220-1202 Logical Security Concepts — Timed 15 Questions

Question 1

A technician is setting up a new wireless network for a small office. They want to ensure that only company-issued devices can connect, and that data transmitted over the air is encrypted. Which combination of settings should they use?

Accepted Answer

WPA3 with AES encryption and MAC address filtering.. WPA2 or WPA3 with AES encryption provides strong wireless security. MAC address filtering can be added as an extra layer to restrict which devices can associate. This combination meets both requirements of encryption and device restriction.

Answer

WPA2 with TKIP encryption and SSID broadcast disabled.

Answer

WEP with 128-bit key and a strong password.

Answer

Open network with a captive portal requiring employee login.

Question 2

A company's security policy mandates that all remote access connections must be authenticated using two different factors. A technician is configuring VPN access for teleworkers. Which combination meets this requirement?

Accepted Answer

Smart card and PIN.. Multifactor authentication requires two or more factors from different categories: something you know (password), something you have (smart card, token), and something you are (biometric). A password plus a one-time code from a hardware token uses two distinct factors, satisfying the policy.

Answer

Username and password only.

Answer

Biometric fingerprint and a PIN.

Answer

Two different passwords.

Question 3

A user calls the help desk saying they cannot access a shared folder on the network. They can access other shares on the same server. The technician verifies the user's account is active and the folder exists. What should the technician check next to resolve the access issue?

Accepted Answer

Review the NTFS permissions on the shared folder.. NTFS permissions control access at the folder level on the server. Even if share permissions allow access, restrictive NTFS permissions can block a specific user. The technician should check the effective permissions on that folder for the user.

Answer

Check if the user's password has expired.

Answer

Verify the user has been added to the local Administrators group.

Answer

Reboot the file server to clear any cached permissions.

Question 4

A technician is configuring a new employee's laptop and needs to ensure that only approved applications can run. The company wants to prevent users from installing unauthorized software. Which security control should be implemented?

Accepted Answer

Configure an application whitelist using AppLocker.. Application whitelisting allows only pre-approved programs to execute, blocking all others by default. This is the most effective way to prevent unauthorized software installation. Software Restriction Policies or AppLocker in Windows can enforce this.

Answer

Enable Windows Defender real-time protection.

Answer

Set the user account as a Standard User.

Answer

Disable the Windows Store.

Question 5

During a security audit, it is discovered that a former employee's user account is still active and has been used to log in remotely three times in the past month. Which logical security principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege requires that users have only the access necessary for their job. An inactive account with remote access violates this and also the principle of account lifecycle management. The immediate issue is that the account should have been disabled upon termination.

Answer

Separation of duties

Answer

Defense in depth

Answer

Mandatory access control

Question 6

An employee receives an email that appears to be from the CEO, asking them to urgently wire funds to a new vendor. The email address looks similar to the CEO's but has a slight typo. What type of social engineering attack is this?

Accepted Answer

Whaling. This is a classic whaling attack, a form of phishing that targets high-level executives or impersonates them to trick employees into performing actions like wire transfers. The spoofed email address and urgent request are typical indicators. Whaling is a specific type of social engineering focused on senior staff.

Answer

Phishing

Answer

Spear phishing

Answer

Vishing

Question 7

A small business wants to ensure that only authorized employees can access the file server from their laptops. Each laptop has a unique hardware ID. Which logical security method should be implemented to enforce this restriction?

Accepted Answer

Enable MAC address filtering on the network switch or router.. MAC address filtering restricts network access based on the unique hardware identifier of a device's network interface. This is a simple logical security control that can be applied at the network level to allow only known laptops. It is not as strong as certificate-based authentication but directly addresses the requirement.

Answer

Require a complex password for the file server share.

Answer

Install a host-based firewall on each laptop.

Answer

Disable the guest account on the file server.

Question 8

A company policy requires that all sensitive data stored on laptops must be unreadable if the device is lost or stolen. A technician is tasked with implementing a solution that works transparently for users. Which approach should they take?

Accepted Answer

Enable BitLocker drive encryption on each laptop.. Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key. It operates transparently after the user authenticates at boot, meeting the policy requirement. BitLocker is a common implementation for Windows systems.

Answer

Set a BIOS password on each laptop.

Answer

Implement a folder-level password policy using EFS.

Answer

Configure a screensaver password with a 1-minute timeout.

Question 9

A technician discovers that a user has been sharing their login credentials with coworkers to allow them to access a shared drive. The company's security policy prohibits password sharing. What is the most effective way to prevent this behavior while still allowing necessary access?

