220-1102 Practice Test 13 — 15 Questions

Question 1

A technician is configuring a new Windows 11 workstation for a user who frequently downloads free software. To reduce the risk of malware infections from bundled applications, which security setting should be enabled?

Accepted Answer

Set User Account Control to always notify.. User Account Control (UAC) set to 'Always notify' is the correct choice because it prompts the user for consent or credentials whenever an application (including bundled installers) attempts to make system-level changes. This gives the user a chance to review and block unauthorized installations, directly reducing the risk of malware from bundled freeware. The other options address different security concerns: Application Guard isolates browser sessions, Firewall controls network traffic, and BitLocker encrypts data at rest.

Answer

Enable Windows Defender Application Guard.

Answer

Turn on Windows Firewall with advanced logging.

Answer

Enable BitLocker drive encryption.

Question 2

A technician is troubleshooting a computer that displays a fake security alert claiming the system is infected and urging the user to call a toll-free number. The alert cannot be closed and appears on top of all other windows. What is the best removal approach?

Accepted Answer

Restart the computer and press F8 to boot into Safe Mode with Networking, then run a malware scan.. This is a tech support scam, a form of scareware that uses a persistent pop-up. Booting into Safe Mode with Networking allows the technician to run an anti-malware scan without the rogue process interfering. Safe Mode loads only essential drivers, preventing the scareware from starting.

Answer

End the process 'svchost.exe' in Task Manager.

Answer

Call the toll-free number to get help removing the alert.

Answer

Use System Restore to revert to a previous restore point.

Question 3

A small business owner reports that all their Microsoft Office documents are now encrypted with a '.crypt' extension and a ransom note demands payment in cryptocurrency. They have a backup from last week stored on an external drive that was disconnected after the backup. What is the best recovery strategy?

Accepted Answer

Restore the files from the disconnected external backup after removing the malware.. Since the backup is offline and not encrypted, restoring from it is the safest and most reliable recovery method. Paying the ransom is discouraged as it funds criminals and may not work. The system should be cleaned of malware before restoration.

Answer

Pay the ransom to obtain the decryption key.

Answer

Run a decryptor tool downloaded from a random website.

Answer

Use System Restore to revert the system to a previous state.

Question 4

A technician is cleaning a computer that has been infected with a rootkit. After running a standard antivirus scan, the malware is still detected on reboot. Which step should the technician take next to ensure complete removal?

Accepted Answer

Boot from a rescue disk and run a malware scan.. Rootkits are designed to hide from the operating system and standard antivirus tools by intercepting system calls and loading before the OS security components. Booting from a rescue disk (e.g., a Linux live CD or a dedicated antivirus rescue ISO) bypasses the infected OS entirely, allowing the scanner to access the file system without the rootkit actively masking its presence. This ensures the malware cannot interfere with the scan, enabling complete detection and removal.

Answer

Perform a clean installation of Windows.

Answer

Disable System Restore and run the antivirus again.

Answer

Run the antivirus in Safe Mode.

Question 5

A technician is investigating a security breach where sensitive customer data was exfiltrated. The only malware found is a hidden driver that intercepts keystrokes and sends them to a remote server. Which malware type is responsible, and what is the best removal strategy?

Accepted Answer

Keylogger; use a rescue disk to boot and run an anti-rootkit scanner.. The malware is a hidden driver that intercepts keystrokes and sends them to a remote server, which is the classic behavior of a keylogger. Because it is a driver, it likely operates at the kernel level, making it a rootkit. Standard antivirus scans may miss it because the OS is compromised, so the best removal strategy is to boot from a rescue disk (clean OS) and run an anti-rootkit scanner to detect and remove the driver without the rootkit hiding itself.

Answer

Spyware; remove by running a standard antivirus scan.

Answer

Ransomware; restore from backup.

Answer

Adware; uninstall suspicious programs from Control Panel.

Question 6

A customer reports that their Windows 10 computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware displays unwanted advertisements and often installs browser toolbars, slowing down the system. Unlike a virus or worm, adware does not self-replicate, and ransomware would demand payment rather than show ads.

Answer

Ransomware

Answer

Virus

Answer

Worm

Question 7

A user reports that their computer is displaying a message claiming their files are encrypted and they must pay 0.5 Bitcoin to a specific address to regain access. The user cannot open any documents or photos. What is the first step the technician should take to respond to this incident?

Accepted Answer

Disconnect the computer from the network.. The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Attempting to decrypt without tools or paying the ransom are not recommended initial actions.

Answer

Pay the ransom to recover the files immediately.

Answer

Run a full antivirus scan to remove the malware.

Answer

Reboot the computer into Safe Mode.

Question 8

A technician is investigating a computer that has been sending spam emails from the user's account without their knowledge. The user has not installed any new software recently. The technician finds a process running that matches a known botnet client. Which two steps should the technician take first to mitigate the threat?

