CCNA Nse 1 Foundational Cybersecurity Concepts Questions — Page 1 of 2

MCQhard

A cybersecurity analyst is investigating a security breach where an attacker bypassed perimeter defenses by sending a weaponized PDF attachment directly to a high-ranking executive's personal email account used on a corporate laptop. What specific type of targeted attack does this represent?

A.Mass spam campaign

B.Whaling attack

C.MAC spoofing attack

D.Structured query language injection

AnswerB

Whaling specifically targets senior executives such as high-ranking officers, satisfying the stem's scenario of a weaponised PDF sent to an executive's personal account. It is a spear-phishing variant distinguished by the victim's seniority, unlike generic phishing or business email compromise.

Why this answer

A whaling attack is a highly targeted spear-phishing variant aimed specifically at senior executives ('big fish') such as CEOs, CFOs, or other high-ranking officials. The attacker here bypassed perimeter defenses by sending a weaponized PDF directly to the executive's personal email, which is a hallmark of whaling — personalized targeting of a high-value individual rather than mass distribution. The personal-account vector and executive target confirm this is whaling, not generic phishing or spam.

Exam trap

FORTINET-NSE123 often tests the distinction between broad phishing/spam and targeted executive-level attacks — candidates pick 'mass spam' because an email was involved, missing the 'high-ranking executive' and 'personal account' cues that define whaling.

How to eliminate wrong answers

Option A is wrong because a mass spam campaign is untargeted bulk email sent to thousands of recipients indiscriminately, whereas this attack was specifically crafted for one executive. Option C is wrong because MAC spoofing is a Layer 2 attack that forges a network interface's hardware address to bypass port security or impersonate another device — it has nothing to do with email-borne malware. Option D is wrong because SQL injection targets database-driven web applications by inserting malicious SQL statements into input fields, not email attachments delivered to an executive.

Practice this question →

MCQmedium

A remote employee connects to an unsecured public Wi-Fi network at a coffee shop and accesses internal corporate resources without utilizing a VPN. Which foundational security principle is primarily compromised in this scenario?

A.Availability, because public networks are prone to high latency and packet loss.

B.Non-repudiation, because transactions cannot be cryptographically verified.

C.Confidentiality, because data in transit can be intercepted by third parties.

D.Integrity, because unauthorized users can modify corporate files in transit.

AnswerC

Traffic traversing the public Wi-Fi network is unencrypted, so anyone on that segment can capture credentials and corporate data. Confidentiality is the property breached, since the data remains intact and available but is exposed to interception by third parties.

Why this answer

Confidentiality is compromised because data transmitted over an unsecured public Wi-Fi network without a VPN can be intercepted by third parties (e.g., via packet sniffing or man-in-the-middle attacks). The lack of encryption means sensitive corporate information is exposed to unauthorized observers.

Exam trap

FORTINET-NSE123 often tests the distinction between confidentiality and integrity in network scenarios; candidates may incorrectly choose integrity when the primary risk is eavesdropping, which is a confidentiality breach.

How to eliminate wrong answers

Option A is wrong because availability concerns uptime and access to resources, not interception; latency and packet loss on public Wi-Fi do not primarily compromise a security principle in this scenario. Option B is wrong because non-repudiation relates to proving the origin and integrity of a transaction, which is not the main issue when data is simply intercepted. Option D is wrong because while integrity could be threatened by tampering, the primary and most direct compromise in this scenario is confidentiality, as the data is exposed to eavesdropping.

Practice this question →

MCQhard

An organization's security policy states that users should have only the access needed to perform their job, and that access should be reviewed regularly. A database administrator currently retains full administrative rights to a finance application even though her role changed six months ago and no longer requires those rights. Which principle is being violated?

A.Least privilege

B.Defense in depth

C.Non-repudiation

D.Separation of duties

AnswerA

Least privilege means granting users the minimum access necessary for their current duties, and revoking rights when roles change. Retaining full administrative rights after a role change directly violates this principle. Regular access reviews exist precisely to catch such accumulation of unnecessary privileges, which increases the attack surface if the account is compromised.

Why this answer

Least privilege requires that accounts hold only the rights their current job demands, with periodic reviews to remove stale entitlements. The administrator's retained full rights after a role change is a textbook violation. This principle is foundational in NSE 1 security concepts and underpins identity and access management controls such as role-based access and recertification campaigns.

Exam trap

The trap here is selecting separation of duties because it also concerns access control, when the scenario actually describes unused excessive rights rather than divided responsibilities.

Practice this question →

MCQhard

An organization wants to enforce the Principle of Least Privilege for a new database containing sensitive customer records. Which user access configuration correctly implements this principle?

A.Share a single high-privileged service account credential among the entire team.

B.Grant read-only access to specific tables only for employees whose roles explicitly require that data.

C.Assign all department members permanent administrative rights to ensure uninterrupted workflow.

D.Provide full database access to all employees during onboarding, revoking it after one year.

AnswerB

Read-only access limited to specific tables satisfies least privilege by granting only the minimum permissions required for each role, rather than broad database or write access. This restricts employees to data their roles explicitly need, directly enforcing the principle within the sensitive customer records scenario.

Why this answer

Option B correctly implements the Principle of Least Privilege by granting only the minimum necessary access—read-only permissions to specific tables—and restricting it to employees whose roles explicitly require that data. This ensures users have no more privileges than needed to perform their job functions, reducing the attack surface and potential for data misuse. The granularity (specific tables) and read-only nature further limit exposure, aligning with the principle's core tenet of minimal rights.

Exam trap

The trap here is confusing least privilege with convenience or broad access, leading candidates to choose options that grant excessive rights (like full access or admin rights) under the guise of operational efficiency or onboarding simplicity.

How to eliminate wrong answers

Option A is wrong because sharing a single high-privileged service account violates least privilege by granting excessive, non-attributable access to all team members, increasing risk of credential compromise and insider threats. Option C is wrong because assigning permanent administrative rights to all department members grants far more privileges than necessary and fails to restrict access based on role requirements, directly contradicting least privilege. Option D is wrong because providing full database access to all employees during onboarding, even temporarily, violates least privilege by granting excessive rights unrelated to job needs, and the one-year revocation period is arbitrary and still exposes sensitive data unnecessarily.

Practice this question →

Multi-Selectmedium

Which TWO of the following actions should an end user take if they suspect their corporate credentials have been compromised? (Choose two)

Select 2 answers

A.Immediately notify the internal IT security or helpdesk team

B.Delete all files on the computer to erase evidence of the compromise

C.Post about the incident on public social media channels to warn friends

D.Change the password immediately from a secure, uncompromised device

E.Keep the incident secret to avoid getting in trouble with management

AnswersA, D

Reporting suspected compromise to IT security or the helpdesk triggers containment, such as session revocation and credential resets, limiting attacker dwell time. It satisfies the stem's requirement for an immediate end-user action following suspected credential compromise.

Why this answer

Option A is correct because promptly notifying the internal IT security or helpdesk team allows the organization to initiate incident response, such as revoking active sessions, resetting credentials, and checking for lateral movement or persistence mechanisms. Option D is correct because changing the password immediately from a secure, uncompromised device reduces the window in which an attacker can use the stolen credentials, and using a trusted device prevents malware or keyloggers from capturing the new password. Option B is not appropriate because deleting files destroys forensic evidence and does not remediate the credential compromise.

Option C is wrong because public social media disclosure can expose sensitive corporate information and does not follow proper incident reporting channels. Option E is wrong because concealing the incident delays response and increases the potential damage and scope of the compromise.

Exam trap

FORTINET-NSE123 often tests the misconception that users should 'clean up' or stay quiet — the correct behavior is always to report immediately and change credentials from a trusted device, never to delete evidence or hide the incident.

Practice this question →

MCQeasy

An employee notices their computer screen locked with a message demanding cryptocurrency payment to restore encrypted files. What type of malware has infected the workstation?

A.A rootkit that grants administrative privileges to remote attackers.

B.Ransomware that encrypts critical files and demands payment for access.

C.Adware that automatically displays unwanted promotional banners.

D.Spyware that covertly records keystrokes and captures screenshots.

AnswerB

Ransomware encrypts files and locks the screen with a payment demand, matching the reported symptoms exactly. The encryption of critical files plus the cryptocurrency extortion message is the defining behaviour, distinguishing it from other malware types that do not hold data hostage.

Why this answer

A locked screen displaying a cryptocurrency payment demand alongside encrypted files is the textbook signature of ransomware — malware that encrypts victim data and holds it hostage until a payment (often in Bitcoin or Monero) is made. The lock screen with payment instructions is the ransom note.

Exam trap

FORTINET-NSE123 often tests malware classification by symptom, so candidates who focus on 'screen locked' may wrongly pick rootkit or spyware instead of recognising the encryption-plus-ransom signature of ransomware.

How to eliminate wrong answers

Option A is wrong because a rootkit is designed for stealthy persistent privileged access, not for displaying a visible payment demand — rootkits hide themselves and typically leave no obvious screen message. Option C is wrong because adware displays unwanted advertisements or redirects browsers; it does not encrypt files or demand cryptocurrency. Option D is wrong because spyware covertly records keystrokes, screenshots, and credentials for exfiltration — it operates silently and never locks the screen with a payment demand.

Practice this question →

MCQmedium

An employee is designing a password for a new privileged system account. Which of the following practices represents the strongest password creation standard?

A.A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

B.A password reused from personal social media accounts to ensure easy recall

C.A long passphrase consisting of random unrelated words and special characters

D.A short word combined with the current year, such as 'Summer2026!'

AnswerC

A long passphrase of random unrelated words plus special characters maximises length and unpredictability, satisfying the stem's requirement for the strongest creation standard. Length defeats brute-force and cracking attacks far more effectively than short complex strings, which remain vulnerable to dictionary and hybrid attacks.

Why this answer

A long passphrase made of random unrelated words plus special characters maximizes length and entropy while remaining memorable, which is the strongest practice among the options. Length is the primary defense against brute-force and dictionary attacks, and random unrelated words defeat predictable patterns. This aligns with modern guidance from NIST SP 800-63B, which emphasizes length over complexity.

Exam trap

FORTINET-NSE123 often tests password best practices by presenting options that look complex but are predictable — candidates may pick 'Summer2026!' because it has complexity, but the trap is that pattern-based passwords are weak regardless of symbol inclusion.

How to eliminate wrong answers

Option A is wrong because keyboard sequences like 'qwertyuiop123!' are easily guessed by attackers using keyboard-walk dictionaries and provide low entropy despite length. Option B is wrong because reusing a password from personal social media creates a single point of failure; if that site is breached, the privileged account is compromised, and it violates the principle of unique credentials. Option D is wrong because 'Summer2026!' follows a predictable pattern (season + year + symbol) that cracking tools and password dictionaries specifically target, and it is too short.

Practice this question →

MCQmedium

A remote worker is using a public Wi-Fi hotspot to access company resources. Which configuration provides the best protection for their traffic?

A.Utilize a secure VPN tunnel to the corporate network.

B.Enable browser-based spell check.

C.Ensure the laptop firewall is turned off to allow easier connectivity.

D.Use an unencrypted FTP connection for file transfers.

AnswerA

A VPN tunnel encrypts all traffic between the remote worker and the corporate network, defeating interception on the untrusted hotspot. This satisfies the constraint of protecting data in transit over a hostile medium, since the hotspot operator can otherwise capture credentials and session data.

Why this answer

A secure VPN tunnel encrypts all traffic between the remote worker and the corporate network, protecting it from interception on an untrusted public Wi-Fi hotspot. This ensures confidentiality and integrity of company data even if the Wi-Fi network is compromised. The other options either do not provide encryption or actively weaken security.

Exam trap

The trap here is confusing basic hygiene measures (like spell check or firewall settings) with actual traffic protection; candidates might think any security feature helps, but only encryption via VPN addresses the risk of unsecured Wi-Fi.

How to eliminate wrong answers

Option B is wrong because browser spell check has no security function and does not protect traffic. Option C is wrong because disabling the laptop firewall removes a critical layer of host-based protection, increasing exposure to attacks. Option D is wrong because unencrypted FTP transmits credentials and data in cleartext, which can be easily captured on a public network.

Practice this question →

MCQhard

An attacker intercepts corporate communications by placing themselves between two communicating hosts, relaying messages and modifying them while both parties believe they are talking directly to each other. What is this attack called?

A.MAC flooding attack

B.Distributed denial of service

C.Man-in-the-Middle attack

D.SQL injection exploit

AnswerC

The attacker sits inline between two hosts, relaying and altering traffic while both endpoints believe they communicate directly. This active interception and modification of the session is precisely the man-in-the-middle mechanism described in the stem.

Why this answer

A Man-in-the-Middle (MitM) attack occurs when an adversary secretly intercepts and relays communications between two parties who believe they are communicating directly. The attacker can eavesdrop, modify, or inject data while remaining undetected, often by exploiting ARP spoofing, DNS poisoning, or rogue Wi-Fi access points. This matches the scenario of relaying and modifying messages between two hosts.

Exam trap

The trap is confusing attacks that enable eavesdropping (MAC flooding) with the actual interception-and-modification attack — candidates may pick MAC flooding because it's a Layer 2 attack that facilitates sniffing, but it does not itself relay and modify traffic.

How to eliminate wrong answers

Option A is wrong because a MAC flooding attack overwhelms a switch's CAM table to force it into hub-like flooding behavior, which can enable eavesdropping but is not itself the described relay-and-modify attack. Option B is wrong because a DDoS attack aims to exhaust resources and deny service, not to stealthily intercept and alter communications. Option D is wrong because SQL injection targets database-driven applications by injecting malicious SQL statements, not intercepting host-to-host communications.

Practice this question →

MCQeasy

An end user receives an email from a display name matching their company executive, urging them to immediately click a link and purchase gift cards for a client meeting. Which foundational security concept and immediate action should the user apply?

A.Forward the email to all colleagues as a warning, including the live clickable link.

B.Reply to the sender asking for clarification using the reply button.

C.Recognize the social engineering attempt and use the organization's phishing reporting tool.

D.Treat it as an urgent executive request and fulfill the purchase immediately.

AnswerC

The email exploits urgency and authority — classic pretexting — rather than any technical vulnerability, so the user must recognise the social engineering and report it through the organisation's phishing reporting tool, satisfying the stem's demand for both a concept and an immediate action.

Why this answer

The email is a classic business email compromise (BEC) or gift card scam, a form of social engineering. The user should recognize the attempt and report it via the organization's phishing reporting tool, which alerts security teams and helps prevent similar attacks.

Exam trap

FORTINET-NSE123 often tests social engineering awareness, and candidates may choose to reply or forward the email instead of reporting it, falling for the urgency trap.

