Answer

Mandatory access control labeling

Answer

Single sign-on federation

Answer

Role-based access auditing

Question 17

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

Accepted Answer

Inadequate identity and access lifecycle offboarding procedures. The exposure stems from a failure in identity and access lifecycle management — specifically, offboarding procedures that should have disabled or deleted the former employee's credentials immediately upon departure. Active credentials weeks after termination indicate the offboarding process was not executed or not enforced.

Answer

Failure to implement adequate endpoint antivirus software

Answer

Absence of hardware token multi-factor authentication

Answer

Lack of network segmentation between departments

Question 18

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

Accepted Answer

Controlled application execution (Whitelisting). Controlled application execution, also called application whitelisting, enforces that only approved, signed, or centrally pushed applications can run on endpoints. By requiring IT to approve and deploy software, the organization prevents users from installing unverified applications, which is the definition of whitelisting. This principle directly reduces the attack surface from malicious or unauthorized software.

Answer

Network boundary defense

Answer

Asymmetric encryption key management

Answer

Principle of fail-secure

Question 19

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

Accepted Answer

Human psychology and helpfulness. This is a classic vishing (voice phishing) / social engineering attack where the attacker manipulates the helpdesk agent's natural desire to be helpful and their deference to authority (a stressed executive). The vulnerability exploited is human psychology — urgency, authority, and empathy — not any technical misconfiguration. No firewall rule, cryptographic weakness, or kernel bug is involved because the attacker never touches the technology directly; they convince a human to bypass controls.

Answer

Misconfigured firewall security policies

Answer

Cryptographic weak implementation

Answer

Unpatched operating system kernel bugs

Question 20

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

Accepted Answer

Vishing (Voice Phishing). Vishing (voice phishing) is the correct answer because the attack is delivered over a phone call, where the attacker impersonates IT staff and uses urgency to extract credentials. This is a social-engineering technique that exploits human trust rather than a technical vulnerability. The phone channel is the defining characteristic that separates vishing from email-based phishing.

Answer

Drive-by download

Answer

Denial of service

Answer

Phishing via email