Accepted Answer

Disconnect the computer from the network and terminate the malicious process.. The immediate priority is to disconnect the computer from the network to stop the botnet communication and prevent further spam. Then, the technician should identify and terminate the malicious process. Scanning without disconnecting may allow continued data exfiltration.

Answer

Run a full antivirus scan and then update the firewall rules.

Answer

Change the user's email password and run a malware scan.

Answer

Reboot the computer into Safe Mode and then run a scan.

Question 9

A user calls the help desk, frantic because their banking app shows an unauthorized transfer of $500. They say they received a call earlier from 'bank security' asking them to install a remote access tool to 'verify their account'. What type of social engineering attack did the user fall victim to?

Accepted Answer

Vishing. The user received a phone call (voice channel) and was tricked into installing remote access software, which is the hallmark of vishing (voice phishing). Unlike phishing, which uses email or malicious links, vishing exploits telephone systems and social engineering to gain unauthorized access or sensitive information.

Answer

Phishing

Answer

Smishing

Answer

Shoulder surfing

Question 10

A customer complains that their computer is running slowly and they keep seeing pop-ups offering free antivirus software. They admit they clicked 'OK' on one pop-up. Which type of social engineering attack has likely occurred?

Accepted Answer

Baiting. The correct answer is Baiting. In this scenario, the user clicked 'OK' on a pop-up offering free antivirus software, which is a classic baiting attack. Baiting lures victims with a false promise (e.g., free software) to trick them into executing malware or revealing credentials. Unlike phishing, which typically uses deceptive emails or websites to steal sensitive information, baiting relies on the allure of a free item or service to trigger a malicious download.

Answer

Phishing

Answer

Pretexting

Answer

Shoulder surfing

Question 11

During a software deployment, a user reports that a stranger in a delivery uniform asked to use their computer to 'check a shipment status' and then quickly left. Later, the user notices unusual network activity. What should the technician investigate first?

Accepted Answer

Scan the workstation for malware and review recent system changes.. The scenario describes a classic social engineering attack where an unauthorized individual gains physical access to a workstation under a pretext. The immediate technical priority is to scan the workstation for malware and review recent system changes because the attacker may have installed a backdoor, keylogger, or remote access trojan (RAT) that explains the unusual network activity. This aligns with incident response best practices: isolate and analyze the affected system first to contain potential data exfiltration or lateral movement.

Answer

Check the user's email for phishing messages.

Answer

Verify the delivery person's identity with the shipping company.

Answer

Disable the user's network access permanently.

Question 12

A user reports receiving a phone call from someone claiming to be from 'Microsoft Support' saying their computer has a virus and asking for remote access to fix it. The user did not grant access. What type of attack was attempted?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack, a social engineering technique where the attacker uses phone calls to trick victims into providing sensitive information or remote access. Legitimate companies like Microsoft do not make unsolicited support calls.

Answer

Phishing

Answer

Smishing

Answer

Pretexting

Question 13

A technician is helping a customer configure a new laptop. The customer mentions they received a pop-up on their old computer warning of a virus and a phone number to call for support. The customer called the number and gave remote access to a 'technician' who then installed several programs. What social engineering attack occurred?

Accepted Answer

Tech support scam. This is a classic tech support scam, a form of social engineering where attackers use fake virus warnings to gain remote access. The pop-up is designed to scare the user into calling a fraudulent support number. Once access is granted, the attacker can install malware or steal data.

Answer

Shoulder surfing

Answer

Phishing

Answer

Dumpster diving

Question 14

A technician is investigating a data breach and discovers that an attacker obtained sensitive files by searching through the company's recycling bins. The bins contained printed reports with customer names and account numbers. What social engineering attack was used?

Accepted Answer

Dumpster diving. Dumpster diving is the physical act of searching through trash to find sensitive information. This attack relies on the failure to properly dispose of documents. Shredding or secure disposal policies are essential countermeasures.

Answer

Tailgating

Answer

Shoulder surfing

Answer

Phishing

Question 15

A user reports that their Windows 10 laptop shows a blue screen with an error message about 'Driver IRQL not less or equal' after connecting a new external hard drive. They need to use the drive for work. Which security setting should you check to ensure driver installation is not blocked?

Accepted Answer

Disable Driver Signature Enforcement temporarily.. The 'Driver IRQL not less or equal' blue screen error typically indicates a faulty or unsigned driver. Disabling Driver Signature Enforcement (Option C) allows the installation of an unsigned driver, which is often necessary for older or third-party hardware like an external hard drive. This directly addresses the driver installation being blocked by Windows' driver signature requirements.

Answer

Check if Secure Boot is enabled in UEFI.

Answer

Verify that User Account Control is set to 'Notify me only when apps try to make changes.'

Answer

Run Windows Update to find a signed driver.