Courseiva

CCNA Nse 1 Foundational Cybersecurity Concepts Questions

75 of 88 questions · Page 1/2 · Nse 1 Foundational Cybersecurity Concepts · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

A.Mass spam campaign
B.Whaling attack
C.MAC spoofing attack
D.Structured query language injection
AnswerB

Targeting executives with specialized phishing is known as whaling.

Why this answer

Whaling is a form of spear phishing specifically directed at high-profile targets like executives or senior management.

Practice this question →
2
MCQmedium

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

A.Availability, because public networks are prone to high latency and packet loss.
B.Non-repudiation, because transactions cannot be cryptographically verified.
C.Confidentiality, because data in transit can be intercepted by third parties.
D.Integrity, because unauthorized users can modify corporate files in transit.
AnswerC

Without a VPN, traffic can be read by anyone monitoring the local wireless medium, violating confidentiality.

Why this answer

Confidentiality is compromised because data transmitted over an unsecured network in plaintext can be intercepted via packet sniffing.

Practice this question →
3
MCQhard

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

A.Share a single high-privileged service account credential among the entire team.
B.Grant read-only access to specific tables only for employees whose roles explicitly require that data.
C.Assign all department members permanent administrative rights to ensure uninterrupted workflow.
D.Provide full database access to all employees during onboarding, revoking it after one year.
AnswerB

Restricting access to only necessary data and roles aligns directly with least privilege.

Why this answer

Least privilege dictates granting users only the minimum necessary access required to perform their job duties.

Practice this question →
4
Multi-Selectmedium

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

Select 2 answers
A.Immediately notify the internal IT security or helpdesk team
B.Delete all files on the computer to erase evidence of the compromise
C.Post about the incident on public social media channels to warn friends
D.Change the password immediately from a secure, uncompromised device
E.Keep the incident secret to avoid getting in trouble with management
AnswersA, D

Reporting the potential compromise allows security teams to monitor sessions and revoke access.

Why this answer

Promptly reporting the incident to IT security and changing the password immediately are critical steps to mitigate unauthorized access.

Practice this question →
5
MCQeasy

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

A.A rootkit that grants administrative privileges to remote attackers.
B.Ransomware that encrypts critical files and demands payment for access.
C.Adware that automatically displays unwanted promotional banners.
D.Spyware that covertly records keystrokes and captures screenshots.
AnswerB

The symptom of demanding payment for file decryption is characteristic of ransomware.

Why this answer

Ransomware encrypts user files and demands a ransom payment in exchange for the decryption key.

Practice this question →
6
MCQmedium

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

A.A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing
B.A password reused from personal social media accounts to ensure easy recall
C.A long passphrase consisting of random unrelated words and special characters
D.A short word combined with the current year, such as 'Summer2026!'
AnswerC

Length and complexity combined create robust entropy, defending against modern cracking tools.

Why this answer

Using a long passphrase with a combination of character types provides high entropy, making it extremely difficult to crack via brute-force or dictionary methods.

Practice this question →
7
MCQmedium

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

A.Utilize a secure VPN tunnel to the corporate network.
B.Enable browser-based spell check.
C.Ensure the laptop firewall is turned off to allow easier connectivity.
D.Use an unencrypted FTP connection for file transfers.
AnswerA

VPNs provide an encrypted tunnel that secures data transit across untrusted networks.

Why this answer

A VPN encrypts the traffic between the client and the corporate gateway, protecting data from interception on public networks.

Practice this question →
8
MCQhard

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

A.MAC flooding attack
B.Distributed denial of service
C.Man-in-the-Middle attack
D.SQL injection exploit
AnswerC

Interception and relay of traffic between two parties is a classic MitM attack.

Why this answer

A Man-in-the-Middle (MitM) attack involves an attacker secretly relaying and potentially altering communications between two parties who believe they are directly communicating.

Practice this question →
9
MCQeasy

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

A.Forward the email to all colleagues as a warning, including the live clickable link.
B.Reply to the sender asking for clarification using the reply button.
C.Recognize the social engineering attempt and use the organization's phishing reporting tool.
D.Treat it as an urgent executive request and fulfill the purchase immediately.
AnswerC

Reporting suspicious emails helps security teams isolate the threat across the network.

Why this answer

This is a classic Business Email Compromise (BEC) and phishing attack. The user should report the email using the organization's Phishing Incident Response tool rather than clicking or replying.

Practice this question →
10
Multi-Selecteasy

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Select 2 answers
A.Writing passwords on a physical notepad kept inside a locked desk drawer
B.Reusing the same strong master password across all banking and work systems for ease of recall
C.Storing passwords in an encrypted password manager application
D.Changing passwords every single week regardless of whether a compromise is suspected
E.Using a unique, complex password for every individual account
AnswersC, E

Password managers securely generate and store complex credentials.

