220-1102 Practice Test 12 — 15 Questions

Question 1

A retail store wants to protect its point-of-sale (POS) terminals from unauthorized physical access during off-hours. The terminals are in an open area with no lockable cabinets. Which control should be prioritized?

Accepted Answer

Use tamper-evident seals on the terminal casings.. Tamper-evident seals provide a visible indicator if a device has been opened, deterring unauthorized physical access to internal components. This question tests understanding of physical security for unattended devices.

Answer

Install a privacy screen on each POS terminal.

Answer

Require a smart card to power on the terminal.

Answer

Enable a screensaver with a password.

Question 2

A company is deploying new laptops to remote workers. They need to ensure that if a laptop is stolen, the data on it cannot be accessed. Which two physical security controls should be configured before shipment?

Accepted Answer

Full-disk encryption and a BIOS/UEFI password.. Full-disk encryption protects data at rest, and a BIOS/UEFI password prevents unauthorized booting or tampering with boot settings. This question tests the combination of controls needed for remote device security.

Answer

Cable lock and privacy filter.

Answer

Smart card reader and biometric scanner.

Answer

Asset tracking tag and a Kensington lock slot.

Question 3

A small business wants to secure its network switch located in a shared office area. The switch has no built-in lock. Which combination of physical controls provides the best protection against unauthorized tampering?

Accepted Answer

Place the switch in a lockable cabinet and enable MAC address filtering.. A lockable cabinet prevents physical access to the switch, and port security prevents unauthorized devices from connecting to the network. This question tests layered physical and logical security for network infrastructure.

Answer

Use a cable lock to secure the switch to the desk.

Answer

Install a privacy filter on the switch's LED display.

Answer

Apply tamper-evident tape over the switch's vents.

Question 4

A technician discovers that a user has been sharing their login credentials with coworkers to allow them to access a shared drive. The company's security policy prohibits password sharing. What is the most effective way to prevent this behavior while still allowing necessary access?

Accepted Answer

Configure the shared drive permissions using security groups and add the coworkers to the appropriate group.. The root cause is that the shared drive access is tied to individual accounts, encouraging sharing. Implementing group-based permissions with proper access control lists (ACLs) allows the company to grant access to a group rather than an individual, eliminating the need to share passwords. Additionally, enforcing a policy of non-repudiation and using audit logs can deter sharing.

Answer

Disable the user's account and create a generic shared account for the drive.

Answer

Implement a Group Policy that forces password changes every 30 days.

Answer

Send a company-wide email reminding users not to share passwords.

Question 5

A company is implementing a new policy that requires users to authenticate using both a password and a one-time code sent to their mobile phone. What type of authentication factor is the one-time code?

Accepted Answer

Something you have. Authentication factors are categorized as something you know (password), something you have (token or phone), and something you are (biometrics). A one-time code sent to a mobile phone is considered 'something you have' because access to the phone is required. This question tests the classification of multi-factor authentication components.

Answer

Something you are

Answer

Something you know

Answer

Somewhere you are

Question 6

A user reports that their workstation is running slowly and they see a pop-up claiming their files are encrypted and a ransom must be paid. They cannot open any documents. What type of malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware encrypts files and demands payment for decryption. This scenario describes classic ransomware behavior, where the user is locked out of their data and a ransom note is displayed.

Answer

Spyware

Answer

Trojan horse

Answer

Rootkit

Question 7

A user calls the help desk because they cannot access a shared folder on the network. The user's account is part of the 'Sales' group, which has 'Read' permission, but the user needs to modify files. What is the most efficient way to grant the required access?

Accepted Answer

Add the user to a group that has 'Modify' permission. Adding the user to a group with 'Modify' permissions is efficient because it avoids individual permission assignments and follows the principle of group-based access control. This ensures the user can edit files without overcomplicating permissions.

Answer

Assign 'Full Control' to the user's account directly

Answer

Change the folder's sharing settings to 'Everyone' with 'Read/Write'

Answer

Remove the user from the Sales group and add them to a new group with 'Read' permission

Question 8

During a security audit, you find that a user's workstation has a USB device that automatically logs in to a cloud storage account when inserted. What security best practice is being violated?

