220-1102 Practice Exam 52 — 20 Questions

Question 1

A new employee receives an email that appears to be from the company's HR department, asking them to click a link to verify their direct deposit information for payroll. The email contains the company logo and looks professional. What is the most likely social engineering attack?

Accepted Answer

Phishing. Phishing is the correct answer because the attack uses a deceptive email that impersonates a legitimate entity (HR department) to trick the recipient into clicking a malicious link. This is a classic example of a broad, untargeted social engineering attack delivered via email, which is the defining characteristic of phishing.

Answer

Whaling

Answer

Vishing

Answer

Shoulder surfing

Question 2

A technician receives an email that appears to be from the company's HR department asking them to click a link to update their direct deposit information. The email contains several grammatical errors and the sender's domain is 'company-hr.com' instead of the official 'company.com'. What is the most effective way to confirm this is a phishing attempt?

Accepted Answer

Forward the email to the company's security team for analysis.. Option C is correct because forwarding the suspicious email to the company's security team allows trained analysts to inspect headers, attachments, and URLs in a sandboxed environment without exposing the technician to risk. This aligns with organizational incident response procedures for phishing, as the security team can verify the sender domain (e.g., SPF/DKIM/DMARC failures) and determine if the email is malicious.

Answer

Reply to the email asking for verification.

Answer

Click the link to see if it looks legitimate.

Answer

Call the phone number listed in the email signature.

Question 3

During a security audit, a technician finds that a user's workstation was infected with malware after the user inserted a USB drive found in the parking lot. The drive was labeled 'Employee Salary Info Q4'. What social engineering principle did the attacker exploit?

Accepted Answer

Baiting. Baiting is the correct answer because the attacker exploited the victim's curiosity by leaving a malware-infected USB drive in a visible location, labeled with an enticing message ('Employee Salary Info Q4'). When the user inserted the drive, the malware executed automatically (e.g., via Autorun.inf in Windows), compromising the workstation. This is a classic baiting attack, which relies on offering something desirable to trick the victim into performing a risky action.

Answer

Scarcity

Answer

Pretexting

Answer

Tailgating

Question 4

During a routine security audit, a technician discovers that an unknown person has been using a badge to enter the building after hours. The badge belongs to a former employee who left the company six months ago. Which type of social engineering attack likely enabled this unauthorized access?

Accepted Answer

Tailgating. The correct answer is B, tailgating. This attack involves an unauthorized person physically following an authorized individual into a secured area without using their own credentials. In this scenario, the unknown person used a badge that belonged to a former employee, which indicates they likely gained entry by closely following someone else through a door or turnstile, exploiting the fact that the badge was not deactivated or that the access control system did not require re-authentication for each individual.

Answer

Phishing

Answer

Dumpster diving

Answer

Shoulder surfing

Question 5

A user reports that they received a voicemail from the company's HR director asking them to call back a number to verify their account details for payroll. The user is suspicious because the HR director is on vacation. What type of social engineering attack is this?

Accepted Answer

Vishing. Vishing (voice phishing) is the correct classification because the attack uses a phone call—specifically a voicemail—to trick the user into calling back and divulging sensitive payroll information. Unlike phishing via email or SMS, vishing exploits voice communication channels to bypass text-based security filters and create a false sense of urgency or authority.

Answer

Smishing

Answer

Pretexting

Answer

Pharming

Question 6

A user calls the help desk complaining that they cannot change their Windows 10 password even though they know the current password. The user is a member of the 'Users' group on a domain-joined computer. What is the most likely cause?

Accepted Answer

The 'Password must meet complexity requirements' policy is preventing the new password from being accepted.. Option C is correct because the user is a member of the 'Users' group on a domain-joined computer, which means password changes are subject to the domain's password policy, not local policies. The 'Password must meet complexity requirements' policy is enforced by the domain controller via Group Policy, and if the new password fails to meet those requirements (e.g., insufficient length, lack of uppercase/lowercase/digits/special characters), the change will be rejected even though the user knows the current password. This is the most likely cause given the user can authenticate but cannot set a compliant new password.

Answer

The user does not have 'Change Password' permission on their own account.

Answer

The 'User must change password at next logon' flag is set.

Answer

The local Security Accounts Manager (SAM) database is corrupted.

Question 7

A security analyst notices that an attacker has been sending emails that appear to come from the company's internal email system, asking employees to click a link to update their shared drive password. The link leads to a fake login page. The attacker is using a spoofed internal domain. What specific type of phishing is this?

Accepted Answer

Spear phishing. This is spear phishing because the attacker targets specific employees within the organization using a spoofed internal domain to make the email appear legitimate. Unlike generic phishing, spear phishing is highly targeted and personalized, often leveraging internal context (e.g., 'update your shared drive password') to increase credibility. The use of a spoofed internal domain exploits trust in the company's email infrastructure, often bypassing SPF/DKIM checks if misconfigured.

Answer

Whaling

Answer

Vishing

Answer

Pharming

Question 8

After deploying a new Windows 11 update, several users complain that they can no longer access shared folders on the network. You verify that network discovery and file sharing are enabled. Which Windows security setting should you check first to resolve this issue?

