Courseiva

CCNA Nse 1 Foundational Cybersecurity Concepts Questions

18 of 93 questions · Page 2/2 · Nse 1 Foundational Cybersecurity Concepts topic · Answers revealed

Practice these questionsExam hubAll questions
76
MCQeasy

A new employee at a small accounting firm receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to avoid account suspension. The email address looks slightly misspelled, and the link points to a domain that is not the bank's real website. What type of attack is this?

A.A man-in-the-middle attack
B.A phishing attack
C.A brute-force attack
D.A denial-of-service attack
AnswerB

This is phishing because the email impersonates a trusted bank and tries to trick the employee into revealing credentials through a fraudulent link and misspelled sender address. Phishing is a social-engineering attack delivered electronically, and the combination of urgency, spoofed branding, and a deceptive URL matches the classic credential-harvesting pattern that Fortinet NSE 1 describes as a common initial access technique.

Why this answer

The email impersonates a trusted financial institution, creates urgency about account suspension, uses a look-alike sender address, and directs the recipient to a fraudulent domain to capture credentials. These are the defining traits of phishing, a social-engineering technique that targets the human element rather than a technical vulnerability. Recognizing the mismatched domain and unusual request is the key defensive skill.

Exam trap

The trap here is assuming that any suspicious email must be malware, when the scenario describes credential theft through deception rather than malicious code execution.

Practice this question →
77
Multi-Selecteasy

Which THREE of the following are recognized signs of a potential phishing attempt?

Select 3 answers
A.The email is sent during standard business hours.
B.The email uses urgent or threatening language to demand immediate action.
C.The sender's email address domain does not match the organization they claim to represent.
D.The email contains an unexpected attachment from an unknown sender.
E.The email is addressed to the employee by their correct first name.
AnswersB, C, D

Urgent or threatening language is a recognised social-engineering indicator, because phishing relies on manufactured time pressure to bypass the recipient's normal scrutiny before they verify the sender or link. This directly satisfies the stem's requirement for a behavioural sign of a potential phishing attempt, independent of any technical header or domain evidence.

Why this answer

Option B is correct because phishing emails frequently employ urgency or threats (e.g., "your account will be closed in 24 hours") to pressure victims into acting before they verify the request. Option C is correct because a mismatch between the sender's domain and the organization they claim to represent (e.g., support@paypa1-secure.com instead of paypal.com) is a classic spoofing indicator, since legitimate organizations send from their own registered domains. Option D is correct because an unexpected attachment from an unknown sender is a common malware delivery vector, often using weaponized files like .exe, .scr, or macro-enabled Office documents.

Option A is not a reliable indicator, since attackers routinely schedule phishing campaigns during business hours to blend in with normal traffic. Option E is also not a sign, because attackers often harvest the recipient's correct first name from social media or breached data to make the message appear more legitimate.

Exam trap

FORTINET-NSE123 often tests the ability to distinguish between common email characteristics and actual phishing indicators, such as mistaking a personalized greeting for a sign of legitimacy or assuming that business-hours sending is suspicious.

Practice this question →
78
MCQeasy

An office worker is leaving their desk for a 15-minute lunch break. What is the most critical immediate security action they should take before walking away?

A.Unplug the Ethernet network cable
B.Lock the workstation screen
C.Power down the computer completely
D.Minimize all open web browser windows
AnswerB

Locking the workstation screen immediately prevents physical access to the active session, satisfying the requirement to secure the unattended endpoint during a short absence. Unlike logging off, which terminates applications and sessions, locking preserves the worker's state while requiring re-authentication, making it the proportionate action for a 15-minute break.

Why this answer

Locking the workstation screen (e.g., via Windows+L or Ctrl+Alt+Del) immediately prevents unauthorized physical access to the session while the user is away. It is the fastest, most critical action to protect sensitive data and maintain accountability, and it does not disrupt ongoing work or network connectivity.

Exam trap

FORTINET-NSE123 often tests basic security hygiene, and candidates may overthink by choosing disruptive actions like unplugging cables or powering down instead of the simple, effective screen lock.

