Priya Dogra – Certification | Jobs | Internships
Related Articles
Endpoint Monitoring quiz answers
These are the answers to the Endpoint Monitoring lesson quiz in Fortinet’s free Getting Started in Cybersecurity course, with a short explanation for every question. Getting Started in Cybersecurity is one of the two course options (with Technical Introduction to Cybersecurity) that, together with Introduction to the Threat Landscape, earns the Fortinet Certified Fundamentals (FCF) in Cybersecurity certification.
Course at a glance
- Provider: Fortinet Training Institute
- Cost: Free
- Course: Getting Started in Cybersecurity (15 short lessons, each with a quiz)
- Best for: Sales and non-technical roles that need a high-level view of security technology
- Counts toward: FCF in Cybersecurity (valid 2 years)
- Official course: training.fortinet.com
- Answers reviewed: November 2026
Fortinet updates its question banks from time to time. If you see a question that isn’t listed here, leave a comment with the question and we’ll add it.
Quiz questions and answers
Question 1: Which three strategies help secure unknown endpoints? (Choose three.)
- Configure network security devices to prevent unauthorized devices from accessing the network
- Enforce the principle of least privilege
- Upgrade antivirus software on all known network devices
- Force devices onto an isolated network until they are secured and registered
- Migrate network assets from a local physical network to the cloud
Why: Block unauthorised devices, apply least privilege and isolate unknown devices until they are secured and registered.
Question 2: Which two elements are a part of the endpoint monitoring category? (Choose two.)
- Endpoint auditing
- Endpoint protection platform (EPP)
- Data loss prevention (DLP)
- Intrusion detection systems (IDS)
Why: In the course, endpoint monitoring includes endpoint protection platforms (EPP) and intrusion detection systems (IDS).
Question 3: Which feature is a function of both EPP and EDR?
- Enforcement of security policies
- Administrative top-down visibility
- Data loss prevention
- Antivirus scanning
Why: Both EPP and EDR give administrators top-down visibility of endpoints.
Question 4: Which feature is a function of endpoint detection and response (EDP)?
- Enforces strong passwords
- Predicts malware using large databases of known attacks
- Enforces security policies
- Data loss prevention
Why: According to the course, EDR draws on large databases of known attacks to predict malware behaviour.
Question 5: Which two features are functions of an endpoint protection platform (EPP)? (Choose two.)
- Enforces security policies
- Updates a malware detection rule based on a CVE alert
- Predicts malware using large databases of known attacks
- Verifies versions of software and firmware
Why: EPP enforces security policies and checks software and firmware versions on endpoints.
Question 6: Which platform can preemptively block new, undiscovered attacks?
- Zero trust network access
- Next generation firewall
- Endpoint management system
- Endpoint detection and response
Why: EDR watches behaviour, so it can block new, previously unseen attacks before they do damage.
Questions from the older NSE 2 version of this lesson
Fortinet’s earlier NSE 2 course asked these questions on the same topic. They are kept here in case your quiz still shows them.
Question 1: Which type of malware seriously reduced the effectiveness of signature-based antivirus?
- Adware
- File-based
- Polymorphic
- Social engineering
Why: Polymorphic malware keeps changing its code, so fixed signatures stop matching it.
Question 2: Which attribute describes the earliest antivirus software?
- Detection and response
- Signature-based
- Polymorphic
- Machine learning
Why: The first antivirus products matched files against signatures of known malware.
Question 3: What was the culmination of endpoint security development?
- Artificial intelligence replaced EDR and EPP technologies
- EPP remained but EDR technology fell out of favour
- Web filtering technology replaced EPP
- EDR and EPP technologies merged
Why: Prevention (EPP) and detection and response (EDR) eventually merged into single endpoint solutions.
Question 4: Identify two problems that are solved by having a single security agent on endpoints. (Choose two.)
- Lack of integration between endpoint security products
- Lack of visibility into how many endpoints have not applied the latest security patches
- Multiple administration consoles adds complexity
- Some users visit dangerous websites
Why: A single agent removes the integration gaps and the multiple consoles that separate products create.
Question 5: Which service is used as part of endpoint detection and response (EDR)?
- Web filtering
- Antivirus (AV)
- Forensics investigation tool
- Device control
Why: EDR includes forensic tools for investigating what happened on an endpoint.
Question 6: Which description best identifies file-based malware?
- Exploits security loopholes and spreads only in the device memory
- The use of deception to manipulate individuals into divulging confidential information
- A large number of irrelevant or inappropriate messages sent over the internet
- A downloaded file, which when opened, runs malicious code or a script
Why: File-based malware is a downloaded file that runs malicious code or a script when it is opened.
Question 7: Which two prevention-focused attributes are found in most contemporary endpoint security solutions? (Choose two.)
- Remediation
- Machine learning (ML)
- Forensics
- Virtual patches
Why: Modern endpoint security uses machine learning and virtual patching to prevent attacks.
Question 8: Which three prevention-focused services are found in endpoint protection platform (EPP)? (Choose three.)
- Antivirus (AV)
- Forensics
- Remediation tools
- Data protection through encryption
- Web filtering
Why: EPP’s prevention services include antivirus, encryption-based data protection and web filtering.
Question 9: Why do threat actors target endpoints in a network?
- Endpoints have a greater monetary value than other assets, such as a database.
- Compromising endpoints offers a greater challenge.
- They are an easy point of entry into a network.
- Antivirus software on endpoints is inferior to that on servers.
Why: Endpoints are often the easiest way into a network.
Question 10: Which two types of devices are considered endpoints, according to the description in the lesson? (Choose two.)
- Databases
- Computer devices used by end users
- Internet of Things (IoT)
- Servers
Why: The lesson describes endpoints as end-user computing devices and Internet of Things (IoT) devices.
All Getting Started in Cybersecurity quiz answers
- Endpoint Monitoring (this page)
- Firewalls quiz answers
- Zero Trust Network Access (ZTNA) quiz answers
- Endpoint Hardening Techniques quiz answers
- Content Filters quiz answers
- SIEM quiz answers
- SOAR quiz answers
- Sandbox quiz answers
- Web Application Firewall (WAF) quiz answers
- SASE quiz answers
- Secure Email Gateway quiz answers
- Network Access Control (NAC) quiz answers
- Cloud Service Models quiz answers
- Wi-Fi quiz answers
- SD-WAN quiz answers
Frequently asked questions
Is Getting Started in Cybersecurity free?
Yes. It is free on the Fortinet Training Institute website; you only need a free account.
What is the difference between Getting Started and Technical Introduction to Cybersecurity?
Getting Started in Cybersecurity is a high-level course for sales and non-technical roles. Technical Introduction to Cybersecurity goes deeper and suits people heading into technical IT or security jobs. Either one, plus Introduction to the Threat Landscape, earns the FCF certification.
Did the old Fortinet NSE 2 course change?
Yes. Fortinet replaced the NSE 1–3 courses with the FCF curriculum. Many NSE 2 lesson topics now appear in Getting Started in Cybersecurity, which is why this page includes both the current and the older questions.
2 comments
Pingback: Fortinet SD-WAN Quiz Answers Explained | Priya Dogra
Pingback: Fortinet Web Application Firewall (WAF) Quiz Answers Explained | Priya Dogra