220-1202 Practice Test 32 — 15 Questions

Question 1

A company uses AppLocker to control which applications can run on Windows 10 workstations. A user needs to run a portable application from a USB drive for a presentation, but it is blocked by AppLocker. The user has local admin rights. What is the best way to allow this specific application while maintaining security?

Accepted Answer

Create a new AppLocker path rule for the USB drive.. AppLocker can be configured with rules based on file path, publisher, or hash. Creating a path rule for the USB drive or a hash rule for the specific executable allows the app while still blocking others. This is more secure than disabling AppLocker or giving the user permanent exceptions.

Answer

Temporarily disable AppLocker service.

Answer

Add the user to the 'Power Users' group.

Answer

Run the application as Administrator.

Question 2

A technician is configuring a Windows 10 kiosk machine that will run a single web application in full-screen mode. The machine must not allow users to access the desktop, taskbar, or other apps. Which Windows security feature should be used to accomplish this?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (formerly Kiosk Mode) in Windows 10/11 allows a device to run a single app in full-screen, locking down the system. It can be configured via Settings > Accounts > Other users > Set up a kiosk. This ensures users cannot exit the app or access other parts of the OS.

Answer

Local Group Policy to hide the taskbar.

Answer

User Account Control set to 'Always notify.'

Answer

Windows Defender Application Guard

Question 3

After a security incident, a forensic analyst needs to review the event logs on a Windows 10 system to determine when a specific user account was created. The logs are intact. Which Windows security setting must be enabled to ensure that account creation events are recorded?

Accepted Answer

Enable 'Audit Account Management' in Advanced Audit Policy.. Audit Account Management policy must be enabled to log events like user account creation. This is configured in Local Security Policy or Group Policy under Advanced Audit Policy Configuration. Without this audit setting, account creation events are not recorded in the Security log.

Answer

Enable 'Audit Logon Events' in Local Security Policy.

Answer

Turn on 'File and Printer Sharing' in Network and Sharing Center.

Answer

Configure Windows Defender to scan for new accounts.

Question 4

A Windows 11 workstation is infected with ransomware that encrypted user files. The IT security team wants to prevent future infections by restricting which processes can modify files in user profile folders. Which Windows security feature can enforce such restrictions without third-party software?

Accepted Answer

Controlled Folder Access. Controlled Folder Access (part of Windows Defender Exploit Guard) allows only trusted apps to access protected folders like Documents, Pictures, etc. It can be configured via Windows Security > Virus & threat protection > Ransomware protection. This effectively blocks ransomware from encrypting files.

Answer

NTFS permissions set to 'Read-only' for all users.

Answer

AppLocker with a deny rule for unknown executables.

Answer

BitLocker with TPM protection

Question 5

A user reports that after a recent Windows update, their standard user account can no longer install certain applications that previously installed without issue. The update changed the default User Account Control (UAC) behavior. Which UAC setting would most likely restore the previous behavior while still prompting for consent?

Accepted Answer

Notify me only when apps try to make changes to my computer (do not dim my desktop). This question tests knowledge of User Account Control (UAC) levels and their impact on standard users. The 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' setting allows standard users to be prompted for credentials without the secure desktop, which is the default behavior that was likely changed. Understanding the four UAC notification levels is essential for troubleshooting permission-related issues after updates.

Answer

Always notify me (dim my desktop)

Answer

Notify me only when apps try to make changes to my computer (dim my desktop)

Answer

Never notify me

Question 6

A small business owner wants to ensure that only authorized USB storage devices can be used on company laptops running Windows 10 Pro. They have a list of approved device hardware IDs. Which security policy should be configured to enforce this restriction?

Accepted Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions. This question covers device installation restrictions via Group Policy or Local Security Policy. The 'Allow installation of devices that match any of these device IDs' policy can be configured with a list of approved hardware IDs, blocking all others. This is a common method for controlling USB device usage in enterprise environments.

Answer

Enable the 'Removable Storage Access' policy under Windows Components

Answer

Configure the 'Devices: Restrict CD-ROM access to locally logged-on user only' policy

Answer

Set the 'Deny all devices' policy under Device Installation Restrictions

Question 7

During a security audit, you discover that a Windows 10 workstation has the 'Store passwords and credentials using reversible encryption' policy enabled. What is the primary security risk associated with this setting?

Accepted Answer

It stores passwords in a format that can be easily decrypted, making them vulnerable if the database is compromised.. This question tests understanding of password storage policies. Reversible encryption means passwords are stored in a format that can be decrypted back to plaintext, which is a significant security risk if an attacker gains access to the SAM database. This setting should only be enabled when required by specific applications, such as those using CHAP authentication.

Answer

It increases the time required to log on to the system.

Answer

It allows users to bypass the password complexity requirement.

Answer

It prevents the use of biometric authentication methods.

Question 8

A user calls the help desk complaining that they cannot change their Windows 10 password even though they know the current password. The user is a member of the 'Users' group on a domain-joined computer. What is the most likely cause?