How to eliminate wrong answers

Option A is wrong because unplugging the Ethernet cable does not secure the local session; an attacker could still access the unlocked workstation and potentially reconnect the cable. Option C is wrong because powering down the computer is disruptive, may lose unsaved work, and is unnecessary for a short break; locking is sufficient. Option D is wrong because minimizing browser windows does not prevent access to the desktop or other applications, leaving the system vulnerable.

Practice this question →
79
MCQeasy

An employee finds a physical document containing sensitive customer records left unattended on a shared printer tray. What security awareness best practice does this situation highlight?

A.Network segmentation compliance
B.Endpoint firewall configuration
C.Clean desk policy adherence
D.Multi-factor authentication protocols
AnswerC

Leaving sensitive documents on a shared printer tray directly violates clean desk policy, which requires securing confidential material when unattended. This best practice prevents unauthorised viewing or removal of customer records in shared physical spaces.

Why this answer

The scenario describes sensitive documents left unattended on a shared printer, which directly violates the clean desk policy. A clean desk policy requires employees to secure sensitive materials (physical and digital) when leaving their workspace, including promptly retrieving printouts. This best practice minimizes the risk of unauthorized access, theft, or inadvertent disclosure of confidential information.

Thus, the situation highlights the need for clean desk policy adherence.

Exam trap

FORTINET-NSE123 often tests the distinction between physical and logical security controls, and candidates may mistakenly choose network or endpoint solutions when the scenario clearly involves physical document handling.

How to eliminate wrong answers

Option A is wrong because network segmentation compliance concerns logical separation of network resources to limit lateral movement, not physical document handling. Option B is wrong because endpoint firewall configuration involves host-based network traffic filtering, which is unrelated to physical security of printed documents. Option D is wrong because multi-factor authentication protocols strengthen logical access controls for systems and applications, not physical document security.

Practice this question →
80
MCQhard

A threat actor infects a critical file server with ransomware, encrypting all business-critical documents and demanding a monetary ransom for the decryption key. However, the organization is able to restore all systems and data within hours without paying the ransom. Which foundational security practice made this successful recovery possible?

A.Enforcing mandatory password complexity rules
B.Implementing strict egress firewall filtering
C.Deploying host-based intrusion detection systems
D.Maintaining immutable, offline data backups
AnswerD

Immutable, offline backups keep a clean copy of data beyond the ransomware's reach, so encrypted production systems can be rebuilt from unaffected media. This satisfies the recovery-without-ransom outcome, since restoration does not depend on the attacker's decryption key.

Why this answer

Immutable, offline backups allow the organization to restore encrypted data without paying the ransom because the backup copies are isolated from the ransomware's reach. Ransomware typically encrypts files on connected systems and network shares, but cannot modify offline or write-once media. This is why the 3-2-1 backup rule (3 copies, 2 media types, 1 offsite) and air-gapped/immutable storage are foundational resilience controls.

Exam trap

The trap is assuming that preventive controls like password policies or firewalls enable recovery; only isolated, immutable backups provide a reliable restoration path after ransomware encryption.

How to eliminate wrong answers

Option A is wrong because password complexity rules only slow credential-based attacks; they do nothing to recover encrypted data after ransomware executes. Option B is wrong because egress filtering may block command-and-control callbacks but does not restore encrypted files or prevent encryption from occurring. Option C is wrong because host-based IDS can detect malicious behavior but cannot decrypt files or provide recovery; it is a detective, not a restorative, control.

Practice this question →
81
MCQeasy

A remote worker receives a text message (SMS) from what appears to be their bank, stating that suspicious activity was detected and asking them to click a short link to confirm their identity. What term specifically describes this form of attack via SMS?

A.Spear phishing
B.Vishing
C.Whaling
D.Smishing
AnswerD

Smishing is phishing delivered by SMS: a text message impersonating a trusted entity, here the bank, and luring the recipient to click a link and surrender credentials. The term specifically names SMS-based social engineering, distinguishing it from email phishing.