How to eliminate wrong answers

Option A is wrong because forwarding the email with the live link to colleagues could spread the phishing attempt and cause others to click it. Option B is wrong because replying to the sender confirms the email address is active and may engage with the attacker. Option D is wrong because fulfilling the request would result in financial loss and is exactly what the attacker wants.

Practice this question →

Multi-Selecteasy

Which TWO of the following practices represent essential foundational habits for maintaining strong personal and corporate password security? (Choose two)

Select 2 answers

A.Writing passwords on a physical notepad kept inside a locked desk drawer

B.Reusing the same strong master password across all banking and work systems for ease of recall

C.Storing passwords in an encrypted password manager application

D.Changing passwords every single week regardless of whether a compromise is suspected

E.Using a unique, complex password for every individual account

AnswersC, E

An encrypted password manager stores credentials under a single strong master secret, so unique complex passwords become practical without memorisation or reuse. Encryption protects the vault if the device is lost, satisfying the scenario's requirement for a foundational password security habit.

Why this answer

Option C is correct because an encrypted password manager securely stores credentials using strong encryption (e.g., AES-256) behind a single master passphrase, enabling users to maintain many distinct, high-entropy passwords without memorizing them or writing them in plaintext. Option E is correct because using a unique, complex password for every account prevents credential-stuffing and lateral movement: if one site is breached, the reused secret cannot unlock other systems, which is a foundational habit for both personal and corporate security. Option A is not recommended because a written notepad, even in a locked drawer, stores passwords in plaintext and is vulnerable to physical access, theft, or insider snooping.

Option B is wrong because reusing one master password across banking and work systems creates a single point of failure, so one breach compromises every account. Option D is wrong because arbitrary weekly rotation without evidence of compromise encourages weaker, predictable passwords and is not aligned with modern guidance (e.g., NIST) that favors unique credentials and rotation only on suspected compromise.

Exam trap

The trap is selecting the 'change passwords frequently' option because it sounds like strong security hygiene — but modern guidance (NIST) explicitly rejects arbitrary rotation, and the exam tests whether candidates know current best practices versus legacy myths.

Practice this question →

MCQeasy

Which of the following scenarios describes a 'pretexting' social engineering attack?

A.An attacker leaves a malicious USB drive in the lobby.

B.An attacker uses automated software to guess passwords.

C.An attacker shoulder-surfs to capture a password.

D.An attacker poses as an auditor to convince an employee to disclose sensitive internal procedures.

AnswerD

Posing as an auditor fabricates a credible pretext, exploiting the employee's deference to authority to extract sensitive internal procedures. This satisfies the scenario's requirement for a fabricated identity and scenario that manipulates trust, distinguishing pretexting from phishing, baiting or quid pro quo attacks, which rely on different lures.

Why this answer

Pretexting is a social-engineering technique where the attacker invents a believable scenario or false identity (a pretext) to manipulate a victim into divulging information or performing an action. Posing as an auditor to convince an employee to disclose sensitive internal procedures is a textbook pretexting attack because it relies on a fabricated role and story to gain trust.

Exam trap

FORTINET-NSE123 often tests the distinction between pretexting (fabricated identity/scenario) and other social-engineering types like baiting, tailgating, or shoulder-surfing, which rely on physical or observational tactics.

How to eliminate wrong answers

Option A is wrong because leaving a malicious USB drive is baiting (a physical media drop attack), not pretexting — it exploits curiosity rather than a fabricated identity. Option B is wrong because automated password guessing is a brute-force/credential attack, a technical rather than social-engineering method. Option C is wrong because shoulder-surfing is observation-based eavesdropping to capture a password, which is a physical observation attack, not a pretext-based manipulation.

Practice this question →

Multi-Selectmedium

Which TWO of the following are considered 'social engineering' techniques?

Select 2 answers

A.Using a rainbow table to crack hashed passwords.

B.Baiting a victim with a 'free' USB drive that contains malware.

C.Tailgating into a secure office area by following an authorized employee.

D.Performing a denial of service attack on a web server.

E.Using a vulnerability scanner to find open ports.

AnswersB, C

Baiting exploits curiosity or greed, using a physical lure — here a malware-laden 'free' USB drive — to trick the victim into triggering infection. It manipulates human trust rather than exploiting a software flaw, which is the defining characteristic of social engineering.

Why this answer

Baiting a victim with a 'free' USB drive containing malware is a classic social engineering technique because it manipulates human curiosity or greed to trick the victim into physically connecting the malicious device, rather than exploiting a technical flaw. Tailgating into a secure office area by following an authorized employee is also social engineering, as it relies on the human tendency to hold doors open or avoid confrontation to bypass physical access controls. In contrast, using a rainbow table to crack hashed passwords is a technical cryptanalytic attack that exploits precomputed hash values, not human behavior.

A denial of service attack on a web server is a technical availability attack that floods resources, and using a vulnerability scanner to find open ports is a technical reconnaissance activity; neither depends on deceiving people.

Exam trap

The trap here is confusing technical attacks (like password cracking or DoS) with social engineering, which specifically involves manipulating people rather than systems.

Practice this question →

Multi-Selecthard

Which TWO strategies are recognized as effective defenses against social engineering attacks like phishing and pretexting? (Choose two.)

Select 2 answers

A.Conducting regular security awareness training and simulated phishing tests for all staff.

B.Implementing multi-factor authentication (MFA) to protect user accounts even if credentials are exposed.

C.Permitting unrestricted personal USB drive usage on all corporate endpoints without scanning.

D.Instructing employees to comply immediately with any urgent executive request received via personal email.

E.Disabling all spam and email filtering to ensure zero legitimate messages are ever delayed.

AnswersA, B

Regular security awareness training combined with simulated phishing tests directly targets the human element that technical controls cannot fully address. Repeated exposure to realistic pretexts builds pattern recognition, satisfying the stem's requirement for an effective social engineering defence by reducing the likelihood that staff disclose credentials or click malicious links.

Why this answer

Option A is correct because regular security awareness training combined with simulated phishing tests conditions staff to recognize pretexting and phishing lures, report suspicious messages, and avoid handing over credentials or sensitive data, directly reducing the human factor these attacks exploit. Option B is correct because MFA adds a second authentication factor beyond the password, so even if a phishing or pretexting attack captures valid credentials, the attacker cannot complete login without the additional factor (e.g., TOTP code, push approval, or FIDO2 key), breaking account takeover. Option C is wrong because unrestricted, unscanned personal USB drives enable malware introduction and data exfiltration, increasing rather than defending against social-engineering-driven compromise.

Option D is wrong because blindly complying with urgent executive requests via personal email is exactly the pretexting behavior attackers exploit; such requests must be verified through out-of-band channels. Option E is wrong because disabling spam and email filtering removes a key technical control that blocks phishing messages, making users more exposed to social engineering.

Exam trap

FORTINET-NSE123 often tests social engineering defenses, and candidates might select options that seem convenient but actually increase risk, such as disabling filters or trusting urgent requests.

Practice this question →

MCQhard

An internal auditor reviews network security logs and discovers that clear-text protocols such as Telnet and HTTP are actively used for managing core network devices. Which security principle is directly violated, and what is the recommended remediation?

A.Integrity is violated; remediation involves enabling packet checksum validation on all switches.

B.Non-repudiation is violated; remediation involves implementing digital signatures on email traffic.

C.Availability is violated; remediation involves upgrading uplink port speeds to 10Gbps.

D.Confidentiality is violated; remediation involves migrating to encrypted management protocols like SSH and HTTPS.

AnswerD

Telnet and HTTP transmit credentials and management data in clear text, so anyone capturing traffic can read them, breaching confidentiality. Migrating to SSH and HTTPS encrypts these sessions, directly satisfying the remediation the scenario requires.

Why this answer

Telnet and HTTP transmit data — including credentials and management commands — in clear text, meaning anyone with network visibility (packet capture, span port, MITM) can read them. This directly violates confidentiality, the security principle ensuring data is only accessible to authorized parties. The correct remediation is migrating to encrypted equivalents: SSH replaces Telnet, and HTTPS (TLS) replaces HTTP.

Exam trap

The trap is that candidates confuse the CIA triad pillars — clear-text protocols are almost always a confidentiality violation, but candidates sometimes pick integrity because they think 'tampering' is the main risk, when the primary exposure is unauthorized reading.

How to eliminate wrong answers

Option A is wrong because integrity concerns unauthorized modification, not unauthorized reading — checksum validation doesn't hide clear-text credentials from a sniffer. Option B is wrong because non-repudiation concerns proving who performed an action (digital signatures, audit trails), which is unrelated to clear-text transmission. Option C is wrong because availability concerns uptime and access to resources; upgrading uplink speeds does nothing to protect credentials exposed in clear text.

Practice this question →

MCQhard

An organization wants to prevent users from visiting malicious websites identified in real-time by a threat intelligence database. Which feature is most effective for this?

A.MAC address filtering on the local switch.

B.Local static IP filtering.

C.Dynamic URL filtering with reputation-based feeds.

D.Disabling cookies in the browser.

AnswerC

Reputation-based dynamic URL filtering consults real-time threat intelligence feeds, blocking newly identified malicious sites at the point of request rather than relying on static categories. This satisfies the stem's requirement for real-time identification by a threat intelligence database.

Why this answer

Dynamic URL filtering with reputation-based feeds queries real-time threat intelligence databases (such as FortiGuard web filter rating service) to classify URLs and block malicious sites as they are identified. This provides up-to-date protection against newly discovered malicious domains, unlike static lists. Local static IP filtering and MAC filtering cannot keep pace with rapidly changing malicious URLs.

Exam trap

FORTINET-NSE123 often tests the misconception that static IP or MAC filtering can substitute for dynamic URL reputation filtering — candidates may choose local static IP filtering thinking it blocks malicious sites, but it cannot adapt to real-time threat intelligence.

How to eliminate wrong answers

Option A is wrong because MAC address filtering operates at Layer 2 and only permits/denies specific hardware addresses; it cannot identify malicious websites by URL or reputation. Option B is wrong because local static IP filtering relies on manually maintained IP lists and cannot dynamically track malicious domains that change IPs or use CDNs. Option D is wrong because disabling cookies in the browser is a client-side privacy measure, not a network security control, and does nothing to block malicious sites at the gateway.

Practice this question →

MCQeasy

An employee receives a phone call from an individual claiming to be from the IT department, asking for their network password to resolve an urgent system ticket. The caller sounds professional and urgent. What best describes this type of attack?

A.Drive-by download

B.Denial of service

C.Phishing via email

D.Vishing (Voice Phishing)

AnswerD

Vishing is voice-based social engineering conducted over a phone call, where the attacker impersonates IT staff and leverages urgency to extract credentials. This matches the scenario precisely, distinguishing it from email-based phishing or SMS-based smishing.

Why this answer

Vishing (voice phishing) is the correct answer because the attack is delivered over a phone call, where the attacker impersonates IT staff and uses urgency to extract credentials. This is a social-engineering technique that exploits human trust rather than a technical vulnerability. The phone channel is the defining characteristic that separates vishing from email-based phishing.

Exam trap

FORTINET-NSE123 often tests the distinction between delivery channels in social-engineering attacks — candidates see 'phishing' and pick the email option without noticing the scenario specifies a phone call, which makes it vishing.

How to eliminate wrong answers

Option A is wrong because a drive-by download is a malicious file or script that installs automatically when a user visits a compromised or malicious website — no phone call is involved. Option B is wrong because a denial of service (DoS) attack floods a system or network with traffic to make it unavailable, which is an availability attack, not a credential-theft social-engineering attack. Option C is wrong because phishing via email uses fraudulent email messages to trick recipients into clicking links or revealing data; the scenario explicitly involves a phone call, not email.

Practice this question →

MCQeasy

An attacker intercepts legitimate communication between two parties and alters the message content while impersonating each party to the other. What type of cyber attack has occurred?

A.A man-in-the-middle attack intercepting and modifying transit data.

B.A distributed denial-of-service attack flooding servers.

C.A zero-day exploit leveraging unpatched software code.

D.A brute-force attack guessing login credentials.

AnswerA

A man-in-the-middle attack places the adversary between two communicating parties, relaying traffic while impersonating each endpoint. The attacker can read and alter message content in transit, matching the stem's description of modified messages and mutual impersonation.

Why this answer

A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, intercepting and potentially altering traffic while each side believes they are talking directly to the other. The scenario describes exactly this: interception plus modification plus mutual impersonation. This is the defining triad of MITM — confidentiality and integrity of the session are both compromised.

Exam trap

The trap is that candidates see 'impersonating' and think phishing or spoofing, but the key differentiator is that the attacker sits in the middle of an active session and modifies data in transit — that is MITM, not phishing.

How to eliminate wrong answers

Option B is wrong because a DDoS attack aims to exhaust availability by flooding a target with traffic, not to intercept or modify communications between two parties. Option C is wrong because a zero-day exploit abuses an undisclosed software vulnerability to execute code or escalate privileges — the scenario describes no software flaw, only traffic interception. Option D is wrong because brute-force attacks systematically guess credentials; here the attacker never guesses anything, they insert themselves into an already-authenticated session.

Practice this question →

MCQmedium

During a security awareness training session, an administrator explains how attackers use pretexting. Which scenario best exemplifies a pretexting attack?

A.An attacker installs a keylogger on an unattended physical workstation in an office.

B.An attacker floods a web server with synthetic traffic to crash the service.

C.An attacker calls the helpdesk posing as a new executive claiming to have lost their password, requesting a reset.

D.An attacker sends mass emails containing a malicious macro-enabled attachment.

AnswerC

Pretexting relies on a fabricated identity and scenario to manipulate the victim into complying. Posing as a new executive who lost their password exploits authority and urgency, pressuring the helpdesk into an unauthorised reset. The invented backstory is the pretext, satisfying the scenario's requirement for a social-engineering ruse rather than technical exploitation.

Why this answer

Pretexting is a social engineering technique where the attacker invents a believable scenario (the pretext) to manipulate a victim into divulging information or performing an action. The helpdesk call impersonating a new executive who lost their password is a classic pretext — the attacker leverages authority and urgency to obtain a password reset. This relies on human trust and process gaps rather than technical exploits.

Exam trap

FORTINET-NSE123 often tests the boundary between pretexting and phishing, causing candidates to choose mass-email scenarios when the question specifically describes a fabricated identity or scenario used to manipulate a specific target.

