220-1102 Browser and Application Security — 15 Questions

Question 1

A technician is troubleshooting a Windows 10 computer where the user cannot install a legitimate browser extension because the browser displays a warning that extensions from this source are not allowed. What setting is likely blocking the installation?

Accepted Answer

The computer is running Windows 10 in S mode.. Windows 10's S mode restricts app installations to the Microsoft Store, which also affects browser extensions. Disabling S mode or using a different browser that supports the extension is the solution.

Answer

The browser is in private browsing mode.

Answer

The user account does not have administrator privileges.

Answer

The browser's security level is set to high.

Question 2

A company policy requires that all web traffic from employee computers be filtered to block known malicious sites. You need to implement this without installing client software on each machine. Which approach should you use?

Accepted Answer

Implement a DNS-based content filtering service on the network's DNS server.. A DNS-based content filter (like OpenDNS or a corporate DNS server) can block malicious domains without requiring client software. This is a scalable solution for network-wide filtering.

Answer

Configure each browser's proxy settings to use a filtering proxy server.

Answer

Enable Windows Defender SmartScreen on each computer via Group Policy.

Answer

Install a third-party browser extension on all browsers to block malicious sites.

Question 3

A user receives an email with a link that appears to be from their bank, asking them to verify their account. The link leads to a page that looks exactly like the bank's login page. What type of attack is this?

Accepted Answer

A phishing attack.. This is a phishing attack, where the attacker creates a fake login page to steal credentials. Users should be trained to verify URLs and never enter credentials from email links.

Answer

A man-in-the-middle attack.

Answer

A ransomware attack.

Answer

A cross-site scripting (XSS) attack.

Question 4

During a security incident response, you discover that a user's browser has a rogue extension that exfiltrates data to a remote server. The extension was installed after the user clicked a fake update prompt on a website. What vulnerability was exploited?

Accepted Answer

Social engineering.. This is a social engineering attack where the user was tricked into installing malicious software. No technical vulnerability was exploited; the user's trust was manipulated.

Answer

A zero-day vulnerability in the browser.

Answer

An insecure direct object reference (IDOR) vulnerability.

Answer

A cross-site request forgery (CSRF) attack.

Question 5

A user reports that their web browser frequently redirects to an unfamiliar search engine and displays pop-up ads even when no tabs are open. What is the most likely cause of this behavior?

Accepted Answer

The user has accidentally enabled a malicious browser extension.. This scenario describes classic symptoms of a browser hijacker, a type of malware that modifies browser settings without permission. The correct action is to scan and remove the malicious software using an anti-malware tool, as simply resetting settings or clearing caches may not remove the underlying infection.

Answer

The browser needs to be updated to the latest version.

Answer

The internet connection is unstable and causing DNS errors.

Answer

The browser cache is full and needs to be cleared.

Question 6

During a security audit, you find that a user's browser has an outdated version of Adobe Flash Player installed. What is the primary security risk associated with this finding?

Accepted Answer

Attackers can exploit known vulnerabilities in the plugin to install malware.. Outdated plugins like Flash Player are common attack vectors because they contain known vulnerabilities that malware can exploit. Keeping software updated is a fundamental browser security practice.

Answer

The browser will run slower and may crash frequently.

Answer

The user will be unable to view some web content.

Answer

The browser will automatically disable the plugin.

Question 7

A technician is configuring a shared kiosk computer in a library. The requirement is that users must not be able to download files or install software. Which browser security setting should be configured?

Accepted Answer

Set the browser to block all downloads and prompt for a save location.. Configuring the browser to prompt for download location and then blocking downloads via Group Policy or registry is effective. The simplest approach is to disable downloads entirely in the browser settings or use a kiosk mode that restricts functionality.

Answer

Disable JavaScript in the browser.

Answer

Enable the browser's private browsing mode.

Answer

Clear the browser cache and cookies daily.

Question 8

A small business owner asks you to configure their office computers so that employees cannot install unauthorized browser extensions. Which policy setting should you implement?

Accepted Answer

Use Group Policy to block extension installation and whitelist approved extensions.. Group Policy is the correct tool in Windows environments to enforce restrictions on browser extensions across multiple computers. This prevents users from adding potentially malicious or unapproved extensions, enhancing security.

Answer

Disable the browser's developer mode in the settings.

