FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts Practice Test 3 — 15 Questions

Question 1

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Man-in-the-Middle attack. A Man-in-the-Middle (MitM) attack occurs when an adversary secretly intercepts and relays communications between two parties who believe they are communicating directly. The attacker can eavesdrop, modify, or inject data while remaining undetected, often by exploiting ARP spoofing, DNS poisoning, or rogue Wi-Fi access points. This matches the scenario of relaying and modifying messages between two hosts.

Answer

MAC flooding attack

Answer

Distributed denial of service

Answer

SQL injection exploit

Question 2

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Accepted Answer

Leave macros disabled unless the source is fully verified and trusted. The correct action is to leave macros disabled unless the source is fully verified and trusted. Macro-enabled documents are a common attack vector for malware delivery, as macros can execute arbitrary code when enabled. Since the email came from an external partner and the user cannot be certain of its legitimacy, the safest practice is to keep macros disabled and verify the sender through a separate channel before taking any further action.

Answer

Forward the spreadsheet to all company contacts for collaborative viewing

Answer

Print the spreadsheet immediately to a physical printer

Answer

Enable macros immediately so the file displays properly

Question 3

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Accepted Answer

Storing passwords in an encrypted password manager application. Option C is correct because an encrypted password manager securely stores credentials using strong encryption (e.g., AES-256) behind a single master passphrase, enabling users to maintain many distinct, high-entropy passwords without memorizing them or writing them in plaintext. Option E is correct because using a unique, complex password for every account prevents credential-stuffing and lateral movement: if one site is breached, the reused secret cannot unlock other systems, which is a foundational habit for both personal and corporate security. Option A is not recommended because a written notepad, even in a locked drawer, stores passwords in plaintext and is vulnerable to physical access, theft, or insider snooping. Option B is wrong because reusing one master password across banking and work systems creates a single point of failure, so one breach compromises every account. Option D is wrong because arbitrary weekly rotation without evidence of compromise encourages weaker, predictable passwords and is not aligned with modern guidance (e.g., NIST) that favors unique credentials and rotation only on suspected compromise.

Answer

Writing passwords on a physical notepad kept inside a locked desk drawer

Answer

Reusing the same strong master password across all banking and work systems for ease of recall

Answer

Changing passwords every single week regardless of whether a compromise is suspected

Question 4

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

Accepted Answer

Implementing network segmentation to restrict lateral movement between departments. Option B is correct because network segmentation (e.g., VLANs, subnets, or microsegmentation) limits lateral movement so that a compromised host in one department cannot freely reach systems in another, adding an internal control layer beyond the perimeter. Option C is correct because requiring multi-factor authentication for all remote and privileged access enforces an additional identity-verification factor (something you know plus something you have/are), directly mitigating credential theft and unauthorized privileged use. These measures align with Defense in Depth by layering preventive controls across network and identity domains rather than trusting a single boundary. Option A is wrong because relying solely on one perimeter firewall creates a single point of failure and ignores insider threats and internal lateral movement. Option D is wrong because deleting logs and monitoring destroys detection, auditing, and incident-response capabilities. Option E is wrong because disabling endpoint antivirus removes a critical host-level control and exposes systems to malware.

Answer

Relying entirely on a single powerful perimeter firewall with no internal security controls

Answer

Eliminating all system logs and monitoring to maximize user privacy

Answer

Disabling all endpoint antivirus solutions to improve computer processing speed

Question 5

Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)

Accepted Answer

Generic greetings like 'Dear Customer' instead of the recipient's actual name. Option A is correct because phishing messages frequently use impersonal, generic salutations such as 'Dear Customer' or 'Dear User' since attackers mass-mail victims without knowing their real names, which is a classic social-engineering red flag. Option C is correct because typosquatting or look-alike sender domains (e.g., 'micros0ft.com' or 'paypa1.com') are a hallmark of phishing, used to impersonate a trusted organization while evading simple domain blocklists. Option B is not an indicator of phishing because a legitimate newsletter from an approved corporate marketing platform with functioning unsubscribe links reflects proper bulk-email practices. Option D is not an indicator because perfect grammar, consistent formatting, and absence of urgency describe well-crafted legitimate mail, not the errors and pressure tactics typical of phishing. Option E is not an indicator because a valid digital signature from an internal PKI certificate actually verifies sender authenticity and integrity, which is the opposite of a phishing trait.

