220-1102 Malware Types and Removal Practice Test 2 — 15 Questions

Question 1

A technician is configuring a new Windows 11 workstation for a user who frequently downloads free software. To reduce the risk of malware infections from bundled applications, which security setting should be enabled?

Accepted Answer

Set User Account Control to always notify.. Windows Defender Application Guard and controlled folder access are useful, but the most direct protection against unwanted bundled software is User Account Control (UAC). UAC prompts for permission before installing software, giving the user a chance to decline bundled items.

Answer

Enable Windows Defender Application Guard.

Answer

Turn on Windows Firewall with advanced logging.

Answer

Enable BitLocker drive encryption.

Question 2

A user reports that their computer is sending out a large amount of network traffic even when they are not using the internet. The antivirus detects a file named 'expl0rer.exe' in the startup folder. What type of malware is most likely causing this behavior?

Accepted Answer

Botnet. A botnet is a network of infected computers that are remotely controlled to perform tasks like sending spam or launching DDoS attacks. The unusual network traffic and startup file indicate the machine is part of a botnet. Removal requires disconnecting from the network and scanning with updated anti-malware.

Answer

Spyware

Answer

Virus

Answer

Trojan

Question 3

A technician is troubleshooting a computer that displays a fake security alert claiming the system is infected and urging the user to call a toll-free number. The alert cannot be closed and appears on top of all other windows. What is the best removal approach?

Accepted Answer

Restart the computer and press F8 to boot into Safe Mode with Networking, then run a malware scan.. This is a tech support scam, a form of scareware that uses a persistent pop-up. Booting into Safe Mode with Networking allows the technician to run an anti-malware scan without the rogue process interfering. Safe Mode loads only essential drivers, preventing the scareware from starting.

Answer

End the process 'svchost.exe' in Task Manager.

Answer

Call the toll-free number to get help removing the alert.

Answer

Use System Restore to revert to a previous restore point.

Question 4

A technician is cleaning a computer that has been infected with a rootkit. After running a standard antivirus scan, the malware is still detected on reboot. Which step should the technician take next to ensure complete removal?

Accepted Answer

Boot from a rescue disk and run a malware scan.. Rootkits load before the operating system and can hide from standard scans. Booting from a rescue disk (e.g., a bootable anti-malware USB) loads a clean OS environment, allowing the scanner to detect and remove the rootkit without interference.

Answer

Perform a clean installation of Windows.

Answer

Disable System Restore and run the antivirus again.

Answer

Run the antivirus in Safe Mode.

Question 5

During a security incident, a user's files have been renamed with a '.encrypted' extension, and a ransom note demands Bitcoin to restore them. The user has no backups. What is the most appropriate immediate action?

Accepted Answer

Disconnect the computer from the network immediately.. Ransomware encrypts files, and paying the ransom does not guarantee decryption. The correct first step is to isolate the infected system to prevent the malware from spreading to network shares or other devices.

Answer

Pay the ransom to regain access quickly.

Answer

Run a full antivirus scan to remove the malware.

Answer

Restart the computer in Safe Mode and attempt file recovery.

Question 6

A technician is investigating a computer that has been sending spam emails from the user's account without their knowledge. The user has not installed any new software recently. The technician finds a process running that matches a known botnet client. Which two steps should the technician take first to mitigate the threat?

Accepted Answer

Disconnect the computer from the network and terminate the malicious process.. The immediate priority is to disconnect the computer from the network to stop the botnet communication and prevent further spam. Then, the technician should identify and terminate the malicious process. Scanning without disconnecting may allow continued data exfiltration.

Answer

Run a full antivirus scan and then update the firewall rules.

Answer

Change the user's email password and run a malware scan.

Answer

Reboot the computer into Safe Mode and then run a scan.

Question 7

A user reports that their computer is displaying a message claiming their files are encrypted and they must pay 0.5 Bitcoin to a specific address to regain access. The user cannot open any documents or photos. What is the first step the technician should take to respond to this incident?

Accepted Answer

Disconnect the computer from the network.. The first step in a ransomware incident is to isolate the infected system from the network to prevent the malware from spreading to other devices. Attempting to decrypt without tools or paying the ransom are not recommended initial actions.

Answer

Pay the ransom to recover the files immediately.

Answer

Run a full antivirus scan to remove the malware.

Answer

Reboot the computer into Safe Mode.