How to eliminate wrong answers

Option A is wrong because installing a keylogger on an unattended workstation is a physical/technical attack (sometimes called baiting or physical intrusion), not pretexting — no fabricated scenario is used to manipulate a person. Option B is wrong because flooding a web server with synthetic traffic is a Denial-of-Service (DoS/DDoS) attack, which is purely technical and involves no social manipulation. Option D is wrong because mass emails with malicious macro attachments describe phishing (specifically a macro-based phishing campaign), which is a broader category; pretexting is a distinct technique focused on a fabricated identity/scenario, not mass email delivery.

Practice this question →

Multi-Selecthard

Which TWO mechanisms are commonly utilized by attackers to establish persistence on a compromised workstation so they can retain access after a system reboot? (Choose two.)

Select 2 answers

A.Running a temporary calculation script inside an isolated browser incognito tab.

B.Running an optional software update diagnostic tool provided by the hardware manufacturer.

C.Installing a kernel-level rootkit that hooks into core operating system processes.

D.Clearing the system browser cache and emptying the local operating system recycle bin.

E.Modifying operating system startup registry keys or creating automated scheduled tasks.

AnswersC, E

A kernel-level rootkit hooks core operating system processes, so it loads before or alongside the kernel and survives reboots, giving attackers persistent privileged access. This satisfies the requirement for a mechanism retaining access after a system restart.

Why this answer

Option C is correct because a kernel-level rootkit loads at boot, hooks into core OS processes, and hides itself from normal detection, giving the attacker durable privileged access that survives reboots. Option E is correct because modifying startup registry keys (e.g., Run/RunOnce keys) or creating scheduled tasks causes attacker code to execute automatically each time the system starts or a trigger fires, a classic persistence technique. Option A is not persistence: an incognito browser tab is temporary and isolated, and closing the browser or rebooting destroys it.

Option B is not persistence: a legitimate manufacturer diagnostic tool is a benign utility, not an attacker mechanism. Option D is not persistence: clearing the browser cache and recycle bin removes data and does not create any recurring execution or access.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse cleanup actions (clearing cache, emptying recycle bin) with true persistence mechanisms — the exam expects you to recognize that persistence specifically means surviving a reboot.

Practice this question →

Multi-Selectmedium

Which TWO methods are effective ways to protect user accounts against credential-based attacks like credential stuffing and brute-forcing? (Choose two)

Select 2 answers

A.Permitting HTTP plaintext transmission for login forms to speed up authentication.

B.Allowing users to share identical passwords to reduce password fatigue.

C.Implementing account lockout policies after a threshold of failed login attempts.

D.Enforcing Multi-Factor Authentication (MFA) across all authentication portals.

E.Disabling logging mechanisms to prevent server storage bloat.

AnswersC, D

Account lockout thresholds halt repeated authentication attempts after a set number of failures, rendering automated brute-force and credential-stuffing runs ineffective. This directly satisfies the constraint of defending user accounts against high-volume credential-based attacks without relying on password complexity alone.

Why this answer

Option C is correct because an account lockout policy that triggers after a defined threshold of failed login attempts (e.g., 5 attempts) blocks automated brute-force and credential-stuffing tools from making unlimited password guesses, throttling the attack and protecting the account. Option D is correct because enforcing Multi-Factor Authentication (MFA) across all authentication portals adds a second verification factor beyond the password, so even valid credentials obtained from credential stuffing or brute-forcing cannot alone grant access. Option A is wrong because permitting HTTP plaintext transmission exposes credentials to interception and does not defend against credential-based attacks.

Option B is wrong because allowing identical shared passwords increases the blast radius of credential stuffing and worsens password fatigue risks. Option E is wrong because disabling logging removes the audit trail needed to detect and respond to brute-force or credential-stuffing attempts.

Exam trap

FORTINET-NSE123 often tests the misconception that password complexity or frequent rotation alone stops credential attacks, when the real defenses are lockout thresholds and MFA that neutralize reused or guessed passwords.

Practice this question →

MCQeasy

An IT administrator creates complex password policies requiring a mix of uppercase, lowercase, numbers, and special characters. Which security objective does this practice primarily support?

A.Preventing structured SQL injection attacks against web databases.

B.Mitigating brute-force and credential-guessing attacks.

C.Preventing physical theft of laptop hardware.

D.Ensuring high network bandwidth availability for video conferencing.

AnswerB

Complex character requirements expand the search space an attacker must exhaust, directly raising the cost of brute-force and dictionary-based credential guessing. This satisfies the stem's constraint of complex password policies, since length and character diversity together determine resistance to exhaustive guessing rather than any single composition rule alone.

Why this answer

Complex password policies increase the search space an attacker must cover, making brute-force and credential-guessing attacks computationally expensive. Requiring uppercase, lowercase, digits, and special characters raises the number of possible combinations per character position, so even a short password becomes far harder to crack. The objective is to slow down or defeat automated guessing, not to address application-layer or physical threats.

Exam trap

The trap is confusing authentication hardening (password complexity) with application-layer defenses (SQL injection) or physical controls, because all are 'security' topics and the wrong answers sound plausible at a glance.

How to eliminate wrong answers

Option A is wrong because SQL injection is mitigated by parameterized queries, input validation, and WAF rules — password complexity has no bearing on how a database parses malicious SQL. Option C is wrong because physical laptop theft is addressed by full-disk encryption, cable locks, and asset tracking, not by password character requirements. Option D is wrong because network bandwidth for video conferencing is a QoS and capacity concern, entirely unrelated to authentication policy.

Practice this question →

Multi-Selecteasy

Which TWO of the following behaviors are recommended when handling unexpected or suspicious email attachments? (Choose two)

Select 2 answers

A.Forward suspicious attachments to all coworkers to see if anyone recognizes them

B.Immediately open executable attachments (.exe) to check what program they run

C.Refrain from opening files with double extensions like .pdf.exe or unexpected script formats

D.Verify the legitimacy of the attachment by contacting the sender through an independent, trusted communication channel

E.Disable your antivirus software temporarily so it does not block the file download

AnswersC, D

Double extensions such as .pdf.exe exploit Windows' habit of hiding the final extension, so the file executes as a program rather than opening as a document. Refraining from opening these, and unexpected script formats, satisfies the stem's requirement to handle suspicious attachments safely before any sandbox or antivirus inspection occurs.

Why this answer

Option C is correct because files with double extensions such as .pdf.exe or unexpected script formats (.js, .vbs, .ps1) are classic malware-delivery tricks that exploit Windows' hiding of known file extensions, so refraining from opening them prevents execution of a disguised payload. Option D is correct because verifying the attachment's legitimacy via an independent, trusted channel (e.g., a phone call or a separate known email address) confirms the sender actually intended to send the file and defeats spoofed or compromised-account attacks. Option A is wrong because forwarding suspicious attachments to coworkers propagates potential malware and phishing to others instead of reporting it to IT/security.

Option B is wrong because opening .exe attachments directly executes untrusted code, which is exactly how ransomware and trojans are installed. Option E is wrong because disabling antivirus removes a key detection layer and increases the risk that the malicious file is downloaded and run.

Exam trap

The trap is that some options sound like 'due diligence' (forwarding to coworkers, opening to check) but actually increase risk; candidates must distinguish between actions that verify safety through trusted channels versus actions that interact with the payload.

Practice this question →

MCQhard

A user reports that their workstation is running unusually slow and sending out large amounts of encrypted traffic to an unknown external IP. What is the most likely issue?

A.The user installed a legitimate browser extension.

B.The user's local firewall is performing a full system scan.

C.The system is performing a routine background update.

D.The host is infected with malware and participating in a botnet.

AnswerD

Sustained slowness plus large volumes of encrypted traffic to an unknown external IP indicate command-and-control beaconing and participation in a botnet, where malware encrypts its channel to evade inspection. This combination distinguishes botnet infection from ordinary hardware or application performance problems.

Why this answer

The combination of a slow workstation, large volumes of encrypted outbound traffic to an unknown external IP, and no legitimate business justification is a textbook indicator of malware command-and-control (C2) beaconing or botnet participation. Malware commonly encrypts its traffic (TLS/custom crypto) to evade deep packet inspection and blends into normal HTTPS flows. The host is likely part of a botnet performing DDoS, spam relay, or crypto-mining tasks, which explains both the CPU/performance degradation and the sustained encrypted egress.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish benign high-bandwidth activity (updates, backups, extensions) from malicious beaconing by focusing on the destination reputation and encryption pattern rather than just the volume of traffic.

How to eliminate wrong answers

Option A is wrong because a legitimate browser extension does not generate sustained large volumes of encrypted traffic to an unknown external IP, nor would it typically cause system-wide slowness. Option B is wrong because a local firewall full system scan is a local, CPU/disk-bound activity that does not produce large outbound encrypted flows to a remote IP. Option C is wrong because routine background updates go to known vendor endpoints (Microsoft, Apple, etc.) over predictable schedules and would not present as an unknown external IP with continuous encrypted traffic.

Practice this question →

Multi-Selecteasy

Which THREE of the following actions represent safe habits when using public Wi-Fi hotspots? (Choose three)

Select 3 answers

A.Conducting personal online banking without checking for HTTPS or using a VPN

B.Disabling automatic connection to open Wi-Fi networks on your mobile device

C.Accepting all unknown certificate warnings when browsing on public hotspots

D.Using a trusted corporate Virtual Private Network (VPN) for all internet traffic

E.Avoiding access to highly sensitive corporate accounts unless an encrypted tunnel is active

AnswersB, D, E

Disabling auto-connect stops the device silently joining rogue or spoofed hotspots broadcasting familiar SSIDs. This removes the opportunity for an attacker to intercept traffic without the user's deliberate action, directly satisfying the safe-habit requirement for public Wi-Fi use.

Why this answer

Option B is correct because disabling automatic connection to open Wi-Fi networks prevents a mobile device from silently joining rogue or evil-twin hotspots that spoof a legitimate SSID, thereby removing an attacker's opportunity to intercept traffic. Option D is correct because a trusted corporate VPN establishes an encrypted tunnel (e.g., IPsec or TLS-based) that protects all internet traffic from eavesdropping and man-in-the-middle manipulation on an untrusted hotspot. Option E is correct because restricting access to highly sensitive corporate accounts to situations where an encrypted tunnel is active ensures credentials and session data are never exposed over the open, unencrypted wireless medium.

Option A is not safe because banking without verifying HTTPS or using a VPN exposes credentials and session cookies to interception. Option C is not safe because accepting unknown certificate warnings enables man-in-the-middle attacks by trusting a fraudulent certificate.

Exam trap

The trap is that some options sound convenient or harmless (like banking without checking HTTPS), but any action that skips encryption or certificate validation on public Wi-Fi is unsafe.

Practice this question →

Multi-Selectmedium

Which TWO actions should an end-user take to protect their physical workstation security?

Select 2 answers

A.Disable the screensaver to ensure the system is always visible.

B.Store sensitive documents in a locked drawer when not in use.

C.Leave the workstation unlocked during lunch breaks to save time.

D.Write the BIOS password on a post-it note attached to the monitor.

E.Lock the computer screen before walking away from the desk.

AnswersB, E

A locked drawer provides a physical access control barrier, preventing unauthorised individuals from reading, photographing or removing sensitive documents left on a desk. This addresses the physical security requirement by removing exposed hardcopy data from the immediate reach of visitors or intruders.

Why this answer

Option B is correct because physically securing sensitive documents in a locked drawer when they are not in use prevents unauthorized individuals from reading, photographing, or removing confidential information, which is a core element of physical workstation security. Option E is correct because locking the computer screen before walking away (e.g., via Windows+L or Ctrl+Alt+L on Linux) enforces access control at the session level, ensuring that an unattended workstation cannot be used by someone passing by. The unmarked options do not belong: disabling the screensaver (A) leaves the display exposed and removes a basic lock trigger, leaving the workstation unlocked during lunch (C) invites unauthorized access, and writing the BIOS password on a post-it note on the monitor (D) directly defeats the purpose of that password by exposing it to anyone nearby.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse physical security best practices with convenience habits, so options that sound time-saving (leaving unlocked, disabling screensaver) are the traps.

Practice this question →

Multi-Selecthard

Which THREE practices represent fundamental cybersecurity hygiene for end users to protect corporate endpoints? (Choose three)

Select 3 answers

A.Storing master credentials in a plain-text document on the desktop for quick reference.

B.Promptly installing operating system and application security patches.

C.Disabling endpoint antivirus agents to maximize system performance during video calls.

D.Verifying software legitimacy before downloading and installing third-party applications.

E.Locking the workstation screen whenever stepping away from the desk.

AnswersB, D, E

Prompt patching closes known vulnerabilities in operating systems and applications before attackers can exploit them, removing a primary endpoint compromise vector. It satisfies the stem's hygiene requirement by keeping corporate endpoints current against published threats.

Why this answer

Option B is correct because promptly installing operating system and application security patches closes known vulnerabilities (e.g., CVEs) that attackers actively exploit, making patch management a core endpoint hygiene practice. Option D is correct because verifying software legitimacy before downloading and installing third-party applications prevents malware, trojans, and supply-chain compromises introduced via untrusted or spoofed sources. Option E is correct because locking the workstation screen whenever stepping away enforces access control, preventing unauthorized physical use of an authenticated session and mitigating insider or walk-by threats.

Option A is not acceptable hygiene because storing master credentials in plain text on the desktop exposes them to any local user or malware, violating secure credential handling. Option C is not acceptable because disabling endpoint antivirus agents removes malware detection and response capabilities, trading essential protection for marginal performance gains.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish genuine hygiene practices from convenience-driven anti-patterns like disabling antivirus or storing plain-text credentials, which are always wrong.

Practice this question →

MCQmedium

A company's security team notices a sudden spike in authentication failures for many user accounts within a short window, followed by successful logins from unfamiliar geographic locations using valid credentials. Which attack best matches this pattern?

A.A brute-force attack guessing random passwords for a single account

B.A man-in-the-middle attack intercepting session tokens

C.Credential stuffing using passwords leaked from another breach

D.A password spray using a small set of common passwords across many accounts

AnswerC

Credential stuffing takes username and password pairs stolen from one service and replays them against other services, producing many failed attempts followed by occasional successes. The unfamiliar locations and valid credentials fit this pattern because attackers automate logins from distributed sources, succeeding wherever users reused passwords across sites.

Why this answer

The combination of widespread authentication failures and subsequent successes using valid credentials from unfamiliar locations is characteristic of credential stuffing. Attackers replay breached username-password pairs across services, capitalizing on password reuse. Defenses include multi-factor authentication, breached-password screening, and monitoring for anomalous login patterns—topics covered in NSE 1 foundational security awareness.

Exam trap

The trap here is confusing credential stuffing with password spraying, since both cause many failures, but stuffing relies on previously breached valid pairs while spraying uses a few common guesses.

