FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts Practice Test 2 — 15 Questions

Question 1

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Separation of duties. Separation of duties (SoD) is the governance control that splits a high-risk process across multiple roles so no single administrator can both author and approve/deploy a change. By requiring a different person to approve firewall rule changes than the one who drafts them, the organization prevents unilateral, unchecked authority. This is a foundational ITIL/COBIT and ISO 27001 control for change management.

Answer

Mandatory access control labeling

Answer

Single sign-on federation

Answer

Role-based access auditing

Question 2

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

Accepted Answer

Inadequate identity and access lifecycle offboarding procedures. The exposure stems from a failure in identity and access lifecycle management — specifically, offboarding procedures that should have disabled or deleted the former employee's credentials immediately upon departure. Active credentials weeks after termination indicate the offboarding process was not executed or not enforced.

Answer

Failure to implement adequate endpoint antivirus software

Answer

Absence of hardware token multi-factor authentication

Answer

Lack of network segmentation between departments

Question 3

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

Accepted Answer

Controlled application execution (Whitelisting). Controlled application execution, also called application whitelisting, enforces that only approved, signed, or centrally pushed applications can run on endpoints. By requiring IT to approve and deploy software, the organization prevents users from installing unverified applications, which is the definition of whitelisting. This principle directly reduces the attack surface from malicious or unauthorized software.

Answer

Network boundary defense

Answer

Asymmetric encryption key management

Answer

Principle of fail-secure

Question 4

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

Accepted Answer

Human psychology and helpfulness. This is a classic vishing (voice phishing) / social engineering attack where the attacker manipulates the helpdesk agent's natural desire to be helpful and their deference to authority (a stressed executive). The vulnerability exploited is human psychology — urgency, authority, and empathy — not any technical misconfiguration. No firewall rule, cryptographic weakness, or kernel bug is involved because the attacker never touches the technology directly; they convince a human to bypass controls.

Answer

Misconfigured firewall security policies

Answer

Cryptographic weak implementation

Answer

Unpatched operating system kernel bugs

Question 5

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

Accepted Answer

Vishing (Voice Phishing). Vishing (voice phishing) is the correct answer because the attack is delivered over a phone call, where the attacker impersonates IT staff and uses urgency to extract credentials. This is a social-engineering technique that exploits human trust rather than a technical vulnerability. The phone channel is the defining characteristic that separates vishing from email-based phishing.

Answer

Drive-by download

Answer

Denial of service

Answer

Phishing via email

Question 6

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

Accepted Answer

Confidentiality across all states of data (transit and rest). Encrypting data in transit (e.g., TLS during upload) and at rest (e.g., AES-256 on storage) directly satisfies the Confidentiality pillar of the CIA triad by ensuring unauthorized parties cannot read the data in either state. The measure does not address Integrity (tamper detection), Availability (uptime/access), or Non-repudiation (proof of origin), so Confidentiality is the primary pillar satisfied.

Answer

Availability and Non-repudiation

Answer

Authenticity and Authorization

Answer

Confidentiality and Integrity

Question 7

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

Accepted Answer

Impossible travel anomaly. The scenario describes a user account being accessed from two geographically distant locations within a timeframe that makes physical travel between them impossible. This is the textbook definition of an impossible travel anomaly, a common behavioral analytics detection used in security monitoring. Fortinet's FortiAnalyzer and FortiSIEM, for example, correlate login events with geolocation data to flag such events as suspicious, often indicating credential compromise or session hijacking.

Answer

Bandwidth saturation anomaly

Answer

Hardware failure indicator

Answer

DNS poisoning event

Question 8

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

Accepted Answer

Clean desk policy adherence. The scenario describes sensitive documents left unattended on a shared printer, which directly violates the clean desk policy. A clean desk policy requires employees to secure sensitive materials (physical and digital) when leaving their workspace, including promptly retrieving printouts. This best practice minimizes the risk of unauthorized access, theft, or inadvertent disclosure of confidential information. Thus, the situation highlights the need for clean desk policy adherence.

