220-1202 Practice Test 31 — 15 Questions

Question 1

A new employee is setting up their workstation and receives a phone call from someone claiming to be from the IT department. The caller says there is a critical security update and needs the employee's login credentials to install it remotely. What social engineering principle is the attacker primarily exploiting?

Accepted Answer

Authority. This scenario exploits the principle of authority, as the attacker impersonates a trusted IT department figure. Social engineers often use authority to bypass security protocols by making victims feel compelled to comply. The correct response is to never share credentials, regardless of who asks.

Answer

Urgency

Answer

Scarcity

Answer

Social proof

Question 2

During a routine security audit, a technician discovers that an unknown person has been using a badge to enter the building after hours. The badge belongs to a former employee who left the company six months ago. Which type of social engineering attack likely enabled this unauthorized access?

Accepted Answer

Tailgating. This describes tailgating, where an attacker follows an authorized person into a secure area without proper credentials. The use of a former employee's badge suggests the attacker may have obtained it through theft or social engineering. Proper badge deactivation upon termination is a key countermeasure.

Answer

Phishing

Answer

Dumpster diving

Answer

Shoulder surfing

Question 3

A user reports that they received a voicemail from the company's HR director asking them to call back a number to verify their account details for payroll. The user is suspicious because the HR director is on vacation. What type of social engineering attack is this?

Accepted Answer

Vishing. This is vishing (voice phishing), where attackers use phone calls or voicemails to trick victims into revealing sensitive information. The impersonation of a known authority figure and the request for account details are classic signs. Vishing often leverages caller ID spoofing to appear legitimate.

Answer

Smishing

Answer

Pretexting

Answer

Pharming

Question 4

A technician is helping a customer configure a new laptop. The customer mentions they received a pop-up on their old computer warning of a virus and a phone number to call for support. The customer called the number and gave remote access to a 'technician' who then installed several programs. What social engineering attack occurred?

Accepted Answer

Tech support scam. This is a classic tech support scam, a form of social engineering where attackers use fake virus warnings to gain remote access. The pop-up is designed to scare the user into calling a fraudulent support number. Once access is granted, the attacker can install malware or steal data.

Answer

Shoulder surfing

Answer

Phishing

Answer

Dumpster diving

Question 5

During a security incident investigation, a technician finds that an attacker called the help desk, pretended to be a new employee who forgot their password, and successfully reset it. The attacker knew the employee's name and department. Which social engineering technique was used?

Accepted Answer

Pretexting. Pretexting is the creation of a fabricated scenario (the pretext) to obtain information or access. The attacker used the employee's details to build credibility and trick the help desk. This highlights the importance of identity verification procedures.

Answer

Phishing

Answer

Tailgating

Answer

Shoulder surfing

Question 6

A user reports that they clicked a link in a text message that appeared to be from their bank, warning of suspicious activity. The link led to a realistic-looking login page, but the user realized it was fake after entering their credentials. What type of social engineering attack is this?

Accepted Answer

Smishing. This is smishing, which is phishing conducted via SMS text messages. The attacker uses urgency and a fake login page to steal credentials. Smishing is increasingly common due to the high trust users place in text messages.

Answer

Vishing

Answer

Pharming

Answer

Pretexting

Question 7

A technician is investigating a data breach and discovers that an attacker obtained sensitive files by searching through the company's recycling bins. The bins contained printed reports with customer names and account numbers. What social engineering attack was used?

Accepted Answer

Dumpster diving. Dumpster diving is the physical act of searching through trash to find sensitive information. This attack relies on the failure to properly dispose of documents. Shredding or secure disposal policies are essential countermeasures.

Answer

Tailgating

Answer

Shoulder surfing

Answer

Phishing

Question 8

A security analyst notices that an attacker has been sending emails that appear to come from the company's internal email system, asking employees to click a link to update their shared drive password. The link leads to a fake login page. The attacker is using a spoofed internal domain. What specific type of phishing is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at specific individuals or groups within an organization. The use of a spoofed internal domain makes it more convincing. This contrasts with regular phishing, which is broader and less personalized.

Answer

Whaling

Answer

Vishing

Answer

Pharming

Question 9

During a security audit, a technician finds that a user's workstation was infected with malware after the user inserted a USB drive found in the parking lot. The drive was labeled 'Employee Salary Info Q4'. What social engineering principle did the attacker exploit?