Why this answer

Using unique passwords for every account prevents credential stuffing attacks from cascading, and utilizing password managers ensures complex, unguessable strings are stored securely.

Practice this question →
11
MCQeasy

Which of the following scenarios describes a 'pretexting' social engineering attack?

A.An attacker leaves a malicious USB drive in the lobby.
B.An attacker uses automated software to guess passwords.
C.An attacker shoulder-surfs to capture a password.
D.An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.
AnswerD

Posing as an authority figure to gather information is a classic pretext.

Why this answer

Pretexting involves creating a fabricated scenario to manipulate a victim into providing information.

Practice this question →
12
Multi-Selectmedium

Which TWO of the following are considered 'social engineering' techniques?

Select 2 answers
A.Using a rainbow table to crack hashed passwords.
B.Baiting a victim with a 'free' USB drive that contains malware.
C.Tailgating into a secure office area by following an authorized employee.
D.Performing a denial of service attack on a web server.
E.Using a vulnerability scanner to find open ports.
AnswersB, C

This exploits curiosity to deliver a payload.

Why this answer

Baiting and tailgating are both social engineering methods used to exploit human behavior.

Practice this question →
13
MCQhard

An enterprise security team implements Multi-Factor Authentication (MFA) across all employee accounts. Which combination of authentication factors represents the strongest implementation of MFA?

A.A password, a push notification sent to a physical mobile device, and a biometric thumbprint scan.
B.A smart card and a hardware security token.
C.A biometric fingerprint scan and a facial recognition scan.
D.A password and a PIN memorized by the user.
AnswerA

This combines knowledge (password), possession (phone), and inherence (biometric), utilizing three separate categories.

Why this answer

Strong MFA combines three distinct authentication factors: something you know, something you have, and something you are.

Practice this question →
14
Multi-Selecteasy

Which THREE of the following actions are examples of good physical security practices in an office environment? (Choose three)

Select 3 answers
A.Locking your workstation screen every time you step away from your desk
B.Wearing your employee identification badge visibly at all times while on premises
C.Challenging or reporting unbadged individuals wandering through secure office areas
D.Leaving visitor logs and visitor badges unattended on the front reception desk for anyone to take
E.Propping open secure exterior fire doors to let fresh air into the building
AnswersA, B, C

Screen locking prevents unauthorized physical access to active user sessions.

Why this answer

Locking unattended screens, wearing ID badges, and challenging unescorted visitors are all fundamental physical security controls.

Practice this question →
15
Multi-Selecthard

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Select 2 answers
A.Conducting regular security awareness training and simulated phishing tests for all staff.
B.Implementing multi-factor authentication (MFA) to protect user accounts even if credentials are exposed.
C.Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.
D.Instructing employees to comply immediately with any urgent executive request received via personal email.
E.Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.
AnswersA, B

Training helps employees recognize suspicious cues and builds an organizational culture of security.

Why this answer

Effective defense against social engineering combines human security awareness training with robust technical email filtering controls.

Practice this question →
16
MCQhard

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

A.Integrity is violated; remediation involves enabling packet checksum validation on all switches.
B.Non-repudiation is violated; remediation involves implementing digital signatures on email traffic.
C.Availability is violated; remediation involves upgrading uplink port speeds to 10Gbps.
D.Confidentiality is violated; remediation involves migrating to encrypted management protocols like SSH and HTTPS.
AnswerD

Unencrypted management traffic exposes passwords to sniffing, violating confidentiality, which is resolved by using SSH and HTTPS.

Why this answer

Telnet and HTTP transmit credentials and management data in clear text, violating confidentiality, and should be replaced with SSH and HTTPS.

Practice this question →
17
MCQhard

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

A.MAC address filtering on the local switch.
B.Local static IP filtering.
C.Dynamic URL filtering with reputation-based feeds.
D.Disabling cookies in the browser.
AnswerC

Reputation-based filtering uses real-time intelligence to identify and block malicious sites.

Why this answer

URL filtering integrated with threat intelligence feeds allows the gateway to block access to known malicious domains before the connection is established.

Practice this question →
18
MCQeasy

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

A.Drive-by download
B.Denial of service
C.Phishing via email
D.Vishing (Voice Phishing)
AnswerD

Using telephone calls to impersonate trusted personnel for data theft is vishing.

Why this answer

Vishing (voice phishing) uses telephone communication to manipulate individuals into divulging confidential information.

Practice this question →
19
MCQeasy

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

A.A man-in-the-middle attack intercepting and modifying transit data.
B.A distributed denial-of-service attack flooding servers.
C.A zero-day exploit leveraging unpatched software code.
D.A brute-force attack guessing login credentials.
AnswerA

MitM attacks involve secretly relaying and potentially altering communications between two parties who believe they are directly communicating.

