220-1102 Practice Test 23 — 15 Questions

Question 1

A security audit reveals that a company's remote access solution uses a VPN with pre-shared keys (PSK) for authentication. The auditor recommends upgrading to certificate-based authentication. Which of the following is the primary security advantage of certificate-based authentication over PSK?

Accepted Answer

Certificates provide mutual authentication and are unique per device, reducing the risk of a single compromised key affecting all users.. Certificate-based authentication provides mutual authentication, meaning both the VPN client and server verify each other's identity using digital certificates issued by a trusted Certificate Authority (CA). Unlike PSK, which is a shared secret that can be leaked and reused across all devices, each certificate is unique per device, so compromise of one certificate does not expose the entire VPN infrastructure. This significantly reduces the blast radius of a security breach and aligns with the principle of least privilege.

Answer

Certificates are easier to configure and manage than PSK.

Answer

Certificates eliminate the need for a VPN server.

Answer

Certificates are faster than PSK for establishing VPN connections.

Question 2

An employee finds a USB drive labeled 'Employee Bonuses Q4' in the parking lot and plugs it into their work computer to see the contents. The computer immediately begins exhibiting erratic behavior. Which social engineering attack was executed?

Accepted Answer

Baiting. The correct answer is C, baiting. Baiting is a social engineering attack that uses a physical device (like a USB drive) or digital offer to lure a victim into taking an action that compromises security. In this scenario, the attacker left a USB drive labeled with an enticing file name ('Employee Bonuses Q4') in a public location, and the victim plugged it into their work computer, which then executed malicious code (e.g., autorun.inf or a malicious script) that caused erratic behavior. This is a classic example of a physical baiting attack, distinct from phishing or pretexting which rely on digital communication or fabricated scenarios.

Answer

Phishing

Answer

Pretexting

Answer

Tailgating

Question 3

An organization uses Windows 10 and wants to prevent users from installing unauthorized software. They have configured Software Restriction Policies via Group Policy. However, a user bypassed the policy by renaming the executable. What additional measure should be taken to enforce the restriction?

Accepted Answer

Use AppLocker with publisher rules. AppLocker with publisher rules is the correct additional measure because Software Restriction Policies (SRP) can be bypassed by renaming executables, as SRP relies on file path or hash rules. AppLocker's publisher rules use digital signatures to identify software, making it immune to filename changes. This provides a more robust enforcement mechanism for preventing unauthorized software installation.

Answer

Enable Windows Defender Real-time Protection

Answer

Set User Account Control to Always Notify

Answer

Enable BitLocker

Question 4

A company laptop was stolen, and the IT department needs to ensure that the data on the device cannot be accessed. The laptop had BitLocker enabled, but the drive was unlocked when stolen. What additional security measure could have prevented data access in this scenario?

Accepted Answer

Configure BitLocker with a startup PIN. BitLocker with a startup PIN requires the user to enter a PIN before the OS loads, even if the drive was previously unlocked. Since the laptop was stolen while unlocked, the PIN would have prevented the drive from being decrypted after a reboot or power loss, protecting the data from unauthorized access.

Answer

Enable Windows Defender Firewall

Answer

Use a strong user password

Answer

Enable System Restore

Question 5

During a security audit, you discover that a user’s Windows 10 device has allowed multiple failed login attempts without locking the account. Which policy should you adjust to enforce account lockout after 5 failed attempts?

Accepted Answer

Account Lockout Policy – Account lockout threshold. The Account Lockout Policy – Account lockout threshold setting directly controls the number of failed logon attempts allowed before the account is locked. By setting this value to 5, the system will enforce a lockout after exactly five incorrect password entries, preventing further brute-force attempts until an administrator unlocks the account or the lockout duration expires.

Answer

Password Policy – Minimum password length

Answer

User Rights Assignment – Deny log on locally

Answer

Security Options – Interactive logon: Message text for users attempting to log on

Question 6

A company uses a Remote Desktop Gateway to allow employees to access internal desktops from the internet. Users report that they can connect to the gateway but cannot see any available desktops in the list. Which of the following is the most likely cause?

Accepted Answer

The users are not members of the correct Active Directory group that is allowed to access specific desktops.. The Remote Desktop Gateway (RD Gateway) acts as a proxy, allowing external RDP connections to internal desktops. When users can connect to the gateway itself but see no desktops, it typically indicates an authorization failure: the RD Gateway uses Resource Authorization Policies (RAPs) to control which desktops a user can access. If the user is not a member of the Active Directory group specified in the RAP, the gateway will deny the list of available desktops, even though the gateway connection succeeds.

Answer

The Remote Desktop Gateway service is not running on the server.

Answer

The desktops are powered off or disconnected from the network.

Answer

The user's RDP client is outdated and cannot display the list.

Question 7

A user reports that their web browser frequently redirects to an unfamiliar search engine and displays pop-up ads even when no tabs are open. What is the most likely cause of this behavior?

Accepted Answer

The user has accidentally enabled a malicious browser extension.. The described behavior—unwanted redirects to an unfamiliar search engine and pop-up ads appearing even with no tabs open—is a classic symptom of adware or a malicious browser extension. Such extensions hijack browser settings, inject ads, and redirect search queries without the user's consent. Unlike a simple update or cache issue, this requires a malicious add-on that has been granted permissions to modify web content and navigation.

Answer

The browser needs to be updated to the latest version.

Answer

The internet connection is unstable and causing DNS errors.

Answer

The browser cache is full and needs to be cleared.