Accepted Answer

The 'Password must meet complexity requirements' policy is preventing the new password from being accepted.. This question tests knowledge of password policies and user permissions. In a domain environment, password policies are typically enforced by the domain controller, not the local machine. The 'Password must meet complexity requirements' policy may be enabled, and the user's new password might not meet those requirements, even though they know the current password.

Answer

The user does not have 'Change Password' permission on their own account.

Answer

The 'User must change password at next logon' flag is set.

Answer

The local Security Accounts Manager (SAM) database is corrupted.

Question 9

A company is migrating from Workgroup to Domain. After joining a Windows 10 computer to the domain, users report that they can no longer log on using their local user accounts. What setting in Local Security Policy is most likely causing this behavior?

Accepted Answer

The 'Deny log on locally' user rights assignment includes the 'Users' group. This question tests understanding of the 'Deny log on locally' user rights assignment. When a computer joins a domain, domain policies may override local settings, and the 'Deny log on locally' policy can be configured to block local accounts. This is a common security measure to enforce domain-only authentication.

Answer

The 'Network access: Do not allow anonymous enumeration of SAM accounts' policy

Answer

The 'Deny log on locally' user rights assignment includes the 'Guests' group

Answer

The 'Interactive logon: Do not display last user name' policy is enabled

Question 10

A technician is configuring a Windows 10 kiosk system that will run a single application in a public library. The kiosk must automatically log on and start the app without any user interaction. Which security setting combination is required?

Accepted Answer

Configure 'Automatic logon' in the registry and enable 'Assigned Access' for the kiosk account. This question tests knowledge of kiosk mode configuration. Windows 10 supports 'Assigned Access' which can be configured to automatically log on a specified user account and launch a single app. This requires enabling the 'Automatic logon' setting in the registry or via the 'netplwiz' tool, and then configuring Assigned Access for that account.

Answer

Enable 'Sticky Keys' and configure the 'Ease of Access' settings

Answer

Set the 'Shutdown: Allow system to be shut down without having to log on' policy

Answer

Enable 'User Account Control: Run all administrators in Admin Approval Mode'

Question 11

After a security incident, a forensic analyst needs to ensure that Windows 10 audit logs capture all successful and failed attempts to access the 'Confidential' folder on a file server. Which audit policy configuration is required?

Accepted Answer

Enable 'Audit object access' and configure the SACL on the folder. This question tests understanding of advanced audit policies. To log file access, you need to enable 'Audit File Share' or 'Audit Detailed File Share' under Advanced Audit Policy. The 'Object Access' subcategory must be configured to log both success and failure events for file share access.

Answer

Enable 'Audit account logon events' for success and failure

Answer

Enable 'Audit privilege use' for success and failure

Answer

Enable 'Audit process tracking' for success and failure

Question 12

A user reports that their Windows 10 computer is displaying a 'Your IT department has limited access to some features of this app' message when trying to run a legacy application. The application worked before the latest Windows update. Which security feature is most likely causing this issue?

Accepted Answer

Windows Defender Application Guard. This question tests knowledge of Windows Defender Application Guard and Windows Sandbox features. The message indicates that Application Guard is blocking the app from accessing certain resources. Application Guard uses hardware isolation to run untrusted applications in a container, and updates may change its default behavior or policies.

Answer

Windows Defender Firewall with Advanced Security

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 13

A company's security policy requires that all Windows 10 workstations automatically lock the screen after 5 minutes of inactivity. However, users in the sales department often leave their desks for extended periods. A technician configures the 'Interactive logon: Machine inactivity limit' policy to 300 seconds. Despite this, the screensaver does not activate. What is the most likely reason?

Accepted Answer

The screensaver is not enabled or configured on the workstations. This question tests understanding of the relationship between the 'Interactive logon: Machine inactivity limit' policy and screensaver settings. The policy locks the workstation after the specified idle time, but it does not automatically enable the screensaver. The screensaver must be separately configured and enabled, or the lock screen will appear without a screensaver.

Answer

The 'Screen saver timeout' policy is set to a longer duration

Answer

The 'Password protect the screensaver' setting is disabled

Answer

The 'Turn off the display' power setting is set to 'Never'

Question 14

A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?

Accepted Answer

Windows Defender Application Control (WDAC). This question tests knowledge of Windows Defender Application Control (WDAC) and AppLocker. WDAC is a more modern and secure solution that can enforce code integrity policies based on publisher signatures, while AppLocker is a legacy feature. WDAC can be configured to allow only signed apps from trusted publishers, providing strong application control.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker Drive Encryption

Answer

User Account Control (UAC)

Question 15

A user reports that after a recent Windows update, they can no longer install a legacy application that requires write access to the Program Files folder. The user is a local administrator. What Windows security setting is most likely blocking the installation?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) prompts for consent or credentials even for administrators when changes require elevated permissions, such as writing to protected folders like Program Files. Disabling UAC or running the installer as administrator can resolve this.

Answer

BitLocker Drive Encryption

Answer

Windows Defender Firewall

Answer

Group Policy Software Restrictions