Practice this question →

MCQmedium

An organization wants to educate its employees on how to recognize sophisticated spear-phishing emails that use personalized details gathered from public professional networks. Which training approach is most effective for building practical resilience?

A.Blocking all external incoming emails entirely

B.Conducting regular simulated phishing tests with immediate feedback

C.Restricting employees from having LinkedIn or social media accounts

D.Requiring employees to read a 100-page security policy manual annually

AnswerB

Simulated phishing tests with immediate feedback give employees direct, repeated practise identifying personalised lures, converting awareness into recognition behaviour. This satisfies the stem's goal of practical resilience against spear-phishing that exploits public professional-network details, unlike passive briefings that build knowledge without applied detection skill.

Why this answer

Regular simulated phishing tests with immediate feedback build practical resilience by exposing employees to realistic lures and teaching them in the moment how to recognize and report them. This active, repetitive training reinforces behavior better than passive reading. Spear-phishing uses personalized details, so hands-on practice with similar scenarios is the most effective way to develop skepticism and verification habits.

Exam trap

The trap is choosing extreme technical controls (blocking all email, banning social media) over practical, behavior-focused training that actually builds user resilience.

How to eliminate wrong answers

Option A is wrong because blocking all external email is operationally impossible and would halt legitimate business communication; it also fails to teach users how to handle threats that bypass filters. Option C is wrong because restricting social media accounts is an unrealistic privacy infringement and does not address the root cause — user judgment — while attackers can still gather data from other sources. Option D is wrong because reading a lengthy manual annually is passive and has poor retention; it does not provide the interactive reinforcement needed to recognize sophisticated lures.

Practice this question →

Multi-Selecthard

Which THREE of the following statements accurately describe foundational security principles in enterprise environments? (Choose three)

Select 3 answers

A.System administrators should always share a single root account password to ensure accountability

B.The principle of least privilege ensures users and accounts are granted only the minimum access needed

C.Separation of duties ensures that critical, high-risk tasks require involvement from multiple people

D.Security through obscurity should be used as the primary defense mechanism for databases

E.Defense in depth relies on deploying multiple overlapping security layers rather than a single defense

AnswersB, C, E

Least privilege directly limits each user and account to the minimum access required for their role, reducing the blast radius of compromised credentials. This satisfies the stem's requirement for a foundational principle governing entitlement scope, distinct from separation of duties, which instead splits high-risk tasks across multiple people.

Why this answer

Option B is correct because the principle of least privilege dictates that users, processes, and accounts receive only the minimum permissions necessary to perform their required tasks, which limits the blast radius of compromised credentials or insider misuse. Option C is correct because separation of duties splits critical, high-risk functions across multiple people so that no single individual can complete a sensitive action alone, reducing fraud and error risk. Option E is correct because defense in depth layers multiple overlapping controls (for example, firewalls, IDS/IPS, endpoint protection, MFA, and encryption) so that failure of one control does not expose the whole environment.

Option A is wrong because sharing a single root password destroys accountability and non-repudiation; each administrator needs a unique, auditable account with sudo or equivalent privilege escalation. Option D is wrong because security through obscurity is a weak supplementary measure, not a primary defense; databases must be protected by strong authentication, encryption, patching, and access controls rather than hidden names or ports.

Exam trap

The trap is that options A and D sound plausible to some candidates (shared root for accountability, obscurity for databases), but they are actually security anti-patterns; the exam expects you to identify the true principles.

Practice this question →

MCQmedium

A company's security team wants to reduce the damage an attacker could cause if a single employee account is compromised. They decide that every employee should have only the access needed to perform their daily job, and no more. Which security principle are they applying?

A.Defense in depth

B.Least privilege

C.Non-repudiation

D.Separation of duties

AnswerB

Least privilege means granting users only the minimum access required for their job functions. By ensuring each employee has just enough access for daily tasks, the company limits what a compromised account can reach, reducing blast radius. This principle is central to Fortinet NSE 1 security concepts and directly addresses the goal of containing damage from a single compromised credential.

Why this answer

Least privilege restricts each account to only the permissions required for its role, so a compromised credential exposes far less data and fewer systems. This directly reduces the potential impact of a single account takeover. Other principles such as separation of duties, defense in depth, and non-repudiation address different risks, including fraud, layered protection, and accountability, rather than minimizing per-account access.

Exam trap

The trap here is confusing least privilege with separation of duties, since both limit what one person can do, but only least privilege is about minimizing each account's granted permissions.

Practice this question →

MCQhard

An IT auditor is reviewing network access controls and discovers that guest Wi-Fi users are placed on the same subnet as internal corporate workstations without any traffic isolation. Which security principle has been violated?

A.Cryptographic salting

B.Symmetric encryption

C.Network segmentation

D.Non-repudiation verification

AnswerC

Placing guest Wi-Fi users and internal workstations on one subnet without isolation removes the boundary between untrusted and trusted zones. Network segmentation requires separating such groups via VLANs, ACLs or firewalls, so its absence directly violates that principle.

Why this answer

Network segmentation is the practice of dividing a network into isolated segments (e.g., guest, internal, DMZ) to control traffic flow and limit lateral movement. Placing guest Wi-Fi users on the same subnet as internal workstations without isolation violates this principle, as guests could potentially access internal resources. The correct answer is network segmentation.

Exam trap

The trap is that the scenario mentions 'same subnet' and 'no traffic isolation,' which clearly points to segmentation, but candidates may be distracted by cryptographic terms (salting, encryption) that are irrelevant to network access control.

How to eliminate wrong answers

Option A is wrong because cryptographic salting is a password hashing technique, unrelated to network access controls. Option B is wrong because symmetric encryption is a data confidentiality method, not a network segmentation principle. Option D is wrong because non-repudiation verification ensures that a party cannot deny sending a message, typically using digital signatures; it does not address network isolation.

Practice this question →

Multi-Selecteasy

Which TWO characteristics describe effective password management principles? (Choose two.)

Select 2 answers

A.Changing passwords every single week regardless of whether any compromise indicators exist.

B.Writing down primary administrator passwords on sticky notes attached to computer monitors.

C.Using a password manager to generate and store complex, unique passwords securely.

D.Reusing the same strong password across all personal and professional accounts for convenience.

E.Employing long passphrases that combine multiple random words for high entropy and memorability.

AnswersC, E

A password manager generates and stores complex, unique credentials per service, satisfying the uniqueness constraint without requiring memorisation. This eliminates credential reuse and weak patterns, directly embodying effective password management by centralising secure storage behind a single strong master passphrase.

Why this answer

Option C is correct because a password manager generates high-entropy, unique credentials for every account and stores them in an encrypted vault, eliminating password reuse and reducing the burden of memorization. Option E is correct because long passphrases built from multiple random words provide high entropy (each additional word multiplies the search space) while remaining memorable, making them resistant to brute-force and dictionary attacks. Option A is wrong because forced weekly rotation without evidence of compromise leads to weaker, predictable passwords and is no longer recommended by standards such as NIST SP 800-63B.

Option B is wrong because writing administrator passwords on sticky notes exposes credentials to anyone with physical or visual access, defeating confidentiality. Option D is wrong because reusing one password across accounts enables credential-stuffing attacks, where a single breach compromises every account sharing that password.

Exam trap

The trap is that candidates equate 'changing passwords often' with security, but modern guidance (NIST 800-63B) explicitly rejects forced frequent rotation — the exam tests whether you know the current best practice, not the legacy one.

Practice this question →

Multi-Selectmedium

Which TWO behaviors are recognized indicators that an incoming email may be a phishing attempt? (Choose two)

Select 2 answers

A.The message conveys extreme urgency and threatens negative consequences if action is not taken immediately.

B.The message includes a link to the corporate intranet home page via the internal DNS domain.

C.The sender email address domain subtly differs from the legitimate organization's domain name.

D.The email is addressed specifically to your correct full corporate title and department.

E.The email contains standard company newsletter updates sent through an official mailing platform.

AnswersA, C

Urgency combined with threats of negative consequences is a recognised social-engineering indicator, exploiting time pressure to bypass scrutiny. This satisfies the stem's requirement for behavioural phishing indicators, as attackers rely on fear to compel victims into clicking links or disclosing credentials before they verify the sender's authenticity.

Why this answer

Option A is correct because social-engineering phishing relies on urgency and threats (e.g., account suspension, legal action, or loss of access) to pressure the recipient into acting before verifying the request. Option C is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are classic spoofing indicators used to impersonate a trusted sender. Options B, D, and E are not indicators: an internal intranet link on the corporate DNS domain, accurate addressing to your real title and department, and legitimate newsletters from an official mailing platform are all consistent with normal, benign email.

Exam trap

FORTINET-NSE123 often tests the difference between normal business communication and actual phishing indicators, tricking candidates into selecting options that describe legitimate or personalized emails as suspicious.

Practice this question →

MCQmedium

An enterprise network team notices that internal workstations are periodically querying known malicious command-and-control (C2) domains. However, direct external DNS queries are blocked. How might an advanced malware strain attempt to resolve these domains?

A.By relying exclusively on local ARP tables

B.By broadcasting requests via local Bluetooth signals

C.By converting domain names into physical print jobs

D.By leveraging alternative public DNS resolvers or DNS-over-HTTPS (DoH)

AnswerD

With direct external DNS blocked, malware can bypass internal resolvers by sending queries to public resolvers or tunnelling DNS inside HTTPS to DoH endpoints, evading port 53 inspection. This satisfies the stem's constraint that direct external DNS queries are blocked.

Why this answer

Advanced malware can bypass blocked external DNS by using alternative public DNS resolvers or DNS-over-HTTPS (DoH), which encrypts DNS queries inside HTTPS traffic on port 443. This makes the malicious domain resolution blend with normal web traffic and evade traditional DNS filtering. DoH in particular is designed to prevent eavesdropping and manipulation, but attackers abuse it to hide C2 communications.

Exam trap

FORTINET-NSE123 often tests whether candidates recognize that DNS filtering can be evaded by encrypted DNS protocols, and distractors focus on irrelevant Layer 2 or physical technologies.

How to eliminate wrong answers

Option A is wrong because ARP tables only map IP addresses to MAC addresses on the local segment and cannot resolve domain names. Option B is wrong because Bluetooth is a short-range personal area network technology and is not used for internet domain resolution. Option C is wrong because converting domain names into print jobs is nonsensical; printers do not resolve DNS for malware C2.

Practice this question →

MCQmedium

A network administrator is setting up a corporate policy to prevent unauthorized internal users from sniffing traffic passing through a shared network segment. Which fundamental security principle is being addressed by implementing encrypted communication protocols like HTTPS and SSH?

A.Integrity

B.Confidentiality

C.Availability

D.Non-repudiation

AnswerB

HTTPS and SSH encrypt payloads in transit, so a user sniffing packets on the shared segment sees ciphertext rather than credentials or data. Confidentiality is the principle ensuring information is disclosed only to authorised parties, which encryption directly enforces against passive interception.

Why this answer

Encrypting communication protocols like HTTPS and SSH ensures that data in transit is protected from unauthorized eavesdropping. This directly addresses the security principle of confidentiality, which ensures that information is not disclosed to unauthorized individuals. By encrypting traffic, even if an attacker sniffs the shared network segment, they cannot read the contents.

Exam trap

FORTINET-NSE123 often tests the mapping of security controls to CIA triad principles; candidates might choose integrity because encryption also provides integrity checks, but the primary goal of preventing sniffing is confidentiality.

How to eliminate wrong answers

Option A is wrong because integrity ensures data is not altered, which encryption also helps with but is not the primary principle addressed by preventing sniffing. Option C is wrong because availability ensures systems and data are accessible when needed, not related to eavesdropping prevention. Option D is wrong because non-repudiation ensures that a party cannot deny sending a message, typically achieved via digital signatures, not encryption alone.

Practice this question →

Multi-Selecthard

Which THREE of the following practices help protect end-user devices (endpoints) from malware and compromise? (Choose three)

Select 3 answers

A.Exercising caution when clicking links or downloading files from untrusted sources

B.Running reputable, centralized endpoint security software (antivirus/EDR)

C.Downloading cracked software and keygens from peer-to-peer file-sharing networks

D.Disabling all firewall rules and network logging to maximize system performance

E.Keeping operating systems and application software patched and up to date

AnswersA, B, E

User behaviour is the primary control here: avoiding untrusted links and downloads blocks the delivery vector that most malware relies on, satisfying the stem's requirement to protect endpoints from compromise. Technical controls alone cannot stop a user who authorises execution, so this practise directly reduces initial infection risk.

Why this answer

Option A is correct because user caution against clicking links or downloading files from untrusted sources directly reduces the most common initial infection vectors, such as phishing emails, malicious attachments, and drive-by downloads. Option B is correct because reputable, centralized endpoint security software (antivirus/EDR) detects, blocks, and remediates malware, and central management ensures consistent policy enforcement and timely signature/behavioral updates across all endpoints. Option E is correct because keeping operating systems and applications patched and up to date closes known vulnerabilities that malware and attackers actively exploit, including remote code execution and privilege escalation flaws.

Option C is not correct because cracked software and keygens from peer-to-peer networks are a well-known malware delivery method and directly increase compromise risk. Option D is not correct because disabling firewall rules and network logging removes preventive and detective controls, weakening endpoint protection and hindering incident response.

Exam trap

FORTINET-NSE123 often tests the misconception that a single control (like antivirus alone) is sufficient, when the correct answer requires a layered approach combining user behavior, endpoint software, and patching.

Practice this question →

MCQeasy

An end user receives an alert that their browser has blocked a potentially malicious website that tried to automatically download an executable file without user interaction. What term describes this type of silent threat?

A.Drive-by download

B.Physical shoulder surfing

C.Social engineering phone call

D.Email phishing scam

AnswerA

A drive-by download is the automatic, unconsented download of malicious code triggered simply by visiting a compromised or malicious page. It matches the stem precisely: the browser blocked an executable attempting to download without any user interaction.

Why this answer

A drive-by download is a silent, automatic download of malicious code (often an executable) that occurs when a user merely visits a compromised or malicious website, without any explicit user action like clicking a download link. The browser blocking the automatic executable download is a classic defense against this threat. This matches the scenario exactly: no user interaction, automatic download attempt, browser-level block.

Exam trap

FORTINET-NSE123 often tests the confusion between drive-by downloads (silent, no user action) and phishing/social engineering (requires user interaction), so candidates must focus on the phrase 'without user interaction' to identify the correct term.

