220-1102 PC Security Issue Remediation — 20 Questions

Question 1

A user calls the help desk saying they cannot log into their Windows 10 workstation because a message claims their files are encrypted and they must pay a ransom. What is the most effective remediation approach?

Accepted Answer

Disconnect from the network and restore files from a verified backup. Option C is correct because ransomware encrypts files with a key known only to the attacker, making decryption without the key impossible. Disconnecting from the network prevents the ransomware from spreading to other systems, and restoring from a verified backup is the only reliable way to recover the original files without paying the ransom.

Answer

Pay the ransom to get the decryption key

Answer

Reboot into Safe Mode and run a malware scan

Answer

Run System Restore to a point before the attack

Question 2

A company's security policy requires that all USB storage devices be blocked on company workstations to prevent data exfiltration. A manager needs to temporarily use a USB drive for a presentation. What is the best way to remediate this while maintaining security?

Accepted Answer

Use a Group Policy to allow only the specific USB device by hardware ID, then remove the allowance after use. Group Policy can be used to block all USB storage by default, but you can create an exception by allowing specific devices via device ID or by using a more granular policy. The best approach is to temporarily grant access to the specific device, then reapply the block.

Answer

Disable the USB blocking Group Policy for the entire domain

Answer

Give the manager a company-approved USB drive and tell them to use it only once

Answer

Create a local admin account on the manager's workstation and disable the USB block locally

Question 3

A small business owner wants to ensure that if a laptop is stolen, the data on the drive cannot be read. The laptop runs Windows 11 Pro. What is the most appropriate remediation?

Accepted Answer

Enable BitLocker on the system drive. BitLocker is the native full-disk encryption feature in Windows 11 Pro that encrypts the entire system drive, including the operating system, applications, and all user data. If the laptop is stolen, the data on the drive remains unreadable without the recovery key or TPM authentication, even if the drive is removed and attached to another computer. This directly addresses the requirement to prevent data access after theft.

Answer

Set a strong BIOS password

Answer

Install an antivirus with anti-theft features

Answer

Use a cloud backup service

Question 4

A company has a policy that all workstations must automatically lock after 10 minutes of inactivity. A user complains that their computer does not lock automatically. Which setting should you check and remediate?

Accepted Answer

Verify that the screen saver is enabled and set to 'On resume, display logon screen' with a 10-minute wait. Option B is correct because the automatic lock behavior in Windows is controlled by the screen saver settings. When 'On resume, display logon screen' is enabled with a 10-minute wait, the screen saver triggers after inactivity and locks the workstation by requiring authentication upon resume. This is the standard mechanism for enforcing a lock timeout, not the power plan sleep timeout.

Answer

Check the power plan settings for sleep timeout

Answer

Ensure Windows Update is fully installed

Answer

Disable the Fast Startup feature

Question 5

During a security audit, you find that several employees have been using the same weak password for their domain accounts. Which remediation should you implement first?

Accepted Answer

Configure a password policy in Group Policy requiring complexity and minimum length. Option B is correct because the most effective first step to prevent weak passwords is to enforce a strong password policy via Group Policy. This centrally mandates complexity requirements (e.g., uppercase, lowercase, digits, special characters) and a minimum length (typically 8–14 characters), which directly blocks the use of simple, common passwords at the domain level. Unlike awareness campaigns or reactive measures, this technical control proactively enforces security standards across all domain accounts.

Answer

Disable the user accounts and require a manager to re-enable them

Answer

Send a company-wide email reminding users to choose strong passwords

Answer

Install a third-party password manager for all employees

Question 6

A technician is configuring a new Windows 10 workstation for a remote employee who will handle sensitive customer data. Which security feature should be enabled to ensure that if the laptop is lost, the data remains protected?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption (C) is the correct choice because it provides full-disk encryption using AES encryption algorithms, ensuring that if the laptop is lost or stolen, the sensitive customer data remains inaccessible without the recovery key or TPM authentication. This directly addresses the requirement to protect data at rest on a lost device.

