CCNA Nse 1 Foundational Cybersecurity Concepts Questions — Page 2 of 2

MCQhard

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

A.Enforcing mandatory password complexity rules

B.Implementing strict egress firewall filtering

C.Deploying host-based intrusion detection systems

D.Maintaining immutable, offline data backups

AnswerD

Secure offline backups ensure that data can be restored safely without paying a ransom.

Why this answer

Regularly tested backups provide an authoritative recovery copy of data, rendering ransomware extortion ineffective.

Practice this question →

MCQeasy

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

A.Spear phishing

B.Vishing

C.Whaling

D.Smishing

AnswerD

Phishing conducted via SMS text messages is known as smishing.

Why this answer

Smishing is a portmanteau of SMS and phishing, representing phishing attacks conducted through mobile text messaging.

Practice this question →

MCQeasy

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

A.Endpoint compliance

B.Network layer security

C.Physical security

D.Application layer security

AnswerC

Tampering with entrance badges and attaching hardware devices directly targets physical security infrastructure.

Why this answer

Physical security controls protect the physical plant, equipment, and media from unauthorized access, theft, or tampering.

Practice this question →

MCQeasy

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

A.A brute-force credential stuffing attack.

B.A targeted spear-phishing attack designed for financial fraud.

C.An advanced persistent threat using zero-day malware.

D.A standard denial-of-service attack.

AnswerB

Spear phishing targets specific individuals with customized social engineering, frequently resulting in BEC.

Why this answer

This scenario describes Business Email Compromise (BEC) and spear phishing, where attackers impersonate executives to induce financial fraud.

Practice this question →

MCQeasy

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

A.Delete the email and clear the browser cache.

B.Click the link to check if the website looks authentic.

C.Reply to the email with the requested credentials to avoid account lockout.

D.Forward the email to the IT helpdesk using the official reporting procedure.

AnswerD

Following the official reporting procedure allows security teams to mitigate the threat.

Why this answer

Reporting the email via the organization's official phishing reporting mechanism ensures the security team can analyze the threat and protect other users.

Practice this question →

MCQhard

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

A.Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.

B.Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.

C.Enforcing identical complex passwords across all local and cloud administrative portals.

D.Duplicating identical edge firewalls in an active-passive cluster for high availability.

AnswerA

Combining different controls across endpoints, network, identity, and human layers creates robust defense-in-depth.

Why this answer

Defense-in-depth uses multiple overlapping security controls so that if one control fails, subsequent controls prevent a breach.

Practice this question →

MCQeasy

What is the primary objective of a 'DDoS' attack?

A.To steal intellectual property.

B.To exhaust system resources and render a service unavailable.

C.To modify user permissions on the server.

D.To install a hidden backdoor for future access.

AnswerB

The goal is to render the target inaccessible to legitimate users.

Why this answer

A Distributed Denial of Service attack aims to make a service unavailable by overwhelming it with traffic.

Practice this question →

MCQeasy

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

A.Writing the password on a sticky note attached to the monitor for easy access during shifts.

B.Using a long, unique passphrase managed by an approved enterprise password manager.

C.Reusing the same strong password across all personal and work applications for easy recall.

D.Using a short password with special characters and changing it every 30 days.

AnswerB

Passphrase length provides strong security, and password managers prevent reuse.

Why this answer

Modern guidelines emphasize length and complexity, often achieved via passphrases, combined with multi-factor authentication, while avoiding predictable patterns.

Practice this question →

MCQeasy

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

A.Offering financial rewards for completing a corporate survey.

B.Creating a false sense of urgency and fear of loss.

C.Establishing authority by impersonating a system administrator calmly.

D.Providing technical assistance for routine software patching.

AnswerB

Threatening immediate account deactivation triggers panic, leading the user to act without verifying authenticity.

Why this answer

Attackers create a sense of urgency and panic to bypass critical thinking and prompt immediate compliance.

Practice this question →

MCQhard

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

A.It verifies user identity and device health continuously, granting least-privilege access per application.

B.It trusts all devices once the initial corporate username and password are validated at the perimeter.

C.It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.

D.It relies entirely on physical network segmentation within the remote employee's home office.

AnswerA

ZTNA constantly evaluates context and restricts access only to authorized individual applications.

Why this answer

ZTNA continuously verifies user identity, device posture, and grants access strictly to specific applications rather than the entire network.

Practice this question →

MCQmedium

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

A.To ensure all personnel understand how to compile source code securely.

B.To replace automated endpoint detection and response software with human monitoring.

C.To transform employees into an active defense layer capable of recognizing social engineering.

D.To train every staff member to write advanced firewall configuration scripts.

AnswerC

Security awareness aims to reduce human error and empower staff to identify phishing and social engineering.

Why this answer

Employees are frequently targeted as the human firewall; training helps them recognize and report social engineering attempts.

Practice this question →

MCQmedium

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

A.Watering hole attack

B.Phishing via SMS (Smishing)

C.Credential stuffing

D.Voice phishing (Vishing)

AnswerD

Vishing involves attackers using phone communication to impersonate trusted authorities and extract credentials.

Why this answer

Vishing (voice phishing) uses phone calls and social manipulation to trick individuals into divulging confidential information.

Practice this question →

MCQhard

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?

A.Risk transfer, purchasing cyber insurance to shift financial liability to a third party.

B.Risk acceptance, choosing to absorb the financial impact if an incident occurs.

C.Risk avoidance, eliminating the business activity entirely to prevent exposure.

D.Risk mitigation, deploying technical controls to lower the probability and impact of threats.

AnswerD

Deploying security controls to reduce risk levels is the definition of risk mitigation.

Why this answer

Implementing technical controls to lower the probability or severity of a risk is known as risk mitigation or risk reduction.

Practice this question →