How to eliminate wrong answers

Option B is wrong because shoulder surfing is a physical, in-person observation attack where someone watches a user type credentials or view sensitive data — it has nothing to do with browser downloads. Option C is wrong because a social engineering phone call is a voice-based manipulation attack (e.g., vishing) that relies on human interaction, not silent automatic downloads. Option D is wrong because email phishing requires the user to receive and interact with an email (clicking links or attachments), whereas a drive-by download occurs simply by visiting a web page with no email involved.

Practice this question →

Multi-Selecteasy

Which TWO practices represent fundamental cybersecurity hygiene guidelines for everyday end users? (Choose two.)

Select 2 answers

A.Clicking on unexpected email attachments immediately to verify their safety.

B.Sharing corporate passwords with trusted team members to ensure project continuity.

C.Disabling all endpoint antivirus software to speed up system performance.

D.Locking the workstation screen whenever walking away from the desk.

E.Using complex, unique passwords for every separate work account.

AnswersD, E

Locking the screen prevents unauthorised physical access to an unattended, already-authenticated session. This satisfies the everyday end-user hygiene scenario because it removes the opportunity for a passer-by to act under the user's logged-in identity without needing any credentials.

Why this answer

Option D is correct because locking the workstation screen whenever leaving the desk prevents unauthorized physical access and session hijacking, a core endpoint hygiene practice (e.g., Windows+L or Ctrl+Alt+Del lock). Option E is correct because using complex, unique passwords for every separate work account limits credential-reuse attacks such as credential stuffing and pass-the-hash lateral movement, and supports per-account breach containment. The unmarked options are unsafe: A invites phishing/malware execution by opening unexpected attachments, B violates least privilege and non-repudiation by sharing credentials, and C removes a key detective/preventive control (antivirus/EDR) and increases malware risk.

Exam trap

The trap is that some options sound like teamwork or efficiency (sharing passwords, disabling antivirus for performance), but they are actually security violations; candidates must recognize that convenience should not trump security hygiene.

Practice this question →

MCQmedium

Which action is a best practice for managing passwords to prevent credential stuffing attacks?

A.Change passwords only when forced by the system administrator.

B.Write passwords on a physical sticky note hidden under the keyboard.

C.Use a password manager to generate and store unique, strong passwords for each site.

D.Use the same password for all work-related accounts to ensure memory efficiency.

AnswerC

A password manager generates high-entropy, unique credentials per site, so a breach of one service cannot be replayed against others. This breaks the credential-reuse chain that credential stuffing depends on, directly satisfying the stem's best-practice requirement for password management.

Why this answer

Credential stuffing succeeds when attackers replay username/password pairs leaked from one breach against other sites, so the defense is to ensure no two accounts share a password. A password manager generates and stores a unique, high-entropy password per site, which breaks the reuse chain that credential stuffing depends on. This is the single most effective user-side control against the attack.

Exam trap

The trap is picking a 'change your password often' answer, which sounds like good hygiene but does not address the reuse vector that credential stuffing specifically exploits.

How to eliminate wrong answers

Option A is wrong because changing passwords only when forced leaves reused credentials valid indefinitely, giving attackers a long window to exploit leaked pairs. Option B is wrong because writing passwords on a sticky note exposes them to anyone with physical or visual access and does nothing to prevent reuse across sites. Option D is wrong because using the same password everywhere is precisely the condition that makes credential stuffing work — one breach compromises every account.

Practice this question →

MCQeasy

When setting up a new online account for a business service, an employee is prompted to save a set of 10 backup recovery codes in case they lose access to their authenticator app. What is the best practice for handling these recovery codes?

A.Write them on a sticky note attached to the computer monitor for convenience

B.Discard them immediately as they are unnecessary if an app is installed

C.Store them in an encrypted password manager or secure offline location

D.Share them in a public corporate chat channel so teammates can assist if needed

AnswerC

Recovery codes grant account access bypassing the authenticator, so storing them in an encrypted password manager or secure offline location prevents unauthorised retrieval while keeping them available. This satisfies the best-practice requirement by protecting the codes from compromise without losing recoverability.

Why this answer

Recovery codes are a critical fallback for MFA when the primary authenticator device is lost, stolen, or reset. Storing them in an encrypted password manager or a physically secure offline location (e.g., a safe) ensures they remain confidential and available only to the legitimate user. This aligns with the principle of least privilege and defense in depth, preventing unauthorized access while preserving account recoverability.

Exam trap

FORTINET-NSE123 often tests the misconception that recovery codes are optional or can be shared for convenience, when in fact they are a critical security control that must be protected like a password.

How to eliminate wrong answers

Option A is wrong because a sticky note on a monitor is visible to anyone with physical or visual access, defeating the purpose of a secret backup. Option B is wrong because discarding recovery codes eliminates the only fallback if the authenticator app is unavailable, leading to permanent account lockout. Option D is wrong because sharing codes in a public chat channel exposes them to all channel members and potentially to attackers who compromise the channel, violating confidentiality.

Practice this question →

MCQmedium

Which cybersecurity practice is most effective in mitigating the impact of a catastrophic ransomware infection on critical enterprise databases?

A.Deploying standard HTTP web proxies without inspection.

B.Increasing the corporate internet bandwidth capacity.

C.Enabling automatic operating system wallpaper updates.

D.Maintaining secure, immutable, and offline backups of critical data.

AnswerD

Immutable, offline backups preserve recoverable copies that ransomware cannot encrypt or delete, directly satisfying the need to restore critical databases without paying a ransom. Unlike replication or snapshots, which inherit the infection, offline immutability guarantees a clean restore point, minimising downtime and data loss after a catastrophic infection.

Why this answer

Immutable, offline backups ensure that even if ransomware encrypts production databases and attempts to encrypt or delete backup copies, a clean recovery point remains available. Because the backups are offline and immutable (write-once), ransomware cannot reach or modify them, enabling full restoration without paying a ransom. This directly mitigates the impact of a catastrophic infection on critical data.

Exam trap

FORTINET-NSE123 often tests the principle that preventive controls alone are insufficient against ransomware, and candidates mistakenly choose network-layer or performance options instead of recognizing that resilient, isolated backup strategy is the definitive mitigation for catastrophic data loss.

How to eliminate wrong answers

Option A is wrong because a standard HTTP web proxy without inspection does not block malicious payloads, command-and-control traffic, or ransomware delivery — it merely forwards traffic and provides no security control. Option B is wrong because increasing internet bandwidth has no bearing on ransomware containment or recovery; it addresses performance, not security. Option C is wrong because automatic wallpaper updates are a cosmetic OS feature with zero security relevance to ransomware mitigation or data recovery.

Practice this question →

Multi-Selectmedium

Which TWO of the following indicators are commonly associated with a potential phishing email? (Choose two)

Select 2 answers

A.Generic greetings like 'Dear Customer' instead of the recipient's actual name

B.A standard newsletter sent via an officially approved corporate marketing platform with working unsubscribe links

C.A sender domain address that slightly misspells a trusted organization's name

D.Content written with perfect grammar, standard company formatting, and no sense of urgency

E.An email digitally signed with a valid corporate PKI certificate issued by the internal IT department

AnswersA, C

Phishing campaigns often use impersonal salutations because attackers send bulk messages without knowing recipients' names. A generic greeting such as 'Dear Customer' is therefore a recognised indicator that the message may be fraudulent rather than legitimate correspondence.

Why this answer

Option A is correct because phishing messages frequently use impersonal, generic salutations such as 'Dear Customer' or 'Dear User' since attackers mass-mail victims without knowing their real names, which is a classic social-engineering red flag. Option C is correct because typosquatting or look-alike sender domains (e.g., 'micros0ft.com' or 'paypa1.com') are a hallmark of phishing, used to impersonate a trusted organization while evading simple domain blocklists. Option B is not an indicator of phishing because a legitimate newsletter from an approved corporate marketing platform with functioning unsubscribe links reflects proper bulk-email practices.

Option D is not an indicator because perfect grammar, consistent formatting, and absence of urgency describe well-crafted legitimate mail, not the errors and pressure tactics typical of phishing. Option E is not an indicator because a valid digital signature from an internal PKI certificate actually verifies sender authenticity and integrity, which is the opposite of a phishing trait.

Exam trap

FORTINET-NSE123 often tests the ability to distinguish between phishing indicators and legitimate email characteristics, trapping candidates who overlook that perfect grammar and valid digital signatures are signs of legitimacy, not phishing.

Practice this question →

MCQhard

An organization wants to ensure that no single administrator has the unchecked authority to approve and deploy high-risk firewall rule changes into production. Which security governance mechanism should be implemented?

A.Separation of duties

B.Mandatory access control labeling

C.Single sign-on federation

D.Role-based access auditing

AnswerA

Separation of duties splits rule authoring from approval and deployment, so the administrator proposing a high-risk change cannot also authorise it. This directly satisfies the stem's constraint that no single administrator holds unchecked authority over the full change lifecycle.

Why this answer

Separation of duties (SoD) is the governance control that splits a high-risk process across multiple roles so no single administrator can both author and approve/deploy a change. By requiring a different person to approve firewall rule changes than the one who drafts them, the organization prevents unilateral, unchecked authority. This is a foundational ITIL/COBIT and ISO 27001 control for change management.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse authentication/authorization controls (SSO, RBAC) with governance controls (SoD), and whether they recognize that auditing is detective rather than preventive.

How to eliminate wrong answers

Option B is wrong because mandatory access control labeling is about enforcing data classification and clearance levels (e.g., Bell-LaPadula), not about splitting approval authority for changes. Option C is wrong because SSO federation centralizes authentication and improves user experience, but it does not prevent one admin from approving their own change. Option D is wrong because role-based access auditing reviews who has which roles after the fact; it is detective, not preventive, and does not enforce dual control.

Practice this question →

MCQeasy

An attacker leaves several branded USB flash drives labeled 'Confidential Salary Data 2026' in the parking lot of a targeted enterprise, hoping curious employees will plug them into corporate computers. What type of social engineering attack is being demonstrated?

A.Baiting

B.Watering hole attack

C.Tailgating

D.Phishing

AnswerA

Baiting exploits curiosity by leaving physical media such as branded USB drives for victims to plug in, delivering malware once connected. The salary-themed labels entice employees, matching the baiting definition rather than phishing or tailgating.

Why this answer

Baiting is a social engineering attack where the attacker leaves a physical item (like a USB drive) or offers something enticing to lure victims into compromising security. The branded USB drives labeled 'Confidential Salary Data 2026' exploit curiosity and the promise of valuable information, hoping employees plug them in and execute malicious payloads. This is the textbook definition of baiting.

Exam trap

FORTINET-NSE123 often tests the distinction between baiting and phishing, causing candidates to select phishing because both involve luring victims, but baiting specifically uses physical media or tangible offers rather than digital messages.

How to eliminate wrong answers

Option B is wrong because a watering hole attack compromises a website frequented by the target group, infecting visitors — it does not involve leaving physical media in a parking lot. Option C is wrong because tailgating involves physically following an authorized person into a restricted area, which is unrelated to USB drives. Option D is wrong because phishing uses fraudulent emails or messages to trick recipients into clicking links or opening attachments, not physical USB drops.

Practice this question →

MCQmedium

An IT team is reviewing security logs and discovers that a user account was successfully accessed from two geographically impossible locations within a ten-minute timeframe. What type of anomaly does this represent?

A.Bandwidth saturation anomaly

B.Impossible travel anomaly

C.Hardware failure indicator

D.DNS poisoning event

AnswerB

Two successful logins from geographically distant locations within ten minutes cannot be achieved by physical travel, so the pattern indicates compromised credentials or session hijacking. This is the defining signature of an impossible travel anomaly, matching the log evidence precisely.

Why this answer

The scenario describes a user account being accessed from two geographically distant locations within a timeframe that makes physical travel between them impossible. This is the textbook definition of an impossible travel anomaly, a common behavioral analytics detection used in security monitoring. Fortinet's FortiAnalyzer and FortiSIEM, for example, correlate login events with geolocation data to flag such events as suspicious, often indicating credential compromise or session hijacking.

Exam trap

FORTINET-NSE123 often tests the distinction between behavioral anomalies (like impossible travel) and network or hardware anomalies, so candidates must recognize that geographic impossibility is a user behavior indicator, not a network performance or attack signature.

How to eliminate wrong answers

Option A is wrong because bandwidth saturation anomaly refers to network performance issues where traffic exceeds capacity, not user authentication patterns. Option C is wrong because hardware failure indicator relates to physical device malfunctions (e.g., disk errors, power supply issues), not login anomalies. Option D is wrong because DNS poisoning event involves tampering with DNS records to redirect traffic, which is a network-level attack, not a user access anomaly.

Practice this question →

MCQhard

An attacker calls the corporate helpdesk posing as a stressed executive traveling abroad, claiming they are locked out of their account and urgently need their password reset without going through standard verification protocols. This attack relies primarily on exploiting which vulnerability?

A.Human psychology and helpfulness

B.Misconfigured firewall security policies

C.Cryptographic weak implementation

D.Unpatched operating system kernel bugs

AnswerA

Social engineering exploits the helpdesk agent's natural desire to assist an authority figure under time pressure, bypassing identity verification. The stem's constraint — an attacker requesting a password reset without standard verification — is satisfied because the vulnerability lies in human psychology and helpfulness, not technical controls.

Why this answer

This is a classic vishing (voice phishing) / social engineering attack where the attacker manipulates the helpdesk agent's natural desire to be helpful and their deference to authority (a stressed executive). The vulnerability exploited is human psychology — urgency, authority, and empathy — not any technical misconfiguration. No firewall rule, cryptographic weakness, or kernel bug is involved because the attacker never touches the technology directly; they convince a human to bypass controls.

Exam trap

The trap is that candidates overthink the question and look for a technical control failure, when the scenario explicitly describes a phone call exploiting trust — the answer is always the human element in social engineering questions.

How to eliminate wrong answers

Option B is wrong because misconfigured firewall policies are a technical control failure, but the attacker here never attempts to traverse the firewall — they call the helpdesk and ask a human to reset credentials. Option C is wrong because cryptographic weaknesses (e.g., weak ciphers, broken key exchange) would be relevant only if the attacker were cracking or intercepting encrypted authentication, which is not described. Option D is wrong because unpatched kernel bugs require exploit code execution against an OS, whereas this attack relies entirely on verbal manipulation with no software exploitation.

Practice this question →

MCQmedium

An enterprise updates its patch management policy to mandate that all operating systems and third-party software must be updated within 48 hours of critical vulnerability disclosures. What security vulnerability window is this policy designed to minimize?

A.The network lease duration assigned by corporate DHCP servers.

B.The exposure window during which attackers can exploit known unpatched vulnerabilities.

C.The physical hardware warranty expiration window for end-user laptops.

D.The vendor development lifecycle window for creating new software features.

