FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts Practice Test 4 — 15 Questions

Question 1

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

Accepted Answer

Ransomware that encrypts critical files and demands payment for access.. A locked screen displaying a cryptocurrency payment demand alongside encrypted files is the textbook signature of ransomware — malware that encrypts victim data and holds it hostage until a payment (often in Bitcoin or Monero) is made. The lock screen with payment instructions is the ransom note.

Answer

A rootkit that grants administrative privileges to remote attackers.

Answer

Adware that automatically displays unwanted promotional banners.

Answer

Spyware that covertly records keystrokes and captures screenshots.

Question 2

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

Accepted Answer

It verifies user identity and device health continuously, granting least-privilege access per application.. ZTNA (Zero Trust Network Access) operates on the principle of 'never trust, always verify' — it continuously validates both user identity and device posture (health, patching, compliance) on every session, not just at initial login. Access is granted on a per-application basis using least-privilege principles, so users only reach the specific apps they need rather than the whole network. This contrasts with traditional VPN-style remote access that grants broad network-level trust after a single authentication event.

Answer

It trusts all devices once the initial corporate username and password are validated at the perimeter.

Answer

It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

Answer

It relies entirely on physical network segmentation within the remote employee's home office.

Question 3

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

Accepted Answer

An attacker calls the helpdesk posing as a new executive claiming to have lost their password, requesting a reset.. Pretexting is a social engineering technique where the attacker invents a believable scenario (the pretext) to manipulate a victim into divulging information or performing an action. The helpdesk call impersonating a new executive who lost their password is a classic pretext — the attacker leverages authority and urgency to obtain a password reset. This relies on human trust and process gaps rather than technical exploits.

Answer

An attacker installs a keylogger on an unattended physical workstation in an office.

Answer

An attacker floods a web server with synthetic traffic to crash the service.

Answer

An attacker sends mass emails containing a malicious macro-enabled attachment.

Question 4

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Accepted Answer

Mitigating brute-force and credential-guessing attacks.. Complex password policies increase the search space an attacker must cover, making brute-force and credential-guessing attacks computationally expensive. Requiring uppercase, lowercase, digits, and special characters raises the number of possible combinations per character position, so even a short password becomes far harder to crack. The objective is to slow down or defeat automated guessing, not to address application-layer or physical threats.

Answer

Preventing structured SQL injection attacks against web databases.

Answer

Preventing physical theft of laptop hardware.

Answer

Ensuring high network bandwidth availability for video conferencing.

Question 5

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

Accepted Answer

USB baiting exploiting human curiosity and physical media.. The scenario describes a USB flash drive deliberately left in a parking lot with an enticing label ('Q4 Salary Adjustments') to lure a curious employee into plugging it into a corporate laptop. This is the textbook definition of USB baiting — a physical social-engineering attack that exploits human curiosity and removable media to deliver malware or gain access.

Answer

Man-in-the-middle interception of wireless frames.

Answer

Cross-site scripting executed within a browser session.

Answer

Watering hole attack targeting web browsing habits.

Question 6

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

Accepted Answer

Users and services are granted only the bare minimum permissions required to perform their explicit functions.. The principle of least privilege (PoLP) requires that users and service accounts are granted only the minimum permissions necessary to perform their explicit job functions. This limits the blast radius of compromised accounts and reduces the risk of accidental or malicious misuse. Applying PoLP to service accounts means avoiding over-privileged accounts that can perform unrelated administrative tasks.

Answer

Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

Answer

Every user account is automatically granted local administrator rights on their assigned workstation by default.

Answer

All administrators share a single root account with full access to simplify password management.

Question 7

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

Accepted Answer

A man-in-the-middle attack intercepting and modifying transit data.. A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, intercepting and potentially altering traffic while each side believes they are talking directly to the other. The scenario describes exactly this: interception plus modification plus mutual impersonation. This is the defining triad of MITM — confidentiality and integrity of the session are both compromised.

Answer

A distributed denial-of-service attack flooding servers.

Answer

A zero-day exploit leveraging unpatched software code.

Answer

A brute-force attack guessing login credentials.

Question 8

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?

Accepted Answer

Risk mitigation, deploying technical controls to lower the probability and impact of threats.. The organization is implementing technical controls—firewall rules, IPS, and encryption—specifically to reduce the likelihood (via prevention) and impact (via protection) of a cyber attack. This is the definition of risk mitigation, which focuses on lowering risk to an acceptable level rather than eliminating it entirely or shifting it to another party. Risk mitigation is the most common strategy in cybersecurity because it balances security with business needs.

Answer

Risk transfer, purchasing cyber insurance to shift financial liability to a third party.

Answer

Risk acceptance, choosing to absorb the financial impact if an incident occurs.

