220-1102 Practice Test 14 — 15 Questions

Question 1

A company uses AppLocker to control which applications can run on Windows 10 workstations. A user needs to run a portable application from a USB drive for a presentation, but it is blocked by AppLocker. The user has local admin rights. What is the best way to allow this specific application while maintaining security?

Accepted Answer

Create a new AppLocker path rule for the USB drive.. AppLocker enforces application control policies regardless of user privileges, including local admin rights. Creating a new path rule for the USB drive allows the specific portable application to run while keeping AppLocker active and maintaining security for other executables. This is the correct approach because it grants a targeted exception without disabling the entire control mechanism.

Answer

Temporarily disable AppLocker service.

Answer

Add the user to the 'Power Users' group.

Answer

Run the application as Administrator.

Question 2

After a security incident, a forensic analyst needs to review the event logs on a Windows 10 system to determine when a specific user account was created. The logs are intact. Which Windows security setting must be enabled to ensure that account creation events are recorded?

Accepted Answer

Enable 'Audit Account Management' in Advanced Audit Policy.. Option B is correct because user account creation is an account management event, not a logon event. In Windows 10, the 'Audit Account Management' policy under Advanced Audit Policy Configuration must be enabled to record Security Event ID 4720 (a user account was created). This setting logs all changes to user and group accounts, including creation, modification, and deletion.

Answer

Enable 'Audit Logon Events' in Local Security Policy.

Answer

Turn on 'File and Printer Sharing' in Network and Sharing Center.

Answer

Configure Windows Defender to scan for new accounts.

Question 3

A company's security policy requires that all Windows 10 workstations automatically lock the screen after 5 minutes of inactivity. However, users in the sales department often leave their desks for extended periods. A technician configures the 'Interactive logon: Machine inactivity limit' policy to 300 seconds. Despite this, the screensaver does not activate. What is the most likely reason?

Accepted Answer

The screensaver is not enabled or configured on the workstations. This question tests understanding of the relationship between the 'Interactive logon: Machine inactivity limit' policy and screensaver settings. The policy locks the workstation after the specified idle time, but it does not automatically enable the screensaver. The screensaver must be separately configured and enabled, or the lock screen will appear without a screensaver.

Answer

The 'Screen saver timeout' policy is set to a longer duration

Answer

The 'Password protect the screensaver' setting is disabled

Answer

The 'Turn off the display' power setting is set to 'Never'

Question 4

A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is the correct feature because it enforces an application control policy that allows only executables, scripts, and installers signed by approved publishers to run. Unlike AppLocker, WDAC operates at the kernel level and can be configured via Group Policy or MDM to create a trust chain based on the publisher's digital signature, effectively blocking all unauthorized software.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker Drive Encryption

Answer

User Account Control (UAC)

Question 5

A user reports that after a recent Windows update, they can no longer install a legacy application that requires write access to the Program Files folder. The user is a local administrator. What Windows security setting is most likely blocking the installation?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) is the Windows security feature that prompts for consent or credentials before allowing actions that require administrative privileges, even for local administrators. By default, UAC virtualizes write attempts to protected system locations like Program Files, redirecting them to a per-user virtual store, which can cause legacy applications that expect direct write access to fail. Disabling UAC or running the installer with explicit administrative rights (e.g., right-click 'Run as administrator') typically resolves the issue.

Answer

BitLocker Drive Encryption

Answer

Windows Defender Firewall

Answer

Group Policy Software Restrictions

Question 6

A company policy requires that all USB flash drives be automatically scanned for malware when inserted. Which Windows security setting should be configured to enforce this?

Accepted Answer

Enable Windows Defender Real-time Protection. Windows Defender Real-time Protection (now part of Microsoft Defender Antivirus) automatically scans removable media, including USB flash drives, for malware upon insertion. This setting enforces the company policy by ensuring that any file accessed or executed from the drive is checked against known threat signatures in real time, without requiring manual scans.

Answer

Configure BitLocker To Go

Answer

Enable Windows Firewall

Answer

Set User Account Control to Always Notify

Question 7

A user complains that their Windows 10 computer is running slowly and they see frequent pop-ups from an unknown program. After running a full antivirus scan, nothing is detected. Which Windows security feature should you use to investigate and remove potentially unwanted software?

Accepted Answer

Windows Defender Offline Scan. Windows Defender Offline Scan boots from a trusted environment to detect and remove persistent malware that standard scans miss. It is ideal for rootkits or stubborn infections that hide from a live OS.

Answer

Windows Defender Firewall

Answer

System Restore

Answer

User Account Control (UAC)

Question 8

A customer says that when they click a link in an email, it opens a website that looks exactly like their bank's login page, but the URL starts with 'http://' instead of 'https://'. What is the most likely security concern?