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Answer

Windows Hello for Business

Question 7

During a routine check, a technician finds that a user's Windows 10 computer has an outdated antivirus that hasn't updated in 3 months. The user claims they never saw any update prompts. What is the most likely reason and the appropriate remediation?

Accepted Answer

The Windows Update service is disabled; re-enable it and set to automatic. Outdated antivirus often results from the update service being disabled or misconfigured. Checking the Windows Update or antivirus update service ensures that automatic updates can run, preventing future lapses.

Answer

The antivirus subscription has expired; renew it

Answer

The user has manually set the antivirus to manual update mode

Answer

The computer is infected with a virus that blocks updates

Question 8

A customer reports that their computer is running slowly and they see pop-up ads even when no browser is open. They suspect malware. Which of the following should you perform first to remediate this issue?

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the first step because it immediately stops the malware from communicating with its command-and-control (C2) server, preventing further data exfiltration, additional payload downloads, or remote control. This containment step is critical before any remediation (like scanning or rebooting) to avoid the malware spreading or causing more damage.

Answer

Run a full antivirus scan

Answer

Reboot the computer in Safe Mode

Answer

Restore from a recent backup

Question 9

A user reports that their Windows 10 computer is infected with a virus that keeps reinstalling itself after removal. What should you do to remediate this persistent infection?

Accepted Answer

Boot from a rescue disc or USB and run an antivirus scan. A virus that reinstalls itself likely has a rootkit or persistent mechanism. Booting from trusted media and scanning the offline system ensures the malware cannot run, allowing complete removal.

Answer

Run a system restore to a previous restore point

Answer

Disable System Restore and then run an antivirus scan in normal mode

Answer

Reinstall Windows from the recovery partition

Question 10

A user's computer is infected with adware that changes the browser homepage and displays constant pop-ups. After removing the adware with an antivirus, the homepage remains changed. What additional remediation step should you take?

Accepted Answer

Reset the browser settings to default. After adware removal, the browser's homepage and settings are often stored in the browser's configuration files or registry keys that the antivirus does not reset. Resetting the browser settings to default restores the homepage, search engine, and new tab page to their original state, clearing any persistent malicious configurations left behind by the adware.

Answer

Reinstall the operating system

Answer

Run a disk cleanup utility

Answer

Update the antivirus definitions and scan again

Question 11

A company's security policy requires that all workstations use a host-based firewall to block incoming connections except for specific allowed applications. A technician needs to configure this on a Windows 10 PC. Which tool should they use?

Accepted Answer

Windows Defender Firewall with Advanced Security. The Windows Defender Firewall with Advanced Security (wf.msc) is the correct tool because it provides granular control over inbound rules, allowing the technician to block all incoming connections by default and then create explicit allow rules for specific applications. This meets the security policy requirement for a host-based firewall that blocks incoming traffic except for permitted applications.

Answer

Windows Defender Antivirus settings

Answer

Group Policy Editor

Answer

Network and Sharing Center

Question 12

A technician discovers that a Windows 10 workstation has been infected with a fileless malware that resides in memory. Traditional antivirus scans have not detected it. Which approach should the technician use to remove this type of malware?

Accepted Answer

Boot from a rescue disk and perform an offline scan.. Fileless malware resides entirely in memory (RAM) and does not write persistent files to disk, so traditional antivirus scans that rely on file signatures cannot detect it. Booting from a rescue disk (e.g., a bootable USB or CD with an offline scanner) loads a clean operating system that bypasses the infected Windows environment, allowing the scanner to inspect memory and terminate the malware without the malware being able to hide or protect itself. This offline approach ensures the malware's process cannot interfere with the scan, making it the correct remediation method.

Answer

Run a full antivirus scan in normal mode.

Answer

Use the Windows Malicious Software Removal Tool (MSRT) in Safe Mode.

Answer

Restore the system from a backup taken before the infection.

Question 13

A technician is troubleshooting a Windows 10 PC that was infected with a rootkit. After booting from a rescue disk and running a scan, the rootkit is removed, but the system is still unstable. What should the technician do next to ensure the system is fully remediated?