AnswerB

The 48-hour mandate directly shrinks the exposure window between a critical vulnerability's public disclosure and its remediation, denying attackers the known-unpatched exploitation period. This satisfies the policy's aim of minimising the time systems remain vulnerable to publicly documented exploits, which is precisely the window attackers target after patches become available.

Why this answer

A 48-hour patch mandate for critical vulnerabilities is designed to shrink the exposure window — the period between public disclosure of a vulnerability and the application of a fix. Attackers frequently weaponize exploits within days of disclosure, so minimizing this window reduces the chance of successful exploitation.

Exam trap

FORTINET-NSE123 often tests the definition of 'vulnerability window,' confusing it with unrelated windows like DHCP leases or warranty periods.

How to eliminate wrong answers

Option A is wrong because DHCP lease duration relates to IP address assignment, not vulnerability exposure. Option C is wrong because hardware warranty expiration is a procurement/support concern, not a security exposure window. Option D is wrong because vendor development lifecycle is about feature creation, not the risk period for unpatched systems.

Practice this question →

MCQeasy

An office worker receives an email claiming to be from the internal HR department, urgently requesting them to click a link and verify their banking details to avoid a delay in payroll. What is the most appropriate initial action for the employee to take according to foundational cybersecurity best practices?

A.Click the link to verify if the website looks authentic before reporting it

B.Report the email using the organization's designated phishing reporting mechanism

C.Forward the email to all colleagues as a warning

D.Reply to the sender asking for verbal confirmation of their identity

AnswerB

Reporting via the organisation's designated phishing channel alerts security teams to the credential-harvesting attempt and enables blocking of similar messages. This satisfies the best-practise requirement for an initial action without engaging the malicious link or divulging banking details.

Why this answer

The email exhibits classic phishing indicators: urgency, authority impersonation (HR), and a request for sensitive financial data. Per foundational security awareness best practices (and frameworks like NIST SP 800-50 and Fortinet's own training), the correct initial action is to report the suspicious email via the organization's designated phishing reporting mechanism (e.g., a 'Report Phish' button or dedicated mailbox). This allows the security team to analyze, block, and remove the threat from other inboxes, and it avoids any interaction that could compromise the user or network.

Exam trap

FORTINET-NSE123 often tests the instinct to 'verify' or 'warn others' instead of following the formal reporting process, but the correct answer always prioritizes reporting without interaction to avoid escalation.

How to eliminate wrong answers

Option A is wrong because clicking the link—even just to 'check' authenticity—can trigger drive-by downloads, credential harvesting, or beaconing to a command-and-control server, and it violates the principle of never interacting with unverified links. Option C is wrong because forwarding the email to all colleagues amplifies the threat, potentially causing multiple users to click the link and overwhelming the IT team with reports, instead of following the proper reporting channel. Option D is wrong because replying to the sender confirms the email address is active and opens a dialogue with the attacker, who can then use social engineering to further manipulate the employee; verbal confirmation should be done via a known, independent channel, not by replying.

Practice this question →

Multi-Selecthard

Which THREE steps are critical for an effective cybersecurity incident response plan?

Select 3 answers

A.Ignoring the incident to see if it resolves itself automatically.

B.Preparation and planning to ensure the team is ready to react.

C.Immediately deleting all corporate data to prevent further theft.

D.Identification and analysis of the threat to understand the scope.

E.Containment to prevent the spread of the security incident.

AnswersB, D, E

Preparation and planning establish the playbooks, roles, tooling and communication channels before an incident occurs. Without this readiness phase, response and recovery actions lack defined ownership and procedures, so it satisfies the stem's requirement for a critical incident response step.

Why this answer

Option B (Preparation and planning) is correct because an effective incident response plan requires proactive readiness—defining roles, playbooks, communication channels, and tools—so the team can react quickly and consistently when an incident occurs. Option D (Identification and analysis of the threat) is correct because responders must detect, validate, and scope the incident (e.g., determining affected hosts, accounts, and indicators of compromise) before they can choose appropriate remediation actions. Option E (Containment) is correct because limiting the spread of the incident—such as isolating compromised systems, disabling accounts, or blocking malicious traffic—prevents further damage while investigation and eradication proceed.

Option A is incorrect because ignoring an incident allows attackers to persist and escalate, and Option C is incorrect because deleting all corporate data destroys evidence and business operations rather than containing or remediating the threat.

Exam trap

FORTINET-NSE123 often tests whether candidates recognize that incident response is a structured, multi-phase process — distractors like 'ignore it' or 'delete everything' exploit the misconception that any drastic action is better than a measured response.

Practice this question →

Multi-Selectmedium

Which THREE common indicators suggest that an email message might be a phishing attempt? (Choose three.)

Select 3 answers

A.A generic salutation such as 'Dear Customer' instead of the recipient's actual name.

B.A sender email address domain that subtly misspells a legitimate corporate brand name.

C.A standard company-wide newsletter detailing upcoming office cafeteria holiday hours.

D.An urgent demand to verify confidential credentials or financial information immediately.

E.A digital signature verifying the cryptographic integrity and authenticity of the sender.

AnswersA, B, D

Impersonal greetings betray bulk, automated campaigns where the attacker lacks the recipient's details. This satisfies the stem's requirement for a common phishing indicator, since legitimate correspondents addressing you directly rarely open with an unnamed generic salutation.

Why this answer

Option A is correct because phishing messages typically use generic salutations like 'Dear Customer' since attackers send them in bulk and don't know the recipient's real name, whereas legitimate organizations usually personalize communications. Option B is correct because typosquatting or look-alike domains (e.g., 'micros0ft.com' or 'paypa1.com') are a classic phishing tactic that impersonates a trusted brand to deceive recipients. Option D is correct because urgency combined with requests to verify credentials or financial data is a hallmark social-engineering pressure tactic designed to bypass the victim's critical thinking.

Option C is not a phishing indicator because routine internal announcements such as cafeteria holiday hours are normal, low-risk corporate communications. Option E is not a phishing indicator because a valid digital signature (e.g., S/MIME or PGP) actually confirms sender authenticity and message integrity, which is the opposite of a phishing sign.

Exam trap

FORTINET-NSE123 often tests whether candidates can distinguish phishing indicators from normal business communications and security features like digital signatures.

Practice this question →

MCQeasy

An end user plugs in a USB keyboard purchased from an unverified online marketplace, and the computer immediately begins executing automated command-line instructions without user intervention. What type of hardware threat has occurred?

A.A keystroke injection attack using a compromised HID device.

B.A distributed denial-of-service attack originating from the keyboard firmware.

C.A hardware logic bomb that physically destroys the motherboard upon boot.

D.A physical RAM scraping attack reading volatile memory contents.

AnswerA

The device enumerates as a trusted USB human interface device but firmware emulates keystrokes, injecting commands the operating system treats as legitimate keyboard input. This is keystroke injection via a compromised HID device, executing without user interaction.

Why this answer

A USB keyboard that immediately executes automated command-line instructions is a classic keystroke injection attack, where the device presents itself as a Human Interface Device (HID) and sends pre-programmed keystrokes to the host. This is often achieved with devices like the USB Rubber Ducky, which emulate a keyboard and can execute scripts at high speed. The correct answer is a keystroke injection attack using a compromised HID device.

Exam trap

FORTINET-NSE123 often tests the confusion between keystroke injection and other hardware threats, such as logic bombs or RAM scraping, by describing a device that acts as a keyboard but performs malicious actions.

How to eliminate wrong answers

Option B is wrong because a DDoS attack involves overwhelming a target with traffic from multiple sources, which is not what a keyboard firmware does; a keyboard cannot generate network-level floods. Option C is wrong because a hardware logic bomb typically refers to malicious code that triggers under specific conditions, and it does not physically destroy the motherboard upon boot; physical destruction is not a standard logic bomb behavior. Option D is wrong because RAM scraping involves reading volatile memory to extract sensitive data, not executing command-line instructions; a keyboard cannot directly read RAM contents.

Practice this question →

Multi-Selecthard

Which TWO of the following principles are core tenets of the CIA triad in cybersecurity? (Choose two)

Select 2 answers

A.Complexity

B.Compliance

C.Concurrency

D.Integrity

E.Confidentiality

AnswersD, E

Integrity guarantees data remains accurate, complete and unaltered except by authorised parties, guarding against unauthorised modification. It is one of the three core CIA tenets, alongside confidentiality and availability, so it satisfies the stem's requirement for a foundational principle.

Why this answer

Option D (Integrity) is correct because the CIA triad's I stands for Integrity, meaning data must remain accurate, complete, and unaltered by unauthorized parties, whether in storage or in transit. Option E (Confidentiality) is correct because the C in the CIA triad stands for Confidentiality, ensuring information is disclosed only to authorized subjects through mechanisms such as encryption, access controls, and authentication. Together with Availability, these two principles form the three core security objectives of the CIA triad.

The unmarked options do not belong: Complexity (A) is a system design characteristic, not a security tenet; Compliance (B) is a regulatory or governance obligation that may support security but is not part of the triad; and Concurrency (C) is a computing property concerning simultaneous operations, unrelated to the CIA triad.

Exam trap

FORTINET-NSE123 often tests the CIA triad by including plausible-sounding but incorrect options like 'Compliance' or 'Complexity' to confuse candidates who might associate security with regulatory adherence or system complexity rather than the core principles of Confidentiality, Integrity, and Availability.

Practice this question →

Multi-Selectmedium

Which THREE security principles are foundational components of the classic Information Security Triad (CIA Triad)? (Choose three.)

Select 3 answers

A.Availability, ensuring authorized users have reliable access to information and resources when needed.

B.Compliance, ensuring all regional government tax laws are strictly obeyed.

C.Confidentiality, ensuring sensitive data is accessible only to authorized individuals.

D.Cost-efficiency, ensuring security budgets remain minimal relative to operational revenue.

E.Integrity, ensuring data and systems are accurate and protected from unauthorized modification.

AnswersA, C, E

Availability ensures authorised users can reliably access information and resources whenever required, guarding against denial-of-service and outages. It is one of the three foundational CIA triad principles, alongside confidentiality and integrity, satisfying the stem's requirement.

Why this answer

The CIA Triad consists of Confidentiality, Integrity, and Availability. Option A (Availability) is correct because it ensures authorized users have reliable and timely access to information and resources, typically supported by redundancy, backups, and uptime controls. Option C (Confidentiality) is correct because it restricts sensitive data access to authorized individuals through mechanisms like encryption, access control lists, and authentication.

Option E (Integrity) is correct because it ensures data and systems remain accurate and protected from unauthorized modification via hashing, digital signatures, and version controls. Option B (Compliance) is not a foundational CIA Triad principle; it is a governance and regulatory requirement that may support security but is not one of the three core components. Option D (Cost-efficiency) is a business or financial objective, not a security principle of the CIA Triad.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse business/governance concepts like Compliance or Cost-efficiency with the actual technical pillars of the CIA Triad, so distractors that sound security-adjacent but are really management concerns are the classic trap.

Practice this question →

MCQhard

An organization implements a policy requiring all software installations on corporate endpoints to be approved and pushed centrally by the IT department, preventing users from installing unverified applications. Which security principle is being enforced?

A.Network boundary defense

B.Asymmetric encryption key management

C.Controlled application execution (Whitelisting)

D.Principle of fail-secure

AnswerC

Whitelisting enforces controlled application execution by permitting only IT-approved software to run or install on endpoints. Users cannot install unverified applications because the policy allows only pre-approved binaries, directly satisfying the requirement that installations be centrally approved and pushed.

Why this answer

Controlled application execution, also called application whitelisting, enforces that only approved, signed, or centrally pushed applications can run on endpoints. By requiring IT to approve and deploy software, the organization prevents users from installing unverified applications, which is the definition of whitelisting. This principle directly reduces the attack surface from malicious or unauthorized software.

Exam trap

FORTINET-NSE123 often tests the confusion between perimeter controls (network boundary defense) and endpoint execution controls (whitelisting), so candidates who focus on network security miss that the policy is about what runs on the endpoint.

How to eliminate wrong answers

Option A is wrong because network boundary defense focuses on perimeter controls like firewalls and segmentation, not on which applications may execute on an endpoint. Option B is wrong because asymmetric encryption key management concerns public/private key handling for encryption and signing, not application installation control. Option D is wrong because fail-secure describes a system defaulting to a secure state on failure (e.g., locking a door when power is lost), not the policy of approving and pushing software centrally.

Practice this question →

MCQeasy

An employee notices their workstation acting sluggish, and several desktop files have had their extensions changed to an unfamiliar format accompanied by a ransom text file. What type of attack has occurred?

A.Ransomware infection

B.DDoS attack

C.Man-in-the-middle interception

D.SQL injection

AnswerA

Mass file-extension renaming plus a ransom note is the defining signature of ransomware: encryption payloads rename or append extensions, then drop instructions demanding payment. The sluggish workstation reflects heavy disk and CPU consumption during encryption, confirming ransomware rather than a worm, trojan or simple disk failure.

Why this answer

The symptoms — sluggish workstation performance, file extensions changed to an unfamiliar format, and a ransom text file — are the textbook signature of a ransomware infection. Ransomware encrypts user files (often renaming them with a new extension) and drops a ransom note demanding payment for the decryption key. The combination of file-extension mutation plus a ransom note is definitive.

Exam trap

FORTINET-NSE123 often tests symptom-to-attack mapping — candidates may confuse ransomware with a generic malware infection or DDoS, but the ransom note plus renamed extensions is the unique fingerprint that must be recognized.

How to eliminate wrong answers

Option B is wrong because a DDoS attack floods a service with traffic to make it unavailable, producing network/service outages rather than local file encryption and ransom notes. Option C is wrong because a man-in-the-middle attack silently intercepts or alters communications between two parties and does not rename or encrypt local files. Option D is wrong because SQL injection targets backend databases through vulnerable web input fields, not endpoint files on an employee workstation.

Practice this question →

MCQmedium

A company's security policy requires that all software patches and operating system updates be evaluated in a test environment before being deployed to production endpoints. Which risk is this policy primarily designed to mitigate?

A.The risk of unauthorized physical entry to data centers

B.The risk of operational downtime caused by faulty updates

C.The risk of zero-day hardware manufacturing defects

D.The risk of social engineering attacks against helpdesk staff

AnswerB

Testing patches before production deployment directly mitigates the risk of faulty updates causing operational downtime, satisfying the policy's requirement for pre-deployment evaluation. Unlike security risks such as unpatched vulnerabilities, this control targets availability: a defective patch can crash systems or disrupt services, and staging it first confines that blast radius to non-production endpoints.

