220-1202 Practice Test 24 — 15 Questions

Question 1

During a security audit, it is discovered that a former employee's user account is still active and has been used to log in remotely three times in the past month. Which logical security principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege requires that users have only the access necessary for their job. An inactive account with remote access violates this and also the principle of account lifecycle management. The immediate issue is that the account should have been disabled upon termination.

Answer

Separation of duties

Answer

Defense in depth

Answer

Mandatory access control

Question 2

A technician is setting up a new wireless network for a small office. They want to ensure that only company-issued devices can connect, and that data transmitted over the air is encrypted. Which combination of settings should they use?

Accepted Answer

WPA3 with AES encryption and MAC address filtering.. WPA2 or WPA3 with AES encryption provides strong wireless security. MAC address filtering can be added as an extra layer to restrict which devices can associate. This combination meets both requirements of encryption and device restriction.

Answer

WPA2 with TKIP encryption and SSID broadcast disabled.

Answer

WEP with 128-bit key and a strong password.

Answer

Open network with a captive portal requiring employee login.

Question 3

A company's security policy mandates that all remote access connections must be authenticated using two different factors. A technician is configuring VPN access for teleworkers. Which combination meets this requirement?

Accepted Answer

Smart card and PIN.. Multifactor authentication requires two or more factors from different categories: something you know (password), something you have (smart card, token), and something you are (biometric). A password plus a one-time code from a hardware token uses two distinct factors, satisfying the policy.

Answer

Username and password only.

Answer

Biometric fingerprint and a PIN.

Answer

Two different passwords.

Question 4

A technician discovers that a user has been sharing their login credentials with coworkers to allow them to access a shared drive. The company's security policy prohibits password sharing. What is the most effective way to prevent this behavior while still allowing necessary access?

Accepted Answer

Configure the shared drive permissions using security groups and add the coworkers to the appropriate group.. The root cause is that the shared drive access is tied to individual accounts, encouraging sharing. Implementing group-based permissions with proper access control lists (ACLs) allows the company to grant access to a group rather than an individual, eliminating the need to share passwords. Additionally, enforcing a policy of non-repudiation and using audit logs can deter sharing.

Answer

Disable the user's account and create a generic shared account for the drive.

Answer

Implement a Group Policy that forces password changes every 30 days.

Answer

Send a company-wide email reminding users not to share passwords.

Question 5

A user reports that they can no longer access their encrypted files after a recent password change. The files were encrypted using EFS on a Windows 10 Pro workstation. What is the most likely cause of this issue?

Accepted Answer

The user did not back up their EFS certificate before changing the password.. EFS (Encrypting File System) ties file encryption to the user's password. When the password is changed without the proper certificate backup, the encryption key may become inaccessible. This question tests the understanding that EFS keys are protected by the user's password and require a backup certificate or recovery agent to avoid data loss after password changes.

Answer

The user changed the password via Ctrl+Alt+Del, which invalidates the EFS certificate.

Answer

The user's account was removed from the local Administrators group during the password change.

Answer

The hard drive has a hardware failure that corrupted the encrypted files.

Question 6

A small business wants to ensure that only authorized personnel can access the server room. The budget is limited, and they need a simple, cost-effective solution. Which logical security control should they implement first?

Accepted Answer

Require a smart card or key fob to unlock the door.. Logical security controls restrict access to digital resources. For physical access to a server room, a smart card or key fob system provides a good balance of cost and security by requiring something the user possesses. This question tests the understanding of logical versus physical controls and the principle of least cost for basic access control.

Answer

Install a biometric fingerprint scanner on the door.

Answer

Implement a strong password policy for all user accounts.

Answer

Hire a security guard to check IDs at the entrance.

Question 7

A user complains that their computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What is the most likely security issue?

Accepted Answer

The system is infected with adware that displays unsolicited advertisements.. Adware is a type of malware that displays unwanted advertisements and often installs toolbars or other software without user consent. It can significantly degrade system performance. This question tests the ability to identify adware based on symptoms like pop-ups and unauthorized toolbars.

Answer

A rootkit has hidden itself in the system's firmware.

Answer

A worm is spreading through the network, consuming bandwidth.

Answer

A Trojan horse has stolen the user's banking credentials.

Question 8

During a security audit, an administrator discovers that several employees have written their domain passwords on sticky notes attached to their monitors. The company policy requires strong passwords and prohibits sharing credentials. Which security principle is being violated?