Answer

A standard newsletter sent via an officially approved corporate marketing platform with working unsubscribe links

Answer

Content written with perfect grammar, standard company formatting, and no sense of urgency

Answer

An email digitally signed with a valid corporate PKI certificate issued by the internal IT department

Question 6

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

Accepted Answer

Refrain from opening files with double extensions like .pdf.exe or unexpected script formats. Option C is correct because files with double extensions such as .pdf.exe or unexpected script formats (.js, .vbs, .ps1) are classic malware-delivery tricks that exploit Windows' hiding of known file extensions, so refraining from opening them prevents execution of a disguised payload. Option D is correct because verifying the attachment's legitimacy via an independent, trusted channel (e.g., a phone call or a separate known email address) confirms the sender actually intended to send the file and defeats spoofed or compromised-account attacks. Option A is wrong because forwarding suspicious attachments to coworkers propagates potential malware and phishing to others instead of reporting it to IT/security. Option B is wrong because opening .exe attachments directly executes untrusted code, which is exactly how ransomware and trojans are installed. Option E is wrong because disabling antivirus removes a key detection layer and increases the risk that the malicious file is downloaded and run.

Answer

Forward suspicious attachments to all coworkers to see if anyone recognizes them

Answer

Immediately open executable attachments (.exe) to check what program they run

Answer

Disable your antivirus software temporarily so it does not block the file download

Question 7

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

Accepted Answer

Immediately notify the internal IT security or helpdesk team. Option A is correct because promptly notifying the internal IT security or helpdesk team allows the organization to initiate incident response, such as revoking active sessions, resetting credentials, and checking for lateral movement or persistence mechanisms. Option D is correct because changing the password immediately from a secure, uncompromised device reduces the window in which an attacker can use the stolen credentials, and using a trusted device prevents malware or keyloggers from capturing the new password. Option B is not appropriate because deleting files destroys forensic evidence and does not remediate the credential compromise. Option C is wrong because public social media disclosure can expose sensitive corporate information and does not follow proper incident reporting channels. Option E is wrong because concealing the incident delays response and increases the potential damage and scope of the compromise.

Answer

Delete all files on the computer to erase evidence of the compromise

Answer

Post about the incident on public social media channels to warn friends

Answer

Keep the incident secret to avoid getting in trouble with management

Question 8

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Accepted Answer

Integrity. Option D (Integrity) is correct because the CIA triad's I stands for Integrity, meaning data must remain accurate, complete, and unaltered by unauthorized parties, whether in storage or in transit. Option E (Confidentiality) is correct because the C in the CIA triad stands for Confidentiality, ensuring information is disclosed only to authorized subjects through mechanisms such as encryption, access controls, and authentication. Together with Availability, these two principles form the three core security objectives of the CIA triad. The unmarked options do not belong: Complexity (A) is a system design characteristic, not a security tenet; Compliance (B) is a regulatory or governance obligation that may support security but is not part of the triad; and Concurrency (C) is a computing property concerning simultaneous operations, unrelated to the CIA triad.

Answer

Complexity

Answer

Compliance

Answer

Concurrency

Question 9

Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)

Accepted Answer

Exercising caution when clicking links or downloading files from untrusted sources. Option A is correct because user caution against clicking links or downloading files from untrusted sources directly reduces the most common initial infection vectors, such as phishing emails, malicious attachments, and drive-by downloads. Option B is correct because reputable, centralized endpoint security software (antivirus/EDR) detects, blocks, and remediates malware, and central management ensures consistent policy enforcement and timely signature/behavioral updates across all endpoints. Option E is correct because keeping operating systems and applications patched and up to date closes known vulnerabilities that malware and attackers actively exploit, including remote code execution and privilege escalation flaws. Option C is not correct because cracked software and keygens from peer-to-peer networks are a well-known malware delivery method and directly increase compromise risk. Option D is not correct because disabling firewall rules and network logging removes preventive and detective controls, weakening endpoint protection and hindering incident response.

