FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts Practice Test 5 — 15 Questions

Question 1

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

Accepted Answer

A generic salutation such as 'Dear Customer' instead of the recipient's actual name.. Option A is correct because phishing messages typically use generic salutations like 'Dear Customer' since attackers send them in bulk and don't know the recipient's real name, whereas legitimate organizations usually personalize communications. Option B is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are a classic phishing tactic that impersonates a trusted brand to deceive recipients. Option D is correct because urgency combined with requests to verify credentials or financial data is a hallmark social-engineering pressure tactic designed to bypass the victim's critical thinking. Option C is not a phishing indicator because routine internal announcements such as cafeteria holiday hours are normal, low-risk corporate communications. Option E is not a phishing indicator because a valid digital signature (e.g., S/MIME or PGP) actually confirms sender authenticity and message integrity, which is the opposite of a phishing sign.

Answer

A standard company-wide newsletter detailing upcoming office cafeteria holiday hours.

Answer

A digital signature verifying the cryptographic integrity and authenticity of the sender.

Question 2

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Accepted Answer

Notify the internal IT security or incident response team without delay.. Option D is correct because promptly notifying the internal IT security or incident response team ensures trained personnel can begin containment, triage, and forensic investigation, which is a core step of any incident response process. Option E is correct because immediately disconnecting the laptop from both wired (Ethernet) and wireless (Wi-Fi) network connections isolates the potentially infected host, preventing malware from spreading laterally, exfiltrating data, or communicating with command-and-control servers. Option A is not appropriate because forwarding a suspicious file to external clients could propagate malware and breach confidentiality, rather than containing the incident. Option B is wrong because deleting system logs and temporary files destroys forensic evidence needed for investigation and may violate retention policies. Option C is wrong because downloading and executing unverified registry cleaners from pop-up advertisements is a common malware delivery vector and would likely worsen the compromise.

Answer

Forward the suspicious file to all external clients as a warning alert.

Answer

Delete all system logs and temporary files to clear up disk space for the virus scanner.

Answer

Download and execute unverified registry cleaner utilities from pop-up advertisements.

Question 3

Which TWO characteristics describe effective password management principles? (Choose two.)

Accepted Answer

Using a password manager to generate and store complex, unique passwords securely.. Option C is correct because a password manager generates high-entropy, unique credentials for every account and stores them in an encrypted vault, eliminating password reuse and reducing the burden of memorization. Option E is correct because long passphrases built from multiple random words provide high entropy (each additional word multiplies the search space) while remaining memorable, making them resistant to brute-force and dictionary attacks. Option A is wrong because forced weekly rotation without evidence of compromise leads to weaker, predictable passwords and is no longer recommended by standards such as NIST SP 800-63B. Option B is wrong because writing administrator passwords on sticky notes exposes credentials to anyone with physical or visual access, defeating confidentiality. Option D is wrong because reusing one password across accounts enables credential-stuffing attacks, where a single breach compromises every account sharing that password.

Answer

Changing passwords every single week regardless of whether any compromise indicators exist.

Answer

Writing down primary administrator passwords on sticky notes attached to computer monitors.

Answer

Reusing the same strong password across all personal and professional accounts for convenience.

Question 4

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

Accepted Answer

Availability, ensuring authorized users have reliable access to information and resources when needed.. The CIA Triad consists of Confidentiality, Integrity, and Availability. Option A (Availability) is correct because it ensures authorized users have reliable and timely access to information and resources, typically supported by redundancy, backups, and uptime controls. Option C (Confidentiality) is correct because it restricts sensitive data access to authorized individuals through mechanisms like encryption, access control lists, and authentication. Option E (Integrity) is correct because it ensures data and systems remain accurate and protected from unauthorized modification via hashing, digital signatures, and version controls. Option B (Compliance) is not a foundational CIA Triad principle; it is a governance and regulatory requirement that may support security but is not one of the three core components. Option D (Cost-efficiency) is a business or financial objective, not a security principle of the CIA Triad.

