220-1102 Practice Exam 51 — 20 Questions

Question 1

A technician is setting up a guest Wi-Fi network in a coffee shop. The owner wants customers to be able to connect easily without entering a password, but still wants basic encryption to prevent eavesdropping. Which security configuration should the technician use?

Accepted Answer

Set up an open network with no encryption and a captive portal for terms of service.. Option A is correct because an open network with a captive portal allows customers to connect without a password while still providing a layer of control (terms of service acceptance). However, it does not provide encryption, so the owner's desire for 'basic encryption' is not actually met by this configuration. The question contains a contradiction: the owner wants no password but also wants encryption. In practice, an open network with a captive portal is the only option that allows password-free connectivity, but it offers no encryption, leaving traffic vulnerable to eavesdropping.

Answer

Use WPA2-PSK with a simple password like 'coffee123'.

Answer

Enable WPA3-Enterprise with certificate-based authentication.

Answer

Use WEP with a shared key printed on a receipt.

Question 2

A network administrator is configuring a new wireless network for a hospital that requires the highest level of security for patient data. The network must support 802.1X authentication with smart cards. Which combination of security protocols and authentication methods should be used?

Accepted Answer

WPA2-Enterprise with EAP-TLS.. Option C is correct because WPA2-Enterprise with EAP-TLS provides the highest level of security for a hospital network requiring 802.1X authentication with smart cards. EAP-TLS uses mutual authentication via digital certificates (which can be stored on smart cards), eliminating the risk of credential theft or man-in-the-middle attacks. WPA2-Enterprise is the appropriate underlying encryption framework for this scenario, as it supports the required 802.1X/EAP integration.

Answer

WPA2-PSK with PEAP-MSCHAPv2.

Answer

WPA3-Personal with SAE.

Answer

WPA3-Enterprise with EAP-TTLS.

Question 3

A small business owner reports that after upgrading their wireless router to a newer model, several older laptops running Windows 7 can no longer connect to the Wi-Fi network. The new router is configured to use WPA3. What is the most likely reason for the connection failures?

Accepted Answer

The laptops have outdated wireless drivers that do not support WPA3.. WPA3 is a newer security protocol that requires both the router and the client device to support it. Older laptops running Windows 7 typically have wireless network adapters and drivers that were designed before WPA3 was standardized (2018), so they only support WPA2 or earlier protocols. Without updated drivers that include WPA3 support, these laptops cannot authenticate with the router, causing the connection failures.

Answer

The router's firewall is blocking the older laptops' MAC addresses.

Answer

The laptops are using an incompatible encryption cipher like TKIP.

Answer

The router's SSID is hidden, and the laptops cannot discover it.

Question 4

A user's laptop running Windows 10 Pro connects to the corporate Wi-Fi but cannot access internal resources. The network uses WPA2-Enterprise with PEAP-MSCHAPv2. The laptop's wireless profile is configured correctly. Other users in the same office can access resources. What is the most likely cause?

Accepted Answer

The user's domain account is locked or the password has expired.. The user can connect to Wi-Fi but cannot access internal resources, and other users are unaffected. Since the wireless profile is correct and WPA2-Enterprise uses PEAP-MSCHAPv2 for authentication, the most likely cause is that the user's domain account is locked or the password has expired. This would prevent successful authentication against the RADIUS server, blocking access to internal resources even though the client associates with the access point.

Answer

The laptop's wireless adapter is faulty.

Answer

The access point is broadcasting on a congested channel.

Answer

The laptop has an incorrect IP address from DHCP.

Question 5

During a wireless site survey, a technician discovers that an employee has set up a personal wireless router in their cubicle, connected to the corporate network. This rogue access point is broadcasting an open SSID. Which security risk is most immediately concerning?

Accepted Answer

The rogue AP provides an unencrypted entry point for attackers to access the corporate network.. The most immediate security risk of a rogue access point broadcasting an open SSID is that it provides an unencrypted entry point into the corporate network. Any attacker within range can associate with the open SSID and, because the AP is connected to the corporate LAN, gain direct access to internal resources without authentication or encryption, bypassing perimeter security controls.

Answer

The rogue AP may cause radio frequency interference with the corporate WLAN.

Answer

The rogue AP will consume additional power from the corporate UPS.

Answer

The rogue AP's DHCP server may conflict with the corporate DHCP server.

Question 6

A company's security policy mandates that all wireless traffic must be encrypted using a protocol that is resistant to KRACK attacks. The current network uses WPA2-PSK with AES. Which of the following upgrades should be implemented to meet this requirement?

Accepted Answer

Upgrade to WPA3-Personal.. WPA3-Personal replaces the Pre-Shared Key (PSK) handshake with Simultaneous Authentication of Equals (SAE), which is resistant to offline dictionary attacks and the KRACK vulnerability that exploits the 4-way handshake in WPA2. Since the policy requires encryption resistant to KRACK attacks, upgrading to WPA3-Personal directly addresses this requirement.

Answer

Change the encryption from AES to TKIP.

Answer

Enable WPA2-Enterprise with 802.1X.

Answer

Implement MAC address filtering.