Answer

Network segmentation compliance

Answer

Endpoint firewall configuration

Answer

Multi-factor authentication protocols

Question 9

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

Accepted Answer

Whaling attack. A whaling attack is a highly targeted spear-phishing variant aimed specifically at senior executives ('big fish') such as CEOs, CFOs, or other high-ranking officials. The attacker here bypassed perimeter defenses by sending a weaponized PDF directly to the executive's personal email, which is a hallmark of whaling — personalized targeting of a high-value individual rather than mass distribution. The personal-account vector and executive target confirm this is whaling, not generic phishing or spam.

Answer

Mass spam campaign

Answer

MAC spoofing attack

Answer

Structured query language injection

Question 10

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

Accepted Answer

Conducting regular simulated phishing tests with immediate feedback. Regular simulated phishing tests with immediate feedback build practical resilience by exposing employees to realistic lures and teaching them in the moment how to recognize and report them. This active, repetitive training reinforces behavior better than passive reading. Spear-phishing uses personalized details, so hands-on practice with similar scenarios is the most effective way to develop skepticism and verification habits.

Answer

Blocking all external incoming emails entirely

Answer

Restricting employees from having LinkedIn or social media accounts

Answer

Requiring employees to read a 100-page security policy manual annually

Question 11

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

Accepted Answer

Store them in an encrypted password manager or secure offline location. Recovery codes are a critical fallback for MFA when the primary authenticator device is lost, stolen, or reset. Storing them in an encrypted password manager or a physically secure offline location (e.g., a safe) ensures they remain confidential and available only to the legitimate user. This aligns with the principle of least privilege and defense in depth, preventing unauthorized access while preserving account recoverability.

Answer

Write them on a sticky note attached to the computer monitor for convenience

Answer

Discard them immediately as they are unnecessary if an app is installed

Answer

Share them in a public corporate chat channel so teammates can assist if needed

Question 12

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

Accepted Answer

By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH). Advanced malware can bypass blocked external DNS by using alternative public DNS resolvers or DNS-over-HTTPS (DoH), which encrypts DNS queries inside HTTPS traffic on port 443. This makes the malicious domain resolution blend with normal web traffic and evade traditional DNS filtering. DoH in particular is designed to prevent eavesdropping and manipulation, but attackers abuse it to hide C2 communications.

Answer

By relying exclusively on local ARP tables

Answer

By broadcasting requests via local Bluetooth signals

Answer

By converting domain names into physical print jobs

Question 13

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Accepted Answer

Network segmentation. Network segmentation is the practice of dividing a network into isolated segments (e.g., guest, internal, DMZ) to control traffic flow and limit lateral movement. Placing guest Wi-Fi users on the same subnet as internal workstations without isolation violates this principle, as guests could potentially access internal resources. The correct answer is network segmentation.

Answer

Cryptographic salting

Answer

Symmetric encryption

Answer

Non-repudiation verification

Question 14

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

Accepted Answer

Drive-by download. A drive-by download is a silent, automatic download of malicious code (often an executable) that occurs when a user merely visits a compromised or malicious website, without any explicit user action like clicking a download link. The browser blocking the automatic executable download is a classic defense against this threat. This matches the scenario exactly: no user interaction, automatic download attempt, browser-level block.

Answer

Physical shoulder surfing

Answer

Social engineering phone call

Answer

Email phishing scam

Question 15

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

Accepted Answer

The risk of operational downtime caused by faulty updates. Testing patches in a staging environment before production deployment is a change-management control designed to catch defective or incompatible updates before they can cause outages. History is full of patches that broke production — a faulty update can crash services, corrupt data, or render systems unbootable — so the test environment acts as a canary. The policy's primary risk mitigation is therefore operational downtime caused by faulty updates.

Answer

The risk of unauthorized physical entry to data centers

Answer

The risk of zero-day hardware manufacturing defects

Answer

The risk of social engineering attacks against helpdesk staff