Answer

Downloading cracked software and keygens from peer-to-peer file-sharing networks

Answer

Disabling all firewall rules and network logging to maximize system performance

Question 10

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Accepted Answer

They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes. Option B is correct because social engineering attacks commonly fabricate urgency or panic (e.g., a fake account-lockout or invoice-due warning) to short-circuit a victim's normal verification and critical-thinking process. Option D is correct because attackers routinely spoof authority figures, IT support staff, or well-known brands through phishing emails, vishing calls, or pretexting to make their requests appear legitimate and trusted. Option E is correct because social engineering fundamentally targets human psychology and trust rather than exploiting memory-corruption or code-level flaws, which is why it bypasses many technical controls. Option A is incorrect because kernel-level debugging tools are used for low-level software analysis, not for manipulating people, and social engineering requires no such tooling. Option C is incorrect because a graphics card driver update addresses only a specific hardware/software component and cannot prevent deception-based attacks that operate entirely through human interaction.

Answer

They always require advanced kernel-level debugging tools to execute

Answer

They are entirely preventable by installing a standard graphics card driver update

Question 11

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Accepted Answer

Disabling automatic connection to open Wi-Fi networks on your mobile device. Option B is correct because disabling automatic connection to open Wi-Fi networks prevents a mobile device from silently joining rogue or evil-twin hotspots that spoof a legitimate SSID, thereby removing an attacker's opportunity to intercept traffic. Option D is correct because a trusted corporate VPN establishes an encrypted tunnel (e.g., IPsec or TLS-based) that protects all internet traffic from eavesdropping and man-in-the-middle manipulation on an untrusted hotspot. Option E is correct because restricting access to highly sensitive corporate accounts to situations where an encrypted tunnel is active ensures credentials and session data are never exposed over the open, unencrypted wireless medium. Option A is not safe because banking without verifying HTTPS or using a VPN exposes credentials and session cookies to interception. Option C is not safe because accepting unknown certificate warnings enables man-in-the-middle attacks by trusting a fraudulent certificate.

Answer

Conducting personal online banking without checking for HTTPS or using a VPN

Answer

Accepting all unknown certificate warnings when browsing on public hotspots

Question 12

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Accepted Answer

An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal. Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment. Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Answer

An organization implements strict role-based access control and regular auditing

Answer

A network administrator configures automated offboarding checklists for departed employees

Question 13

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

Accepted Answer

The principle of least privilege ensures users and accounts are granted only the minimum access needed. Option B is correct because the principle of least privilege dictates that users, processes, and accounts receive only the minimum permissions necessary to perform their required tasks, which limits the blast radius of compromised credentials or insider misuse. Option C is correct because separation of duties splits critical, high-risk functions across multiple people so that no single individual can complete a sensitive action alone, reducing fraud and error risk. Option E is correct because defense in depth layers multiple overlapping controls (for example, firewalls, IDS/IPS, endpoint protection, MFA, and encryption) so that failure of one control does not expose the whole environment. Option A is wrong because sharing a single root password destroys accountability and non-repudiation; each administrator needs a unique, auditable account with sudo or equivalent privilege escalation. Option D is wrong because security through obscurity is a weak supplementary measure, not a primary defense; databases must be protected by strong authentication, encryption, patching, and access controls rather than hidden names or ports.

Answer

System administrators should always share a single root account password to ensure accountability

Answer

Security through obscurity should be used as the primary defense mechanism for databases

Question 14

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

Accepted Answer

Confidentiality, because data in transit can be intercepted by third parties.. Confidentiality is compromised because data transmitted over an unsecured public Wi-Fi network without a VPN can be intercepted by third parties (e.g., via packet sniffing or man-in-the-middle attacks). The lack of encryption means sensitive corporate information is exposed to unauthorized observers.

Answer

Availability, because public networks are prone to high latency and packet loss.

Answer

Non-repudiation, because transactions cannot be cryptographically verified.

Answer

Integrity, because unauthorized users can modify corporate files in transit.

Question 15

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

Accepted Answer

A targeted spear-phishing attack designed for financial fraud.. This is a targeted spear-phishing attack (specifically a business email compromise / CEO fraud variant) where the attacker spoofs or mimics an executive's display name to pressure an employee into an urgent wire transfer. The defining traits — external domain, executive impersonation, urgency, financial request — map directly to spear-phishing for financial fraud. It is targeted, not mass, and relies on social engineering rather than malware.

Answer

A brute-force credential stuffing attack.

Answer

An advanced persistent threat using zero-day malware.

Answer

A standard denial-of-service attack.