Question 7

A customer complains that their new smartphone connects to their home Wi-Fi but has no internet access. The router is configured with WPA2-PSK and a 64-character pre-shared key. Other devices work fine. What is the most likely cause?

Accepted Answer

The smartphone is using a wrong or mistyped Wi-Fi password.. The most likely cause is a mistyped or incorrect Wi-Fi password. Since the smartphone connects to the Wi-Fi network (association and authentication succeed at Layer 2) but has no internet access, the device is likely using a wrong pre-shared key that still allows partial connectivity due to WPA2-PSK's four-way handshake behavior—if the key is incorrect, the handshake fails, but some implementations may show a 'connected' status without proper encryption. Other devices work fine, ruling out router-side issues like DHCP exhaustion or DNS misconfiguration.

Answer

The smartphone's Wi-Fi antenna is faulty.

Answer

The router's DHCP server has run out of IP addresses.

Answer

The smartphone's DNS settings are misconfigured.

Question 8

A technician is troubleshooting a Windows 10 workstation that displays a fake security alert claiming the system is infected and prompting the user to call a toll-free number. The user cannot close the alert window or open Task Manager. Which type of malware is causing this behavior, and what is the best removal approach?

Accepted Answer

It is a tech support scam; boot into Safe Mode with Networking and run an anti-malware scan.. The fake security alert that cannot be closed and blocks Task Manager is a classic tech support scam, not actual malware that encrypts files or hides deep in the system. Booting into Safe Mode with Networking loads only essential drivers and services, bypassing the scam's persistence mechanism, and allows an anti-malware scan to remove the malicious files and registry entries.

Answer

It is a rootkit; use a rootkit removal tool from within Windows.

Answer

It is ransomware; pay the fee to remove the alert.

Answer

It is a worm; disconnect the network and reinstall the operating system.

Question 9

A technician is investigating a security incident where multiple workstations on the same network are showing signs of infection: slow performance, unusual network traffic, and the presence of a file named 'svch0st.exe' in the Startup folder. The technician suspects a worm that spreads through network shares. What is the most effective containment strategy?

Accepted Answer

Disable network shares and isolate infected workstations from the network.. Disabling network shares and isolating infected workstations from the network is the most effective containment strategy because the worm spreads through network shares (SMB protocol). By cutting off the propagation vector (network shares) and isolating infected hosts, you prevent the worm from reaching other workstations, even if the malware is still active locally. This aligns with the immediate containment phase of incident response, which prioritizes stopping the spread over remediation.

Answer

Run a full antivirus scan on all workstations simultaneously.

Answer

Update the antivirus definitions on one workstation and scan it.

Answer

Reboot all workstations into Safe Mode with Networking.

Question 10

A technician is troubleshooting a wireless network where users report intermittent connectivity and slow speeds. The network uses WPA2-Enterprise with EAP-TLS and certificate-based authentication. The technician notices that the RADIUS server logs show frequent certificate validation failures. What is the most likely root cause?

Accepted Answer

Client devices have expired or untrusted certificates.. The RADIUS server logs show frequent certificate validation failures, which directly points to an issue with the certificates presented by the clients during EAP-TLS authentication. In WPA2-Enterprise with EAP-TLS, both the server and client must present valid certificates; if client certificates are expired or untrusted, the RADIUS server will reject the authentication, causing intermittent connectivity and slow speeds as clients fail to re-authenticate or roam.

Answer

The access point's firmware is outdated, causing packet loss.

Answer

The RADIUS server's certificate has expired.

Answer

The wireless channel is overlapping with neighboring networks.

Question 11

A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?

Accepted Answer

Upgrade to WPA3-SAE.. WPA3-SAE (Simultaneous Authentication of Equals) replaces the WPA2-PSK 4-way handshake with a protocol that uses a Diffie-Hellman key exchange, making it resistant to offline dictionary attacks. Even if an attacker captures the SAE handshake, they cannot crack the passphrase offline because the key exchange provides forward secrecy and prevents brute-force attempts without interacting with the network.

Answer

Switch to WPA2-Enterprise with 802.1X and a RADIUS server.

Answer

Increase the WPA2-PSK passphrase length to 63 characters.

Answer

Enable MAC address filtering on the access point.

Question 12

During a routine security audit, a technician discovers that a user's workstation has a program that records keystrokes and periodically sends the data to an external server. The user denies installing any software recently. Which type of malware is this?

Accepted Answer

Keylogger. The program described records keystrokes and exfiltrates them to an external server, which is the defining behavior of a keylogger. This type of malware captures user input, such as usernames and passwords, and sends the data to an attacker. The user's denial of installing software suggests the keylogger may have been delivered stealthily, often via a Trojan horse or drive-by download, but the core functionality is keylogging.

Answer

Trojan horse

Answer

Worm

Answer

Ransomware

Question 13

A technician is tasked with removing a persistent malware infection that survives reboots and re-infects the system even after a full antivirus scan in Safe Mode. The malware appears to hide in the Master Boot Record (MBR). Which removal method should the technician use?

