FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts Practice Test 2 — 15 Questions

Question 1

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Controlled application execution (Whitelisting). Application whitelisting or controlled application execution ensures that only pre-approved, trusted software can run on endpoints.

Answer

Network boundary defense

Answer

Asymmetric encryption key management

Answer

Principle of fail-secure

Question 2

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

Accepted Answer

Human psychology and helpfulness. Social engineering exploits human psychology, such as helpfulness, fear, or authority, rather than technical software flaws.

Answer

Misconfigured firewall security policies

Answer

Cryptographic weak implementation

Answer

Unpatched operating system kernel bugs

Question 3

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

Accepted Answer

Vishing (Voice Phishing). Vishing (voice phishing) uses telephone communication to manipulate individuals into divulging confidential information.

Answer

Drive-by download

Answer

Denial of service

Answer

Phishing via email

Question 4

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

Accepted Answer

Confidentiality across all states of data (transit and rest). Encryption protects data confidentiality during transit and at rest, ensuring unauthorized parties cannot read it.

Answer

Availability and Non-repudiation

Answer

Authenticity and Authorization

Answer

Confidentiality and Integrity

Question 5

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

Accepted Answer

Impossible travel anomaly. Impossible travel indicates that credentials are likely compromised and being used simultaneously by an attacker elsewhere.

Answer

Bandwidth saturation anomaly

Answer

Hardware failure indicator

Answer

DNS poisoning event

Question 6

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

Accepted Answer

Clean desk policy adherence. Clear desk and clear screen policies require employees to secure sensitive physical and digital information when not attended.

Answer

Network segmentation compliance

Answer

Endpoint firewall configuration

Answer

Multi-factor authentication protocols

Question 7

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

Accepted Answer

Whaling attack. Whaling is a form of spear phishing specifically directed at high-profile targets like executives or senior management.

Answer

Mass spam campaign

Answer

MAC spoofing attack

Answer

Structured query language injection

Question 8

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

Accepted Answer

Conducting regular simulated phishing tests with immediate feedback. Simulated phishing campaigns combined with immediate, contextual training help users recognize real-world tactics safely.

Answer

Blocking all external incoming emails entirely

Answer

Restricting employees from having LinkedIn or social media accounts

Answer

Requiring employees to read a 100-page security policy manual annually

Question 9

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

Accepted Answer

Store them in an encrypted password manager or secure offline location. Recovery codes should be stored securely and privately, such as in an encrypted password manager, rather than on sticky notes or unsecured text files.

Answer

Write them on a sticky note attached to the computer monitor for convenience

Answer

Discard them immediately as they are unnecessary if an app is installed

Answer

Share them in a public corporate chat channel so teammates can assist if needed

Question 10

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Accepted Answer

By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH). Advanced malware often uses alternative lookup methods, such as utilizing hardcoded public DNS resolvers or tunneling protocols, to bypass internal DNS restrictions.

Answer

By relying exclusively on local ARP tables

Answer

By broadcasting requests via local Bluetooth signals

Answer

By converting domain names into physical print jobs

Question 11

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Accepted Answer

Network segmentation. Network segmentation isolates untrusted zones (like guest networks) from sensitive internal assets to limit the impact of a breach.

Answer

Cryptographic salting

Answer

Symmetric encryption

Answer

Non-repudiation verification

Question 12

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

Accepted Answer

Drive-by download. A drive-by download occurs when malware is downloaded automatically without the user's explicit consent or knowledge when visiting a compromised website.

Answer

Physical shoulder surfing

Answer

Social engineering phone call

Answer

Email phishing scam

Question 13

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

Accepted Answer

The risk of operational downtime caused by faulty updates. Testing updates prevents faulty patches from causing widespread system instability, crashes, or availability loss in production.

Answer

The risk of unauthorized physical entry to data centers

Answer

The risk of zero-day hardware manufacturing defects

Answer

The risk of social engineering attacks against helpdesk staff

Question 14

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

Accepted Answer

Man-in-the-Middle attack. A Man-in-the-Middle (MitM) attack involves an attacker secretly relaying and potentially altering communications between two parties who believe they are directly communicating.

Answer

MAC flooding attack

Answer

Distributed denial of service

Answer

SQL injection exploit

Question 15

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Accepted Answer

Leave macros disabled unless the source is fully verified and trusted. Users should never enable macros in unsolicited or external documents unless the source is verified and business necessity is confirmed, as macros are a common vector for malware delivery.

Answer

Forward the spreadsheet to all company contacts for collaborative viewing

Answer

Print the spreadsheet immediately to a physical printer

Answer

Enable macros immediately so the file displays properly