220-1202 Practice Test 28 — 15 Questions

Question 1

A user reports that their computer has been acting strangely: files are missing, and the mouse cursor moves on its own, opening programs and typing messages. The technician suspects a remote access Trojan (RAT). What is the most effective immediate action to stop the unauthorized access?

Accepted Answer

Disconnect the Ethernet cable and disable Wi-Fi.. A RAT gives an attacker remote control of the system. The immediate action is to disconnect the computer from the network, which cuts off the attacker's connection. After isolation, the technician can run scans and remove the malware. Continuing to work while connected risks data theft or further damage.

Answer

Run a full antivirus scan while the user is logged off.

Answer

Change the user's password and log off.

Answer

Restore the system to a previous restore point.

Question 2

A technician is tasked with removing a persistent malware infection that survives reboots and re-infects the system even after a full antivirus scan in Safe Mode. The malware appears to hide in the Master Boot Record (MBR). Which removal method should the technician use?

Accepted Answer

Use the Windows Recovery Environment to run bootrec /fixmbr.. MBR malware infects the boot sector, loading before the operating system, which allows it to survive standard scans and Safe Mode. The most effective removal is to use the Windows Recovery Environment (WinRE) with bootrec /fixmbr and bootrec /fixboot commands. This overwrites the infected boot sector. If that fails, a full reinstall may be necessary.

Answer

Run a system file checker (sfc /scannow) from within Windows.

Answer

Perform a clean installation of Windows without formatting the drive.

Answer

Disable System Restore and delete all restore points.

Question 3

A technician is investigating a security incident where multiple workstations on the same network are showing signs of infection: slow performance, unusual network traffic, and the presence of a file named 'svch0st.exe' in the Startup folder. The technician suspects a worm that spreads through network shares. What is the most effective containment strategy?

Accepted Answer

Disable network shares and isolate infected workstations from the network.. A worm that spreads via network shares requires immediate network segmentation to stop propagation. Disabling the network shares on all workstations and isolating infected systems from the network prevents the worm from reaching other devices. Patching the vulnerability used for spread (e.g., SMB) is also critical, but containment is the priority.

Answer

Run a full antivirus scan on all workstations simultaneously.

Answer

Update the antivirus definitions on one workstation and scan it.

Answer

Reboot all workstations into Safe Mode with Networking.

Question 4

A technician is dealing with a zero-day malware infection that has evaded all signature-based antivirus scans. The malware is polymorphic, changing its code each time it infects a new system. Which approach is most likely to detect and remove this type of malware?

Accepted Answer

Employ a heuristic-based or behavior-based malware removal tool.. Polymorphic malware changes its signature, making signature-based detection ineffective. Heuristic analysis and behavior-based detection tools, such as those used by advanced endpoint detection and response (EDR) solutions, can identify malware based on suspicious actions rather than static signatures. Running a tool that uses heuristic scanning can detect the malware's behavior, such as file encryption or unauthorized registry changes.

Answer

Update the antivirus to the latest signature definitions and run a full scan.

Answer

Use a bootable antivirus rescue disk to scan the system before the OS loads.

Answer

Reinstall the operating system from a known-good backup.

Question 5

A customer reports that their desktop computer is running extremely slowly, and they see frequent pop-up advertisements even when no browser is open. Task Manager shows a process named 'svch0st.exe' consuming 95% CPU. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware displays unwanted advertisements and often masquerades as legitimate processes. The misspelled 'svch0st.exe' mimics a Windows system process, a common adware tactic. This malware type is best removed using a dedicated anti-malware tool.

Answer

Ransomware

Answer

Rootkit

Answer

Spyware

Question 6

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

Accepted Answer

Disconnect the computer from the network immediately.. Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Answer

Pay the ransom to regain access quickly.

Answer

Run a full antivirus scan to remove the malware.

Answer

Restart the computer in Safe Mode and attempt file recovery.

Question 7

A technician is configuring a new Windows 11 workstation for a user who frequently downloads free software. To reduce the risk of malware infections from bundled applications, which security setting should be enabled?

Accepted Answer

Set User Account Control to always notify.. Windows Defender Application Guard and controlled folder access are useful, but the most direct protection against unwanted bundled software is User Account Control (UAC). UAC prompts for permission before installing software, giving the user a chance to decline bundled items.

Answer

Enable Windows Defender Application Guard.

Answer

Turn on Windows Firewall with advanced logging.

Answer

Enable BitLocker drive encryption.

Question 8

A user reports that their web browser's homepage has changed to an unfamiliar search engine, and new toolbars have appeared without their consent. They have not installed any new software recently. Which type of malware is most likely responsible?