Accepted Answer

Use the Windows Recovery Environment to run bootrec /fixmbr.. Option B is correct because the malware is hiding in the Master Boot Record (MBR), which is the first sector of the boot drive and loads before the operating system. Running `bootrec /fixmbr` from the Windows Recovery Environment (WinRE) overwrites the MBR code with a clean Windows bootloader, effectively removing the malware that persists there. This method targets the infection at its source, unlike antivirus scans that run after the OS loads and cannot access the MBR while it is in use.

Answer

Run a system file checker (sfc /scannow) from within Windows.

Answer

Perform a clean installation of Windows without formatting the drive.

Answer

Disable System Restore and delete all restore points.

Question 14

A technician is dealing with a zero-day malware infection that has evaded all signature-based antivirus scans. The malware is polymorphic, changing its code each time it infects a new system. Which approach is most likely to detect and remove this type of malware?

Accepted Answer

Employ a heuristic-based or behavior-based malware removal tool.. Heuristic and behavior-based detection tools analyze the actions and code patterns of malware rather than relying on static signatures. Since polymorphic malware changes its code with each infection, signature-based detection fails, but behavioral analysis can identify malicious activity such as registry modifications, process injection, or network anomalies. This approach is effective against zero-day threats because it detects anomalies without needing prior knowledge of the specific malware variant.

Answer

Update the antivirus to the latest signature definitions and run a full scan.

Answer

Use a bootable antivirus rescue disk to scan the system before the OS loads.

Answer

Reinstall the operating system from a known-good backup.

Question 15

A user reports that their computer is sending out a large amount of network traffic even when they are not using the internet. The antivirus detects a file named 'expl0rer.exe' in the startup folder. What type of malware is most likely causing this behavior?

Accepted Answer

Botnet. The file name 'expl0rer.exe' mimics the legitimate 'explorer.exe' but uses a zero in place of the 'o', a common obfuscation technique. The symptom of high outbound network traffic without user activity, combined with the file's presence in the startup folder, strongly indicates the computer is part of a botnet. Botnet malware connects to a command-and-control (C2) server to receive instructions, often used for DDoS attacks or spam relays, which generates constant network activity.

Answer

Spyware

Answer

Virus

Answer

Trojan

Question 16

During a routine security audit, a technician finds that a user's computer has an unknown program running that is sending keystrokes and screenshots to a remote server. The user did not install this program. Which type of malware is this?

Accepted Answer

Keylogger. Option C is correct because the described behavior—capturing keystrokes and screenshots and sending them to a remote server—is the defining characteristic of a keylogger. This type of malware specifically records user input and screen activity to steal sensitive data like passwords and personal information, and it often runs without the user's knowledge or consent.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 17

A technician is troubleshooting a Windows 10 computer that exhibits strange behavior: system files are missing, and the computer fails to boot normally. A boot-time virus scan detects a virus that infected the Master Boot Record (MBR). Which tool should the technician use to repair the MBR?

Accepted Answer

Bootrec.exe /FixMbr. The Bootrec.exe /FixMbr command writes a new Master Boot Record (MBR) to the system partition, overwriting the infected boot code without affecting the existing partition table. This is the correct tool for repairing a virus-compromised MBR that prevents normal booting on Windows 10.

Answer

System Restore

Answer

SFC /Scannow

Answer

CHKDSK /F

Question 18

An employee finds a USB drive labeled 'Employee Salary Info Q4' in the parking lot. Out of curiosity, they plug it into their work computer to see the contents. What type of social engineering attack is this an example of?

Accepted Answer

Baiting. Option C is correct because baiting is a social engineering attack that exploits human curiosity or greed by offering something enticing, such as a USB drive labeled 'Employee Salary Info Q4.' When the employee plugs the USB into their work computer, they may inadvertently install malware (e.g., a keylogger or backdoor) that compromises the system. This attack relies on physical media as the delivery vector, distinguishing it from other social engineering methods.

Answer

Phishing

Answer

Tailgating

Answer

Pretexting

Question 19

A receptionist holds the door for a person carrying a large box, assuming they work in the building. Later, that person is seen plugging a USB drive into a workstation in the finance department. Which social engineering technique was most likely used to gain initial access?

Accepted Answer

Tailgating. The correct answer is C because tailgating involves an unauthorized person gaining physical access to a secure area by following an authorized individual. In this scenario, the receptionist held the door for the person carrying a large box, assuming they worked in the building, which allowed the attacker to bypass physical security controls without authentication.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 20

A user calls the help desk because they received a pop-up on their screen claiming their computer is infected with a virus and to call a toll-free number for immediate support. The user did not call the number. What should the technician advise the user to do?

Accepted Answer

Close the pop-up and run a full antivirus scan.. Option C is correct because the pop-up is a classic tech support scam, a form of social engineering. The user should close the pop-up (e.g., using Task Manager or Alt+F4) and immediately run a full antivirus scan to detect and remove any potential malware that may have triggered the pop-up or been downloaded in the background. This ensures the system is cleaned and prevents further compromise.

Answer

Call the number to see if it's legitimate.

Answer

Ignore the pop-up and continue working.

Answer

Reboot the computer immediately.