Why this answer

An attack where an adversary positions themselves between two endpoints to monitor or alter traffic is a Man-in-the-Middle (MitM) attack.

Practice this question →
20
MCQmedium

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

A.An attacker installs a keylogger on an unattended physical workstation in an office.
B.An attacker floods a web server with synthetic traffic to crash the service.
C.An attacker calls the helpdesk posing as a new executive claiming to have lost their password, requesting a reset.
D.An attacker sends mass emails containing a malicious macro-enabled attachment.
AnswerC

Posing as an executive with an urgent fictitious backstory is a classic pretexting scenario.

Why this answer

Pretexting involves an attacker fabricating a scenario or identity to trick a victim into releasing information.

Practice this question →
21
Multi-Selecthard

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Select 2 answers
A.Running a temporary calculation script inside an isolated browser incognito tab.
B.Running an optional software update diagnostic tool provided by the hardware manufacturer.
C.Installing a kernel-level rootkit that hooks into core operating system processes.
D.Clearing the system browser cache and emptying the local operating system recycle bin.
E.Modifying operating system startup registry keys or creating automated scheduled tasks.
AnswersC, E

Rootkits embed themselves deeply into the OS kernel to hide malicious activity and survive reboots.

Why this answer

Attackers maintain persistence through mechanisms such as scheduled tasks, startup registry keys, or installed rootkits.

Practice this question →
22
Multi-Selectmedium

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Select 2 answers
A.Permitting HTTP plaintext transmission for login forms to speed up authentication.
B.Allowing users to share identical passwords to reduce password fatigue.
C.Implementing account lockout policies after a threshold of failed login attempts.
D.Enforcing Multi-Factor Authentication (MFA) across all authentication portals.
E.Disabling logging mechanisms to prevent server storage bloat.
AnswersC, D

Lockout policies stop automated brute-force guessing tools.

Why this answer

Multi-factor authentication and account lockout policies effectively mitigate credential stuffing and brute-forcing.

Practice this question →
23
MCQeasy

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

A.Preventing structured SQL injection attacks against web databases.
B.Mitigating brute-force and credential-guessing attacks.
C.Preventing physical theft of laptop hardware.
D.Ensuring high network bandwidth availability for video conferencing.
AnswerB

Complex passwords expand the keyspace, directly hindering automated guessing tools.

Why this answer

Complex passwords increase entropy, making brute-force and dictionary attacks significantly harder to execute successfully.

Practice this question →
24
Multi-Selecteasy

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

Select 2 answers
A.Forward suspicious attachments to all coworkers to see if anyone recognizes them
B.Immediately open executable attachments (.exe) to check what program they run
C.Refrain from opening files with double extensions like .pdf.exe or unexpected script formats
D.Verify the legitimacy of the attachment by contacting the sender through an independent, trusted communication channel
E.Disable your antivirus software temporarily so it does not block the file download
AnswersC, D

Double extensions and script formats are common techniques used to disguise malware.

Why this answer

Users should verify files with senders through independent channels and avoid opening unknown executable or script attachments.

Practice this question →
25
MCQhard

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

A.The user installed a legitimate browser extension.
B.The user's local firewall is performing a full system scan.
C.The system is performing a routine background update.
D.The host is infected with malware and participating in a botnet.
AnswerD

Malware communicating with a C2 server often exhibits these traffic patterns.

Why this answer

These symptoms are consistent with a botnet infection where the host is part of a command-and-control network.

Practice this question →
26
Multi-Selecteasy

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Select 3 answers
A.Conducting personal online banking without checking for HTTPS or using a VPN
B.Disabling automatic connection to open Wi-Fi networks on your mobile device
C.Accepting all unknown certificate warnings when browsing on public hotspots
D.Using a trusted corporate Virtual Private Network (VPN) for all internet traffic
E.Avoiding access to highly sensitive corporate accounts unless an encrypted tunnel is active
AnswersB, D, E

This prevents devices from connecting to rogue access points automatically.

Why this answer

Using a VPN, avoiding sensitive transactions on unencrypted networks, and disabling automatic network connection features protect users on public Wi-Fi.

Practice this question →
27
Multi-Selectmedium

Which TWO actions should an end-user take to protect their physical workstation security?

Select 2 answers
A.Disable the screensaver to ensure the system is always visible.
B.Store sensitive documents in a locked drawer when not in use.
C.Leave the workstation unlocked during lunch breaks to save time.
D.Write the BIOS password on a post-it note attached to the monitor.
E.Lock the computer screen before walking away from the desk.
AnswersB, E

Physical document protection is as important as digital security.