Why this answer

Smishing is the specific term for phishing conducted via SMS text messages. The attacker impersonates a trusted entity (the bank) and uses a short link to lure the victim into clicking, which is the defining characteristic of SMS-based phishing. The 'SMS' + 'phishing' combination gives the term 'smishing'.

Exam trap

FORTINET-NSE123 often tests the distinction between phishing variants by delivery channel — candidates confuse smishing (SMS) with vishing (voice) or spear phishing (targeted email), so the key is to map the medium to the term.

How to eliminate wrong answers

Option A is wrong because spear phishing refers to a targeted email attack aimed at a specific individual or organization, not SMS. Option B is wrong because vishing is voice phishing conducted over phone calls or voicemail, not text messages. Option C is wrong because whaling is a subtype of spear phishing that specifically targets high-profile executives such as CEOs or CFOs, and it is not tied to SMS delivery.

Practice this question →
82
MCQeasy

An employee notices that a physical access control badge reader at the office entrance has been tampered with and a small unauthorized recording device is attached nearby. This scenario primarily represents a threat vector targeting which aspect of security?

A.Endpoint compliance
B.Network layer security
C.Physical security
D.Application layer security
AnswerC

Tampered badge readers and covert recording devices directly compromise the physical control layer protecting the entrance, enabling badge cloning or unauthorised entry. This satisfies the stem's constraint: the threat vector targets physical access mechanisms, not logical controls such as Microsoft Entra ID authentication or network-based defences.

Why this answer

The scenario describes tampering with a badge reader and attaching an unauthorized recording device — both are attacks against the physical access control infrastructure of a building. Physical security encompasses the controls (badge readers, locks, cameras, guards) that protect facilities and hardware from unauthorized physical access. Since the threat targets the badge reader itself rather than any network, endpoint, or application component, it falls squarely under physical security.

Exam trap

The trap here is conflating any security incident with network or endpoint security; candidates must recognize that tampering with a badge reader is a physical-layer threat, not a logical one.

How to eliminate wrong answers

Option A is wrong because endpoint compliance concerns the configuration and health posture of user devices (patch level, AV status, EDR agent), not tampering with a badge reader. Option B is wrong because network layer security deals with firewalls, segmentation, and protocols like IPsec/TLS protecting data in transit, not physical access hardware. Option D is wrong because application layer security addresses vulnerabilities in software (SQLi, XSS, insecure APIs), which is unrelated to a recording device attached to a door reader.

Practice this question →
83
MCQeasy

An end user receives an email from an external domain with a display name mimicking the company CEO, asking for an urgent wire transfer. What is the most accurate primary classification of this threat?

A.A brute-force credential stuffing attack.
B.A targeted spear-phishing attack designed for financial fraud.
C.An advanced persistent threat using zero-day malware.
D.A standard denial-of-service attack.
AnswerB

Spear-phishing fits because the message is tailored, not mass-sent: the attacker spoofs the CEO's display name and targets a specific employee to trigger an urgent wire transfer. This satisfies the stem's financial-fraud objective and external-origin constraint, distinguishing it from generic phishing, which lacks such targeting and pretext specificity.

Why this answer

This is a targeted spear-phishing attack (specifically a business email compromise / CEO fraud variant) where the attacker spoofs or mimics an executive's display name to pressure an employee into an urgent wire transfer. The defining traits — external domain, executive impersonation, urgency, financial request — map directly to spear-phishing for financial fraud. It is targeted, not mass, and relies on social engineering rather than malware.

Exam trap

The trap is that candidates see 'email' and 'CEO' and jump to generic phishing or APT, but the specific combination of executive impersonation plus financial urgency is the textbook definition of spear-phishing/BEC — pick the most precise classification.

How to eliminate wrong answers

Option A is wrong because brute-force credential stuffing involves automated login attempts using leaked username/password pairs, not a crafted email impersonating an executive. Option C is wrong because an APT with zero-day malware implies a sophisticated, persistent intrusion using undisclosed exploits — the scenario describes a single social-engineering email with no malware. Option D is wrong because a DoS attack targets availability by flooding services, which has nothing to do with a fraudulent wire-transfer request.

