220-1102 Practice Test 32 — 15 Questions

Question 1

During a security audit, a technician notices that an unauthorized person is standing just behind an employee at the secure door, waiting for the employee to badge in so they can enter without badging themselves. What type of social engineering attack is being attempted?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a secured area without using their own credentials. In this scenario, the attacker waits for the employee to badge in and then slips through the door before it closes, bypassing the access control system. This exploits the trust or politeness of the employee and the physical security gap between the door closing and the authentication check.

Answer

Pretexting

Answer

Baiting

Answer

Phishing

Question 2

During a security incident, a technician discovers that a user's computer has a program that hides its processes from Task Manager and allows an attacker to remotely control the system. The technician suspects a rootkit. Which removal method is most effective for a rootkit?

Accepted Answer

Reinstall the operating system from a trusted source.. Option C is correct because rootkits operate at a deep level within the operating system, often hooking kernel-mode functions or modifying system files to hide their presence. Reinstalling the OS from a trusted source ensures that all rootkit components, including those embedded in the boot sector or kernel, are completely removed, as no residual malicious code remains. This method is the only guaranteed way to eliminate a rootkit that has compromised the system's integrity.

Answer

Run a system restore to a point before the infection.

Answer

Use an antivirus boot disk to scan and remove the rootkit.

Answer

Delete the rootkit's files manually in Safe Mode.

Question 3

A user reports receiving an email that appears to be from their CEO, urgently requesting that they purchase $500 in gift cards and reply with the codes. The email address looks slightly off (e.g., ceo@cornpany.com instead of ceo@company.com). What type of social engineering attack is this?

Accepted Answer

Whaling. Whaling is a targeted social engineering attack aimed at senior executives (the 'big fish') like the CEO. The email impersonates the CEO to trick the recipient into performing a financial action, and the slightly spoofed domain (cornpany.com vs company.com) is a classic indicator of a whaling attempt, as it exploits the authority of a high-level executive to bypass normal security checks.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 4

A receptionist at a company receives a call from someone claiming to be from the IT department. The caller says they need her password to perform an urgent server update. The receptionist provides the password. What type of social engineering attack is this?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker fabricates a scenario (the pretext) to manipulate the target into divulging sensitive information. In this case, the caller falsely claims to be from the IT department and invokes an urgent server update to trick the receptionist into revealing her password. This is not a technical exploit but a psychological manipulation that relies on the target's trust in authority and urgency.

Answer

Tailgating

Answer

Phishing

Answer

Baiting

Question 5

A technician is tasked with removing malware from a Windows 10 computer that has a Trojan horse that downloaded additional payloads. The technician has already run a full antivirus scan and removed the Trojan, but the computer still exhibits suspicious network activity. What should the technician do next?

Accepted Answer

Run a second opinion malware scanner such as Malwarebytes.. Even after removing the Trojan with a full antivirus scan, the computer may still have residual malware components (e.g., backdoors, keyloggers, or downloaders) that the primary scanner missed. Running a second opinion scanner like Malwarebytes uses a different detection engine and signature database, increasing the chance of identifying and removing these hidden threats. This step is critical because the suspicious network activity indicates an active infection that the first scan failed to fully eradicate.

Answer

Reimage the computer immediately.

Answer

Reset the web browser settings to default.

Answer

Disable all startup programs in Task Manager.

Question 6

A new employee is setting up their workstation and receives a phone call from someone claiming to be from the IT department. The caller says there is a critical security update and needs the employee's login credentials to install it remotely. What social engineering principle is the attacker primarily exploiting?

Accepted Answer

Authority. The attacker is impersonating IT staff, which leverages the principle of authority. By claiming to be from the IT department, the attacker exploits the employee's tendency to comply with perceived organizational authority, especially regarding security updates. This is a classic social engineering tactic where the attacker uses a trusted role to bypass security protocols.

Answer

Urgency

Answer

Scarcity

Answer

Social proof

Question 7

A technician receives a call from someone claiming to be from the company's IT security team, asking for the administrator password to 'run a critical update.' The caller's voice sounds stressed and they mention a data breach. What should the technician do?

Accepted Answer

Ask for a callback number and verify it against the company directory.. Option B is correct because it follows the principle of verifying identity through a trusted channel before disclosing sensitive information. The technician should ask for a callback number and cross-reference it against the company directory to ensure the caller is legitimate, as social engineering attacks often use urgency and impersonation to bypass security protocols.

Answer

Provide the password immediately to prevent a data breach.

Answer

Ignore the call because IT never calls about updates.

Answer

Change the password and give them the new one.

Question 8

A technician is troubleshooting a printer issue and finds a sticky note under the keyboard with the domain admin password written on it. The user says they kept it there 'for convenience.' Which social engineering attack does this practice most enable?

Accepted Answer

Shoulder surfing. The sticky note with the domain admin password under the keyboard directly enables shoulder surfing, where an attacker visually captures sensitive information (the password) by looking over the user's shoulder or at the exposed note. This is a physical social engineering attack that exploits the convenience of storing credentials in plain sight, bypassing any technical authentication controls.

Answer

Phishing

Answer

Tailgating

Answer

Baiting

Question 9

A small business owner wants to prevent employees from changing system time, installing printers, and modifying power settings on their Windows 10 workstations. They do not want to remove local admin rights entirely. Which Windows security tool should be used to apply these restrictions?

