FORTINET-NSE123 Nse 1 Foundational Cybersecurity Concepts Practice Test 6 — 15 Questions

Question 1

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Accepted Answer

Implementing account lockout policies after a threshold of failed login attempts.. Option C is correct because an account lockout policy that triggers after a defined threshold of failed login attempts (e.g., 5 attempts) blocks automated brute-force and credential-stuffing tools from making unlimited password guesses, throttling the attack and protecting the account. Option D is correct because enforcing Multi-Factor Authentication (MFA) across all authentication portals adds a second verification factor beyond the password, so even valid credentials obtained from credential stuffing or brute-forcing cannot alone grant access. Option A is wrong because permitting HTTP plaintext transmission exposes credentials to interception and does not defend against credential-based attacks. Option B is wrong because allowing identical shared passwords increases the blast radius of credential stuffing and worsens password fatigue risks. Option E is wrong because disabling logging removes the audit trail needed to detect and respond to brute-force or credential-stuffing attempts.

Answer

Permitting HTTP plaintext transmission for login forms to speed up authentication.

Answer

Allowing users to share identical passwords to reduce password fatigue.

Answer

Disabling logging mechanisms to prevent server storage bloat.

Question 2

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Accepted Answer

The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.. Option A is correct because social-engineering phishing relies on urgency and threats (e.g., account suspension, legal action, or loss of access) to pressure the recipient into acting before verifying the request. Option C is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are classic spoofing indicators used to impersonate a trusted sender. Options B, D, and E are not indicators: an internal intranet link on the corporate DNS domain, accurate addressing to your real title and department, and legitimate newsletters from an official mailing platform are all consistent with normal, benign email.

Answer

The message includes a link to the corporate intranet home page via the internal DNS domain.

Answer

The email is addressed specifically to your correct full corporate title and department.

Answer

The email contains standard company newsletter updates sent through an official mailing platform.

Question 3

Which of the following scenarios describes a 'pretexting' social engineering attack?

Accepted Answer

An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.. Pretexting is a social-engineering technique where the attacker invents a believable scenario or false identity (a pretext) to manipulate a victim into divulging information or performing an action. Posing as an auditor to convince an employee to disclose sensitive internal procedures is a textbook pretexting attack because it relies on a fabricated role and story to gain trust.

Answer

An attacker leaves a malicious USB drive in the lobby.

Answer

An attacker uses automated software to guess passwords.

Answer

An attacker shoulder-surfs to capture a password.

Question 4

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

Accepted Answer

Principle of Least Privilege. The Principle of Least Privilege (PoLP) mandates that users are granted only the minimum access rights necessary to perform their job functions—nothing more. Restricting access to specific data and applications directly implements this principle by limiting the blast radius of compromised accounts and reducing insider threat risk. Fortinet products like FortiGate and FortiManager enforce PoLP through role-based access control (RBAC) profiles and administrative profiles that define granular permissions.

Answer

Separation of Duties

Answer

Security by Obscurity

Answer

Defense in Depth

Question 5

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

Accepted Answer

Utilize a secure VPN tunnel to the corporate network.. A secure VPN tunnel encrypts all traffic between the remote worker and the corporate network, protecting it from interception on an untrusted public Wi-Fi hotspot. This ensures confidentiality and integrity of company data even if the Wi-Fi network is compromised. The other options either do not provide encryption or actively weaken security.

Answer

Enable browser-based spell check.

Answer

Ensure the laptop firewall is turned off to allow easier connectivity.

Answer

Use an unencrypted FTP connection for file transfers.

Question 6

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

Accepted Answer

Dynamic URL filtering with reputation-based feeds.. Dynamic URL filtering with reputation-based feeds queries real-time threat intelligence databases (such as FortiGuard web filter rating service) to classify URLs and block malicious sites as they are identified. This provides up-to-date protection against newly discovered malicious domains, unlike static lists. Local static IP filtering and MAC filtering cannot keep pace with rapidly changing malicious URLs.

Answer

MAC address filtering on the local switch.

Answer

Local static IP filtering.

Answer

Disabling cookies in the browser.

Question 7

What is the primary objective of a 'DDoS' attack?

Accepted Answer

To exhaust system resources and render a service unavailable.. A DDoS (Distributed Denial of Service) attack aims to overwhelm a target's resources — bandwidth, CPU, memory, or connection tables — by flooding it with traffic from many distributed sources, making the service unavailable to legitimate users. The primary goal is disruption, not data theft or persistence.

Answer

To steal intellectual property.

Answer

To modify user permissions on the server.

Answer

To install a hidden backdoor for future access.

Question 8

Which THREE of the following are recognized signs of a potential phishing attempt?

Accepted Answer

The email uses urgent or threatening language to demand immediate action.. Option B is correct because phishing emails frequently employ urgency or threats (e.g., "your account will be closed in 24 hours") to pressure victims into acting before they verify the request. Option C is correct because a mismatch between the sender's domain and the organization they claim to represent (e.g., support@paypa1-secure.com instead of paypal.com) is a classic spoofing indicator, since legitimate organizations send from their own registered domains. Option D is correct because an unexpected attachment from an unknown sender is a common malware delivery vector, often using weaponized files like .exe, .scr, or macro-enabled Office documents. Option A is not a reliable indicator, since attackers routinely schedule phishing campaigns during business hours to blend in with normal traffic. Option E is also not a sign, because attackers often harvest the recipient's correct first name from social media or breached data to make the message appear more legitimate.

