220-1202 Practice Test 29 — 15 Questions

Question 1

During a routine security audit, a technician finds that a user's computer has an unknown program running that is sending keystrokes and screenshots to a remote server. The user did not install this program. Which type of malware is this?

Accepted Answer

Keylogger. A keylogger records keystrokes and can capture screenshots, sending data to an attacker. This is a form of spyware, not a worm, rootkit, or ransomware, which have different behaviors.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 2

A user reports that their computer is displaying a message claiming their files are encrypted and they must pay 0.5 Bitcoin to a specific address to regain access. The user cannot open any documents or photos. What is the first step the technician should take to respond to this incident?

Accepted Answer

Disconnect the computer from the network.. The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Attempting to decrypt without tools or paying the ransom are not recommended initial actions.

Answer

Pay the ransom to recover the files immediately.

Answer

Run a full antivirus scan to remove the malware.

Answer

Reboot the computer into Safe Mode.

Question 3

A technician is troubleshooting a Windows 10 computer that exhibits strange behavior: system files are missing, and the computer fails to boot normally. A boot-time virus scan detects a virus that infected the Master Boot Record (MBR). Which tool should the technician use to repair the MBR?

Accepted Answer

Bootrec.exe /FixMbr. The Bootrec.exe tool with the /FixMbr switch is used to repair the Master Boot Record in Windows. System Restore, SFC, and CHKDSK do not specifically repair the MBR.

Answer

System Restore

Answer

SFC /Scannow

Answer

CHKDSK /F

Question 4

A small business owner reports that all their employees are receiving emails from each other containing a link that, when clicked, downloads a file that installs a program that spreads to other contacts. The emails appear to come from known senders. What type of malware is this?

Accepted Answer

Worm. A worm self-replicates and spreads automatically, often via email or network shares, without needing to attach to a host file. This behavior distinguishes it from a virus, Trojan, or rootkit.

Answer

Virus

Answer

Trojan horse

Answer

Rootkit

Question 5

A user calls the help desk because their computer is running slowly and they see a fake antivirus program warning that their system is infected. The user cannot close the warning window. Which type of malware is this, and what is the best removal approach?

Accepted Answer

Rogue antivirus; boot into Safe Mode with Networking and run Malwarebytes.. Rogue antivirus (scareware) displays fake warnings to trick users into paying for unnecessary software. The best approach is to boot into Safe Mode with Networking and run a legitimate malware removal tool, as the malware may block normal mode.

Answer

Ransomware; pay the fee to remove the warning.

Answer

Spyware; run a full scan in normal mode.

Answer

Adware; uninstall the program from Control Panel.

Question 6

During a security incident, a technician discovers that a user's computer has a program that hides its processes from Task Manager and allows an attacker to remotely control the system. The technician suspects a rootkit. Which removal method is most effective for a rootkit?

Accepted Answer

Reinstall the operating system from a trusted source.. Rootkits are deeply embedded and often cannot be removed by standard tools. The most reliable removal method is to wipe the drive and reinstall the operating system from a trusted source.

Answer

Run a system restore to a point before the infection.

Answer

Use an antivirus boot disk to scan and remove the rootkit.

Answer

Delete the rootkit's files manually in Safe Mode.

Question 7

A technician is tasked with removing malware from a Windows 10 computer that has a Trojan horse that downloaded additional payloads. The technician has already run a full antivirus scan and removed the Trojan, but the computer still exhibits suspicious network activity. What should the technician do next?

Accepted Answer

Run a second opinion malware scanner such as Malwarebytes.. After removing the initial malware, additional payloads or backdoors may remain. Running a second opinion scanner like Malwarebytes can detect remnants that the primary antivirus missed. Reimaging is drastic if not yet necessary, and resetting the browser or disabling startup items may not address hidden threats.

Answer

Reimage the computer immediately.

Answer

Reset the web browser settings to default.

Answer

Disable all startup programs in Task Manager.

Question 8

A user reports that their computer is infected with a virus that has encrypted all their personal files and left a text file with instructions to pay a ransom. The technician has verified the infection is ransomware. The company has a backup policy. What is the best course of action to recover the data?