Answer

Compliance, ensuring all regional government tax laws are strictly obeyed.

Answer

Cost-efficiency, ensuring security budgets remain minimal relative to operational revenue.

Question 5

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Accepted Answer

Conducting regular security awareness training and simulated phishing tests for all staff.. Option A is correct because regular security awareness training combined with simulated phishing tests conditions staff to recognize pretexting and phishing lures, report suspicious messages, and avoid handing over credentials or sensitive data, directly reducing the human factor these attacks exploit. Option B is correct because MFA adds a second authentication factor beyond the password, so even if a phishing or pretexting attack captures valid credentials, the attacker cannot complete login without the additional factor (e.g., TOTP code, push approval, or FIDO2 key), breaking account takeover. Option C is wrong because unrestricted, unscanned personal USB drives enable malware introduction and data exfiltration, increasing rather than defending against social-engineering-driven compromise. Option D is wrong because blindly complying with urgent executive requests via personal email is exactly the pretexting behavior attackers exploit; such requests must be verified through out-of-band channels. Option E is wrong because disabling spam and email filtering removes a key technical control that blocks phishing messages, making users more exposed to social engineering.

Answer

Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.

Answer

Instructing employees to comply immediately with any urgent executive request received via personal email.

Answer

Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.

Question 6

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Accepted Answer

Installing a kernel-level rootkit that hooks into core operating system processes.. Option C is correct because a kernel-level rootkit loads at boot, hooks into core OS processes, and hides itself from normal detection, giving the attacker durable privileged access that survives reboots. Option E is correct because modifying startup registry keys (e.g., Run/RunOnce keys) or creating scheduled tasks causes attacker code to execute automatically each time the system starts or a trigger fires, a classic persistence technique. Option A is not persistence: an incognito browser tab is temporary and isolated, and closing the browser or rebooting destroys it. Option B is not persistence: a legitimate manufacturer diagnostic tool is a benign utility, not an attacker mechanism. Option D is not persistence: clearing the browser cache and recycle bin removes data and does not create any recurring execution or access.

Answer

Running a temporary calculation script inside an isolated browser incognito tab.

Answer

Running an optional software update diagnostic tool provided by the hardware manufacturer.

Answer

Clearing the system browser cache and emptying the local operating system recycle bin.

Question 7

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

Accepted Answer

Recognize the social engineering attempt and use the organization's phishing reporting tool.. The email is a classic business email compromise (BEC) or gift card scam, a form of social engineering. The user should recognize the attempt and report it via the organization's phishing reporting tool, which alerts security teams and helps prevent similar attacks.

Answer

Forward the email to all colleagues as a warning, including the live clickable link.

Answer

Reply to the sender asking for clarification using the reply button.

Answer

Treat it as an urgent executive request and fulfill the purchase immediately.

Question 8

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

Accepted Answer

Establish an authorized corporate VPN connection before accessing internal systems.. A corporate VPN creates an encrypted tunnel (typically IPsec or TLS) between the employee's device and the corporate gateway, so any data traversing the untrusted coffee shop Wi-Fi is protected from eavesdropping. Without this encryption layer, an attacker on the same hotspot can capture credentials, session tokens, and sensitive traffic using tools like Wireshark or a rogue AP. The VPN must be established before any internal resource is accessed so that no cleartext traffic leaks onto the public network.

Answer

Enable local file sharing to speed up document syncing over public connections.

Answer

Disable the operating system firewall to allow seamless packet routing through the hotspot.

Answer

Configure the web browser to accept all SSL certificates to bypass public portal warnings.

Question 9

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

Accepted Answer

Grant read-only access to specific tables only for employees whose roles explicitly require that data.. Option B correctly implements the Principle of Least Privilege by granting only the minimum necessary access—read-only permissions to specific tables—and restricting it to employees whose roles explicitly require that data. This ensures users have no more privileges than needed to perform their job functions, reducing the attack surface and potential for data misuse. The granularity (specific tables) and read-only nature further limit exposure, aligning with the principle's core tenet of minimal rights.