Why this answer

Testing patches in a staging environment before production deployment is a change-management control designed to catch defective or incompatible updates before they can cause outages. History is full of patches that broke production — a faulty update can crash services, corrupt data, or render systems unbootable — so the test environment acts as a canary. The policy's primary risk mitigation is therefore operational downtime caused by faulty updates.

Exam trap

The trap is over-thinking the question and picking a security-control answer (like physical access or social engineering) when the policy is explicitly about pre-deployment evaluation, which maps to change management and availability risk.

How to eliminate wrong answers

Option A is wrong because physical data-center entry is a facility security control addressed by badge access, biometrics, and mantraps, not by patch testing. Option C is wrong because zero-day hardware manufacturing defects are a supply-chain and hardware-assurance concern, not something a software patch test environment can detect. Option D is wrong because social engineering against helpdesk staff is mitigated by awareness training, verification procedures, and call-back policies, not by patch staging.

Practice this question →

MCQhard

A company mandates that all sensitive corporate documents stored on cloud storage must be encrypted both while being uploaded over the internet and while sitting at rest on the storage servers. Which security triad pillars are primarily satisfied by this measure?

A.Confidentiality across all states of data (transit and rest)

B.Availability and Non-repudiation

C.Authenticity and Authorization

D.Confidentiality and Integrity

AnswerA

Encrypting data in transit (TLS over the internet) and at rest (server-side encryption) prevents unauthorised disclosure in both states, satisfying confidentiality. The mandate targets only secrecy, not integrity or availability, so confidentiality is the pillar primarily met.

Why this answer

Encrypting data in transit (e.g., TLS during upload) and at rest (e.g., AES-256 on storage) directly satisfies the Confidentiality pillar of the CIA triad by ensuring unauthorized parties cannot read the data in either state. The measure does not address Integrity (tamper detection), Availability (uptime/access), or Non-repudiation (proof of origin), so Confidentiality is the primary pillar satisfied.

Exam trap

FORTINET-NSE123 often tests whether candidates can map a control to the correct CIA pillar — encryption is almost always Confidentiality, but candidates sometimes pick Integrity because they conflate encryption with tamper-proofing.

How to eliminate wrong answers

Option B is wrong because Availability concerns uptime and access, and Non-repudiation concerns proof of action — encryption does not provide either. Option C is wrong because Authenticity (verifying identity) and Authorization (granting permissions) are access-control concepts, not encryption outcomes, though encryption may support them indirectly. Option D is wrong because while encryption can support Integrity via authenticated modes (e.g., AES-GCM), the question specifies encryption for confidentiality in transit and at rest, not integrity verification — and the best answer is the one that captures both states of data.

Practice this question →

MCQmedium

Which security principle is enforced when an administrator restricts a user's access to only the specific data and applications required for their job function?

A.Separation of Duties

B.Security by Obscurity

C.Defense in Depth

D.Principle of Least Privilege

AnswerD

Least privilege grants each account only the minimum access needed for its job function, directly matching the stem's restriction to required data and applications. It limits blast radius if credentials are compromised, unlike role-based or discretionary models that grant broader standing access.

Why this answer

The Principle of Least Privilege (PoLP) mandates that users are granted only the minimum access rights necessary to perform their job functions—nothing more. Restricting access to specific data and applications directly implements this principle by limiting the blast radius of compromised accounts and reducing insider threat risk. Fortinet products like FortiGate and FortiManager enforce PoLP through role-based access control (RBAC) profiles and administrative profiles that define granular permissions.

Exam trap

FORTINET-NSE123 often tests the confusion between Principle of Least Privilege and Separation of Duties, where candidates mistakenly choose Separation of Duties because both involve restricting access, but Separation of Duties focuses on dividing tasks to prevent conflict of interest, not on limiting access to job-specific resources.

How to eliminate wrong answers

Option A is wrong because Separation of Duties divides critical tasks among multiple users to prevent fraud (e.g., one admin creates a firewall policy, another approves it), not about limiting access to job-specific resources. Option B is wrong because Security by Obscurity relies on hiding system details (e.g., non-standard ports, secret URLs) as a primary defense, which is not a true security principle and does not restrict access based on job function. Option C is wrong because Defense in Depth uses multiple layered controls (firewalls, IPS, endpoint protection) to protect assets, but it does not define the scope of a user's access rights.

Practice this question →

Multi-Selecthard

Which TWO actions should an employee take immediately upon suspecting their corporate laptop has been compromised by malware? (Choose two.)

Select 2 answers

A.Forward the suspicious file to all external clients as a warning alert.

B.Delete all system logs and temporary files to clear up disk space for the virus scanner.

C.Download and execute unverified registry cleaner utilities from pop-up advertisements.

D.Notify the internal IT security or incident response team without delay.

E.Immediately disconnect the laptop from both wired and wireless network connections.

AnswersD, E

Prompt reporting lets the incident response team isolate the endpoint and contain lateral movement before the malware spreads. This satisfies the stem's "immediately" constraint, since early notification triggers the organisation's detection and containment workflow while forensic evidence on the laptop remains intact.

Why this answer

Option D is correct because promptly notifying the internal IT security or incident response team ensures trained personnel can begin containment, triage, and forensic investigation, which is a core step of any incident response process. Option E is correct because immediately disconnecting the laptop from both wired (Ethernet) and wireless (Wi-Fi) network connections isolates the potentially infected host, preventing malware from spreading laterally, exfiltrating data, or communicating with command-and-control servers. Option A is not appropriate because forwarding a suspicious file to external clients could propagate malware and breach confidentiality, rather than containing the incident.

Option B is wrong because deleting system logs and temporary files destroys forensic evidence needed for investigation and may violate retention policies. Option C is wrong because downloading and executing unverified registry cleaners from pop-up advertisements is a common malware delivery vector and would likely worsen the compromise.

Exam trap

FORTINET-NSE123 often tests incident response priorities, so candidates may choose 'delete logs' or 'scan first' options that sound helpful but actually destroy evidence or delay containment.

Practice this question →

Multi-Selecthard

Which TWO of the following measures contribute effectively to a robust 'Defense in Depth' security strategy for an enterprise? (Choose two)

Select 2 answers

A.Relying entirely on a single powerful perimeter firewall with no internal security controls

B.Implementing network segmentation to restrict lateral movement between departments

C.Requiring multi-factor authentication for all remote and privileged user access

D.Eliminating all system logs and monitoring to maximize user privacy

E.Disabling all endpoint antivirus solutions to improve computer processing speed

AnswersB, C

Network segmentation restricts lateral movement between departments, satisfying the stem's requirement for an effective Defence in Depth measure. By dividing the network into zones with enforced inter-zone controls, a compromised host cannot freely reach other segments, limiting breach propagation and supporting least-privilege access.

Why this answer

Option B is correct because network segmentation (e.g., VLANs, subnets, or microsegmentation) limits lateral movement so that a compromised host in one department cannot freely reach systems in another, adding an internal control layer beyond the perimeter. Option C is correct because requiring multi-factor authentication for all remote and privileged access enforces an additional identity-verification factor (something you know plus something you have/are), directly mitigating credential theft and unauthorized privileged use. These measures align with Defense in Depth by layering preventive controls across network and identity domains rather than trusting a single boundary.

Option A is wrong because relying solely on one perimeter firewall creates a single point of failure and ignores insider threats and internal lateral movement. Option D is wrong because deleting logs and monitoring destroys detection, auditing, and incident-response capabilities. Option E is wrong because disabling endpoint antivirus removes a critical host-level control and exposes systems to malware.

Exam trap

FORTINET-NSE123 often tests the misconception that a single strong perimeter control is sufficient, when Defense in Depth requires multiple overlapping layers including segmentation and MFA.

Practice this question →

MCQmedium

An employee finds a USB flash drive labeled 'Q4 Salary Adjustments' left in the parking lot and plugs it into their corporate laptop to see whose pay increased. What attack vector does this situation demonstrate?

A.USB baiting exploiting human curiosity and physical media.

B.Man-in-the-middle interception of wireless frames.

C.Cross-site scripting executed within a browser session.

D.Watering hole attack targeting web browsing habits.

AnswerA

Dropping a labelled drive exploits curiosity to bypass technical controls, since the user voluntarily connects the device. Once plugged in, malicious firmware or autorun payloads execute, making this a physical-media social-engineering vector rather than a network-based intrusion.

Why this answer

The scenario describes a USB flash drive deliberately left in a parking lot with an enticing label ('Q4 Salary Adjustments') to lure a curious employee into plugging it into a corporate laptop. This is the textbook definition of USB baiting — a physical social-engineering attack that exploits human curiosity and removable media to deliver malware or gain access.

Exam trap

FORTINET-NSE123 often tests the confusion between physical social-engineering vectors (USB baiting) and network-based attacks (MITM, XSS, watering hole), so candidates must match the scenario's physical-media detail to the correct vector.

How to eliminate wrong answers

Option B is wrong because man-in-the-middle interception involves an attacker positioning between two communicating parties (e.g., ARP spoofing, rogue Wi-Fi AP) to capture or alter traffic; no wireless interception occurs in this scenario. Option C is wrong because cross-site scripting is a web application vulnerability where malicious scripts execute in a victim's browser session; it has nothing to do with a physical USB drive. Option D is wrong because a watering hole attack compromises a website frequently visited by a target group, infecting visitors via drive-by download; it does not involve physical media or parking-lot drops.

Practice this question →

MCQmedium

A company discovers that a former disgruntled employee still has active login credentials to internal collaboration tools weeks after their departure. Which administrative security control failure is primarily responsible for this exposure?

A.Inadequate identity and access lifecycle offboarding procedures

B.Failure to implement adequate endpoint antivirus software

C.Absence of hardware token multi-factor authentication

D.Lack of network segmentation between departments

AnswerA

Deprovisioning accounts promptly on termination is the core identity lifecycle control. Leaving credentials active weeks after departure means the offboarding process failed to revoke access, directly enabling the former employee's unauthorised logins to collaboration tools.

Why this answer

The exposure stems from a failure in identity and access lifecycle management — specifically, offboarding procedures that should have disabled or deleted the former employee's credentials immediately upon departure. Active credentials weeks after termination indicate the offboarding process was not executed or not enforced.

Exam trap

FORTINET-NSE123 often tests whether candidates pick a technical control (MFA, antivirus, segmentation) when the scenario clearly describes a process/governance failure (offboarding), which is the actual root cause.

How to eliminate wrong answers

Option B is wrong because endpoint antivirus protects against malware, not against unauthorized access using valid credentials; antivirus would not prevent a former employee from logging in. Option C is wrong because MFA would add a layer of protection, but the primary failure is that the account was never disabled — MFA absence is a secondary control gap, not the root cause of stale credentials. Option D is wrong because network segmentation limits lateral movement but does not address the fact that a terminated user still has valid credentials to collaboration tools; segmentation is irrelevant to this identity lifecycle failure.

Practice this question →

MCQmedium

A hospital's security team deploys network segmentation so that the radiology imaging VLAN cannot directly reach the billing VLAN. A vendor's maintenance laptop connected to the imaging VLAN is later found to be infected with ransomware. Which security benefit of segmentation does this design primarily provide in this situation?

A.It encrypts all traffic between the imaging and billing VLANs.

B.It automatically removes ransomware from the vendor laptop.

C.It reduces the lateral movement path available to the ransomware.

D.It authenticates the vendor laptop before granting network access.

AnswerC

Segmentation limits which systems can communicate, so an infected device on the imaging VLAN cannot freely reach billing hosts. This constrains lateral movement, the phase where malware spreads from an initial foothold to other systems. In Fortinet terms, internal segmentation firewalls and VLAN separation enforce policy between zones, containing the blast radius even when endpoint protection fails on one device.

Why this answer

By preventing the imaging VLAN from directly reaching the billing VLAN, the design blocks a compromised device from pivoting into other sensitive systems. This containment of lateral movement is the core security value of segmentation, especially in environments like healthcare where flat networks magnify ransomware impact. Fortinet teaches segmentation and internal firewalling as key techniques for limiting breach scope.

Exam trap

The trap here is crediting segmentation with endpoint cleanup or traffic encryption, when its primary security value is restricting which systems an attacker can reach.

Practice this question →

MCQmedium

Why is multi-factor authentication (MFA) considered a critical defense against password-based attacks?

A.It adds a layer of defense even if the primary password is stolen.

B.It prevents all forms of social engineering.

C.It eliminates the need for strong password policies.

D.It automatically encrypts all outgoing email traffic.

AnswerA

MFA requires a second factor beyond the password, so a stolen or phished credential alone cannot authenticate. This directly satisfies the stem's constraint: the password compromise no longer grants access, breaking credential-replay and password-spraying attacks.

Why this answer

MFA requires a second factor beyond the password, so even if an attacker steals or guesses the password through phishing, credential stuffing, or a breach, they still cannot authenticate without the additional factor. This directly mitigates the impact of password compromise, which is the most common initial access vector.

Exam trap

FORTINET-NSE123 often tests whether candidates overstate MFA's benefits — the trap is choosing an answer that claims MFA stops all social engineering or removes the need for password hygiene, both of which are false.

How to eliminate wrong answers

Option B is wrong because MFA does not prevent social engineering — attackers can still trick users into approving a push notification (MFA fatigue) or into revealing an OTP. Option C is wrong because MFA complements, rather than replaces, strong password policies; weak passwords still increase risk of other attacks. Option D is wrong because MFA has nothing to do with encrypting outgoing email traffic — that is handled by TLS/S-MIME.

Practice this question →

MCQmedium

An end user is browsing the internet and encounters a pop-up warning stating that their computer is infected with multiple viruses, prompting them to call a toll-free number immediately for technical support. What is the most accurate classification of this threat?

A.A SQL injection exploit

B.A distributed denial-of-service attack

C.A legitimate endpoint telemetry notification

D.A tech support scam

AnswerD

The pop-up fabricates an infection and pushes a toll-free number, relying on fear and urgency to make the victim call and hand over payment or remote access. That social-engineering mechanism, not actual malware, defines a tech support scam.

Why this answer

A tech support scam is a social engineering attack where a fake pop-up or alert claims the user's system is infected and urges them to call a toll-free number, where scammers then charge for fake 'fixes' or steal remote access. The scenario describes exactly this: a browser pop-up warning of infection with an urgent phone number. No exploitation of code, traffic flooding, or legitimate telemetry is involved — the threat is deception targeting the user.

Exam trap

The trap here is confusing a user-facing social-engineering lure with an actual technical exploit — candidates see 'virus' and 'pop-up' and jump to malware or exploit categories instead of recognizing the phone-call element as the defining trait of a tech support scam.