Why this answer

Locking the screen and keeping sensitive documents stored securely are fundamental physical security controls.

Practice this question →
28
Multi-Selecthard

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

Select 3 answers
A.Storing master credentials in a plain-text document on the desktop for quick reference.
B.Promptly installing operating system and application security patches.
C.Disabling endpoint antivirus agents to maximize system performance during video calls.
D.Verifying software legitimacy before downloading and installing third-party applications.
E.Locking the workstation screen whenever stepping away from the desk.
AnswersB, D, E

Patching closes known vulnerabilities exploited by malware.

Why this answer

Keeping software updated, avoiding unverified downloads, and locking screens are foundational hygiene steps.

Practice this question →
29
MCQmedium

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

A.Blocking all external incoming emails entirely
B.Conducting regular simulated phishing tests with immediate feedback
C.Restricting employees from having LinkedIn or social media accounts
D.Requiring employees to read a 100-page security policy manual annually
AnswerB

Practical simulations reinforce awareness and test behavioral readiness effectively.

Why this answer

Simulated phishing campaigns combined with immediate, contextual training help users recognize real-world tactics safely.

Practice this question →
30
Multi-Selecthard

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

Select 3 answers
A.System administrators should always share a single root account password to ensure accountability
B.The principle of least privilege ensures users and accounts are granted only the minimum access needed
C.Separation of duties ensures that critical, high-risk tasks require involvement from multiple people
D.Security through obscurity should be used as the primary defense mechanism for databases
E.Defense in depth relies on deploying multiple overlapping security layers rather than a single defense
AnswersB, C, E

Least privilege limits access scope to reduce potential damage from compromised accounts.

Why this answer

Least privilege, defense in depth, and separation of duties are core foundational security principles.

Practice this question →
31
MCQhard

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

A.Cryptographic salting
B.Symmetric encryption
C.Network segmentation
D.Non-repudiation verification
AnswerC

Placing guests on the corporate subnet without isolation violates network segmentation best practices.

Why this answer

Network segmentation isolates untrusted zones (like guest networks) from sensitive internal assets to limit the impact of a breach.

Practice this question →
32
Multi-Selecteasy

Which TWO characteristics describe effective password management principles? (Choose two.)

Select 2 answers
A.Changing passwords every single week regardless of whether any compromise indicators exist.
B.Writing down primary administrator passwords on sticky notes attached to computer monitors.
C.Using a password manager to generate and store complex, unique passwords securely.
D.Reusing the same strong password across all personal and professional accounts for convenience.
E.Employing long passphrases that combine multiple random words for high entropy and memorability.
AnswersC, E

Password managers eliminate the need to memorize complex passwords and prevent reuse.

Why this answer

Effective password management relies on using password managers to generate long, unique passphrases or passwords for every account.

Practice this question →
33
Multi-Selectmedium

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Select 2 answers
A.The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.
B.The message includes a link to the corporate intranet home page via the internal DNS domain.
C.The sender email address domain subtly differs from the legitimate organization's domain name.
D.The email is addressed specifically to your correct full corporate title and department.
E.The email contains standard company newsletter updates sent through an official mailing platform.
AnswersA, C

Attackers manufacture urgency to bypass critical thinking.

Why this answer

Urgency, mismatched sender domains, and unexpected attachments are key indicators of phishing.

Practice this question →
34
MCQmedium

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

A.By relying exclusively on local ARP tables
B.By broadcasting requests via local Bluetooth signals
C.By converting domain names into physical print jobs
D.By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH)
AnswerD

Malware can bypass local DNS blocks by using external public resolvers or encrypted DNS protocols.

Why this answer

Advanced malware often uses alternative lookup methods, such as utilizing hardcoded public DNS resolvers or tunneling protocols, to bypass internal DNS restrictions.

Practice this question →
35
MCQmedium

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

A.Integrity
B.Confidentiality
C.Availability
D.Non-repudiation
AnswerB

Confidentiality protects sensitive data from unauthorized interception and eavesdropping.

Why this answer

Confidentiality ensures that data is readable only by intended parties, which is achieved through encryption, preventing casual sniffing on shared segments.

Practice this question →
36
Multi-Selecthard

Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)

Select 3 answers
A.Exercising caution when clicking links or downloading files from untrusted sources
B.Running reputable, centralized endpoint security software (antivirus/EDR)
C.Downloading cracked software and keygens from peer-to-peer file-sharing networks
D.Disabling all firewall rules and network logging to maximize system performance
E.Keeping operating systems and application software patched and up to date
AnswersA, B, E

Mindful browsing prevents the accidental introduction of malware onto the device.