Practice this question →
84
MCQeasy

An employee receives an email claiming to be from the IT department requesting their network credentials to 'verify account security'. What is the most appropriate action?

A.Delete the email and clear the browser cache.
B.Click the link to check if the website looks authentic.
C.Reply to the email with the requested credentials to avoid account lockout.
D.Forward the email to the IT helpdesk using the official reporting procedure.
AnswerD

Forwarding the message to the IT helpdesk via the official reporting procedure lets security staff verify and block the phishing campaign while avoiding credential disclosure. This satisfies the requirement for the most appropriate action on a suspected credential-harvesting email.

Why this answer

Forwarding the suspicious email to the IT helpdesk via the official reporting procedure allows security teams to investigate, block the sender, and warn other employees who may have received the same message. It also avoids interacting with the malicious content, which is the safest course of action.

Exam trap

FORTINET-NSE123 often tests whether candidates choose 'delete and move on' as a safe-sounding option — the trap is that deletion destroys evidence and fails to protect other users, whereas reporting is the correct organizational response.

How to eliminate wrong answers

Option A is wrong because deleting the email and clearing the browser cache destroys evidence the security team needs and does nothing to protect other users who may have received the same phishing message. Option B is wrong because clicking the link — even just to 'check' — can trigger drive-by downloads, credential harvesting pages, or tracking pixels that confirm the address is active. Option C is wrong because replying with credentials hands them directly to the attacker and defeats the entire purpose of the phishing simulation or real attack.

Practice this question →
85
MCQhard

An enterprise is establishing a multi-layered security strategy for its infrastructure. Which implementation best demonstrates the concept of 'Defense-in-Depth'?

A.Implementing network segmentation, endpoint protection, multi-factor authentication, and user awareness training.
B.Relying solely on a next-generation firewall with advanced intrusion prevention configured at the edge.
C.Enforcing identical complex passwords across all local and cloud administrative portals.
D.Duplicating identical edge firewalls in an active-passive cluster for high availability.
AnswerA

Defense-in-Depth layers independent controls across network, endpoint, identity and human domains, so no single failure exposes the estate. This satisfies the stem's requirement for the best demonstration, since segmentation, endpoint protection, multi-factor authentication and training each cover distinct attack surfaces.

Why this answer

Defense-in-Depth means layering multiple independent security controls so that a failure in one does not compromise the whole system. Implementing network segmentation, endpoint protection, MFA, and user awareness training covers network, endpoint, identity, and human layers, which is the textbook example of a layered defense strategy.

Exam trap

FORTINET-NSE123 often tests the difference between redundancy (duplicating one control) and defense-in-depth (layering diverse controls), so candidates may pick the HA firewall option thinking more firewalls equals more depth.

How to eliminate wrong answers

Option B is wrong because relying solely on a next-generation firewall is a single point of failure and represents a 'perimeter-only' approach, not defense-in-depth. Option C is wrong because enforcing identical complex passwords across portals is a credential-reuse anti-pattern that increases blast radius if one portal is breached, and it is not a layered control. Option D is wrong because duplicating identical edge firewalls in active-passive HA provides availability, not defense-in-depth; it is redundancy of a single control, not multiple diverse controls.

Practice this question →
86
MCQeasy

What is the primary objective of a 'DDoS' attack?

A.To steal intellectual property.
B.To exhaust system resources and render a service unavailable.
C.To modify user permissions on the server.
D.To install a hidden backdoor for future access.
AnswerB

A DDoS attack floods a target with traffic from many distributed sources, consuming bandwidth, connection tables or CPU until legitimate users cannot reach the service. This resource-exhaustion mechanism directly satisfies the scenario's stated objective of rendering a service unavailable.

Why this answer

A DDoS (Distributed Denial of Service) attack aims to overwhelm a target's resources — bandwidth, CPU, memory, or connection tables — by flooding it with traffic from many distributed sources, making the service unavailable to legitimate users. The primary goal is disruption, not data theft or persistence.

Exam trap

FORTINET-NSE123 often tests the distinction between DDoS (availability/disruption) and other attack types like data theft, privilege escalation, or backdoor installation — candidates may pick 'steal data' because they conflate all cyberattacks with data breaches.