Answer

Risk avoidance, eliminating the business activity entirely to prevent exposure.

Question 9

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

Accepted Answer

Maintaining secure, immutable, and offline backups of critical data.. Immutable, offline backups ensure that even if ransomware encrypts production databases and attempts to encrypt or delete backup copies, a clean recovery point remains available. Because the backups are offline and immutable (write-once), ransomware cannot reach or modify them, enabling full restoration without paying a ransom. This directly mitigates the impact of a catastrophic infection on critical data.

Answer

Deploying standard HTTP web proxies without inspection.

Answer

Increasing the corporate internet bandwidth capacity.

Answer

Enabling automatic operating system wallpaper updates.

Question 10

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

Accepted Answer

Confidentiality is violated; remediation involves migrating to encrypted management protocols like SSH and HTTPS.. Telnet and HTTP transmit data — including credentials and management commands — in clear text, meaning anyone with network visibility (packet capture, span port, MITM) can read them. This directly violates confidentiality, the security principle ensuring data is only accessible to authorized parties. The correct remediation is migrating to encrypted equivalents: SSH replaces Telnet, and HTTPS (TLS) replaces HTTP.

Answer

Integrity is violated; remediation involves enabling packet checksum validation on all switches.

Answer

Non-repudiation is violated; remediation involves implementing digital signatures on email traffic.

Answer

Availability is violated; remediation involves upgrading uplink port speeds to 10Gbps.

Question 11

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

Accepted Answer

To transform employees into an active defense layer capable of recognizing social engineering.. Security awareness training's primary goal is to turn employees into a human sensor layer — teaching them to recognize phishing, pretexting, and other social engineering attacks and to report them. Since attackers frequently target people to bypass technical controls, an aware workforce is a critical defense layer. This is the core purpose of such programs for non-technical staff.

Answer

To ensure all personnel understand how to compile source code securely.

Answer

To replace automated endpoint detection and response software with human monitoring.

Answer

To train every staff member to write advanced firewall configuration scripts.

Question 12

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

Accepted Answer

Creating a false sense of urgency and fear of loss.. The email uses a deadline ('deactivated within 24 hours') combined with a threat of losing account access, which is the textbook definition of urgency plus fear of loss — two of the most common social engineering levers. Attackers weaponize time pressure to short-circuit the victim's critical thinking so they click and enter credentials without verifying the sender. This is a hallmark of phishing and pretexting campaigns.

Answer

Offering financial rewards for completing a corporate survey.

Answer

Establishing authority by impersonating a system administrator calmly.

Answer

Providing technical assistance for routine software patching.

Question 13

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

Accepted Answer

A keystroke injection attack using a compromised HID device.. A USB keyboard that immediately executes automated command-line instructions is a classic keystroke injection attack, where the device presents itself as a Human Interface Device (HID) and sends pre-programmed keystrokes to the host. This is often achieved with devices like the USB Rubber Ducky, which emulate a keyboard and can execute scripts at high speed. The correct answer is a keystroke injection attack using a compromised HID device.

Answer

A distributed denial-of-service attack originating from the keyboard firmware.

Answer

A hardware logic bomb that physically destroys the motherboard upon boot.

Answer

A physical RAM scraping attack reading volatile memory contents.

Question 14

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

Accepted Answer

The exposure window during which attackers can exploit known unpatched vulnerabilities.. A 48-hour patch mandate for critical vulnerabilities is designed to shrink the exposure window — the period between public disclosure of a vulnerability and the application of a fix. Attackers frequently weaponize exploits within days of disclosure, so minimizing this window reduces the chance of successful exploitation.

Answer

The network lease duration assigned by corporate DHCP servers.

Answer

The physical hardware warranty expiration window for end-user laptops.

Answer

The vendor development lifecycle window for creating new software features.

Question 15

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

Accepted Answer

Locking the workstation screen whenever walking away from the desk.. Option D is correct because locking the workstation screen whenever leaving the desk prevents unauthorized physical access and session hijacking, a core endpoint hygiene practice (e.g., Windows+L or Ctrl+Alt+Del lock). Option E is correct because using complex, unique passwords for every separate work account limits credential-reuse attacks such as credential stuffing and pass-the-hash lateral movement, and supports per-account breach containment. The unmarked options are unsafe: A invites phishing/malware execution by opening unexpected attachments, B violates least privilege and non-repudiation by sharing credentials, and C removes a key detective/preventive control (antivirus/EDR) and increases malware risk.

Answer

Clicking on unexpected email attachments immediately to verify their safety.

Answer

Sharing corporate passwords with trusted team members to ensure project continuity.

Answer

Disabling all endpoint antivirus software to speed up system performance.