Why this answer

Endpoint protection, keeping software updated, and avoiding unverified links or downloads are vital practices for endpoint security.

Practice this question →
37
MCQeasy

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

A.Drive-by download
B.Physical shoulder surfing
C.Social engineering phone call
D.Email phishing scam
AnswerA

Automatic background downloads of malicious files while browsing represent drive-by downloads.

Why this answer

A drive-by download occurs when malware is downloaded automatically without the user's explicit consent or knowledge when visiting a compromised website.

Practice this question →
38
Multi-Selecteasy

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

Select 2 answers
A.Clicking on unexpected email attachments immediately to verify their safety.
B.Sharing corporate passwords with trusted team members to ensure project continuity.
C.Disabling all endpoint antivirus software to speed up system performance.
D.Locking the workstation screen whenever walking away from the desk.
E.Using complex, unique passwords for every separate work account.
AnswersD, E

Locking unattended screens prevents physical unauthorized access by opportunistic visitors.

Why this answer

End users should maintain strong, unique passwords and lock their screens when leaving workstations unattended.

Practice this question →
39
MCQmedium

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

A.Change passwords only when forced by the system administrator.
B.Write passwords on a physical sticky note hidden under the keyboard.
C.Use a password manager to generate and store unique, strong passwords for each site.
D.Use the same password for all work-related accounts to ensure memory efficiency.
AnswerC

This approach eliminates the risk associated with password reuse.

Why this answer

Using a unique, complex password for every service ensures that one breach does not lead to the compromise of other accounts.

Practice this question →
40
MCQeasy

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

A.Write them on a sticky note attached to the computer monitor for convenience
B.Discard them immediately as they are unnecessary if an app is installed
C.Store them in an encrypted password manager or secure offline location
D.Share them in a public corporate chat channel so teammates can assist if needed
AnswerC

Secure storage ensures availability for emergency recovery without exposing them to unauthorized access.

Why this answer

Recovery codes should be stored securely and privately, such as in an encrypted password manager, rather than on sticky notes or unsecured text files.

Practice this question →
41
MCQmedium

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

A.Deploying standard HTTP web proxies without inspection.
B.Increasing the corporate internet bandwidth capacity.
C.Enabling automatic operating system wallpaper updates.
D.Maintaining secure, immutable, and offline backups of critical data.
AnswerD

Offsite or immutable backups allow organizations to recover encrypted files without negotiating with attackers.

Why this answer

Maintaining regular, immutable backups stored offline or in a segmented cloud repository ensures data can be restored without paying a ransom.

Practice this question →
42
Multi-Selectmedium

Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)

Select 2 answers
A.Generic greetings like 'Dear Customer' instead of the recipient's actual name
B.A standard newsletter sent via an officially approved corporate marketing platform with working unsubscribe links
C.A sender domain address that slightly misspells a trusted organization's name
D.Content written with perfect grammar, standard company formatting, and no sense of urgency
E.An email digitally signed with a valid corporate PKI certificate issued by the internal IT department
AnswersA, C

Mass phishing campaigns often use generic salutations because they target many recipients.

Why this answer

Phishing emails frequently employ artificial urgency to prompt rash actions and often feature sender addresses with subtle domain spoofing or misspellings.

Practice this question →
43
MCQhard

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

A.Separation of duties
B.Mandatory access control labeling
C.Single sign-on federation
D.Role-based access auditing
AnswerA

Requiring one admin to create a rule and a different admin to approve/deploy it enforces separation of duties.

Why this answer

Separation of duties ensures that critical tasks require authorization from multiple distinct individuals to prevent misuse or error.

Practice this question →
44
MCQeasy

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

A.Baiting
B.Watering hole attack
C.Tailgating
D.Phishing
AnswerA

Baiting relies on physical items like infected USB drives to entice users into compromising their systems.

Why this answer

Baiting involves leaving physical media in places where targets are likely to find them, playing on curiosity or greed.

Practice this question →
45
MCQmedium

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

A.Bandwidth saturation anomaly
B.Impossible travel anomaly
C.Hardware failure indicator
D.DNS poisoning event
AnswerB

Logins from distant geographic locations in an impossibly short timeframe indicate compromised credentials.

Why this answer

Impossible travel indicates that credentials are likely compromised and being used simultaneously by an attacker elsewhere.

Practice this question →
46
MCQhard

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

A.Human psychology and helpfulness
B.Misconfigured firewall security policies
C.Cryptographic weak implementation
D.Unpatched operating system kernel bugs
AnswerA

Impersonation attacks target human tendencies to be helpful and defer to perceived authority.

Why this answer

Social engineering exploits human psychology, such as helpfulness, fear, or authority, rather than technical software flaws.