Accepted Answer

Browser hijacker. A browser hijacker modifies browser settings like the homepage and adds unwanted toolbars. It often installs silently through drive-by downloads or bundled with other software. Removal requires resetting the browser and scanning with anti-malware tools.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 9

A technician is troubleshooting a computer that displays a fake security alert claiming the system is infected and urging the user to call a toll-free number. The alert cannot be closed and appears on top of all other windows. What is the best removal approach?

Accepted Answer

Restart the computer and press F8 to boot into Safe Mode with Networking, then run a malware scan.. This is a tech support scam, a form of scareware that uses a persistent pop-up. Booting into Safe Mode with Networking allows the technician to run an anti-malware scan without the rogue process interfering. Safe Mode loads only essential drivers, preventing the scareware from starting.

Answer

End the process 'svchost.exe' in Task Manager.

Answer

Call the toll-free number to get help removing the alert.

Answer

Use System Restore to revert to a previous restore point.

Question 10

A small business owner reports that all their Microsoft Office documents are now encrypted with a '.crypt' extension and a ransom note demands payment in cryptocurrency. They have a backup from last week stored on an external drive that was disconnected after the backup. What is the best recovery strategy?

Accepted Answer

Restore the files from the disconnected external backup after removing the malware.. Since the backup is offline and not encrypted, restoring from it is the safest and most reliable recovery method. Paying the ransom is discouraged as it funds criminals and may not work. The system should be cleaned of malware before restoration.

Answer

Pay the ransom to obtain the decryption key.

Answer

Run a decryptor tool downloaded from a random website.

Answer

Use System Restore to revert the system to a previous state.

Question 11

A technician is cleaning a computer that has been infected with a rootkit. After running a standard antivirus scan, the malware is still detected on reboot. Which step should the technician take next to ensure complete removal?

Accepted Answer

Boot from a rescue disk and run a malware scan.. Rootkits load before the operating system and can hide from standard scans. Booting from a rescue disk (e.g., a bootable anti-malware USB) loads a clean OS environment, allowing the scanner to detect and remove the rootkit without interference.

Answer

Perform a clean installation of Windows.

Answer

Disable System Restore and run the antivirus again.

Answer

Run the antivirus in Safe Mode.

Question 12

A user reports that their computer is sending out a large amount of network traffic even when they are not using the internet. The antivirus detects a file named 'expl0rer.exe' in the startup folder. What type of malware is most likely causing this behavior?

Accepted Answer

Botnet. A botnet is a network of infected computers that are remotely controlled to perform tasks like sending spam or launching DDoS attacks. The unusual network traffic and startup file indicate the machine is part of a botnet. Removal requires disconnecting from the network and scanning with updated anti-malware.

Answer

Spyware

Answer

Virus

Answer

Trojan

Question 13

A technician is investigating a security breach where sensitive customer data was exfiltrated. The only malware found is a hidden driver that intercepts keystrokes and sends them to a remote server. Which malware type is responsible, and what is the best removal strategy?

Accepted Answer

Keylogger; use a rescue disk to boot and run an anti-rootkit scanner.. A keylogger records keystrokes to steal credentials and sensitive data. As a kernel-level rootkit, it hides from standard scans. Booting from a rescue disk and using a specialized anti-rootkit tool is necessary to remove it without reinstalling the OS.

Answer

Spyware; remove by running a standard antivirus scan.

Answer

Ransomware; restore from backup.

Answer

Adware; uninstall suspicious programs from Control Panel.

Question 14

During a routine security audit, a technician discovers that a user's computer has a program that opens a backdoor on port 4444 and allows remote control. The program was installed alongside a free PDF converter the user downloaded last week. Which malware type is this, and what is the most effective removal method?

Accepted Answer

Trojan horse; boot into Safe Mode and run a full anti-malware scan.. A Trojan horse disguises as legitimate software (the PDF converter) but contains malicious code. This Trojan opens a backdoor (a RAT). Removal requires disconnecting from the network, booting into Safe Mode, and using an updated anti-malware scanner to eliminate the Trojan and its persistence mechanisms.

Answer

Worm; use a network-based firewall to block port 4444.

Answer

Ransomware; pay the ransom to regain control.

Answer

Rootkit; perform a clean installation of Windows.

Question 15

A customer reports that their Windows 10 computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware displays unwanted advertisements and often installs browser toolbars, slowing down the system. Unlike a virus or worm, adware does not self-replicate, and ransomware would demand payment rather than show ads.

Answer

Ransomware

Answer

Virus

Answer

Worm