Accepted Answer

Review Windows Defender Firewall rules for 'File and Printer Sharing.'. After a Windows 11 update, the most common cause for losing access to shared folders—even when network discovery and file sharing are enabled—is that the Windows Defender Firewall rules for 'File and Printer Sharing' have been reset or disabled. This update often modifies firewall profiles (e.g., switching from Private to Public) or resets custom rules, blocking the NetBIOS, SMB, and RPC ports (TCP 139, 445; UDP 137, 138) required for file sharing. Checking and re-enabling these inbound rules restores connectivity.

Answer

Check if the users are in the 'Remote Desktop Users' group.

Answer

Verify that the 'Password Protected Sharing' option is turned off.

Answer

Run Windows Update to install additional patches.

Question 9

A company is migrating from Workgroup to Domain. After joining a Windows 10 computer to the domain, users report that they can no longer log on using their local user accounts. What setting in Local Security Policy is most likely causing this behavior?

Accepted Answer

The 'Deny log on locally' user rights assignment includes the 'Users' group. When a Windows 10 computer is joined to a domain, the default Local Security Policy setting for 'Deny log on locally' includes the 'Users' group. This prevents local user accounts (which are members of the local Users group) from logging on interactively, forcing users to use domain accounts instead. The behavior stops after the computer is joined because the policy is applied by default to enforce domain authentication.

Answer

The 'Network access: Do not allow anonymous enumeration of SAM accounts' policy

Answer

The 'Deny log on locally' user rights assignment includes the 'Guests' group

Answer

The 'Interactive logon: Do not display last user name' policy is enabled

Question 10

After a security incident, a forensic analyst needs to ensure that Windows 10 audit logs capture all successful and failed attempts to access the 'Confidential' folder on a file server. Which audit policy configuration is required?

Accepted Answer

Enable 'Audit object access' and configure the SACL on the folder. To audit access attempts to a specific folder, you must enable the 'Audit object access' policy in the Advanced Audit Policy Configuration (or the legacy 'Audit object access' under Local Policies). This policy alone does not audit anything; you must also configure a System Access Control List (SACL) on the 'Confidential' folder itself, specifying which access types (e.g., Read, Write) for which users or groups to audit for success and failure. Without the SACL, no object access events are generated.

Answer

Enable 'Audit account logon events' for success and failure

Answer

Enable 'Audit privilege use' for success and failure

Answer

Enable 'Audit process tracking' for success and failure

Question 11

A user reports that after a recent Windows update, they can no longer install software on their company-issued laptop. When they try to run an installer, they get a message: 'Your system administrator has blocked this program.' The user has local administrator rights on the laptop. Which Windows security setting is most likely causing this issue?

Accepted Answer

User Account Control (UAC) is set to 'Always notify.'. User Account Control (UAC) with the 'Always notify' setting forces every installation attempt to prompt for administrator approval, even when the user has local admin rights. If the user clicks 'No' or the prompt is suppressed by Group Policy (e.g., via the 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' policy set to 'Elevate without prompting' or 'Prompt for consent'), the installer is blocked with the 'Your system administrator has blocked this program' message. This occurs because UAC treats the installer as requiring elevation, and the policy prevents the user from approving it.

Answer

Windows Defender Firewall is blocking the installer.

Answer

BitLocker Drive Encryption is preventing write access.

Answer

The user's account is not part of the local Administrators group.

Question 12

A technician is configuring a Windows 10 kiosk machine that will run a single web application in full-screen mode. The machine must not allow users to access the desktop, taskbar, or other apps. Which Windows security feature should be used to accomplish this?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (Kiosk Mode) is the correct Windows security feature because it locks down the device to run a single Universal Windows Platform (UWP) app or a web browser in full-screen mode, preventing users from accessing the desktop, taskbar, or other applications. This feature is specifically designed for kiosk scenarios and enforces a restricted user experience by configuring a local or domain user account to launch only the designated app upon sign-in.

Answer

Local Group Policy to hide the taskbar.

Answer

User Account Control set to 'Always notify.'

Answer

Windows Defender Application Guard

Question 13

During a security audit, you discover that a Windows 10 workstation has the 'Store passwords and credentials using reversible encryption' policy enabled. What is the primary security risk associated with this setting?

Accepted Answer

It stores passwords in a format that can be easily decrypted, making them vulnerable if the database is compromised.. The 'Store passwords using reversible encryption' policy (enabled via the 'Network access: Do not allow storage of passwords and credentials for network authentication' or directly in a Group Policy setting) causes Windows to store passwords in a format that can be decrypted back to plaintext. This directly violates the principle of storing only hashed credentials; if the SAM database or LSASS process memory is compromised, an attacker can recover the original password, enabling lateral movement or privilege escalation.

Answer

It increases the time required to log on to the system.

Answer

It allows users to bypass the password complexity requirement.

Answer

It prevents the use of biometric authentication methods.

