220-1202 Logical Security Concepts Practice Test 2 — 15 Questions

Question 1

A user reports that they can no longer access their encrypted files after a recent password change. The files were encrypted using EFS on a Windows 10 Pro workstation. What is the most likely cause of this issue?

Accepted Answer

The user did not back up their EFS certificate before changing the password.. EFS (Encrypting File System) ties file encryption to the user's password. When the password is changed without the proper certificate backup, the encryption key may become inaccessible. This question tests the understanding that EFS keys are protected by the user's password and require a backup certificate or recovery agent to avoid data loss after password changes.

Answer

The user changed the password via Ctrl+Alt+Del, which invalidates the EFS certificate.

Answer

The user's account was removed from the local Administrators group during the password change.

Answer

The hard drive has a hardware failure that corrupted the encrypted files.

Question 2

During a security audit, an administrator discovers that several employees have written their domain passwords on sticky notes attached to their monitors. The company policy requires strong passwords and prohibits sharing credentials. Which security principle is being violated?

Accepted Answer

Password confidentiality. Password confidentiality is a core security principle; passwords must be kept secret and not be easily observable. Writing passwords on sticky notes directly violates this by making them visible to anyone nearby. This question tests the understanding of password security best practices and the concept of confidentiality.

Answer

Principle of least privilege

Answer

Account lockout policy

Answer

Multi-factor authentication

Question 3

A user receives an email that appears to be from their bank, asking them to click a link and verify their account information due to 'suspicious activity.' The email address looks legitimate, but the link points to a different domain. What type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers impersonate a trusted entity to trick victims into revealing sensitive information. The suspicious link is a key indicator. This question tests the ability to recognize phishing attempts based on common characteristics like urgent language and deceptive links.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 4

A user complains that their computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What is the most likely security issue?

Accepted Answer

The system is infected with adware that displays unsolicited advertisements.. Adware is a type of malware that displays unwanted advertisements and often installs toolbars or other software without user consent. It can significantly degrade system performance. This question tests the ability to identify adware based on symptoms like pop-ups and unauthorized toolbars.

Answer

A rootkit has hidden itself in the system's firmware.

Answer

A worm is spreading through the network, consuming bandwidth.

Answer

A Trojan horse has stolen the user's banking credentials.

Question 5

A company's security policy requires that all laptops have a TPM chip enabled and be configured to require a PIN at startup before the operating system loads. Which security feature is being configured?

Accepted Answer

BitLocker with TPM and PIN protector. BitLocker with a PIN enhances pre-boot authentication by requiring both a TPM (for integrity verification) and a user-entered PIN before the OS loads. This prevents unauthorized access even if the TPM is present. This question tests the understanding of BitLocker's pre-boot authentication options and the role of the TPM.

Answer

Secure Boot

Answer

Windows Defender System Guard

Answer

Group Policy password complexity enforcement

Question 6

A user reports that they can no longer access the internet after installing a new software application. The technician suspects the application modified system settings. Which security feature could have prevented this?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) prompts for permission before allowing changes that affect system settings. If the user had denied the UAC prompt, the application would not have been able to modify network settings.

Answer

Windows Defender Firewall

Answer

BitLocker Drive Encryption

Answer

Windows Defender Antivirus

Question 7

A user reports that their workstation is running slowly and they see a pop-up claiming their files are encrypted and a ransom must be paid. They cannot open any documents. What type of malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware encrypts files and demands payment for decryption. This scenario describes classic ransomware behavior, where the user is locked out of their data and a ransom note is displayed.

Answer

Spyware

Answer

Trojan horse

Answer

Rootkit

Question 8

During a security audit, you find that a user's workstation has a USB device that automatically logs in to a cloud storage account when inserted. What security best practice is being violated?

Accepted Answer

Disabling auto-run. USB auto-run devices can bypass authentication and pose a security risk. Disabling auto-run prevents unauthorized access and malware from executing automatically, which is a key security practice.

Answer

Password complexity requirements

Answer

Account lockout policies

Answer

Enforcing screen locks

Question 9

A company requires that all sensitive data be encrypted when stored on laptops. Which technology should be implemented to ensure data is protected even if a laptop is stolen?

Accepted Answer

BitLocker Drive Encryption. Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key. This protects data in case of theft, as the drive cannot be accessed without proper authentication.

Answer

File-level encryption using EFS

Answer

TPM chip only

Answer

Secure Boot

Question 10

A technician is configuring a new firewall for a small office. They need to allow remote employees to securely access the internal network. Which technology should be enabled on the firewall?

Accepted Answer

VPN server. A VPN creates an encrypted tunnel between a remote user and the internal network, ensuring secure access. This is the standard method for remote employees to connect safely.

Answer

Port forwarding

Answer

VPN passthrough

Answer

DMZ

Question 11

A company's security policy requires that user accounts be disabled after 90 days of inactivity. An administrator needs to implement this automatically. Which feature should they configure?

Accepted Answer

User account expiration. Account expiration policies can be set to automatically disable accounts after a specified period of inactivity. This enforces the security policy without manual intervention.

Answer

Password expiration policy

Answer

Account lockout threshold

Answer

Group Policy refresh interval

Question 12

A small business wants to ensure that only authorized employees can access the file server from their laptops. Each laptop has a unique MAC address. Which security measure should be implemented on the network switch?

Accepted Answer

Configure MAC filtering. MAC address filtering restricts network access to devices with approved MAC addresses, providing a basic layer of security. This is a simple way to allow only specific laptops to connect to the file server.

Answer

Disable SSID broadcast

Answer

Enable WPA3 encryption

Answer

Change the default admin password

Question 13

A user receives an email from what appears to be their bank, asking them to click a link and verify their account due to suspicious activity. The email contains several spelling errors and the link points to an unfamiliar domain. What type of attack is this?

Accepted Answer

Phishing. Phishing attacks use deceptive emails to trick users into revealing sensitive information. The suspicious link and errors indicate a phishing attempt, not a legitimate bank communication.

Answer

Spear phishing

Answer

Whaling

Answer

Vishing

Question 14

A server administrator notices that an unauthorized user has been accessing sensitive data by exploiting a vulnerability in a web application. The application was recently updated. What is the most likely cause of this security incident?

Accepted Answer

Zero-day vulnerability. A zero-day vulnerability is a previously unknown flaw that attackers exploit before a patch is available. Even with recent updates, such vulnerabilities can exist, leading to unauthorized access.

Answer

Weak password policy

Answer

Misconfigured firewall

Answer

Social engineering attack

Question 15

A user calls the help desk because they cannot access a shared folder on the network. The user's account is part of the 'Sales' group, which has 'Read' permission, but the user needs to modify files. What is the most efficient way to grant the required access?

Accepted Answer

Add the user to a group that has 'Modify' permission. Adding the user to a group with 'Modify' permissions is efficient because it avoids individual permission assignments and follows the principle of group-based access control. This ensures the user can edit files without overcomplicating permissions.

Answer

Assign 'Full Control' to the user's account directly

Answer

Change the folder's sharing settings to 'Everyone' with 'Read/Write'

Answer

Remove the user from the Sales group and add them to a new group with 'Read' permission