How to eliminate wrong answers

Option A is wrong because stealing intellectual property is the goal of espionage or data exfiltration attacks, not DDoS, which focuses on availability. Option C is wrong because modifying user permissions is a privilege escalation or insider threat objective, unrelated to the resource-exhaustion nature of DDoS. Option D is wrong because installing a backdoor is a persistence technique associated with APTs or malware, whereas DDoS is a volumetric or resource-depletion attack with no persistence mechanism.

Practice this question →
87
MCQeasy

When creating a new password for corporate accounts, which practice aligns with modern cybersecurity best practices for end users?

A.Writing the password on a sticky note attached to the monitor for easy access during shifts.
B.Using a long, unique passphrase managed by an approved enterprise password manager.
C.Reusing the same strong password across all personal and work applications for easy recall.
D.Using a short password with special characters and changing it every 30 days.
AnswerB

Length and uniqueness defeat brute-force and credential-stuffing attacks, while an approved enterprise password manager removes the need to memorise or reuse credentials. This satisfies the stem's requirement for a practice aligned with modern best practice, unlike forced complexity or periodic rotation.

Why this answer

Using a long, unique passphrase managed by an approved enterprise password manager aligns with NIST SP 800-63B and modern zero-trust guidance: length and uniqueness beat complexity and rotation. The password manager ensures each account has a distinct, high-entropy credential that the user never has to memorize or reuse, and enterprise approval ensures the vault meets organizational security and compliance requirements.

Exam trap

The trap is that candidates default to legacy advice — 'complex and rotated frequently' — when modern frameworks like NIST 800-63B explicitly favor length, uniqueness, and breach screening over complexity and forced rotation.

How to eliminate wrong answers

Option A is wrong because writing passwords on sticky notes exposes them to anyone with physical or camera access — a direct violation of confidentiality and a common audit finding. Option C is wrong because reusing a password across personal and work accounts means a breach on any one site enables credential stuffing against corporate systems, defeating the purpose of unique credentials. Option D is wrong because short passwords with special characters and 30-day rotation reflect outdated guidance — NIST 800-63B explicitly discourages forced periodic rotation and short complexity-based passwords in favor of length and breach screening.

Practice this question →
88
MCQeasy

An employee receives an email stating their account will be deactivated within 24 hours unless they click an embedded link and verify their credentials immediately. What psychological manipulation tactic is the attacker primarily leveraging?

A.Offering financial rewards for completing a corporate survey.
B.Creating a false sense of urgency and fear of loss.
C.Establishing authority by impersonating a system administrator calmly.
D.Providing technical assistance for routine software patching.
AnswerB

The 24-hour deactivation deadline paired with threatened account loss pressures the recipient to act before verifying the message. This leverages urgency and fear of loss, satisfying the stem's request for the primary psychological manipulation tactic rather than authority, curiosity, or reward-based lures.

Why this answer

The email uses a deadline ('deactivated within 24 hours') combined with a threat of losing account access, which is the textbook definition of urgency plus fear of loss — two of the most common social engineering levers. Attackers weaponize time pressure to short-circuit the victim's critical thinking so they click and enter credentials without verifying the sender. This is a hallmark of phishing and pretexting campaigns.

Exam trap

FORTINET-NSE123 often tests the confusion between authority and urgency — candidates see an 'account deactivation' notice and pick 'impersonating an administrator,' missing that the dominant lever here is the artificial deadline and fear of loss, not calm authority.

How to eliminate wrong answers

Option A is wrong because the email offers no financial reward or survey incentive — the lure is account deactivation, not a prize, so the manipulation tactic is not reward-based. Option C is wrong because although the attacker may imply authority, the message is not calm or authoritative in tone; it uses alarm and a hard deadline, which is urgency/fear, not composed authority. Option D is wrong because the email offers no technical assistance or patching help — it threatens loss of access, which is fear-based coercion rather than a helpful pretext.

Practice this question →
89
MCQhard

An organization implements a Zero Trust Network Access (ZTNA) model for remote workers. Unlike traditional remote access, how does ZTNA handle user authentication and resource authorization?

