220-1202 PC Security Issue Remediation — Timed 10 Questions

Question 1

A user calls the help desk saying they cannot log into their Windows 10 workstation because a message claims their files are encrypted and they must pay a ransom. What is the most effective remediation approach?

Accepted Answer

Disconnect from the network and restore files from a verified backup. Option C is correct because ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.

Answer

Pay the ransom to get the decryption key

Answer

Reboot into Safe Mode and run a malware scan

Answer

Run System Restore to a point before the attack

Question 2

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Accepted Answer

Use a Group Policy to allow only the specific USB device by hardware ID, then remove the allowance after use. Group Policy can be used to block all USB storage by default, but you can create an exception by allowing specific devices via device ID or by using a more granular policy. The best approach is to temporarily grant access to the specific device, then reapply the block.

Answer

Disable the USB blocking Group Policy for the entire domain

Answer

Give the manager a company-approved USB drive and tell them to use it only once

Answer

Create a local admin account on the manager's workstation and disable the USB block locally

Question 3

A small business owner wants to ensure that if a laptop is stolen, the data on the drive cannot be read. The laptop runs Windows 11 Pro. What is the most appropriate remediation?

Accepted Answer

Enable BitLocker on the system drive. BitLocker is the native full-disk encryption feature in Windows 11 Pro that encrypts the entire system drive, including the operating system, applications, and all user data. If the laptop is stolen, the data on the drive remains unreadable without the recovery key or TPM authentication, even if the drive is removed and attached to another computer. This directly addresses the requirement to prevent data access after theft.

Answer

Set a strong BIOS password

Answer

Install an antivirus with anti-theft features

Answer

Use a cloud backup service

Question 4

A company has a policy that all workstations must automatically lock after 10 minutes of inactivity. A user complains that their computer does not lock automatically. Which setting should you check and remediate?

Accepted Answer

Verify that the screen saver is enabled and set to 'On resume, display logon screen' with a 10-minute wait. Option B is correct because the automatic lock behavior in Windows is controlled by the screen saver settings. When 'On resume, display logon screen' is enabled with a 10-minute wait, the screen saver triggers after inactivity and locks the workstation by requiring authentication upon resume. This is the standard mechanism for enforcing a lock timeout, not the power plan sleep timeout.

Answer

Check the power plan settings for sleep timeout

Answer

Ensure Windows Update is fully installed

Answer

Disable the Fast Startup feature

Question 5

During a security audit, you find that several employees have been using the same weak password for their domain accounts. Which remediation should you implement first?

Accepted Answer

Configure a password policy in Group Policy requiring complexity and minimum length. Option B is correct because the most effective first step to prevent weak passwords is to enforce a strong password policy via Group Policy. This centrally mandates complexity requirements (e.g., uppercase, lowercase, digits, special characters) and a minimum length (typically 8–14 characters), which directly blocks the use of simple, common passwords at the domain level. Unlike awareness campaigns or reactive measures, this technical control proactively enforces security standards across all domain accounts.

Answer

Disable the user accounts and require a manager to re-enable them

Answer

Send a company-wide email reminding users to choose strong passwords

Answer

Install a third-party password manager for all employees

Question 6

A technician is configuring a new Windows 10 workstation for a remote employee who will handle sensitive customer data. Which security feature should be enabled to ensure that if the laptop is lost, the data remains protected?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption (C) is the correct choice because it provides full-disk encryption using AES encryption algorithms, ensuring that if the laptop is lost or stolen, the sensitive customer data remains inaccessible without the recovery key or TPM authentication. This directly addresses the requirement to protect data at rest on a lost device.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

Windows Hello for Business

Question 7

During a routine check, a technician finds that a user's Windows 10 computer has an outdated antivirus that hasn't updated in 3 months. The user claims they never saw any update prompts. What is the most likely reason and the appropriate remediation?

Accepted Answer

The Windows Update service is disabled; re-enable it and set to automatic. Outdated antivirus often results from the update service being disabled or misconfigured. Checking the Windows Update or antivirus update service ensures that automatic updates can run, preventing future lapses.

Answer

The antivirus subscription has expired; renew it

Answer

The user has manually set the antivirus to manual update mode

Answer

The computer is infected with a virus that blocks updates

Question 8

A customer reports that their computer is running slowly and they see pop-up ads even when no browser is open. They suspect malware. Which of the following should you perform first to remediate this issue?

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.

Answer

Run a full antivirus scan

Answer

Reboot the computer in Safe Mode

Answer

Restore from a recent backup

Question 9

A user reports that their Windows 10 computer is infected with a virus that keeps reinstalling itself after removal. What should you do to remediate this persistent infection?

Accepted Answer

Boot from a rescue disc or USB and run an antivirus scan. A virus that reinstalls itself likely has a rootkit or persistent mechanism. Booting from trusted media and scanning the offline system ensures the malware cannot run, allowing complete removal.

Answer

Run a system restore to a previous restore point

Answer

Disable System Restore and then run an antivirus scan in normal mode

Answer

Reinstall Windows from the recovery partition

Question 10

A user's computer is infected with adware that changes the browser homepage and displays constant pop-ups. After removing the adware with an antivirus, the homepage remains changed. What additional remediation step should you take?

Accepted Answer

Reset the browser settings to default. After adware removal, the browser's homepage and settings are often stored in the browser's configuration files or registry keys that the antivirus does not reset. Resetting the browser settings to default restores the homepage, search engine, and new tab page to their original state, clearing any persistent malicious configurations left behind by the adware.

Answer

Reinstall the operating system

Answer

Run a disk cleanup utility

Answer

Update the antivirus definitions and scan again