Question 14

A Windows 11 workstation is infected with ransomware that encrypted user files. The IT security team wants to prevent future infections by restricting which processes can modify files in user profile folders. Which Windows security feature can enforce such restrictions without third-party software?

Accepted Answer

Controlled Folder Access. Controlled Folder Access (CFA) is a Windows Defender Exploit Guard feature that restricts which applications can modify files in protected folders, such as user profile directories. By default, CFA blocks untrusted or unknown processes from writing to or encrypting files in these folders, directly preventing ransomware from encrypting user data without requiring third-party software.

Answer

NTFS permissions set to 'Read-only' for all users.

Answer

AppLocker with a deny rule for unknown executables.

Answer

BitLocker with TPM protection

Question 15

A small business owner wants to ensure that only authorized USB storage devices can be used on company laptops running Windows 10 Pro. They have a list of approved device hardware IDs. Which security policy should be configured to enforce this restriction?

Accepted Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions. Option D is correct because the 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions allows an administrator to specify a whitelist of approved hardware IDs. When configured, only USB storage devices whose hardware IDs match the list will be installed, effectively blocking all unauthorized devices. This directly enforces the requirement to restrict USB storage to approved devices only.

Answer

Enable the 'Removable Storage Access' policy under Windows Components

Answer

Configure the 'Devices: Restrict CD-ROM access to locally logged-on user only' policy

Answer

Set the 'Deny all devices' policy under Device Installation Restrictions

Question 16

A user receives an email with a link that appears to be from their bank, asking them to verify their account. The link leads to a page that looks exactly like the bank's login page. What type of attack is this?

Accepted Answer

A phishing attack.. This scenario describes a phishing attack, where the attacker sends a deceptive email impersonating a trusted entity (the bank) to trick the user into clicking a malicious link. The link leads to a fraudulent website that mimics the legitimate bank login page, designed to capture the user's credentials. Phishing exploits social engineering rather than technical vulnerabilities, relying on the user's trust and inattention to detail.

Answer

A man-in-the-middle attack.

Answer

A ransomware attack.

Answer

A cross-site scripting (XSS) attack.

Question 17

A small business wants to ensure that all employees use strong passwords that include uppercase, lowercase, numbers, and special characters, and that passwords expire every 60 days. Which tool should be used to enforce these settings on a standalone Windows 10 workstation?

Accepted Answer

Local Security Policy (secpol.msc). The Local Security Policy (secpol.msc) is the correct tool because it provides a centralized interface to configure password policies, such as minimum password length, complexity requirements (uppercase, lowercase, numbers, special characters), and maximum password age (e.g., 60 days). These settings are enforced locally on a standalone Windows 10 workstation through the Security Settings node under Account Policies.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Windows Defender Firewall with Advanced Security

Answer

Device Manager

Question 18

A user reports that their Windows 10 computer is displaying a message that 'Windows Defender Antivirus is turned off' even though they have not disabled it. They have also noticed that they cannot open the Windows Security app. What is the most likely cause?

Accepted Answer

The computer is infected with malware. When a user sees 'Windows Defender Antivirus is turned off' and cannot open the Windows Security app, the most likely cause is malware that has disabled the antivirus and blocked access to security settings to prevent removal. Malware often modifies registry keys or terminates Windows Defender services (e.g., WinDefend) to evade detection, and it may also corrupt or block the Windows Security Center UI (SecurityHealthService.exe). This is a common symptom of ransomware or trojans that specifically target Windows Defender.

Answer

Windows Defender is disabled via Group Policy

Answer

Windows needs a critical update

Answer

User Account Control is blocking the app

Question 19

A user reports that their browser frequently redirects to a search page they never set, and they see unfamiliar toolbars. After running a malware scan that found nothing, what should the technician do next to resolve the issue?

Accepted Answer

Reset the browser settings to default.. The symptoms—unwanted redirects and unfamiliar toolbars—are classic signs of browser hijacking, often caused by a malicious extension or a changed proxy configuration. Since a malware scan found nothing, the next logical step is to reset the browser settings to default, which removes all extensions, restores the homepage and search engine, and clears cached data that may be enforcing the redirects. This action directly addresses the most common vector for such behavior without resorting to hardware or OS-level changes.

Answer

Replace the network cable.

Answer

Update the network adapter driver.

Answer

Reinstall the operating system.

Question 20

A user calls the help desk complaining that their browser homepage keeps changing to a site they did not set, and they cannot change it back. You remotely check and find no malware. What is the most likely cause?

Accepted Answer

A recently installed program modified the browser settings during installation.. Option B is correct because many legitimate software installers include bundled programs or browser extensions that modify the default homepage, search provider, or new tab page as part of their installation routine. Even without malware, these changes are often made via registry keys (e.g., HKCU\Software\Microsoft\Internet Explorer\Main\Start Page) or browser policy files, and the user may not have unchecked the relevant option during setup. Since no malware was found, a recently installed program is the most likely cause of the unwanted homepage change.

Answer

The user's browser profile is corrupted.

Answer

The user's DNS settings are being hijacked by the ISP.

Answer

The browser's shortcut target is pointing to a different URL.