Accepted Answer

The email contains a phishing link.. The absence of HTTPS and the lookalike page strongly indicate a phishing attempt. Phishing sites often mimic legitimate sites to steal credentials, and the lack of encryption is a red flag. Users should never enter credentials on non-HTTPS pages, especially from email links.

Answer

The website is using an expired SSL certificate.

Answer

The user's browser is infected with adware.

Answer

The user's DNS server has been compromised.

Question 9

A technician is configuring a kiosk computer that will be used by the public to access a specific website. The technician wants to prevent users from navigating to other sites or changing browser settings. Which browser feature should be enabled?

Accepted Answer

Enable kiosk mode.. Kiosk mode locks the browser to a specific site or set of sites, hides the address bar, and disables settings access. This is ideal for public terminals. Other options like private browsing or parental controls do not provide the same level of restriction.

Answer

Enable private browsing mode.

Answer

Enable parental controls.

Answer

Disable the address bar via group policy.

Question 10

A technician is investigating a security incident where a user's credentials were stolen. The user says they only logged into their email from a coffee shop Wi-Fi. The technician notices that the browser was not using HTTPS for the login page. What is the most likely attack method used?

Accepted Answer

Man-in-the-middle attack.. On an open Wi-Fi network, an attacker can perform a man-in-the-middle attack to intercept unencrypted HTTP traffic. Without HTTPS, the login credentials are sent in plaintext and can be captured easily. This is a common risk on public Wi-Fi.

Answer

Cross-site scripting (XSS) attack.

Answer

DNS spoofing attack.

Answer

Brute force attack.

Question 11

A user reports that their browser frequently redirects to a different search engine, and a new toolbar has appeared. After checking the browser settings, you find the homepage has been changed and there are unknown extensions enabled. What is the most likely cause of this issue?

Accepted Answer

A browser hijacker installed via a malicious extension. This scenario describes classic symptoms of a browser hijacker, a type of malware that modifies browser settings without user consent. The correct answer is to remove the malicious extensions and reset the browser settings. This reinforces the importance of managing browser extensions and understanding common malware behaviors.

Answer

A corrupted browser cache

Answer

An outdated browser version

Answer

A misconfigured proxy server

Question 12

A small business owner wants to ensure that employees cannot install unauthorized browser extensions on company-managed Windows 10 computers. Which method should you use to enforce this restriction?

Accepted Answer

Configure Group Policy to block extension installation. Group Policy allows administrators to centrally manage Windows settings, including browser policies. By configuring the 'Block installation of extensions' policy under Administrative Templates for each browser (e.g., Chrome, Edge), you can prevent users from installing unauthorized extensions on company-managed Windows 10 computers.

Answer

Enable private browsing mode in each browser

Answer

Set the browser homepage to a company-approved site

Answer

Install an ad-blocker extension

Question 13

A user calls the help desk saying that every time they click a link in an email, their browser opens a page that says 'Your computer is infected! Call this number.' They are unable to close the page normally. What type of attack is this, and what is the first step you should take?

Accepted Answer

Tech support scam; force close the browser using Task Manager, then run a security scan. This is a tech support scam using a social engineering tactic to frighten the user. The correct first step is to close the browser forcefully using Task Manager, then run a security scan. This tests the ability to distinguish between different attack types and appropriate response procedures.

Answer

Phishing attack; immediately change the user's email password

Answer

Browser hijacker; run a full antivirus scan immediately

Answer

Drive-by download; disconnect the computer from the network

Question 14

During a security audit, you discover that a user's browser has multiple pop-up windows appearing, even when no websites are open. The user denies installing any software. Which tool should you use to identify and remove the underlying cause?

Accepted Answer

Run a full scan with Windows Defender or another anti-malware tool. Pop-ups appearing without a browser suggest adware or a potentially unwanted program (PUP) running as a background process. Using Windows Defender or an anti-malware scanner is the correct approach. This tests understanding of adware behavior and removal tools.

Answer

Reset the browser settings to default

Answer

Disable JavaScript in the browser

Answer

Clear the browser cache and cookies

Question 15

A technician is decommissioning a server that contained encrypted patient health records. The organization's policy requires data to be destroyed beyond recovery, but the server must be returned to the leasing company. Which method should the technician use?

Accepted Answer

Remove the hard drives and physically shred them, then return the server without drives.. Option C is correct because physically shredding the hard drives ensures the encrypted patient health records are destroyed beyond any possible recovery, which satisfies the organization's policy. Returning the server without drives complies with the leasing company's requirement to return the server chassis, as the drives are typically owned by the organization or can be removed per lease terms. This method is the only one that guarantees data destruction at the physical media level, bypassing any residual data on the encrypted drives.

Answer

Perform a full format of all drives.

Answer

Use a degausser on the entire server chassis.

Answer

Run a disk cleanup and delete all files.