Nse 1 Foundational Cybersecurity Concepts

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

An organization's security policy states that users should have only the access needed to perform their job, and that access should be reviewed regularly. A database administrator currently retains full administrative rights to a finance application even though her role changed six months ago and no longer requires those rights. Which principle is being violated?

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Which of the following scenarios describes a 'pretexting' social engineering attack?

Which TWO of the following are considered 'social engineering' techniques?

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Which TWO actions should an end-user take to protect their physical workstation security?

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

A company's security team notices a sudden spike in authentication failures for many user accounts within a short window, followed by successful logins from unfamiliar geographic locations using valid credentials. Which attack best matches this pattern?

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

A company's security team wants to reduce the damage an attacker could cause if a single employee account is compromised. They decide that every employee should have only the access needed to perform their daily job, and no more. Which security principle are they applying?

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

Which TWO characteristics describe effective password management principles? (Choose two.)

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

Which THREE steps are critical for an effective cybersecurity incident response plan?

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

A hospital's security team deploys network segmentation so that the radiology imaging VLAN cannot directly reach the billing VLAN. A vendor's maintenance laptop connected to the imaging VLAN is later found to be infected with ransomware. Which security benefit of segmentation does this design primarily provide in this situation?

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

Which THREE of the following are common indicators that a system has been compromised by malware?

A retail company wants to reduce the risk that stolen customer credit card numbers can be used if its database is breached. Which TWO practices best support this goal? (Choose two.)

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

A new employee at a small accounting firm receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to avoid account suspension. The email address looks slightly misspelled, and the link points to a domain that is not the bank's real website. What type of attack is this?

Which THREE of the following are recognized signs of a potential phishing attempt?

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

What is the primary objective of a 'DDoS' attack?

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

A new hire at a financial services firm receives an email that appears to come from the CEO, asking them to urgently purchase gift cards for a client appreciation event and to send the redemption codes by reply email. The message uses the CEO's correct name and photo but originates from an external address. Which type of attack is this?

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?