220-1102 Practice Test 31 — 15 Questions

Question 1

During a security incident investigation, you discover that an attacker gained physical access to a network closet by using a cloned RFID badge. Which control would have most effectively prevented this type of attack?

Accepted Answer

Use a biometric reader instead of RFID. A biometric reader (e.g., fingerprint or iris scanner) is the most effective control because it authenticates based on a unique physical trait that cannot be cloned or duplicated like an RFID badge. Since the attacker used a cloned RFID badge, a biometric system would have required the attacker's own biometric data, which they cannot replicate from the legitimate user. This directly addresses the root cause of the attack—credential theft via cloning—rather than merely detecting or delaying it.

Answer

Install a CCTV camera in the closet

Answer

Add a door sensor alarm

Answer

Require a second factor like a PIN

Question 2

A company uses a private cloud for its internal applications. The IT team wants to ensure that if one physical host fails, the virtual machines running on it can be automatically restarted on another host with minimal downtime. Which feature should they implement?

Accepted Answer

High availability. High availability (HA) is the correct feature because it is designed to automatically restart virtual machines on a surviving host within a cluster when a physical host fails. HA uses heartbeat monitoring between hosts and a resource manager to detect failures and trigger VM restarts, minimizing downtime without requiring manual intervention.

Answer

Fault tolerance

Answer

Live migration

Answer

Snapshots

Question 3

During a routine security walkthrough, you notice that an employee has propped open a secured door to the server room with a doorstop to allow easy access for a cleaning crew. What is the most immediate action you should take?

Accepted Answer

Remove the doorstop and close the door.. The immediate priority is to restore the physical security control by removing the doorstop and closing the door. A propped-open door bypasses the access control system (e.g., card reader, electronic lock), allowing unauthorized entry to the server room. This action directly mitigates the active vulnerability without delay.

Answer

Document the incident and report it to the security manager.

Answer

Reprimand the employee who propped the door.

Answer

Install a door alarm that sounds if the door is open too long.

Question 4

A company experiences a data breach after an attacker physically removes a hard drive from an unsecured workstation. The workstation was in a public area. Which combination of physical and logical controls would have best prevented this?

Accepted Answer

Cable lock and full-disk encryption. Option B is correct because a cable lock physically secures the workstation to a fixed object, preventing the attacker from removing the hard drive, while full-disk encryption (FDE) renders the data on the drive unreadable even if the drive is physically removed. Together, they address both the physical theft vector and the data exposure risk, which a single control cannot achieve. Without FDE, a BIOS password or Windows password can be bypassed by removing the drive and reading it from another system.

Answer

Cable lock and BIOS password

Answer

Security camera and Windows password

Answer

Proximity card reader and screen lock

Question 5

A helpdesk technician receives a call from an employee who says their smart card stopped working for building access. The employee is in a hurry and asks the technician to remotely disable the card and issue a temporary PIN for the day. What should the technician do first?

Accepted Answer

Ask the employee to visit the security office in person with a photo ID.. Option B is correct because smart card credentials for physical access are typically managed by a separate physical security system (e.g., an access control server), not the helpdesk's IT identity management system. The technician cannot remotely disable the card or issue a temporary PIN without proper authorization and verification of the caller's identity. The standard procedure is to require in-person verification with a photo ID at the security office to prevent social engineering attacks.

Answer

Disable the smart card and provide a temporary PIN as requested.

Answer

Reset the smart card remotely and test it with a badge reader.

Answer

Send a temporary PIN via email to the employee's company address.

Question 6

A school district is deploying laptops to students and wants to deter theft while keeping devices usable. Which physical security control should they implement on the laptops?

Accepted Answer

Apply asset tracking tags. Asset tracking tags (e.g., RFID or GPS-enabled stickers) provide a non-intrusive way to monitor and recover laptops if stolen, without hindering normal use. They deter theft by enabling location tracking and inventory management, which aligns with the school's goal of keeping devices usable while reducing loss.

Answer

Install a cable lock on each laptop

Answer

Use a laptop safe

Answer

Enable a BIOS password

Question 7

An organization experiences a data breach when an attacker physically removes hard drives from a decommissioned server that was placed in a storage area without being properly sanitized. What physical security control should have been implemented?

Accepted Answer

Use a degausser to erase the hard drives before disposal.. Option C is correct because the core issue is that the hard drives were not properly sanitized before disposal, allowing an attacker to recover data from them. A degausser is a physical security control that uses a strong magnetic field to erase data on magnetic media, such as hard disk drives (HDDs), rendering the drives unreadable and unrecoverable. This directly addresses the root cause of the breach by ensuring data is destroyed before the hardware leaves a secure environment.

Answer

Install a surveillance camera in the storage area.

Answer

Require a smart card to access the storage area.

Answer

Apply tamper-evident seals to the server chassis.

Question 8

A technician is tasked with securing a shared office printer that stores sensitive documents on its hard drive. The printer is in an open area. Which physical security measure should be prioritized to protect the data on the printer?

Accepted Answer

Place the printer in a locked room. Option C is correct because the most effective physical security measure to protect sensitive data on a printer's hard drive in an open area is to control physical access to the device itself. Placing the printer in a locked room prevents unauthorized individuals from physically removing the hard drive or accessing the printer's internal components, which is the primary threat in an open area. While encryption and secure release are important, they do not mitigate the risk of physical theft or tampering with the storage medium.

