220-1202 Security Practice Questions

Question 1

A security analyst is reviewing a Windows 10 workstation that is suspected of being infected with malware. The analyst notices unusual network traffic and wants to identify the malware's persistence mechanism. Which of the following Windows locations should the analyst check? (Choose two.)

Accepted Answer

The Startup folder for the current user and all users. The Registry Run key and the Startup folders are two of the most common autostart locations that malware uses to maintain persistence. The Run key causes programs to execute at user logon, and the Startup folders contain shortcuts that launch at logon. Both are frequently checked during malware removal to identify and disable malicious autostart entries.

Answer

The Event Viewer Security log

Answer

The Task Scheduler library

Answer

The folder C:\Windows\System32\drivers\etc\hosts

Question 2

A small office has a Windows 11 Pro workstation that is not joined to a domain. The office manager wants to ensure that files containing customer credit card numbers are encrypted at rest so that if the drive is removed, the data cannot be read. The workstation does not have a TPM chip. Which Windows feature should be enabled to meet this requirement?

Accepted Answer

BitLocker with a startup PIN. BitLocker with a startup PIN is the correct answer because it provides full volume encryption and can be enabled without a TPM by requiring a pre-boot PIN. This ensures that if the drive is removed, the data remains encrypted and inaccessible. EFS only encrypts individual files, Device Encryption requires a TPM, and Storage Spaces does not provide encryption.

Answer

Encrypting File System (EFS)

Answer

Storage Spaces with parity

Answer

Device Encryption

Question 3

A technician is hardening a Windows 11 workstation that will be used by a remote employee. The goal is to reduce the attack surface against malware delivered through email attachments and malicious websites. Which two of the following built-in Windows features should the technician enable to meet this goal? (Choose two.)

Accepted Answer

Controlled folder access. The goal is to reduce the attack surface against malware arriving through email attachments and malicious websites. SmartScreen evaluates downloaded files and sites against reputation and blocks suspicious content, while Controlled folder access stops unauthorized applications from modifying protected user folders, limiting ransomware impact. RDP hardening, Windows Sandbox, and BitLocker address different risks and do not directly counter the named delivery vectors.

Answer

Remote Desktop Protocol with Network Level Authentication

Answer

BitLocker Drive Encryption

Answer

Windows Sandbox

Question 4

A security analyst is reviewing a Windows 11 event log and notices multiple failed logon attempts (Event ID 4625) for the built-in Administrator account from various source IP addresses. The account is currently disabled. Which of the following best describes what the analyst should do next?

Accepted Answer

Check the source IP addresses and block them at the firewall. The analyst should block the source IP addresses at the firewall to stop the brute-force attack. The built-in Administrator account is disabled, so the attack is unsuccessful, but blocking the IPs prevents further attempts. Enabling the account or resetting its password is unnecessary and risky, and disabling auditing would remove valuable evidence. Blocking the source IPs is the most effective immediate response.

Answer

Disable auditing for logon events to reduce log noise

Answer

Reset the password for the built-in Administrator account

Answer

Enable the built-in Administrator account to monitor its usage

Question 5

A user's Windows 11 computer is infected with malware that encrypts files and demands payment. The user has a recent full system image backup stored on an external drive that was connected during the infection. Which of the following is the best course of action?

Accepted Answer

Disconnect the external drive and scan it with antivirus software. The external drive was connected during the infection, so it may also be infected. Disconnecting it and scanning it with antivirus ensures that the backup is clean before restoration. Paying the ransom is not recommended, and restoring immediately or scanning only the system could reintroduce malware. The best course is to secure and scan the backup first.

Answer

Run a full system scan and then restore the backup

Answer

Restore the system image from the external drive immediately

Answer

Pay the ransom to get the decryption key

Question 6

A user reports that when they connect to the corporate Wi-Fi at a coffee shop, a browser warning appears stating the site's certificate is not trusted. The user is able to browse the internet but sees the warning on every HTTPS site. A technician suspects an on-path attack. Which of the following should the technician check FIRST to confirm the presence of an on-path attack?

Accepted Answer

The certificate chain presented by the browser to see if it is issued by an unknown or self-signed certificate authority.. The certificate chain is the most direct evidence of an on-path attack because the attacker must present a certificate to intercept TLS traffic. If the certificate is self-signed or issued by an untrusted CA, the browser will warn the user. DNS or ARP checks might reveal other attack vectors, but the certificate warning specifically indicates TLS interception, so examining the certificate chain confirms the attack.

Answer

The DNS server settings on the user's device and compare them to the corporate DNS servers.

Answer

The ARP cache on the user's device to look for duplicate MAC addresses.

Answer

The Wi-Fi encryption type configured on the user's device to ensure it is using WPA3.

Question 7

A technician is configuring a Windows 11 workstation for a small business that handles credit card payments. The owner wants to ensure that stored cardholder data cannot be read if the drive is removed and attached to another computer. Which Windows feature should the technician enable?

Accepted Answer

BitLocker. BitLocker encrypts the entire volume, so if the drive is removed and connected to another computer, the data remains unreadable without the recovery key or the original TPM. EFS, firewall rules, and UAC do not provide full-volume encryption, so they fail the physical-theft requirement. BitLocker is the correct built-in Windows feature for protecting data at rest.

Answer

Encrypting File System (EFS)

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Question 8

A user reports that when visiting a banking website, the browser displays a warning that the site's certificate is not trusted, even though the site worked yesterday. The technician verifies the system clock is correct and the network is functioning. Which of the following is the MOST likely cause?

Accepted Answer

The root certificate for the issuing CA was removed from the Trusted Root Certification Authorities store.. A browser trusts a TLS certificate only if it can chain it to a root CA in the Trusted Root Certification Authorities store. If that root was removed, the chain breaks and the browser warns that the certificate is not trusted. An expired certificate or DNS problem could also cause warnings, but the sudden failure with a correct clock points to a missing root certificate.

Answer

The user's account password has expired.

Answer

The website's TLS certificate has expired.

Answer

The DNS server is resolving the banking site to an incorrect IP address.

Question 9

A security analyst notices that several workstations on the same subnet are resolving popular banking domains to an IP address that belongs to an unknown server. The analyst confirms the DHCP server is legitimate and the DNS server settings have not been changed by Group Policy. Which of the following attacks is MOST likely occurring?

Accepted Answer

DNS poisoning. DNS poisoning inserts false records into a DNS resolver's cache, so clients receive attacker-controlled IP addresses for legitimate names. Because DHCP and Group Policy are intact, the misdirection must come from the DNS layer. Evil twin, ARP poisoning, and domain hijacking do not match the specific symptom of multiple clients resolving banking domains to an unknown server.

Answer

Evil twin

Answer

Domain hijacking

Answer

ARP poisoning

Question 10

A technician is asked to dispose of several old company laptops that contain sensitive customer data. The company wants to ensure the data cannot be recovered while still allowing the laptops to be donated. Which of the following should the technician perform?

Accepted Answer

Perform a secure erase or overwrite the drives.. Secure erase or overwriting renders the original data unrecoverable while keeping the drive usable, so the laptops can be donated. Physical destruction prevents donation, and formatting or repartitioning leaves recoverable data. The technician should choose a sanitization method that meets both the security and reuse goals.

Answer

Run a standard format on the drives.

Answer

Delete all partitions and create a new one.

Answer

Physically destroy the hard drives.

Security

220-1202 Security — Key Topics

Where candidates lose marks on Security