Accepted Answer

Configure the shared drive permissions using security groups and add the coworkers to the appropriate group.. The root cause is that the shared drive access is tied to individual accounts, encouraging sharing. Implementing group-based permissions with proper access control lists (ACLs) allows the company to grant access to a group rather than an individual, eliminating the need to share passwords. Additionally, enforcing a policy of non-repudiation and using audit logs can deter sharing.

Answer

Disable the user's account and create a generic shared account for the drive.

Answer

Implement a Group Policy that forces password changes every 30 days.

Answer

Send a company-wide email reminding users not to share passwords.

Question 10

A user reports that their workstation is running slowly and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their system tray that they did not install. What is the most likely security issue?

Accepted Answer

The system has adware installed.. This scenario describes classic symptoms of adware or potentially unwanted program (PUP) infection. Adware displays unsolicited advertisements and often installs toolbars; it degrades performance and can be a vector for more serious malware. The correct answer identifies the issue as adware.

Answer

A rootkit has hidden itself in the kernel.

Answer

A ransomware encryption process has started.

Answer

The user's account has been phished and credentials stolen.

Question 11

A company is implementing a new policy that requires users to authenticate using both a password and a one-time code sent to their mobile phone. What type of authentication factor is the one-time code?

Accepted Answer

Something you have. Authentication factors are categorized as something you know (password), something you have (token or phone), and something you are (biometrics). A one-time code sent to a mobile phone is considered 'something you have' because access to the phone is required. This question tests the classification of multi-factor authentication components.

Answer

Something you are

Answer

Something you know

Answer

Somewhere you are

Question 12

A technician is configuring a small office network and wants to ensure that guest users can access the internet but cannot connect to internal company resources like file servers or printers. Which logical security method should be implemented?

Accepted Answer

Implement a guest VLAN that is isolated from the internal network.. Network segmentation, often achieved through VLANs, separates network traffic into distinct broadcast domains. A guest VLAN can be configured with access only to the internet, while internal resources remain on a separate VLAN with restricted access. This question tests the understanding of network segmentation as a logical security control.

Answer

Enable MAC address filtering on the wireless access point.

Answer

Require a complex password for the guest Wi-Fi network.

Answer

Disable the SSID broadcast for the guest network.

Question 13

During a routine security scan, a technician finds that a user's workstation has an open port 3389 that is accessible from the internet. The user denies enabling Remote Desktop. What is the most likely security implication and immediate action?

Accepted Answer

Disable the Remote Desktop service and block port 3389 at the firewall immediately.. Port 3389 is used by Remote Desktop Protocol (RDP). An open RDP port exposed to the internet is a major security risk, often exploited by attackers for brute-force attacks or ransomware deployment. The immediate action should be to block the port at the firewall and investigate how it was opened. This question tests the ability to identify high-risk exposure and prioritize remediation.

Answer

The port is likely used by a legitimate application; no action is needed.

Answer

Change the RDP listening port to a non-standard port to hide it.

Answer

Enable Network Level Authentication (NLA) on the workstation.

Question 14

A small business wants to ensure that only authorized personnel can access the server room. The budget is limited, and they need a simple, cost-effective solution. Which logical security control should they implement first?

Accepted Answer

Require a smart card or key fob to unlock the door.. Logical security controls restrict access to digital resources. For physical access to a server room, a smart card or key fob system provides a good balance of cost and security by requiring something the user possesses. This question tests the understanding of logical versus physical controls and the principle of least cost for basic access control.

Answer

Install a biometric fingerprint scanner on the door.

Answer

Implement a strong password policy for all user accounts.

Answer

Hire a security guard to check IDs at the entrance.

Question 15

An organization wants to ensure that even if a laptop is stolen, the data on the hard drive cannot be read. The laptop runs Windows 10 Pro and is used by employees who travel frequently. Which security feature should be enabled?

Accepted Answer

Enable BitLocker Drive Encryption on the system drive.. Full disk encryption (FDE) protects all data on the drive by encrypting it, making it unreadable without the decryption key. BitLocker is the native FDE solution in Windows 10 Pro. This question tests the understanding that FDE is the appropriate countermeasure for data theft from stolen devices, as opposed to file-level encryption or access controls.

Answer

Set a strong BIOS/UEFI password.

Answer

Configure a screensaver password with a short timeout.

Answer

Use EFS to encrypt individual files and folders.