Practice this question →
47
MCQmedium

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

A.The network lease duration assigned by corporate DHCP servers.
B.The exposure window during which attackers can exploit known unpatched vulnerabilities.
C.The physical hardware warranty expiration window for end-user laptops.
D.The vendor development lifecycle window for creating new software features.
AnswerB

Prompt patching shortens the time attackers have to weaponize and exploit newly discovered flaws.

Why this answer

Rapid patching minimizes the window of exposure between when a vulnerability is disclosed and when it is remediated.

Practice this question →
48
MCQeasy

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

A.Click the link to verify if the website looks authentic before reporting it
B.Report the email using the organization's designated phishing reporting mechanism
C.Forward the email to all colleagues as a warning
D.Reply to the sender asking for verbal confirmation of their identity
AnswerB

This allows security analysts to investigate and neutralize the threat safely.

Why this answer

Reporting the email using the organization's official phishing reporting tool is the safest and correct action, as it alerts the security team without interacting with the malicious link.

Practice this question →
49
Multi-Selecthard

Which THREE steps are critical for an effective cybersecurity incident response plan?

Select 3 answers
A.Ignoring the incident to see if it resolves itself automatically.
B.Preparation and planning to ensure the team is ready to react.
C.Immediately deleting all corporate data to prevent further theft.
D.Identification and analysis of the threat to understand the scope.
E.Containment to prevent the spread of the security incident.
AnswersB, D, E

Preparation allows for an organized response.

Why this answer

Preparation, identification, and containment are foundational phases of any incident response lifecycle.

Practice this question →
50
Multi-Selectmedium

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

Select 3 answers
A.A generic salutation such as 'Dear Customer' instead of the recipient's actual name.
B.A sender email address domain that subtly misspells a legitimate corporate brand name.
C.A standard company-wide newsletter detailing upcoming office cafeteria holiday hours.
D.An urgent demand to verify confidential credentials or financial information immediately.
E.A digital signature verifying the cryptographic integrity and authenticity of the sender.
AnswersA, B, D

Phishing campaigns are often sent in bulk using generic greetings rather than personalized details.

Why this answer

Phishing emails often feature generic greetings, mismatched sender domains, and urgent demands for sensitive information.

Practice this question →
51
MCQeasy

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

A.A keystroke injection attack using a compromised HID device.
B.A distributed denial-of-service attack originating from the keyboard firmware.
C.A hardware logic bomb that physically destroys the motherboard upon boot.
D.A physical RAM scraping attack reading volatile memory contents.
AnswerA

Devices like Rubber Duckies masquerade as keyboards to rapidly inject pre-programmed malicious commands.

Why this answer

A device disguised as a standard USB human interface device that injects keystrokes is known as a BadUSB or keystroke injection attack.

Practice this question →
52
Multi-Selecthard

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Select 2 answers
A.Complexity
B.Compliance
C.Concurrency
D.Integrity
E.Confidentiality
AnswersD, E

Integrity ensures data and systems are accurate and protected from unauthorized modification.

Why this answer

Confidentiality, Integrity, and Availability form the foundational CIA triad of information security.

Practice this question →
53
Multi-Selectmedium

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

Select 3 answers
A.Availability, ensuring authorized users have reliable access to information and resources when needed.
B.Compliance, ensuring all regional government tax laws are strictly obeyed.
C.Confidentiality, ensuring sensitive data is accessible only to authorized individuals.
D.Cost-efficiency, ensuring security budgets remain minimal relative to operational revenue.
E.Integrity, ensuring data and systems are accurate and protected from unauthorized modification.
AnswersA, C, E

Availability ensures systems and data remain operational and reachable for business functions.

Why this answer

The CIA Triad consists of Confidentiality, Integrity, and Availability.

Practice this question →
54
MCQhard

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

A.Network boundary defense
B.Asymmetric encryption key management
C.Controlled application execution (Whitelisting)
D.Principle of fail-secure
AnswerC

Restricting software execution to an approved list prevents unauthorized or malicious apps from running.

Why this answer

Application whitelisting or controlled application execution ensures that only pre-approved, trusted software can run on endpoints.

Practice this question →
55
MCQeasy

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

A.Ransomware infection
B.DDoS attack
C.Man-in-the-middle interception
D.SQL injection
AnswerA

File encryption and ransom notes are signature indicators of ransomware.

Why this answer

Ransomware encrypts user or system files and demands payment for the decryption key.

Practice this question →
56
MCQmedium

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

A.The risk of unauthorized physical entry to data centers
B.The risk of operational downtime caused by faulty updates
C.The risk of zero-day hardware manufacturing defects
D.The risk of social engineering attacks against helpdesk staff
AnswerB

Testing ensures updates do not break critical business applications before rollout.