Question 8

A technician is troubleshooting a Windows 10 computer that exhibits strange behavior: system files are missing, and the computer fails to boot normally. A boot-time virus scan detects a virus that infected the Master Boot Record (MBR). Which tool should the technician use to repair the MBR?

Accepted Answer

Bootrec.exe /FixMbr. The Bootrec.exe tool with the /FixMbr switch is used to repair the Master Boot Record in Windows. System Restore, SFC, and CHKDSK do not specifically repair the MBR.

Answer

System Restore

Answer

SFC /Scannow

Answer

CHKDSK /F

Question 9

During a security incident, a technician discovers that a user's computer has a program that hides its processes from Task Manager and allows an attacker to remotely control the system. The technician suspects a rootkit. Which removal method is most effective for a rootkit?

Accepted Answer

Reinstall the operating system from a trusted source.. Rootkits are deeply embedded and often cannot be removed by standard tools. The most reliable removal method is to wipe the drive and reinstall the operating system from a trusted source.

Answer

Run a system restore to a point before the infection.

Answer

Use an antivirus boot disk to scan and remove the rootkit.

Answer

Delete the rootkit's files manually in Safe Mode.

Question 10

A technician is tasked with removing malware from a Windows 10 computer that has a Trojan horse that downloaded additional payloads. The technician has already run a full antivirus scan and removed the Trojan, but the computer still exhibits suspicious network activity. What should the technician do next?

Accepted Answer

Run a second opinion malware scanner such as Malwarebytes.. After removing the initial malware, additional payloads or backdoors may remain. Running a second opinion scanner like Malwarebytes can detect remnants that the primary antivirus missed. Reimaging is drastic if not yet necessary, and resetting the browser or disabling startup items may not address hidden threats.

Answer

Reimage the computer immediately.

Answer

Reset the web browser settings to default.

Answer

Disable all startup programs in Task Manager.

Question 11

A customer reports that their Windows 10 computer is running very slowly, and they see frequent pop-up ads even when no browser is open. They also notice a new toolbar in their browser that they did not install. What type of malware is most likely causing these symptoms?

Accepted Answer

Adware. Adware displays unwanted advertisements and often installs browser toolbars, slowing down the system. Unlike a virus or worm, adware does not self-replicate, and ransomware would demand payment rather than show ads.

Answer

Ransomware

Answer

Virus

Answer

Worm

Question 12

A user reports that their computer is infected with a virus that has encrypted all their personal files and left a text file with instructions to pay a ransom. The technician has verified the infection is ransomware. The company has a backup policy. What is the best course of action to recover the data?

Accepted Answer

Restore the files from a recent backup after removing the malware.. The best approach for ransomware recovery is to restore files from a known clean backup after removing the malware. Decryption tools are not always available, and paying the ransom is discouraged. Reinstalling the OS is needed only if the system is compromised, but data recovery is the priority.

Answer

Pay the ransom and hope the decryption key is provided.

Answer

Use a ransomware decryption tool from a reputable source.

Answer

Reinstall the operating system and hope the files become accessible.

Question 13

During a routine security audit, a technician finds that a user's computer has an unknown program running that is sending keystrokes and screenshots to a remote server. The user did not install this program. Which type of malware is this?

Accepted Answer

Keylogger. A keylogger records keystrokes and can capture screenshots, sending data to an attacker. This is a form of spyware, not a worm, rootkit, or ransomware, which have different behaviors.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 14

A user calls the help desk because their computer is running slowly and they see a fake antivirus program warning that their system is infected. The user cannot close the warning window. Which type of malware is this, and what is the best removal approach?

Accepted Answer

Rogue antivirus; boot into Safe Mode with Networking and run Malwarebytes.. Rogue antivirus (scareware) displays fake warnings to trick users into paying for unnecessary software. The best approach is to boot into Safe Mode with Networking and run a legitimate malware removal tool, as the malware may block normal mode.

Answer

Ransomware; pay the fee to remove the warning.

Answer

Spyware; run a full scan in normal mode.

Answer

Adware; uninstall the program from Control Panel.

Question 15

A small business owner reports that all their employees are receiving emails from each other containing a link that, when clicked, downloads a file that installs a program that spreads to other contacts. The emails appear to come from known senders. What type of malware is this?

Accepted Answer

Worm. A worm self-replicates and spreads automatically, often via email or network shares, without needing to attach to a host file. This behavior distinguishes it from a virus, Trojan, or rootkit.

Answer

Virus

Answer

Trojan horse

Answer

Rootkit