Answer

Enable secure print release with a PIN

Answer

Encrypt the printer's hard drive

Answer

Use a cable lock on the printer

Question 9

An organization wants to ensure that even if a laptop is stolen, the data on the hard drive cannot be read. The laptop runs Windows 10 Pro and is used by employees who travel frequently. Which security feature should be enabled?

Accepted Answer

Enable BitLocker Drive Encryption on the system drive.. BitLocker Drive Encryption is the correct choice because it encrypts the entire system drive at the block level, using AES encryption (typically 128-bit or 256-bit) with a TPM (Trusted Platform Module) to protect the encryption keys. This ensures that if the laptop is stolen, the hard drive cannot be removed and read from another system, as the data remains encrypted without the correct authentication (e.g., TPM + PIN or recovery key).

Answer

Set a strong BIOS/UEFI password.

Answer

Configure a screensaver password with a short timeout.

Answer

Use EFS to encrypt individual files and folders.

Question 10

During a security audit, it is discovered that a former employee's user account is still active and has been used to log in remotely three times in the past month. Which logical security principle has been violated?

Accepted Answer

Least privilege. The correct answer is B, least privilege. The principle of least privilege requires that users be granted only the minimum access rights necessary to perform their job functions. A former employee's account remaining active and being used for remote logins violates this principle because the account should have been disabled or deleted upon termination, removing all access privileges.

Answer

Separation of duties

Answer

Defense in depth

Answer

Mandatory access control

Question 11

A technician is configuring a wireless network for a new office. The network must support legacy devices that only support WPA-TKIP, but the technician also wants to maximize security for modern devices. Which configuration should the technician use?

Accepted Answer

Set up a separate SSID with WPA-TKIP for legacy devices and another SSID with WPA2-AES for modern devices.. Option D is correct because it isolates legacy WPA-TKIP devices on a separate SSID, preventing the weaker TKIP encryption from compromising the security of modern devices. Modern devices can then connect to a second SSID using WPA2-AES, which provides strong encryption (CCMP) and is not vulnerable to TKIP-specific attacks like Michael MIC exhaustion. This approach satisfies both requirements without forcing all devices onto a single, less secure configuration.

Answer

Enable WPA3-SAE for all devices.

Answer

Use WPA2-PSK with TKIP encryption.

Answer

Configure the router for WPA2-PSK with AES and enable WPA-TKIP as a fallback.

Question 12

A company's security policy requires that user accounts be disabled after 90 days of inactivity. An administrator needs to implement this automatically. Which feature should they configure?

Accepted Answer

User account expiration. User account expiration allows an administrator to set a specific date or, in some directory services like Active Directory, a duration after which the account is automatically disabled. By configuring the account to expire after 90 days from the last logon, the policy requirement is met automatically without manual intervention.

Answer

Password expiration policy

Answer

Account lockout threshold

Answer

Group Policy refresh interval

Question 13

A technician is configuring a wireless network for a school that uses Chromebooks and iPads. The network must support fast roaming and prioritize security. The technician enables WPA2-Enterprise with 802.1X. What additional configuration is needed to ensure seamless roaming between access points?

Accepted Answer

Enable 802.11r (Fast Roaming) on the wireless controller.. Option C is correct because 802.11r (Fast Roaming) enables seamless key distribution between access points during client transitions, eliminating the need for full re-authentication with the RADIUS server. This is essential for devices like Chromebooks and iPads that move frequently across a school campus, ensuring low-latency roaming while maintaining WPA2-Enterprise security.

Answer

Enable WPA3-SAE on all access points.

Answer

Configure all access points with the same SSID and passphrase.

Answer

Disable WPS on all access points.

Question 14

A user calls the help desk because their computer is running slowly and they see a fake antivirus program warning that their system is infected. The user cannot close the warning window. Which type of malware is this, and what is the best removal approach?

Accepted Answer

Rogue antivirus; boot into Safe Mode with Networking and run Malwarebytes.. The symptoms—a fake antivirus warning that cannot be closed—are classic indicators of rogue antivirus (scareware). This type of malware mimics legitimate security software to trick users into paying for unnecessary services. The best removal approach is to boot into Safe Mode with Networking, which loads only essential drivers and services, preventing the rogue program from auto-starting, then run Malwarebytes to detect and remove the threat.

Answer

Ransomware; pay the fee to remove the warning.

Answer

Spyware; run a full scan in normal mode.

Answer

Adware; uninstall the program from Control Panel.

Question 15

A technician is configuring a new employee's workstation. The employee mentions that a 'friendly IT guy' from the help desk called earlier and asked for their username and temporary password to 'pre-setup the account'. The employee provided the information. What should the technician do first?

Accepted Answer

Reset the employee's password and report the incident to the security team.. Option B is correct because the employee has already fallen victim to a social engineering attack (phishing or vishing). The technician must immediately reset the compromised password to prevent unauthorized access and report the incident to the security team so they can investigate and mitigate further risk. This follows the principle of least privilege and incident response best practices for credential compromise.

Answer

Proceed with the setup as planned, since the employee already provided the info.

Answer

Call the help desk to verify if they made the call.

Answer

Tell the employee it was likely a test and to ignore it.