Nse 1 Foundational Cybersecurity Concepts practice questions

Leaving visitor logs and visitor badges unattended on the front reception desk for anyone to take

Why it fails: Unattended visitor logs expose sensitive guest data and compromise front-desk security.

Propping open secure exterior fire doors to let fresh air into the building

Why it fails: Propping open secure doors bypasses physical access control and allows tailgating.

A smart card and a hardware security token.

Why it fails: Both represent 'something you have', which is only a single factor category.

A biometric fingerprint scan and a facial recognition scan.

Why it fails: Both are biometric factors ('something you are'), representing only one category.

A password and a PIN memorized by the user.

Why it fails: Both a password and a PIN are knowledge factors, violating the requirement for multiple distinct categories.

Connecting to corporate systems through a secure enterprise VPN with MFA enforced.

Why it fails: Using a secure VPN with MFA is a best practice, not poor hygiene.

Allowing family members to use the corporate laptop for personal web browsing and gaming.

Why it fails: Sharing corporate devices for personal use by non-employees introduces significant malware and data leakage risks.

Reusing the exact same corporate network password for personal social media and streaming accounts.

Why it fails: Password reuse across personal and work domains is a major risk factor if personal sites are breached.

multi_select

Why it fails: ...

multi_select

Why it fails: ...

multi_select

Why it fails: ...

multi_select

Why it fails: ...

Enabling SMTP relaying for all internal users.

Why it fails: Open relaying is a security vulnerability, not a protection.

Requiring all users to use digital signatures for internal emails only.

Why it fails: External spoofing must be addressed at the gateway level via DNS records.

multi_select

Why it fails: ...

Disabling all attachments in incoming emails.

Why it fails: This is a restrictive policy, but it does not specifically prevent domain spoofing.

Watering hole attack

Why it fails: Watering hole attacks compromise a website the target group frequents, infecting visitors who browse it. Here the delivery vector is physical removable media, so no website is involved. Watering hole would be correct if attackers had breached a trusted site the employees routinely visit.

Tailgating

Why it fails: Tailgating is physically following an authorised person through a secured door without credentials. No entry point or access control is bypassed here; the attack relies on an employee plugging in dropped media. Tailgating would be correct if the attacker gained unauthorised physical entry to the building.

Phishing

Why it fails: Phishing delivers a fraudulent message electronically, typically email, to trick recipients into clicking links or opening attachments. This scenario uses physical USB drives left in a car park, with no electronic message sent. Phishing would be correct if the lure arrived via email or another digital channel.

Endpoint compliance

Why it fails: Endpoint compliance concerns the configuration and health of managed devices such as laptops and servers, not a hardware reader at a doorway. It would be the correct aspect if the tampering involved an unpatched workstation or missing endpoint agent on a corporate machine.

Network layer security

Why it fails: Network layer security covers traffic inspection, segmentation and protocol attacks, whereas the badge reader and recording device are physical artefacts at the entrance. It would be correct if the attacker intercepted or spoofed network traffic to reach internal systems.

Application layer security

Why it fails: Tampering with a badge reader and attaching a recording device is a physical attack on the entry point, not exploitation of software flaws such as injection or insecure APIs. Application layer security would be the answer if the attacker targeted a web application's input handling instead.

Separation of duties

Why it fails: Separation of duties splits a sensitive task across multiple people so no single identity holds end-to-end control; here one service account held all privileges, so the failure is excessive privilege scope, addressed by least privilege. Separation of duties would be correct where one person could otherwise both initiate and approve a payment.

Defense in depth

Why it fails: Defence in depth layers independent controls so one failure does not grant access; the stem describes a single over-privileged account, not missing layers. It would be correct where an attacker must be stopped at multiple successive boundaries, such as network, host and application controls.

Security through obscurity

Why it fails: Security through obscurity hides design or implementation details, which the stem never mentions; the actual flaw is a service account holding far more privilege than its routine function requires. Obscurity would be the intended answer only where secrecy of design is the control under discussion.

A SQL injection exploit

Why it fails: SQL injection targets database-driven web applications by inserting malicious query syntax; it does not produce browser pop-ups or phone numbers. It tempts as a recognised web attack, but the scenario describes tech-support scareware, a social-engineering scam.

A distributed denial-of-service attack

Why it fails: A DDoS attack floods a service with traffic to exhaust its capacity, so it cannot generate browser pop-ups or toll-free support prompts. It is tempting because both involve malicious internet activity, but DDoS would be the answer if the scenario described degraded availability rather than a social-engineering lure.

A legitimate endpoint telemetry notification

Why it fails: Legitimate endpoint telemetry arrives through managed security agents and consoles, never as unsolicited browser pop-ups demanding a phone call. It is tempting because genuine alerts do report infections, but that would fit a scenario where a known EDR or antivirus tool surfaces a verified detection to an administrator.

It guarantees complete encryption of all local workstation files

Why it fails: Multi-factor authentication verifies identity; it does not encrypt files on the endpoint, which requires full-disk encryption such as BitLocker. It is tempting because the VPN does encrypt traffic in transit, but that protects the tunnel, not local workstation storage, so file encryption remains a separate control.