Accepted Answer

Run the System File Checker (SFC) tool to repair corrupted files.. After removing a rootkit, the system may have corrupted system files that cause instability. Running the System File Checker (SFC) tool with the 'sfc /scannow' command scans protected system files and replaces corrupted versions with cached copies from the Windows side-by-side store, directly addressing file integrity issues left by the rootkit.

Answer

Reinstall the operating system from scratch.

Answer

Disable System Restore and delete all restore points.

Answer

Perform a disk cleanup to remove temporary files.

Question 14

A user calls the help desk because their workstation is running very slowly and they notice unusual network activity. You suspect ransomware. What should you do first to contain the threat?

Accepted Answer

Disconnect the workstation from the network immediately.. The immediate priority is containment to prevent the ransomware from spreading to other systems on the network. Isolating the workstation by disconnecting it from the network is the first step, followed by notifying the security team.

Answer

Run a full antivirus scan on the affected workstation.

Answer

Back up all files to an external drive before taking action.

Answer

Restart the computer and boot into Safe Mode.

Question 15

A company policy requires that all USB flash drives be encrypted before use. A technician needs to configure a new drive for a manager who will store confidential client data. Which built-in Windows tool should the technician use?

Accepted Answer

BitLocker To Go. BitLocker To Go is the correct built-in Windows tool for encrypting removable drives like USB flash drives. It provides full-disk encryption specifically designed for portable storage, ensuring that the confidential client data on the drive is protected if the drive is lost or stolen.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Firewall

Answer

Device Manager

Question 16

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Accepted Answer

Disable the account to prevent further access.. The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Answer

Reset the account password and enable MFA.

Answer

Review the server logs to determine the extent of the breach.

Answer

Notify the employee's manager and HR department.

Question 17

A technician is configuring a new Windows 10 workstation for a user who handles sensitive financial data. The company policy mandates that the screen lock after 5 minutes of inactivity and require a password on wake. Which settings should the technician configure?

Accepted Answer

Configure the screen saver to start after 5 minutes and check 'On resume, display logon screen.'. The screen saver settings in Windows include an option to 'On resume, display logon screen,' which locks the workstation after the screen saver activates. Setting the screen saver timeout to 5 minutes and enabling the logon screen requirement meets the policy.

Answer

Set the power plan to turn off the display after 5 minutes.

Answer

Enable the 'Require password on wakeup' setting in the power plan only.

Answer

Set the computer to sleep after 5 minutes and require a password on wake.

Question 18

A small business owner wants to ensure that all company laptops have their hard drives encrypted in case of theft. The laptops run Windows 10 Pro. Which technology should the technician enable to meet this requirement?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption (option C) is the correct technology because it provides full-disk encryption for Windows 10 Pro, ensuring that all data on the laptop's hard drive is encrypted at rest. This protects against data exposure if the device is stolen, as the drive cannot be accessed without the decryption key (e.g., a PIN, USB key, or TPM-based authentication). BitLocker is built into Windows 10 Pro and is specifically designed for whole-drive encryption, meeting the requirement for all company laptops.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Antivirus

Answer

TPM (Trusted Platform Module)

Question 19

A customer reports that their Windows 10 laptop is displaying pop-up ads even when no browser is open. They suspect a malware infection. Which of the following should you do first to remediate this issue?

Accepted Answer

Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.. The first step in malware remediation is to disconnect from the network to prevent further communication with command-and-control servers. Then boot into Safe Mode to prevent malicious processes from loading, and run a full antivirus scan. This isolates the threat before attempting removal.

Answer

Run a full antivirus scan while the system is connected to the internet.

Answer

Perform a System Restore to a point before the pop-ups started.

Answer

Immediately reinstall Windows 10 to ensure complete removal.

Question 20

A user reports that their Windows 10 PC is infected with a virus that keeps reappearing after removal. The technician boots into Safe Mode, runs a full antivirus scan, and removes the threat. However, after rebooting normally, the virus returns. What is the most likely reason?

Accepted Answer

The virus has a persistence mechanism, such as a scheduled task or registry run key.. Option B is correct because the virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.

Answer

The antivirus definitions are outdated.

Answer

The user is re-downloading the virus from the same source.

Answer

The virus is a polymorphic variant that changes its signature.