Answer

Share a single high-privileged service account credential among the entire team.

Answer

Assign all department members permanent administrative rights to ensure uninterrupted workflow.

Answer

Provide full database access to all employees during onboarding, revoking it after one year.

Question 10

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

Accepted Answer

Ransomware infection. The symptoms — sluggish workstation performance, file extensions changed to an unfamiliar format, and a ransom text file — are the textbook signature of a ransomware infection. Ransomware encrypts user files (often renaming them with a new extension) and drops a ransom note demanding payment for the decryption key. The combination of file-extension mutation plus a ransom note is definitive.

Answer

DDoS attack

Answer

Man-in-the-middle interception

Answer

SQL injection

Question 11

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

Accepted Answer

Voice phishing (Vishing). Voice phishing (vishing) is a social engineering attack where the attacker uses a phone call to manipulate the victim into revealing sensitive information, such as passwords. In this scenario, the caller impersonates IT helpdesk and creates urgency, which are classic vishing tactics. Vishing exploits human trust over the phone rather than technical vulnerabilities.

Answer

Watering hole attack

Answer

Phishing via SMS (Smishing)

Answer

Credential stuffing

Question 12

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

Accepted Answer

Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.. Defense-in-Depth means layering multiple independent security controls so that a failure in one does not compromise the whole system. Implementing network segmentation, endpoint protection, MFA, and user awareness training covers network, endpoint, identity, and human layers, which is the textbook example of a layered defense strategy.

Answer

Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

Answer

Enforcing identical complex passwords across all local and cloud administrative portals.

Answer

Duplicating identical edge firewalls in an active-passive cluster for high availability.

Question 13

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

Accepted Answer

Using a long, unique passphrase managed by an approved enterprise password manager.. Using a long, unique passphrase managed by an approved enterprise password manager aligns with NIST SP 800-63B and modern zero-trust guidance: length and uniqueness beat complexity and rotation. The password manager ensures each account has a distinct, high-entropy credential that the user never has to memorize or reuse, and enterprise approval ensures the vault meets organizational security and compliance requirements.

Answer

Writing the password on a sticky note attached to the monitor for easy access during shifts.

Answer

Reusing the same strong password across all personal and work applications for easy recall.

Answer

Using a short password with special characters and changing it every 30 days.

Question 14

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

Accepted Answer

Promptly installing operating system and application security patches.. Option B is correct because promptly installing operating system and application security patches closes known vulnerabilities (e.g., CVEs) that attackers actively exploit, making patch management a core endpoint hygiene practice. Option D is correct because verifying software legitimacy before downloading and installing third-party applications prevents malware, trojans, and supply-chain compromises introduced via untrusted or spoofed sources. Option E is correct because locking the workstation screen whenever stepping away enforces access control, preventing unauthorized physical use of an authenticated session and mitigating insider or walk-by threats. Option A is not acceptable hygiene because storing master credentials in plain text on the desktop exposes them to any local user or malware, violating secure credential handling. Option C is not acceptable because disabling endpoint antivirus agents removes malware detection and response capabilities, trading essential protection for marginal performance gains.

Answer

Storing master credentials in a plain-text document on the desktop for quick reference.

Answer

Disabling endpoint antivirus agents to maximize system performance during video calls.

Question 15

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

Accepted Answer

Forward the email to the IT helpdesk using the official reporting procedure.. Forwarding the suspicious email to the IT helpdesk via the official reporting procedure allows security teams to investigate, block the sender, and warn other employees who may have received the same message. It also avoids interacting with the malicious content, which is the safest course of action.

Answer

Delete the email and clear the browser cache.

Answer

Click the link to check if the website looks authentic.

Answer

Reply to the email with the requested credentials to avoid account lockout.