Accepted Answer

Baiting. This attack exploits curiosity and the baiting principle, where an attacker leaves a malicious device in a place where it will be found. The enticing label increases the likelihood of someone picking it up. This is a form of social engineering that relies on human psychology rather than technical vulnerabilities.

Answer

Scarcity

Answer

Pretexting

Answer

Tailgating

Question 10

A user reports that after a recent Windows update, they can no longer install software on their company-issued laptop. When they try to run an installer, they get a message: 'Your system administrator has blocked this program.' The user has local administrator rights on the laptop. Which Windows security setting is most likely causing this issue?

Accepted Answer

User Account Control (UAC) is set to 'Always notify.'. Windows User Account Control (UAC) can be configured to prompt for consent or credentials when software installation is attempted, even for local admins. If UAC is set to 'Always notify,' it will block installations that don't receive explicit approval. The 'blocked by administrator' message often points to UAC or AppLocker, but with local admin rights, UAC is the primary control.

Answer

Windows Defender Firewall is blocking the installer.

Answer

BitLocker Drive Encryption is preventing write access.

Answer

The user's account is not part of the local Administrators group.

Question 11

A small business owner wants to prevent employees from changing system time, installing printers, and modifying power settings on their Windows 10 workstations. They do not want to remove local admin rights entirely. Which Windows security tool should be used to apply these restrictions?

Accepted Answer

Local Group Policy Editor (gpedit.msc). Local Group Policy Editor (gpedit.msc) allows granular control over user permissions and system settings without removing admin rights. It can restrict specific actions like changing time or installing printers via Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

Answer

Windows Defender Security Center

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Registry Editor (regedit)

Question 12

After deploying a new Windows 11 update, several users complain that they can no longer access shared folders on the network. You verify that network discovery and file sharing are enabled. Which Windows security setting should you check first to resolve this issue?

Accepted Answer

Review Windows Defender Firewall rules for 'File and Printer Sharing.'. Windows Defender Firewall can block file and printer sharing even if sharing settings are enabled. The 'File and Printer Sharing' inbound rule must be allowed for the appropriate network profile (e.g., Private). This is a common issue after updates that reset firewall rules.

Answer

Check if the users are in the 'Remote Desktop Users' group.

Answer

Verify that the 'Password Protected Sharing' option is turned off.

Answer

Run Windows Update to install additional patches.

Question 13

A user wants to encrypt a USB flash drive so that if it is lost, the data cannot be read on another computer. The USB drive will be used on both Windows 10 and Windows 11 devices. Which Windows feature should be used?

Accepted Answer

BitLocker To Go. BitLocker To Go allows encryption of removable drives like USB flash drives. It is available in Pro and Enterprise editions of Windows and provides strong protection. The encrypted drive can be accessed on other Windows systems with the password or recovery key.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Encryption

Answer

Secure Boot

Question 14

During a security audit, you discover that a Windows 10 workstation has a weak local administrator password. The company policy requires all local admin passwords to be at least 12 characters with complexity. Which tool can enforce this policy for all future password changes on that workstation?

Accepted Answer

Local Security Policy (secpol.msc). Local Security Policy (secpol.msc) allows configuring password policies like minimum length and complexity for local accounts. This is applied via Account Policies > Password Policy. It ensures that any new password meets the requirements.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Registry Editor (regedit)

Answer

Windows Defender Firewall with Advanced Security

Question 15

A user reports that their Windows 10 laptop shows a blue screen with an error message about 'Driver IRQL not less or equal' after connecting a new external hard drive. They need to use the drive for work. Which security setting should you check to ensure driver installation is not blocked?

Accepted Answer

Disable Driver Signature Enforcement temporarily.. Driver Signature Enforcement ensures that only drivers with a valid digital signature can be installed. If a driver is unsigned or has an invalid signature, Windows may block it, causing errors. This setting is part of Windows security and can be temporarily disabled for troubleshooting.

Answer

Check if Secure Boot is enabled in UEFI.

Answer

Verify that User Account Control is set to 'Notify me only when apps try to make changes.'

Answer

Run Windows Update to find a signed driver.