Answer

Set the browser to always use private browsing mode.

Answer

Install a pop-up blocker on each computer.

Question 9

A customer reports that their browser shows a 'Your connection is not private' warning when visiting their online banking site, but other websites work fine. What is the most likely cause?

Accepted Answer

The bank's SSL certificate has expired or is misconfigured.. This warning typically indicates a certificate issue, such as an expired or invalid SSL certificate on the banking site itself. It is not a problem with the user's browser or computer.

Answer

The user's system date and time are incorrect.

Answer

The user's browser is infected with a man-in-the-middle proxy.

Answer

The user's anti-virus is blocking the connection.

Question 10

A user calls the help desk complaining that their browser homepage keeps changing to a site they did not set, and they cannot change it back. You remotely check and find no malware. What is the most likely cause?

Accepted Answer

A recently installed program modified the browser settings during installation.. Some legitimate software installers include options to change browser settings, and users may inadvertently agree. This is a common cause of homepage changes that are not malware-related.

Answer

The user's browser profile is corrupted.

Answer

The user's DNS settings are being hijacked by the ISP.

Answer

The browser's shortcut target is pointing to a different URL.

Question 11

A user reports that their browser crashes every time they visit a particular website. Other websites work fine. The technician tries the same website on another computer and it works normally. What is the most likely cause on the user's computer?

Accepted Answer

A browser extension is incompatible with that website.. A corrupted browser extension or add-on can cause crashes on specific sites. Since the site works on another computer, the issue is local. Disabling extensions one by one can isolate the problem. Other causes like malware or outdated drivers are less specific to a single site.

Answer

The website has been blacklisted by the company's firewall.

Answer

The user's network adapter driver is outdated.

Answer

The website is using a newer version of TLS that the browser doesn't support.

Question 12

A user reports that after installing a free PDF converter from an advertisement, their browser homepage changed and they see constant pop-ups for antivirus software. A malware scan found PUPs (Potentially Unwanted Programs). What is the best next step to fully remove the unwanted software and restore browser settings?

Accepted Answer

Use a dedicated adware removal tool and then reset the browser.. PUPs like browser hijackers often come bundled with free software. Using a dedicated PUP removal tool or adware cleaner is more effective than a standard antivirus scan. After removal, resetting the browser ensures all changes are reverted.

Answer

Run System Restore to a point before installation.

Answer

Manually delete the program from Program Files.

Answer

Disable the browser's JavaScript and ActiveX.

Question 13

A technician is investigating a security incident where a user's credentials were stolen. The user says they only logged into their email from a coffee shop Wi-Fi. The technician notices that the browser was not using HTTPS for the login page. What is the most likely attack method used?

Accepted Answer

Man-in-the-middle attack.. On an open Wi-Fi network, an attacker can perform a man-in-the-middle attack to intercept unencrypted HTTP traffic. Without HTTPS, the login credentials are sent in plaintext and can be captured easily. This is a common risk on public Wi-Fi.

Answer

Cross-site scripting (XSS) attack.

Answer

DNS spoofing attack.

Answer

Brute force attack.

Question 14

A user's browser is displaying a warning that the website's certificate is not trusted, even though the URL is correct. The technician checks the date and time on the computer and finds it is set to 2019. What is the most likely cause of the certificate warning?

Accepted Answer

The system date is incorrect, causing certificate validation to fail.. SSL certificates are time-sensitive; if the system date is far in the past or future, the browser cannot verify the certificate's validity. Synchronizing the system clock with a time server resolves this issue without needing to install a new certificate.

Answer

The website's SSL certificate has been revoked.

Answer

The browser's certificate store is corrupted.

Answer

The user is connected to a malicious proxy.

Question 15

A customer says that when they click a link in an email, it opens a website that looks exactly like their bank's login page, but the URL starts with 'http://' instead of 'https://'. What is the most likely security concern?

Accepted Answer

The email contains a phishing link.. The absence of HTTPS and the lookalike page strongly indicate a phishing attempt. Phishing sites often mimic legitimate sites to steal credentials, and the lack of encryption is a red flag. Users should never enter credentials on non-HTTPS pages, especially from email links.

Answer

The website is using an expired SSL certificate.

Answer

The user's browser is infected with adware.

Answer

The user's DNS server has been compromised.