Why this answer

Testing updates prevents faulty patches from causing widespread system instability, crashes, or availability loss in production.

Practice this question →
57
MCQhard

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

A.Confidentiality across all states of data (transit and rest)
B.Availability and Non-repudiation
C.Authenticity and Authorization
D.Confidentiality and Integrity
AnswerA

Encryption ensures confidentiality whether data is moving or stored.

Why this answer

Encryption protects data confidentiality during transit and at rest, ensuring unauthorized parties cannot read it.

Practice this question →
58
MCQmedium

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

A.Separation of Duties
B.Security by Obscurity
C.Defense in Depth
D.Principle of Least Privilege
AnswerD

This restricts access to the bare minimum required for operations.

Why this answer

The Principle of Least Privilege ensures that users have only the minimum access necessary to perform their tasks, minimizing potential damage.

Practice this question →
59
Multi-Selecthard

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Select 2 answers
A.Forward the suspicious file to all external clients as a warning alert.
B.Delete all system logs and temporary files to clear up disk space for the virus scanner.
C.Download and execute unverified registry cleaner utilities from pop-up advertisements.
D.Notify the internal IT security or incident response team without delay.
E.Immediately disconnect the laptop from both wired and wireless network connections.
AnswersD, E

Prompt reporting allows security analysts to contain the incident and initiate forensics.

Why this answer

Upon suspecting a compromise, users should disconnect from the network to stop lateral movement and immediately report the incident to IT security.

Practice this question →
60
Multi-Selecthard

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

Select 2 answers
A.Relying entirely on a single powerful perimeter firewall with no internal security controls
B.Implementing network segmentation to restrict lateral movement between departments
C.Requiring multi-factor authentication for all remote and privileged user access
D.Eliminating all system logs and monitoring to maximize user privacy
E.Disabling all endpoint antivirus solutions to improve computer processing speed
AnswersB, C

Segmentation stops an attacker from moving freely across the entire internal network.

Why this answer

Defense in depth relies on layering independent security controls, such as network segmentation and multi-factor authentication, so that if one control fails, another provides protection.

Practice this question →
61
MCQmedium

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

A.USB baiting exploiting human curiosity and physical media.
B.Man-in-the-middle interception of wireless frames.
C.Cross-site scripting executed within a browser session.
D.Watering hole attack targeting web browsing habits.
AnswerA

Baiting relies on curiosity to induce users to insert malicious storage devices.

Why this answer

Leaving physical media in public spaces to entice curiosity is a social engineering tactic known as USB baiting.

Practice this question →
62
MCQmedium

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

A.Inadequate identity and access lifecycle offboarding procedures
B.Failure to implement adequate endpoint antivirus software
C.Absence of hardware token multi-factor authentication
D.Lack of network segmentation between departments
AnswerA

Failing to disable accounts upon termination leaves dormant credentials vulnerable to misuse.

Why this answer

Poor offboarding and lifecycle management processes fail to promptly revoke access when personnel leave the organization.

Practice this question →
63
MCQmedium

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

A.It adds a layer of defense even if the primary password is stolen.
B.It prevents all forms of social engineering.
C.It eliminates the need for strong password policies.
D.It automatically encrypts all outgoing email traffic.
AnswerA

MFA acts as a secondary gate, preventing unauthorized access even with valid credentials.

Why this answer

MFA requires a second form of verification, ensuring that even if a password is compromised, the attacker cannot access the account.

Practice this question →
64
MCQmedium

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

A.A SQL injection exploit
B.A distributed denial-of-service attack
C.A legitimate endpoint telemetry notification
D.A tech support scam
AnswerD

Fake virus pop-ups urging users to call a support line are hallmark indicators of technical support scams.

Why this answer

Tech support scams use fear and false urgency via deceptive alerts to trick users into paying for unnecessary services or granting remote access to their machines.

Practice this question →
65
Multi-Selectmedium

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Select 3 answers
A.An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal
B.An organization implements strict role-based access control and regular auditing
C.A network administrator configures automated offboarding checklists for departed employees
D.An attacker drops infected USB flash drives in a company parking lot to entice curious employees
E.A user sees a pop-up browser alert claiming their PC is infected and instructing them to call a fraudulent support line
AnswersA, D, E

Credential harvesting via spoofed login pages is a classic phishing attack.

Why this answer

Phishing, baiting with USB drives, and tech support scams are all classic threat types targeting end users.

Practice this question →
66
Multi-Selectmedium

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Select 3 answers
A.They always require advanced kernel-level debugging tools to execute
B.They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes
C.They are entirely preventable by installing a standard graphics card driver update
D.They often impersonate authority figures, IT support, or trusted brands
E.They primarily exploit human psychology and trust rather than software code vulnerabilities
AnswersB, D, E

Urgency short-circuits careful critical thinking, making victims more compliant.