Question 8

During a remote troubleshooting session, a technician uses a tool that allows them to view the user's screen and control the mouse and keyboard. The user reports that the session is extremely laggy, with noticeable delay between the technician's actions and the screen update. Which of the following is the most likely cause of this lag?

Accepted Answer

The network connection between the technician and the user has high latency or low bandwidth.. The lag described is a classic symptom of network latency or insufficient bandwidth, which directly impacts the responsiveness of remote desktop protocols like RDP or VNC. These protocols transmit screen updates and input events in real time; high latency delays the round-trip of packets, while low bandwidth can cause frame drops or compression artifacts, resulting in the noticeable delay between the technician's actions and the screen update.

Answer

The remote desktop software is using an outdated encryption protocol.

Answer

The user's computer has insufficient RAM to handle remote desktop sessions.

Answer

The technician's computer is running a different operating system than the user's.

Question 9

A user working from home reports that they can no longer connect to the company's internal file server using Remote Desktop. They confirm their internet connection is working. Which remote access technology should the technician verify is still active on the user's VPN client?

Accepted Answer

VPN connection. The user's internet connection is working, but they cannot reach the internal file server via Remote Desktop. This indicates the VPN tunnel, which provides encrypted access to the internal network, has likely dropped or is misconfigured. Without an active VPN connection, the user's client cannot route traffic to the private IP range of the file server, even though general internet access is available.

Answer

SSH tunnel

Answer

Remote Desktop Gateway

Answer

VNC server

Question 10

A technician is configuring a remote desktop solution for a user who needs to access a Windows 10 Pro workstation from a Linux laptop. Which protocol should the technician ensure is enabled on the Windows machine?

Accepted Answer

RDP. RDP (Remote Desktop Protocol) is the native protocol used by Windows for remote desktop connections. Windows 10 Pro includes an RDP server that listens on TCP port 3389, allowing clients such as the Microsoft Remote Desktop client on Linux to connect and provide a full graphical desktop experience. The technician must ensure the 'Allow remote connections to this computer' setting is enabled and that the Windows Firewall permits inbound RDP traffic.

Answer

VNC

Answer

SSH

Answer

Telnet

Question 11

A technician is configuring a VPN for a remote user. The user's home router uses NAT, and the technician wants to ensure the VPN traffic is encapsulated and encrypted. Which VPN protocol should the technician choose for the best balance of security and compatibility?

Accepted Answer

OpenVPN. OpenVPN is the correct choice because it provides a robust balance of security and compatibility, especially for remote users behind NAT. It uses SSL/TLS for encryption and can operate over a single UDP or TCP port (typically 1194), which easily traverses NAT without requiring additional configuration. Unlike L2TP/IPsec, OpenVPN does not rely on IPsec's NAT-sensitive protocols like ESP, making it more reliable across home routers.

Answer

PPTP

Answer

L2TP/IPsec

Answer

SSTP

Question 12

A user reports that they can no longer connect to the company network from home using VPN. They confirm their internet connection is working and that they can browse websites. Which of the following should a technician check first to resolve the VPN connectivity issue?

Accepted Answer

Verify the user's VPN username and password. The user's internet connection is working (they can browse websites), which rules out general network connectivity issues. The most common cause of VPN authentication failure is incorrect or expired credentials, so verifying the username and password is the quickest and most logical first step before escalating to more complex troubleshooting.

Answer

Check if the VPN client software is up to date

Answer

Restart the VPN server at the data center

Answer

Reinstall the network adapter drivers

Question 13

A company deploys a new remote access solution using a VPN concentrator. After setup, users report that they can connect to the VPN but cannot access internal file servers. Other internal resources like email are accessible. Which of the following is the most likely cause?

Accepted Answer

The VPN concentrator lacks a route to the file server's subnet. Option C is correct because the VPN concentrator must have a route to the file server's subnet to forward traffic from VPN clients. Without this route, packets destined for the file server are dropped, while other resources (like email) remain accessible if their subnets are reachable. This is a classic routing issue in remote access VPN deployments.

Answer

The VPN client is using an incorrect DNS server

Answer

The file server is not on the same VLAN as the VPN concentrator

Answer

The users do not have permission to log on locally to the file server

Question 14

A technician is on a support call with a user who has a strong accent and is speaking quickly. The technician is having difficulty understanding the issue. What is the most professional way to handle this?

Accepted Answer

Ask the user to speak more slowly and repeat the problem, apologizing for the difficulty.. Option B is correct because it demonstrates active listening and professional courtesy by politely asking the user to slow down and repeat the issue. This approach maintains rapport, ensures accurate information gathering, and avoids misdiagnosis that could lead to wasted time or incorrect troubleshooting steps. In a support context, clear communication is essential for identifying the root cause and applying the correct fix.

Answer

Pretend to understand and hope the issue becomes clear during troubleshooting.

Answer

Transfer the call to a different technician who might understand the accent better.

Answer

Tell the user that their accent is hard to understand and ask them to email the problem instead.

Question 15

A small business owner asks you to configure their office computers so that employees cannot install unauthorized browser extensions. Which policy setting should you implement?

Accepted Answer

Use Group Policy to block extension installation and whitelist approved extensions.. Group Policy allows centralized management of browser settings in a domain environment. By configuring the 'Configure the list of force-installed extensions' and 'Block external extensions' policies, an administrator can whitelist approved extensions and prevent users from installing any others. This directly addresses the requirement to block unauthorized browser extensions.

Answer

Disable the browser's developer mode in the settings.

Answer

Set the browser to always use private browsing mode.

Answer

Install a pop-up blocker on each computer.