It prevents all forms of social engineering attacks against remote workers

Why it fails: Push-based MFA raises the cost of credential-based attacks but cannot stop social engineering that tricks a user into approving a prompt or revealing a code. It is tempting because MFA blocks many phishing attempts, yet real-time phishing and MFA-fatigue attacks still succeed, so prevention is not absolute.

It entirely eliminates the need for strong passwords on corporate accounts

Why it fails: MFA supplements passwords rather than replacing them; the password remains the first factor, and weak or reused credentials still expose accounts to spraying and credential-stuffing. It is tempting because MFA adds a strong second layer, but password strength and uniqueness remain necessary, so elimination is not achieved.

Enforcing mandatory password complexity rules

Why it fails: Password complexity slows credential-based intrusion but does nothing once ransomware has encrypted files; it provides no restoration path. It is tempting because strong authentication is a foundational control, yet the scenario's rapid recovery depended on having recoverable data copies. Complexity rules cannot decrypt or replace lost documents.

Implementing strict egress firewall filtering

Why it fails: Egress filtering restricts outbound traffic, which can block command-and-control or exfiltration, but it neither preserves nor restores encrypted data. It is tempting because it limits ransomware damage propagation, yet the stem's recovery came from having restorable copies. Backups, not outbound firewall rules, enabled the swift rebuild.

Deploying host-based intrusion detection systems

Why it fails: Host-based intrusion detection monitors and alerts on suspicious local activity but performs no backup or restore function, so it cannot recover encrypted files. It is tempting because it detects ransomware behaviour, yet detection alone leaves data encrypted. Recovery within hours requires immutable or offline backups, not endpoint monitoring.

Integrity

Why it fails: Integrity guards data against unauthorised modification, whereas sniffing is passive reading; HTTPS and SSH encrypt payloads so captured packets stay unreadable, which is confidentiality. It tempts because encryption also carries integrity checks, and would be correct if the threat were tampering with traffic in transit.

Availability

Why it fails: Encryption counters eavesdropping on a shared segment, which is confidentiality; availability concerns uptime and resilience against denial of service, not preventing unauthorised reading of traffic. It tempts because encryption supports always-on secure access, and would be correct if the requirement were redundant links or DDoS mitigation.

Non-repudiation

Why it fails: Non-repudiation proves a party performed an action, typically via digital signatures, and does not stop a sniffer reading plaintext on a shared segment; encryption delivers confidentiality. It tempts because both rely on cryptography, and would be correct if the requirement were proving who sent or approved a transaction.

Click the link to verify if the website looks authentic before reporting it

Why it fails: Clicking the link risks credential harvesting, drive-by malware or session theft, and merely viewing a page cannot verify legitimacy since attackers clone HR portals convincingly. The correct action is reporting the message through internal channels without interacting. Clicking would be defensible only for a known, independently verified sender address.

Forward the email to all colleagues as a warning

Why it fails: Forwarding the email to colleagues amplifies the phishing attempt and exposes others, rather than reporting it to IT or security. It is tempting because warning teammates feels responsible, but bulk forwarding is the correct action only for confirmed, non-malicious informational notices, not suspected phishing.

Reply to the sender asking for verbal confirmation of their identity

Why it fails: Replying confirms the mailbox is live and invites the attacker to continue the conversation with further social engineering; a reply cannot establish identity because the From address is spoofable. The correct action is reporting the email to the security team without responding. Replying would suit a verified internal contact via a separate trusted channel.

Spear phishing

Why it fails: Spear phishing is a targeted email attack crafted for a specific individual, delivered through mail rather than SMS. It would apply if the message arrived in the worker's inbox and referenced personal details, whereas SMS-based lures carry their own distinct term.

Vishing

Why it fails: Vishing is voice phishing conducted by telephone call, where an attacker verbally impersonates an institution. It would be the correct term if the worker received a phone call from someone claiming to be the bank, rather than an SMS containing a link.

Whaling

Why it fails: Whaling targets senior executives such as CEOs or CFOs with highly tailored messages, typically by email. It would be correct if the recipient held an executive role and the lure was personalised to them, not a generic SMS sent to an ordinary remote worker.

A sequence of consecutive keyboard keys like 'qwertyuiop123!' for ease of typing

Why it fails: Sequential keyboard rows are predictable and appear in cracking dictionaries, so they fail the privileged-account strength requirement. It tempts because such strings are easy to type and remember, and a long random passphrase would be the correct choice when memorability must be balanced with entropy.

A password reused from personal social media accounts to ensure easy recall

Why it fails: Reusing a personal social media password exposes the privileged account to credential-stuffing once that external site is breached. It tempts because recall is effortless, and a unique randomly generated password stored in a password manager would be correct when the account must remain uncompromised.

A short word combined with the current year, such as 'Summer2026!'

Why it fails: 'Summer2026!' follows a predictable pattern attackers enumerate first: dictionary words, seasons, years and trailing symbols. It fails the length and randomness a privileged account demands. Such constructions suit low-risk consumer logins where memorability outweighs brute-force resistance, but privileged credentials require long, randomly generated passphrases stored in a vault.