Accepted Answer

Local Group Policy Editor (gpedit.msc). The Local Group Policy Editor (gpedit.msc) allows administrators to configure granular security settings for users and computers without removing local admin rights. Specifically, it can enforce restrictions on system time changes (via 'Change the system time' user right), printer installation (via 'Device Installation Restrictions'), and power settings (via 'Power Management' policies) through Computer Configuration or User Configuration nodes. This tool applies these settings via Group Policy objects that are processed locally, making it the correct choice for non-domain workstations.

Answer

Windows Defender Security Center

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Registry Editor (regedit)

Question 10

A customer reports that their browser shows a 'Your connection is not private' warning when visiting their online banking site, but other websites work fine. What is the most likely cause?

Accepted Answer

The bank's SSL certificate has expired or is misconfigured.. The 'Your connection is not private' warning indicates a TLS/SSL certificate validation failure. Since only the banking site is affected, the issue is specific to that site's certificate, not a system-wide problem. The most common cause is that the bank's SSL certificate has expired, is self-signed, or does not match the domain name, triggering the browser's certificate trust check.

Answer

The user's system date and time are incorrect.

Answer

The user's browser is infected with a man-in-the-middle proxy.

Answer

The user's anti-virus is blocking the connection.

Question 11

A user reports that they cannot access a shared folder on the network, but other users can. The folder is on a Windows 10 Pro workstation. What should you check first to resolve this issue?

Accepted Answer

Check the NTFS permissions on the folder. Since other users can access the shared folder, the network share and firewall are functioning correctly. The issue is specific to one user, which points to a permission problem at the file system level. NTFS permissions control user-level access to folders, and a misconfigured or missing ACE (Access Control Entry) for that user would prevent access while allowing others. Checking NTFS permissions is the logical first step because it directly governs per-user access to the resource.

Answer

Check the Windows Defender Firewall settings

Answer

Check the user’s password expiration status

Answer

Check the User Account Control settings

Question 12

A user reports that after a recent Windows update, their standard user account can no longer install certain applications that previously installed without issue. The update changed the default User Account Control (UAC) behavior. Which UAC setting would most likely restore the previous behavior while still prompting for consent?

Accepted Answer

Notify me only when apps try to make changes to my computer (do not dim my desktop). The default UAC behavior in Windows is 'Notify me only when apps try to make changes to my computer (dim my desktop)' — this prompts for consent when an app requests administrative privileges, but does not prompt for standard user account changes that are handled by the system. The update changed the behavior to a more restrictive setting, likely 'Always notify me (dim my desktop)', which prompts for any system change, including those that previously installed without issue. Option B, 'Notify me only when apps try to make changes to my computer (do not dim my desktop)', restores the previous behavior by prompting for consent only when an app attempts to make a change, but without dimming the desktop, which is a less intrusive prompt that still maintains security.

Answer

Always notify me (dim my desktop)

Answer

Notify me only when apps try to make changes to my computer (dim my desktop)

Answer

Never notify me

Question 13

A technician is configuring a new Windows 10 kiosk computer that will run a single application for public use. They need to prevent users from accessing the desktop, taskbar, or other system functions. Which Windows security feature should be used?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (Kiosk Mode) is the correct feature because it locks down the Windows 10 device to run only a single Universal Windows Platform (UWP) app or a classic Win32 app in full-screen mode, completely hiding the desktop, taskbar, Start menu, and other system interfaces. This is specifically designed for public-facing kiosk scenarios where users must not be able to exit the application or access any other system functions.

Answer

User Account Control (UAC) set to highest level

Answer

Local Group Policy – Software Restriction Policies

Answer

Windows Defender Application Guard

Question 14

A technician is troubleshooting a Windows 10 computer where the user cannot install a legitimate browser extension because the browser displays a warning that extensions from this source are not allowed. What setting is likely blocking the installation?

Accepted Answer

The computer is running Windows 10 in S mode.. Windows 10 in S mode enforces a security policy that restricts application installations exclusively to the Microsoft Store. This includes browser extensions, which are blocked unless they are obtained from the Store. The browser warning directly reflects this OS-level restriction, not a browser-specific setting.

Answer

The browser is in private browsing mode.

Answer

The user account does not have administrator privileges.

Answer

The browser's security level is set to high.

Question 15

A technician is configuring a Windows 10 kiosk system that will run a single application in a public library. The kiosk must automatically log on and start the app without any user interaction. Which security setting combination is required?

Accepted Answer

Configure 'Automatic logon' in the registry and enable 'Assigned Access' for the kiosk account. Option B is correct because configuring 'Automatic logon' in the registry (via the WinLogon key) allows the kiosk to boot directly to the desktop without user interaction, while enabling 'Assigned Access' restricts the kiosk account to running only a single specified Universal Windows Platform (UWP) app, preventing access to the rest of the system. This combination meets the requirement for an unattended, single-application kiosk in a public library.

Answer

Enable 'Sticky Keys' and configure the 'Ease of Access' settings

Answer

Set the 'Shutdown: Allow system to be shut down without having to log on' policy

Answer

Enable 'User Account Control: Run all administrators in Admin Approval Mode'