Accepted Answer

Disabling auto-run. USB auto-run devices can bypass authentication and pose a security risk. Disabling auto-run prevents unauthorized access and malware from executing automatically, which is a key security practice.

Answer

Password complexity requirements

Answer

Account lockout policies

Answer

Enforcing screen locks

Question 9

A user reports that their Windows 11 laptop can see the office Wi-Fi network but fails to connect, displaying 'Can't connect to this network'. Other users with the same laptop model connect without issues. The network uses WPA2-PSK with AES. What should you check first?

Accepted Answer

Forget the network on the laptop and reconnect by entering the passphrase again.. A mismatch in the saved passphrase is a common cause of connection failures when the network is visible. The correct answer is to forget the network and re-enter the correct passphrase. This tests troubleshooting skills for wireless authentication issues.

Answer

Update the wireless adapter driver.

Answer

Change the router's security protocol to WPA3.

Answer

Disable the firewall on the laptop.

Question 10

A user reports that their system is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice that their default search engine has changed without their permission. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware is designed to display unwanted advertisements and can modify browser settings, causing pop-ups and search engine hijacking. Unlike a virus or worm, adware does not typically replicate itself or require a host file to spread. The symptoms described—pop-ups outside the browser and unauthorized search engine changes—are classic signs of adware infection.

Answer

Virus

Answer

Ransomware

Answer

Rootkit

Question 11

A small business owner calls for support because all of their files on the server have been renamed with a .encrypted extension, and a text file named 'README_TO_DECRYPT.txt' appears on the desktop demanding a Bitcoin payment. What is the first step the technician should take?

Accepted Answer

Disconnect the server from the network.. The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Paying the ransom is discouraged as it does not guarantee data recovery and funds criminal activity. After isolation, the technician can assess the damage and attempt recovery from backups.

Answer

Pay the ransom to get the decryption key immediately.

Answer

Run a full antivirus scan on the server.

Answer

Restore files from a recent backup immediately.

Question 12

A technician is removing malware from a Windows 10 PC and wants to ensure that no remnants remain in the registry or startup folders. After running an antivirus scan and deleting infected files, which additional step should the technician perform?

Accepted Answer

Check and clean startup entries using MSConfig or Autoruns.. After removing malware, it is critical to check and clean startup entries using tools like MSConfig or Autoruns to prevent the malware from reloading on reboot. Malware often adds entries to the registry Run keys or the Startup folder to persist. Simply deleting files may leave these entries intact, allowing the malware to reinstall itself.

Answer

Run the Windows Memory Diagnostic tool.

Answer

Disable System Restore to free up disk space.

Answer

Update all device drivers to the latest versions.

Question 13

A user reports that their computer has been acting strangely: files are missing, and the mouse cursor moves on its own, opening programs and typing messages. The technician suspects a remote access Trojan (RAT). What is the most effective immediate action to stop the unauthorized access?

Accepted Answer

Disconnect the Ethernet cable and disable Wi-Fi.. A RAT gives an attacker remote control of the system. The immediate action is to disconnect the computer from the network, which cuts off the attacker's connection. After isolation, the technician can run scans and remove the malware. Continuing to work while connected risks data theft or further damage.

Answer

Run a full antivirus scan while the user is logged off.

Answer

Change the user's password and log off.

Answer

Restore the system to a previous restore point.

Question 14

A customer reports that their desktop computer is running extremely slowly, and they see frequent pop-up advertisements even when no browser is open. Task Manager shows a process named 'svch0st.exe' consuming 95% CPU. Which type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware displays unwanted advertisements and often masquerades as legitimate processes. The misspelled 'svch0st.exe' mimics a Windows system process, a common adware tactic. This malware type is best removed using a dedicated anti-malware tool.

Answer

Ransomware

Answer

Rootkit

Answer

Spyware

Question 15

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

Accepted Answer

Disconnect the computer from the network immediately.. Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Answer

Pay the ransom to regain access quickly.

Answer

Run a full antivirus scan to remove the malware.

Answer

Restart the computer in Safe Mode and attempt file recovery.