Unplug the Ethernet network cable

Why it fails: Unplugging Ethernet leaves the machine powered on and unlocked, so anyone can still access the session, files and cached credentials; Wi-Fi may also remain active. It is tempting because it appears to sever network access, but physically disconnecting a cable is not a session-locking control and is impractical on wireless or docked laptops.

Power down the computer completely

Why it fails: A full power-down takes longer than the break and leaves the session unprotected during shutdown; the immediate control is locking the screen (Windows+L), which instantly requires re-authentication. It is tempting because powering off seems maximally secure, but for a 15-minute absence it delays work and is unnecessary.

Minimize all open web browser windows

Why it fails: Minimising browser windows leaves the desktop, applications and session fully accessible to anyone passing the desk; locking the workstation is the immediate control. It is tempting because it hides visible content, but minimising provides no authentication barrier and does not protect email, files or the OS session.

Mandatory access control labeling

Why it fails: Mandatory access control labelling restricts which subjects may access which objects; it does not separate the approval and deployment duties of administrators. It is tempting because MAC is a genuine governance control, and it would be correct where the requirement is enforcing data classification boundaries rather than preventing one person from both approving and deploying changes.

Single sign-on federation

Why it fails: Single sign-on federation centralises authentication across services; it does not divide approval from deployment authority, so one administrator still holds both. It is tempting because SSO is a common governance control, and it would be correct where the requirement is consolidating identities and credentials rather than enforcing separation of duties.

Role-based access auditing

Why it fails: Auditing only records who changed what after the fact; it cannot block a single administrator from both approving and deploying a rule. Separation of duties is required, splitting approval from execution. Auditing suits detective compliance reporting, not preventing unilateral high-risk changes.

Failure to implement adequate endpoint antivirus software

Why it fails: Endpoint antivirus detects malicious software on devices; the failure here is that the account was never disabled, so the former employee logs in legitimately. Antivirus would be the right control against malware execution on an endpoint.

Absence of hardware token multi-factor authentication

Why it fails: Hardware tokens bind authentication to a physical device, but the exposure stems from accounts surviving termination, not weak authentication factors. It would be the right control where credential theft or phishing is the risk, since a stolen password alone could not authenticate.

Lack of network segmentation between departments

Why it fails: Lack of network segmentation addresses lateral movement after an attacker is already inside, not the persistence of a departed employee's credentials. It is tempting because segmentation genuinely limits breach spread, and would be the right control if the concern were containing an active intruder moving between departments. Here, the failure is offboarding: accounts were never disabled.

Network boundary defense

Why it fails: Network boundary defence concerns perimeter controls such as firewalls and DMZs, not endpoint application approval. It tempts candidates picturing layered security, but boundary defence is correct when the scenario involves filtering traffic entering or leaving a network segment rather than controlling local software installation.

Asymmetric encryption key management

Why it fails: Asymmetric encryption key management governs key pairs for confidentiality and authentication, not application control. It cannot block unapproved installations or push software centrally. It is tempting because it underpins code-signing and TLS, and would be correct where the requirement is verifying publisher signatures or protecting keys, rather than restricting which applications users may install.

Principle of fail-secure

Why it fails: Fail-secure governs how a system behaves on failure, defaulting to denial; it does not describe restricting installation rights. It tempts candidates associating denial with security, but fail-secure is correct when designing a device to lock down rather than permit access during an outage.

Misconfigured firewall security policies

Why it fails: The call exploits human trust and urgency, not network filtering, so firewall policy configuration is irrelevant to the helpdesk's decision to reset credentials. It tempts because firewalls govern access control generally, and a misconfigured firewall would be correct if the attacker were bypassing network segmentation instead.

Cryptographic weak implementation

Why it fails: This attack exploits human trust through social engineering, not any weakness in encryption algorithms or key management. Cryptographic weaknesses concern broken ciphers, poor key storage or flawed protocols. The scenario involves no cryptography at all, so this option misidentifies the vulnerability class entirely.

Unpatched operating system kernel bugs

Why it fails: The attack exploits human trust and helpdesk verification gaps, not kernel code flaws; no software vulnerability is involved. It is tempting because unpatched kernels are a genuine compromise vector, and it would be correct if the attacker gained code execution through a known privilege-escalation CVE.

Drive-by download

Why it fails: A drive-by download exploits a browser or plugin vulnerability to install malware when a user merely visits a compromised page; no phone call or verbal request occurs here. It is tempting because both are social-adjacent initial access vectors, and it would be correct if the employee's web browsing had silently installed malicious code.

Denial of service

Why it fails: Denial of service floods a system or network to exhaust resources and disrupt availability; it involves no impersonation or credential harvesting. It is tempting because both attacks target the organisation, and it would be correct if the caller's goal were to overwhelm a service rather than obtain the employee's password.

Phishing via email

Why it fails: Phishing via email delivers fraudulent messages through email; this attack arrives by telephone voice call, making it vishing. It is tempting because the pretext, impersonation and urgency are identical social-engineering traits, and it would be correct had the request for credentials arrived in the employee's inbox instead.