Accepted Answer

Restore the files from a recent backup after removing the malware.. The best approach for ransomware recovery is to restore files from a known clean backup after removing the malware. Decryption tools are not always available, and paying the ransom is discouraged. Reinstalling the OS is needed only if the system is compromised, but data recovery is the priority.

Answer

Pay the ransom and hope the decryption key is provided.

Answer

Use a ransomware decryption tool from a reputable source.

Answer

Reinstall the operating system and hope the files become accessible.

Question 9

A technician is investigating a computer that has been sending spam emails from the user's account without their knowledge. The user has not installed any new software recently. The technician finds a process running that matches a known botnet client. Which two steps should the technician take first to mitigate the threat?

Accepted Answer

Disconnect the computer from the network and terminate the malicious process.. The immediate priority is to disconnect the computer from the network to stop the botnet communication and prevent further spam. Then, the technician should identify and terminate the malicious process. Scanning without disconnecting may allow continued data exfiltration.

Answer

Run a full antivirus scan and then update the firewall rules.

Answer

Change the user's email password and run a malware scan.

Answer

Reboot the computer into Safe Mode and then run a scan.

Question 10

A user calls the help desk, frantic because their banking app shows an unauthorized transfer of $500. They say they received a call earlier from 'bank security' asking them to install a remote access tool to 'verify their account'. What type of social engineering attack did the user fall victim to?

Accepted Answer

Vishing. This is a classic vishing (voice phishing) attack combined with a tech support scam. The attacker used a phone call to impersonate a trusted entity and tricked the user into installing remote access software, giving the attacker control over the device to perform fraudulent transactions.

Answer

Phishing

Answer

Smishing

Answer

Shoulder surfing

Question 11

A receptionist at a company receives a call from someone claiming to be from the IT department. The caller says they need her password to perform an urgent server update. The receptionist provides the password. What type of social engineering attack is this?

Accepted Answer

Pretexting. This is a classic example of pretexting, where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. The caller impersonated an IT staff member to establish trust and authority.

Answer

Tailgating

Answer

Phishing

Answer

Baiting

Question 12

A user reports receiving an email that appears to be from their CEO, urgently requesting that they purchase $500 in gift cards and reply with the codes. The email address looks slightly off (e.g., ceo@cornpany.com instead of ceo@company.com). What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack, a type of phishing that targets high-profile individuals or impersonates them to trick lower-level employees. The attacker used a spoofed email address to impersonate the CEO and create a sense of urgency.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 13

An employee finds a USB drive labeled 'Employee Salary Info Q4' in the parking lot. Out of curiosity, they plug it into their work computer to see the contents. What type of social engineering attack is this an example of?

Accepted Answer

Baiting. This is baiting, where an attacker leaves a physical item (like a USB drive) in a location where it is likely to be found and used. The enticing label is the 'bait' that exploits human curiosity.

Answer

Phishing

Answer

Tailgating

Answer

Pretexting

Question 14

A technician is configuring a new employee's workstation. The employee mentions that a 'friendly IT guy' from the help desk called earlier and asked for their username and temporary password to 'pre-setup the account'. The employee provided the information. What should the technician do first?

Accepted Answer

Reset the employee's password and report the incident to the security team.. This is a social engineering attack where the attacker posed as IT support. The technician should immediately report the incident to the security team and flag the account as compromised, as the credentials are now in the hands of an attacker.

Answer

Proceed with the setup as planned, since the employee already provided the info.

Answer

Call the help desk to verify if they made the call.

Answer

Tell the employee it was likely a test and to ignore it.

Question 15

A user calls the help desk because they received a pop-up on their screen claiming their computer is infected with a virus and to call a toll-free number for immediate support. The user did not call the number. What should the technician advise the user to do?

Accepted Answer

Close the pop-up and run a full antivirus scan.. This is a tech support scam, a form of social engineering that uses scare tactics (fake virus warnings) to trick users into calling a fake support line. The user should close the pop-up and run a security scan to ensure no malware was installed.

Answer

Call the number to see if it's legitimate.

Answer

Ignore the pop-up and continue working.

Answer

Reboot the computer immediately.