NSE 2 Practice Exam — Technical Intro to Cybersecurity

A. To physically block malicious traffic at the perimeter B. To aggregate, correlate, and analyze log/event data from across the environment to detect threats C. To encrypt data at rest on servers D. To manage user password resets

Correct: B

A SIEM centralizes log data from many sources and applies correlation/analytics to surface threats that wouldn't be visible in any single log.

A. Comparing CPU usage across servers B. Linking related events from multiple sources to identify patterns a single log alone wouldn't reveal C. Backing up log files to cold storage D. Encrypting log data in transit

Correct: B

Correlation rules tie together events across devices/time (e.g. a failed VPN login followed by unusual file access) to reveal a pattern that no single event shows on its own.

A. A production environment used for live customer traffic B. An isolated environment where suspicious files are executed and observed for malicious behavior before being allowed onto the real network C. A backup copy of network configuration D. A discount testing license for a firewall

Correct: B

A sandbox detonates a suspicious file in isolation, watching what it actually does (file writes, network calls, process spawning) rather than trusting a static signature match.

A. It can catch unknown/zero-day malware that has no matching signature yet, by observing what it actually does B. It is faster than signature matching C. It requires no compute resources D. It only works on PDF files

Correct: A

Signatures only match known threats; behavioral analysis detects malicious intent from actions, which works even against malware with no prior signature.

A. Compliance reporting and audit trail retention B. Physical badge access control C. DNS resolution for the network D. Load balancing web traffic

Correct: A

Retained, searchable logs also satisfy audit and compliance requirements (e.g. proving what happened during an incident window), not just real-time detection.

A. A real threat that went undetected B. An alert that fires on benign activity, incorrectly flagged as malicious C. A confirmed and verified attack D. A system that is offline

Correct: B

A false positive wastes analyst time chasing something harmless; tuning detection rules aims to reduce these without missing real threats (false negatives).

A. NGFWs only filter by port number B. NGFWs add application awareness, user identity, and integrated threat inspection (IPS, AV, web filtering) on top of stateful inspection C. NGFWs cannot perform NAT D. NGFWs operate only at Layer 2

Correct: B

NGFWs keep the stateful engine as a base but layer application-, user-, and content-aware inspection on top, consolidating what used to be several separate appliances.

A. Encrypting disk storage B. Identifying and controlling traffic by the specific application generating it, rather than just port/protocol C. Managing firewall firmware updates D. Assigning IP addresses via DHCP

Correct: B

Modern apps share common ports (443), so App Control fingerprints traffic by behavior/signature to identify the actual application and enforce policy on it specifically.

A. Intelligently steering traffic across multiple WAN links based on real-time performance and business policy, instead of relying on one static path B. Encrypting data stored on disk C. Replacing the need for any firewall D. Assigning static IP addresses to LAN hosts

Correct: A

SD-WAN abstracts multiple transport links (MPLS, broadband, LTE) and picks the best path per application/policy in real time, rather than pinning traffic to one static circuit.

A. It removes the need for any WAN links B. Traffic can be both path-optimized and security-inspected at the same point, without backhauling to a separate device C. It disables encryption for performance D. It only works with a single ISP

Correct: B

Without integration, branch traffic would need to backhaul to a central firewall for inspection; secure SD-WAN applies full security at the branch edge itself.

A. A single physical monitor is required B. Centralized visibility and control across distributed sites/devices from one management console C. Only one administrator is allowed to log in D. All traffic must pass through one physical location

Correct: B

The term describes consolidated management/visibility tooling, not a physical or traffic-routing constraint.

A. Most modern traffic is encrypted, so without decrypting and inspecting it, threats hidden inside HTTPS traffic go unseen B. SSL inspection is only relevant for internal traffic C. It removes the need for any firewall policy D. It replaces the need for antivirus scanning

Correct: A

Without decrypting encrypted sessions, an NGFW's deep-inspection engines (IPS, AV, app control) are effectively blind to what's actually inside the traffic.

A. The cloud provider is responsible for everything, including customer data B. Security responsibilities are divided between the cloud provider (securing the underlying infrastructure) and the customer (securing what they configure/put in the cloud) C. The customer is responsible for physical data center security D. There is no division of responsibility in the cloud

Correct: B

The provider secures the infrastructure "of" the cloud; the customer is responsible for security "in" the cloud — data, access config, and workloads they deploy.