Answer

The email is sent during standard business hours.

Answer

The email is addressed to the employee by their correct first name.

Question 9

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

Accepted Answer

The host is infected with malware and participating in a botnet.. The combination of a slow workstation, large volumes of encrypted outbound traffic to an unknown external IP, and no legitimate business justification is a textbook indicator of malware command-and-control (C2) beaconing or botnet participation. Malware commonly encrypts its traffic (TLS/custom crypto) to evade deep packet inspection and blends into normal HTTPS flows. The host is likely part of a botnet performing DDoS, spam relay, or crypto-mining tasks, which explains both the CPU/performance degradation and the sustained encrypted egress.

Answer

The user installed a legitimate browser extension.

Answer

The user's local firewall is performing a full system scan.

Answer

The system is performing a routine background update.

Question 10

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

Accepted Answer

It adds a layer of defense even if the primary password is stolen.. MFA requires a second factor beyond the password, so even if an attacker steals or guesses the password through phishing, credential stuffing, or a breach, they still cannot authenticate without the additional factor. This directly mitigates the impact of password compromise, which is the most common initial access vector.

Answer

It prevents all forms of social engineering.

Answer

It eliminates the need for strong password policies.

Answer

It automatically encrypts all outgoing email traffic.

Question 11

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

Accepted Answer

Use a password manager to generate and store unique, strong passwords for each site.. Credential stuffing succeeds when attackers replay username/password pairs leaked from one breach against other sites, so the defense is to ensure no two accounts share a password. A password manager generates and stores a unique, high-entropy password per site, which breaks the reuse chain that credential stuffing depends on. This is the single most effective user-side control against the attack.

Answer

Change passwords only when forced by the system administrator.

Answer

Write passwords on a physical sticky note hidden under the keyboard.

Answer

Use the same password for all work-related accounts to ensure memory efficiency.

Question 12

Which TWO actions should an end-user take to protect their physical workstation security?

Accepted Answer

Store sensitive documents in a locked drawer when not in use.. Option B is correct because physically securing sensitive documents in a locked drawer when they are not in use prevents unauthorized individuals from reading, photographing, or removing confidential information, which is a core element of physical workstation security. Option E is correct because locking the computer screen before walking away (e.g., via Windows+L or Ctrl+Alt+L on Linux) enforces access control at the session level, ensuring that an unattended workstation cannot be used by someone passing by. The unmarked options do not belong: disabling the screensaver (A) leaves the display exposed and removes a basic lock trigger, leaving the workstation unlocked during lunch (C) invites unauthorized access, and writing the BIOS password on a post-it note on the monitor (D) directly defeats the purpose of that password by exposing it to anyone nearby.

Answer

Disable the screensaver to ensure the system is always visible.

Answer

Leave the workstation unlocked during lunch breaks to save time.

Answer

Write the BIOS password on a post-it note attached to the monitor.

Question 13

Which TWO of the following are considered 'social engineering' techniques?

Accepted Answer

Baiting a victim with a 'free' USB drive that contains malware.. Baiting a victim with a 'free' USB drive containing malware is a classic social engineering technique because it manipulates human curiosity or greed to trick the victim into physically connecting the malicious device, rather than exploiting a technical flaw. Tailgating into a secure office area by following an authorized employee is also social engineering, as it relies on the human tendency to hold doors open or avoid confrontation to bypass physical access controls. In contrast, using a rainbow table to crack hashed passwords is a technical cryptanalytic attack that exploits precomputed hash values, not human behavior. A denial of service attack on a web server is a technical availability attack that floods resources, and using a vulnerability scanner to find open ports is a technical reconnaissance activity; neither depends on deceiving people.

Answer

Using a rainbow table to crack hashed passwords.

Answer

Performing a denial of service attack on a web server.

Answer

Using a vulnerability scanner to find open ports.

Question 14

Which THREE of the following are common indicators that a system has been compromised by malware?

Accepted Answer

An unexpected increase in outbound network traffic.. Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access. Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Answer

The system boot time remains consistent with previous months.

Answer

The computer performs regular daily virus definition updates.

Question 15

Which THREE steps are critical for an effective cybersecurity incident response plan?

Accepted Answer

Preparation and planning to ensure the team is ready to react.. Option B (Preparation and planning) is correct because an effective incident response plan requires proactive readiness—defining roles, playbooks, communication channels, and tools—so the team can react quickly and consistently when an incident occurs. Option D (Identification and analysis of the threat) is correct because responders must detect, validate, and scope the incident (e.g., determining affected hosts, accounts, and indicators of compromise) before they can choose appropriate remediation actions. Option E (Containment) is correct because limiting the spread of the incident—such as isolating compromised systems, disabling accounts, or blocking malicious traffic—prevents further damage while investigation and eradication proceed. Option A is incorrect because ignoring an incident allows attackers to persist and escalate, and Option C is incorrect because deleting all corporate data destroys evidence and business operations rather than containing or remediating the threat.

Answer

Ignoring the incident to see if it resolves itself automatically.

Answer

Immediately deleting all corporate data to prevent further theft.