Accepted Answer

Password confidentiality. Password confidentiality is a core security principle; passwords must be kept secret and not be easily observable. Writing passwords on sticky notes directly violates this by making them visible to anyone nearby. This question tests the understanding of password security best practices and the concept of confidentiality.

Answer

Principle of least privilege

Answer

Account lockout policy

Answer

Multi-factor authentication

Question 9

A company is implementing a new policy that requires users to authenticate using both a password and a one-time code sent to their mobile phone. What type of authentication factor is the one-time code?

Accepted Answer

Something you have. Authentication factors are categorized as something you know (password), something you have (token or phone), and something you are (biometrics). A one-time code sent to a mobile phone is considered 'something you have' because access to the phone is required. This question tests the classification of multi-factor authentication components.

Answer

Something you are

Answer

Something you know

Answer

Somewhere you are

Question 10

A technician is configuring a small office network and wants to ensure that guest users can access the internet but cannot connect to internal company resources like file servers or printers. Which logical security method should be implemented?

Accepted Answer

Implement a guest VLAN that is isolated from the internal network.. Network segmentation, often achieved through VLANs, separates network traffic into distinct broadcast domains. A guest VLAN can be configured with access only to the internet, while internal resources remain on a separate VLAN with restricted access. This question tests the understanding of network segmentation as a logical security control.

Answer

Enable MAC address filtering on the wireless access point.

Answer

Require a complex password for the guest Wi-Fi network.

Answer

Disable the SSID broadcast for the guest network.

Question 11

A user receives an email that appears to be from their bank, asking them to click a link and verify their account information due to 'suspicious activity.' The email address looks legitimate, but the link points to a different domain. What type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers impersonate a trusted entity to trick victims into revealing sensitive information. The suspicious link is a key indicator. This question tests the ability to recognize phishing attempts based on common characteristics like urgent language and deceptive links.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 12

An organization wants to ensure that even if a laptop is stolen, the data on the hard drive cannot be read. The laptop runs Windows 10 Pro and is used by employees who travel frequently. Which security feature should be enabled?

Accepted Answer

Enable BitLocker Drive Encryption on the system drive.. Full disk encryption (FDE) protects all data on the drive by encrypting it, making it unreadable without the decryption key. BitLocker is the native FDE solution in Windows 10 Pro. This question tests the understanding that FDE is the appropriate countermeasure for data theft from stolen devices, as opposed to file-level encryption or access controls.

Answer

Set a strong BIOS/UEFI password.

Answer

Configure a screensaver password with a short timeout.

Answer

Use EFS to encrypt individual files and folders.

Question 13

A company's security policy requires that all laptops have a TPM chip enabled and be configured to require a PIN at startup before the operating system loads. Which security feature is being configured?

Accepted Answer

BitLocker with TPM and PIN protector. BitLocker with a PIN enhances pre-boot authentication by requiring both a TPM (for integrity verification) and a user-entered PIN before the OS loads. This prevents unauthorized access even if the TPM is present. This question tests the understanding of BitLocker's pre-boot authentication options and the role of the TPM.

Answer

Secure Boot

Answer

Windows Defender System Guard

Answer

Group Policy password complexity enforcement

Question 14

During a routine security scan, a technician finds that a user's workstation has an open port 3389 that is accessible from the internet. The user denies enabling Remote Desktop. What is the most likely security implication and immediate action?

Accepted Answer

Disable the Remote Desktop service and block port 3389 at the firewall immediately.. Port 3389 is used by Remote Desktop Protocol (RDP). An open RDP port exposed to the internet is a major security risk, often exploited by attackers for brute-force attacks or ransomware deployment. The immediate action should be to block the port at the firewall and investigate how it was opened. This question tests the ability to identify high-risk exposure and prioritize remediation.

Answer

The port is likely used by a legitimate application; no action is needed.

Answer

Change the RDP listening port to a non-standard port to hide it.

Answer

Enable Network Level Authentication (NLA) on the workstation.

Question 15

A user reports that their workstation is running slowly and they see a pop-up claiming their files are encrypted and a ransom must be paid. They cannot open any documents. What type of malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware encrypts files and demands payment for decryption. This scenario describes classic ransomware behavior, where the user is locked out of their data and a ransom note is displayed.

Answer

Spyware

Answer

Trojan horse

Answer

Rootkit