A.It verifies user identity and device health continuously, granting least-privilege access per application.
B.It trusts all devices once the initial corporate username and password are validated at the perimeter.
C.It automatically trusts all traffic originating from corporate-issued laptops without checking user credentials.
D.It relies entirely on physical network segmentation within the remote employee's home office.
AnswerA

ZTNA replaces perimeter trust with continuous verification of user identity and device posture, then issues per-application least-privilege access rather than broad network-level admission. This satisfies the stem's contrast with traditional remote access, which grants network access after a one-off login.

Why this answer

ZTNA (Zero Trust Network Access) operates on the principle of 'never trust, always verify' — it continuously validates both user identity and device posture (health, patching, compliance) on every session, not just at initial login. Access is granted on a per-application basis using least-privilege principles, so users only reach the specific apps they need rather than the whole network. This contrasts with traditional VPN-style remote access that grants broad network-level trust after a single authentication event.

Exam trap

FORTINET-NSE123 often tests the misconception that ZTNA is just 'VPN with MFA' — candidates pick options implying one-time authentication or device-only trust, missing that ZTNA requires continuous verification of both identity and device posture with per-application least privilege.

How to eliminate wrong answers

Option B is wrong because trusting all devices after a one-time username/password check at the perimeter is the classic perimeter-based (castle-and-moat) model that ZTNA explicitly replaces — ZTNA re-verifies continuously and never grants blanket trust. Option C is wrong because device ownership alone does not establish trust in ZTNA; device health and user identity must both be validated, and corporate-issued laptops can still be compromised or used by unauthorized users. Option D is wrong because ZTNA is a logical, identity- and policy-driven architecture delivered via software/cloud brokers — it does not depend on physical network segmentation in a home office, which is neither scalable nor enforceable.

Practice this question →
90
MCQmedium

What is the primary purpose of conducting regular security awareness training for non-technical employees in an organization?

A.To ensure all personnel understand how to compile source code securely.
B.To replace automated endpoint detection and response software with human monitoring.
C.To transform employees into an active defense layer capable of recognizing social engineering.
D.To train every staff member to write advanced firewall configuration scripts.
AnswerC

Training equips non-technical staff to spot phishing, pretexting and other social-engineering lures, turning them into an active defence layer that reports incidents. This directly addresses the human-targeted attack vector that technical controls alone cannot fully close.

Why this answer

Security awareness training's primary goal is to turn employees into a human sensor layer — teaching them to recognize phishing, pretexting, and other social engineering attacks and to report them. Since attackers frequently target people to bypass technical controls, an aware workforce is a critical defense layer. This is the core purpose of such programs for non-technical staff.

Exam trap

FORTINET-NSE123 often tests scope confusion — candidates pick options about coding or firewall scripting, missing that awareness training's purpose is specifically to build a human defense layer against social engineering, not to teach technical skills.

How to eliminate wrong answers

Option A is wrong because secure source code compilation is a developer-specific skill, not the purpose of general security awareness training for non-technical employees. Option B is wrong because awareness training does not replace EDR software — human monitoring cannot substitute for automated detection and response at scale, and the two are complementary, not replacements. Option D is wrong because writing firewall configuration scripts is a specialized network/security engineering task, far outside the scope of awareness training for non-technical staff.

Practice this question →
91
MCQeasy

A new hire at a financial services firm receives an email that appears to come from the CEO, asking them to urgently purchase gift cards for a client appreciation event and to send the redemption codes by reply email. The message uses the CEO's correct name and photo but originates from an external address. Which type of attack is this?

A.Business Email Compromise (BEC) using impersonation
B.A phishing email delivering a malicious macro document
C.A denial-of-service attack against the mail server
D.A watering hole attack targeting the finance department
AnswerA

This is a classic BEC impersonation: the attacker spoofs or mimics a trusted executive to pressure an employee into an unauthorized transfer of value. The request for gift card codes, urgency, and external origin are hallmark indicators. Fortinet's NSE 1 foundational material classifies such executive-impersonation fraud under social engineering and BEC because it exploits authority and trust rather than a software vulnerability.