Why this answer

Social engineering often relies on manipulation of human emotions such as fear or urgency, impersonation of trusted entities, and bypassing technical controls by targeting users.

Practice this question →
67
MCQmedium

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

A.Enable local file sharing to speed up document syncing over public connections.
B.Disable the operating system firewall to allow seamless packet routing through the hotspot.
C.Establish an authorized corporate VPN connection before accessing internal systems.
D.Configure the web browser to accept all SSL certificates to bypass public portal warnings.
AnswerC

A VPN creates a secure, encrypted tunnel over public infrastructure.

Why this answer

A Virtual Private Network (VPN) encrypts traffic between the endpoint and the corporate network, protecting data-in-transit from public Wi-Fi sniffing.

Practice this question →
68
MCQmedium

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

A.It ensures that compromised credentials alone are insufficient for an attacker to gain access
B.It guarantees complete encryption of all local workstation files
C.It prevents all forms of social engineering attacks against remote workers
D.It entirely eliminates the need for strong passwords on corporate accounts
AnswerA

Requiring a second independent verification factor prevents simple password theft from resulting in a successful breach.

Why this answer

Multi-factor authentication (MFA) significantly reduces the risk of unauthorized access even if a primary password is compromised via phishing or credential stuffing.

Practice this question →
69
MCQhard

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

A.Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.
B.Every user account is automatically granted local administrator rights on their assigned workstation by default.
C.Users and services are granted only the bare minimum permissions required to perform their explicit functions.
D.All administrators share a single root account with full access to simplify password management.
AnswerC

This matches the definition of least privilege, limiting blast radius if an account is compromised.

Why this answer

Least privilege dictates that users and services should only be granted the minimum permissions necessary to perform their specific functions.

Practice this question →
70
MCQeasy

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

A.Forward the spreadsheet to all company contacts for collaborative viewing
B.Print the spreadsheet immediately to a physical printer
C.Enable macros immediately so the file displays properly
D.Leave macros disabled unless the source is fully verified and trusted
AnswerD

Disabling macros prevents automated malicious scripts from executing upon opening files.

Why this answer

Users should never enable macros in unsolicited or external documents unless the source is verified and business necessity is confirmed, as macros are a common vector for malware delivery.

Practice this question →
71
Multi-Selecthard

Which THREE of the following are common indicators that a system has been compromised by malware?

Select 3 answers
A.An unexpected increase in outbound network traffic.
B.Frequent, unexplained system crashes or freezes.
C.The system boot time remains consistent with previous months.
D.The computer performs regular daily virus definition updates.
E.Automatic creation of new, unrecognized administrative accounts.
AnswersA, B, E

This suggests the system is communicating with a C2 server.

Why this answer

Unexpected system behavior, unauthorized network connections, and modified system files are clear signs of an infection.

Practice this question →
72
MCQhard

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

A.Separation of duties
B.Defense in depth
C.Security through obscurity
D.Principle of least privilege
AnswerD

Granting broad administrative access instead of restricted permissions violates the principle of least privilege.

Why this answer

The principle of least privilege dictates that accounts and users should only have the minimum necessary access to perform their required functions, minimizing the blast radius of a compromise.

Practice this question →
73
Multi-Selecteasy

Which THREE of the following are recognized signs of a potential phishing attempt?

Select 3 answers
A.The email is sent during standard business hours.
B.The email uses urgent or threatening language to demand immediate action.
C.The sender's email address domain does not match the organization they claim to represent.
D.The email contains an unexpected attachment from an unknown sender.
E.The email is addressed to the employee by their correct first name.
AnswersB, C, D

Urgency is a psychological trigger used in phishing.

Why this answer

Unexpected attachments, urgent language, and suspicious sender domains are common indicators of phishing.

Practice this question →
74
MCQeasy

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

A.Unplug the Ethernet network cable
B.Lock the workstation screen
C.Power down the computer completely
D.Minimize all open web browser windows
AnswerB

Locking the screen ensures that physical access requires re-authentication.

Why this answer

Locking the workstation prevents unauthorized physical access to sensitive open applications and data while the user is away.

Practice this question →
75
MCQeasy

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

A.Network segmentation compliance
B.Endpoint firewall configuration
C.Clean desk policy adherence
D.Multi-factor authentication protocols
AnswerC

Leaving sensitive printouts unattended violates clean desk policies designed to prevent physical data exposure.

Why this answer

Clear desk and clear screen policies require employees to secure sensitive physical and digital information when not attended.

Practice this question →
Page 1 of 2 · 88 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Nse 1 Foundational Cybersecurity Concepts questions.

Start 20-question session