A. A tool that only encrypts endpoint hard drives B. A solution that continuously monitors endpoint activity to detect, investigate, and respond to threats C. A type of network switch D. A password manager for endpoints

Correct: B

EDR goes beyond traditional antivirus by continuously recording endpoint behavior, enabling detection of suspicious activity and giving responders the ability to investigate and remediate.

A. A physical firewall appliance in the data center B. A control point between users and cloud services that enforces security policy — visibility and data protection for SaaS usage C. A cloud provider's billing dashboard D. A backup solution for on-premises servers

Correct: B

A CASB sits (as a proxy or via API) between users and cloud/SaaS apps to give the organization visibility and policy enforcement it wouldn't otherwise have over third-party-hosted services.

A. Endpoints never connect outside the corporate network B. Devices roam, connect to untrusted networks, and can be compromised through means (USB, personal email) that bypass the perimeter entirely C. Endpoints don't run any software D. Perimeter security makes endpoint security unnecessary

Correct: B

A laptop that travels off-network, or a USB drive plugged in locally, never crosses the perimeter firewall at all — endpoint controls cover exactly the gap the perimeter can't see.

A. Nothing different — containers have identical exposure to the host B. Process and resource isolation that limits the blast radius if one workload is compromised C. It removes the need for any patching D. Automatic encryption of all network traffic

Correct: B

Containers isolate processes/filesystems from each other and the host, so a compromised container is (in principle) contained rather than immediately compromising everything else on the host.

A. Cloud services being used without visibility or approval from the security team, creating unmonitored and unmanaged risk B. Excessive logging of user activity C. Overly strict compliance policies D. Too many redundant backups

Correct: A

Shadow IT means data can flow into services security never assessed or approved — the org can't protect or even monitor what it doesn't know exists.

A. Log storage and long-term retention only B. The core next-generation firewall platform providing network security enforcement C. Endpoint antivirus agent D. Email gateway only

Correct: B

FortiGate is Fortinet's NGFW platform — the enforcement point for firewall policy, VPN, and integrated security profiles.

A. Centralized logging, reporting, and analytics across Fortinet Security Fabric devices B. Acting as the primary firewall for internet edge traffic C. Managing Wi-Fi access point firmware exclusively D. Providing endpoint antivirus signatures

Correct: A

FortiAnalyzer collects logs from FortiGates (and other Fabric devices) for centralized reporting, analytics, and long-term retention.

A. Centralized configuration, policy, and firmware management across multiple FortiGate devices B. Sandboxing suspicious files C. Acting as a SIEM for third-party devices only D. Providing SSL VPN client software only

Correct: A

FortiManager is the centralized management plane — pushing consistent policy, objects, and firmware to many FortiGates instead of configuring each device individually.

A. A cloud-hosted firewall management portal B. An endpoint agent providing VPN connectivity, endpoint protection, and compliance/telemetry back to the Fabric C. A dedicated hardware sandboxing appliance D. A load balancer for web servers

Correct: B

FortiClient is the endpoint-side agent — it's how a laptop gets VPN access and reports its security posture (compliance) into the wider Fabric.

A. A single standalone product with no integration B. An architecture where Fortinet (and third-party) security products share telemetry and coordinate response, rather than operating as isolated silos C. A physical cabling standard D. A licensing bundle with no functional integration

Correct: B

The Fabric's value proposition is integration — devices share visibility and can automate coordinated response (e.g. an endpoint alert triggering a firewall-level quarantine) rather than each product working in isolation.

A. Advanced/dynamic analysis of suspicious files to detect zero-day and evasive malware before they reach the network B. Storing firewall configuration backups C. Managing user password policies D. Acting as the primary internet-facing firewall

Correct: A

FortiSandbox provides the dynamic-detonation analysis referenced earlier in this exam — files suspicious enough to warrant deeper inspection get forwarded to it for behavioral verdicting.

A. Wireless access point firmware updates B. Centralized security information and event management — log aggregation, correlation, and analytics across the environment C. A dedicated email anti-spam gateway function only D. SD-WAN path selection

Correct: B

FortiSIEM is Fortinet's SIEM product — the same log-aggregation/correlation function covered earlier in this exam, extended across both Fortinet and third-party sources.