Why this answer

The message impersonates a senior executive, creates urgency, and requests an untraceable transfer of value to an external party. That combination defines Business Email Compromise, a social engineering category emphasized in NSE 1 foundational training. Recognizing authority impersonation and unusual payment requests is a core user-level defense, since technical filters cannot reliably catch every spoofed executive message.

Exam trap

The trap here is assuming any email asking for money is ordinary phishing, when executive impersonation with no malicious link or attachment is specifically classified as Business Email Compromise.

Practice this question →
92
MCQmedium

A user receives a phone call from someone claiming to be from the corporate IT helpdesk, urgently asking for their network password to resolve a critical security alert. What social engineering tactic is being used?

A.Watering hole attack
B.Phishing via SMS (Smishing)
C.Credential stuffing
D.Voice phishing (Vishing)
AnswerD

Vishing uses a telephone call to manipulate the target into disclosing credentials, precisely matching the stem's scenario of a fraudulent helpdesk caller demanding the network password under urgency. Unlike email-based phishing, the voice channel supplies real-time pressure and impersonation, satisfying the social engineering tactic described.

Why this answer

Voice phishing (vishing) is a social engineering attack where the attacker uses a phone call to manipulate the victim into revealing sensitive information, such as passwords. In this scenario, the caller impersonates IT helpdesk and creates urgency, which are classic vishing tactics. Vishing exploits human trust over the phone rather than technical vulnerabilities.

Exam trap

FORTINET-NSE123 often tests whether candidates can differentiate social engineering vectors by communication channel, and distractors mix up phishing, smishing, and vishing.

How to eliminate wrong answers

Option A is wrong because a watering hole attack involves compromising a website frequented by a target group to deliver malware, not a phone call. Option B is wrong because smishing uses SMS text messages, not voice calls, to phish victims. Option C is wrong because credential stuffing is an automated attack that uses previously breached username/password pairs to gain access, not a social engineering phone call.

Practice this question →
93
MCQhard

An organization performs a risk assessment and decides to implement firewall rules, intrusion prevention systems (IPS), and encryption to reduce the likelihood and impact of a cyber attack. What risk management strategy are they employing?

A.Risk transfer, purchasing cyber insurance to shift financial liability to a third party.
B.Risk acceptance, choosing to absorb the financial impact if an incident occurs.
C.Risk avoidance, eliminating the business activity entirely to prevent exposure.
D.Risk mitigation, deploying technical controls to lower the probability and impact of threats.
AnswerD

Deploying firewall rules, IPS and encryption directly reduces both the likelihood and impact of threats, which is the definition of risk mitigation. These technical controls satisfy the stem's requirement to lower risk rather than transfer, avoid or accept it, matching the strategy the organisation selected after its assessment.

Why this answer

The organization is implementing technical controls—firewall rules, IPS, and encryption—specifically to reduce the likelihood (via prevention) and impact (via protection) of a cyber attack. This is the definition of risk mitigation, which focuses on lowering risk to an acceptable level rather than eliminating it entirely or shifting it to another party. Risk mitigation is the most common strategy in cybersecurity because it balances security with business needs.

Exam trap

The trap here is confusing risk mitigation with risk transfer or avoidance, as candidates may think any risk-related action falls under a single category, but the key is that mitigation reduces risk through controls, while transfer shifts it and avoidance eliminates the activity.

How to eliminate wrong answers

Option A is wrong because risk transfer involves shifting financial liability to a third party, typically through cyber insurance or outsourcing, not deploying technical controls. Option B is wrong because risk acceptance means acknowledging the risk and taking no action to reduce it, often because the cost of mitigation exceeds the potential loss. Option C is wrong because risk avoidance requires eliminating the risky activity altogether, such as discontinuing a service or process, which is not what the organization is doing here.

Practice this question →
← PreviousPage 2 of 2 · 93 questions total

Ready to test yourself?

Try a timed practice session using only Nse 1 Foundational Cybersecurity Concepts questions.

Start 20-question session