How to eliminate wrong answers

Option A is wrong because SQL injection is a code-injection attack against a database-driven application's input fields, not a browser pop-up directed at an end user. Option B is wrong because a DDoS attack floods a target with traffic to exhaust resources, whereas here nothing is being flooded — the user is being socially manipulated. Option C is wrong because legitimate endpoint telemetry notifications come from managed security agents (e.g., FortiClient or EDR consoles) and never instruct users to call a toll-free number.

Practice this question →

Multi-Selectmedium

Which THREE of the following scenarios describe common forms of cybersecurity attacks against end users? (Choose three)

Select 3 answers

A.An employee receives an email mimicking IT support asking them to verify their credentials on a fake login portal

B.An organization implements strict role-based access control and regular auditing

C.A network administrator configures automated offboarding checklists for departed employees

D.An attacker drops infected USB flash drives in a company parking lot to entice curious employees

E.A user sees a pop-up browser alert claiming their PC is infected and instructing them to call a fraudulent support line

AnswersA, D, E

Credential phishing via a spoofed IT-support email and fake login portal is a social-engineering attack targeting the end user directly, exploiting trust rather than software vulnerabilities. It satisfies the stem's requirement for a common attack scenario against end users.

Why this answer

Option A is correct because it describes phishing, specifically a credential-harvesting attack where a spoofed email impersonates IT support and directs the victim to a fake login portal to steal usernames and passwords. Option D is correct because it describes baiting via infected USB flash drives, a physical social-engineering technique that relies on employee curiosity to introduce malware such as a Trojan or worm into the corporate network. Option E is correct because it describes tech support scams (scareware), where a fraudulent browser pop-up uses false infection warnings to pressure the user into calling a fake support line and surrendering access or payment.

Options B and C are not attacks at all: role-based access control with auditing and automated offboarding checklists are defensive security controls and administrative best practices that reduce risk rather than describe adversary activity.

Exam trap

FORTINET-NSE123 often tests the confusion between attack scenarios and defensive controls, so candidates must recognize that options describing security best practices (RBAC, offboarding) are not attacks.

Practice this question →

Multi-Selectmedium

Which THREE of the following characteristics are typical of social engineering attacks? (Choose three)

Select 3 answers

A.They always require advanced kernel-level debugging tools to execute

B.They frequently manufacture a sense of false urgency or panic to prompt rushed mistakes

C.They are entirely preventable by installing a standard graphics card driver update

D.They often impersonate authority figures, IT support, or trusted brands

E.They primarily exploit human psychology and trust rather than software code vulnerabilities

AnswersB, D, E

Manufacturing false urgency or panic pushes targets into rushed decisions, bypassing the verification steps that would otherwise expose the deception. This satisfies the stem's characteristic requirement by naming the pressure tactic: time compression suppresses deliberate scrutiny, making compliance more likely than reasoned refusal.

Why this answer

Option B is correct because social engineering attacks commonly fabricate urgency or panic (e.g., a fake account-lockout or invoice-due warning) to short-circuit a victim's normal verification and critical-thinking process. Option D is correct because attackers routinely spoof authority figures, IT support staff, or well-known brands through phishing emails, vishing calls, or pretexting to make their requests appear legitimate and trusted. Option E is correct because social engineering fundamentally targets human psychology and trust rather than exploiting memory-corruption or code-level flaws, which is why it bypasses many technical controls.

Option A is incorrect because kernel-level debugging tools are used for low-level software analysis, not for manipulating people, and social engineering requires no such tooling. Option C is incorrect because a graphics card driver update addresses only a specific hardware/software component and cannot prevent deception-based attacks that operate entirely through human interaction.

Exam trap

FORTINET-NSE123 often tests the misconception that social engineering requires sophisticated technical exploits, when in fact the entire category is defined by psychological manipulation of people rather than code.

Practice this question →

MCQmedium

A remote employee working from a coffee shop connects to an unsecured public Wi-Fi network to access corporate resources. Which security control must the employee engage first to protect data-in-transit from eavesdropping?

A.Enable local file sharing to speed up document syncing over public connections.

B.Disable the operating system firewall to allow seamless packet routing through the hotspot.

C.Establish an authorized corporate VPN connection before accessing internal systems.

D.Configure the web browser to accept all SSL certificates to bypass public portal warnings.

AnswerC

Public Wi-Fi is unencrypted, so traffic is exposed to eavesdropping. An authorised corporate VPN establishes an encrypted tunnel to the corporate gateway before any internal resource is accessed, protecting data-in-transit regardless of the hostile underlying network.

Why this answer

A corporate VPN creates an encrypted tunnel (typically IPsec or TLS) between the employee's device and the corporate gateway, so any data traversing the untrusted coffee shop Wi-Fi is protected from eavesdropping. Without this encryption layer, an attacker on the same hotspot can capture credentials, session tokens, and sensitive traffic using tools like Wireshark or a rogue AP. The VPN must be established before any internal resource is accessed so that no cleartext traffic leaks onto the public network.

Exam trap

FORTINET-NSE123 often tests the misconception that HTTPS alone is sufficient on public Wi-Fi, leading candidates to pick browser-related options instead of recognizing that an authorized VPN tunnel is the required first control for data-in-transit protection.

How to eliminate wrong answers

Option A is wrong because enabling local file sharing exposes the endpoint's files to other hosts on the public Wi-Fi segment, increasing the attack surface rather than protecting data-in-transit. Option B is wrong because disabling the host firewall removes a critical endpoint defense and does nothing to encrypt traffic — it actually makes the device more vulnerable to inbound attacks on the hotspot. Option D is wrong because accepting all SSL certificates defeats certificate validation, enabling man-in-the-middle attacks and removing the very trust assurance TLS is meant to provide.

Practice this question →

MCQmedium

A company implements a policy where remote workers must connect through a secure virtual private network (VPN) and authenticate using both a password and a push notification sent to their mobile device. What is the primary cybersecurity benefit of this dual-step authentication approach?

A.It ensures that compromised credentials alone are insufficient for an attacker to gain access

B.It guarantees complete encryption of all local workstation files

C.It prevents all forms of social engineering attacks against remote workers

D.It entirely eliminates the need for strong passwords on corporate accounts

AnswerA

Requiring a password plus a push notification means a stolen or phished password alone cannot grant access; the attacker must also control the registered mobile device. This satisfies the stem's multi-factor constraint, where knowledge-based credentials are combined with a possession factor, directly mitigating credential-compromise attacks.

Why this answer

Multi-factor authentication (MFA) combines something the user knows (password) with something the user possesses (mobile push token), so a stolen or phished password alone cannot grant access. The push notification acts as a second independent factor that an attacker would also need to compromise, defeating credential-stuffing and password-reuse attacks. This is the core security benefit of the dual-step approach.

Exam trap

FORTINET-NSE123 often tests the misconception that MFA 'prevents' attacks outright, when in reality it only raises the bar — candidates who pick 'prevents all social engineering' or 'eliminates the need for strong passwords' fall for the absolute-language trap.

How to eliminate wrong answers

Option B is wrong because MFA has nothing to do with encrypting local workstation files — full-disk encryption (BitLocker, FileVault) is the control that addresses that. Option C is wrong because MFA does not prevent social engineering; attackers can still phish users into approving a push (MFA fatigue) or trick them into revealing codes, so it only reduces the impact of some social-engineering outcomes. Option D is wrong because MFA is a compensating control, not a replacement for strong passwords — weak passwords still enable credential stuffing against other services and can be brute-forced if MFA is misconfigured or bypassed.

Practice this question →

MCQhard

An organization adopts the principle of least privilege (PoLP) across its server infrastructure. How should user accounts and service accounts be configured to adhere to this principle?

A.Service accounts are assigned domain administrator privileges to ensure background tasks never fail due to permissions.

B.Every user account is automatically granted local administrator rights on their assigned workstation by default.

C.Users and services are granted only the bare minimum permissions required to perform their explicit functions.

D.All administrators share a single root account with full access to simplify password management.

AnswerC

Least privilege means granting identities only the minimum rights needed for their explicit duties, with no standing excess permissions. This applies equally to user and service accounts, satisfying the stem's requirement by limiting each account's access scope to its defined function.

Why this answer

The principle of least privilege (PoLP) requires that users and service accounts are granted only the minimum permissions necessary to perform their explicit job functions. This limits the blast radius of compromised accounts and reduces the risk of accidental or malicious misuse. Applying PoLP to service accounts means avoiding over-privileged accounts that can perform unrelated administrative tasks.

Exam trap

FORTINET-NSE123 often tests whether candidates understand that least privilege applies to both human and service accounts, and distractors promote convenience over security.

How to eliminate wrong answers

Option A is wrong because granting domain administrator privileges to service accounts violates least privilege and creates a massive security risk if the account is compromised. Option B is wrong because automatically granting local administrator rights to every user account is the opposite of least privilege and increases attack surface. Option D is wrong because sharing a single root account eliminates accountability and violates least privilege by giving everyone full access.

Practice this question →

MCQeasy

A worker receives an email from an external partner containing a spreadsheet with macros enabled. When opened, the spreadsheet prompts the user to 'Enable Content' to view protected data. What foundational cybersecurity best practice should the user apply here?

A.Forward the spreadsheet to all company contacts for collaborative viewing

B.Print the spreadsheet immediately to a physical printer

C.Enable macros immediately so the file displays properly

D.Leave macros disabled unless the source is fully verified and trusted

AnswerD

Macro-enabled documents are a primary malware delivery vector, and 'Enable Content' executes embedded code. Leaving macros disabled unless the sender and file are independently verified blocks this execution path, satisfying the best-practice constraint the scenario tests.

Why this answer

The correct action is to leave macros disabled unless the source is fully verified and trusted. Macro-enabled documents are a common attack vector for malware delivery, as macros can execute arbitrary code when enabled. Since the email came from an external partner and the user cannot be certain of its legitimacy, the safest practice is to keep macros disabled and verify the sender through a separate channel before taking any further action.

Exam trap

FORTINET-NSE123 often tests the principle of least privilege and user awareness, where the trap is assuming that a file from a known external partner is automatically safe, leading candidates to choose enabling macros for convenience over security.

How to eliminate wrong answers

Option A is wrong because forwarding a potentially malicious spreadsheet to all company contacts would propagate the threat across the organization, increasing the attack surface and risking widespread compromise. Option B is wrong because printing the spreadsheet does not neutralize the macro threat; the malicious code remains in the file and could still execute if the document is later opened with macros enabled. Option C is wrong because enabling macros immediately bypasses the security control designed to prevent unauthorized code execution, directly exposing the system to potential malware infection.

Practice this question →

Multi-Selecthard

Which THREE of the following are common indicators that a system has been compromised by malware?

Select 3 answers

A.An unexpected increase in outbound network traffic.

B.Frequent, unexplained system crashes or freezes.

C.The system boot time remains consistent with previous months.

D.The computer performs regular daily virus definition updates.

E.Automatic creation of new, unrecognized administrative accounts.

AnswersA, B, E

Malware command-and-control and data exfiltration generate outbound connections to external hosts, so a sudden traffic spike beyond the established baseline indicates compromise. This satisfies the indicator criterion because normal user activity rarely produces sustained, unexplained egress growth.

Why this answer

Option A is correct because malware often exfiltrates data or communicates with command-and-control (C2) servers, producing an unexpected rise in outbound traffic that deviates from the host's normal baseline. Option B is correct because frequent, unexplained crashes or freezes can result from malicious code corrupting memory, consuming CPU/RAM, or interfering with kernel and driver operations. Option E is correct because automatic creation of new, unrecognized administrative accounts is a classic persistence and privilege-escalation indicator, often tied to backdoors or rootkits establishing unauthorized access.

Option C does not belong because a consistent boot time is a sign of normal, stable system behavior rather than compromise. Option D does not belong because regular daily virus definition updates indicate properly functioning endpoint protection, not malware infection.

Exam trap

FORTINET-NSE123 often tests whether candidates confuse normal system behaviors (like consistent boot time or regular updates) with indicators of compromise, leading them to select incorrect options.

Practice this question →

Multi-Selectmedium

A retail company wants to reduce the risk that stolen customer credit card numbers can be used if its database is breached. Which TWO practices best support this goal? (Choose two.)

Select 2 answers

A.Store card numbers in a plaintext file on the web server for quick reference by support staff.

B.Tokenize stored card numbers so the database holds non-sensitive tokens instead of the actual values.

C.Increase the database server's RAM so queries returning card numbers run faster.

D.Enable verbose SQL error messages so developers can debug database queries faster.

E.Encrypt the card number column with keys stored in a separate, access-controlled key management system.

AnswersB, E

Tokenization replaces sensitive card data with surrogate values that are useless outside the tokenization system. If the database is stolen, the tokens cannot be used to conduct transactions, directly reducing the value of the breach. This aligns with data-protection principles in NSE 1 foundational content, where minimizing the storage of sensitive data limits impact.

Why this answer

Both tokenization and strong encryption with separated key management ensure that exfiltrated card data cannot be directly used for fraud. Tokenization removes the sensitive value entirely from the database, while encryption keeps it unreadable without keys held elsewhere. Together they embody the principle of reducing the value of stolen data, a foundational concept in the NSE 1 curriculum.

Exam trap

The trap here is choosing operational or debugging conveniences such as verbose errors or extra memory, which do nothing to make stolen card data unusable.

Practice this question →

MCQhard

During an incident response review, it is discovered that an attacker gained access to an internal database by compromising a service account that had full administrative privileges across multiple disparate systems, far exceeding what was necessary for its routine function. Which security best practice was violated?

A.Separation of duties

B.Defense in depth

C.Security through obscurity

D.Principle of least privilege

AnswerD

The service account held administrative rights across multiple disparate systems, far beyond its routine function, directly breaching least privilege. This principle demands granting only the minimum access necessary for a defined task, so excessive standing privileges enabled the attacker's broad compromise.

Why this answer

The Principle of Least Privilege requires that accounts be granted only the minimum permissions necessary to perform their function. A service account with full administrative rights across multiple disparate systems clearly exceeds its required scope, so least privilege was violated. This over-provisioning is exactly what enabled the attacker to pivot broadly after compromising the account.

Exam trap

The trap is conflating 'least privilege' with 'separation of duties' — both are access-control principles, but only least privilege addresses the scope of permissions granted to a single account.

How to eliminate wrong answers

Option A is wrong because separation of duties concerns dividing critical tasks among different people to prevent fraud/error — it is not the principle that directly governs how much privilege a single account should hold. Option B is wrong because defense in depth is about layering multiple overlapping controls; the scenario describes excessive privilege on one account, not a missing layer. Option C is wrong because security through obscurity relies on hiding implementation details, which is unrelated to granting excessive permissions.

Practice this question →