220-1102 PC Security Issue Remediation Practice Test 2 — 15 Questions

Question 1

A technician is responding to a security incident where an employee's credentials were used to access a server without authorization. The employee claims they did not perform the action. Which of the following should the technician do first to remediate the compromised account?

Accepted Answer

Disable the account to prevent further access.. The immediate step is to disable the compromised account to prevent further unauthorized access. Then the technician should force a password reset and enable multi-factor authentication (MFA) to secure the account. Logging and investigation follow containment.

Answer

Reset the account password and enable MFA.

Answer

Review the server logs to determine the extent of the breach.

Answer

Notify the employee's manager and HR department.

Question 2

A technician is configuring a new Windows 10 workstation for a user who handles sensitive financial data. The company policy mandates that the screen lock after 5 minutes of inactivity and require a password on wake. Which settings should the technician configure?

Accepted Answer

Configure the screen saver to start after 5 minutes and check 'On resume, display logon screen.'. The screen saver settings in Windows include an option to 'On resume, display logon screen,' which locks the workstation after the screen saver activates. Setting the screen saver timeout to 5 minutes and enabling the logon screen requirement meets the policy.

Answer

Set the power plan to turn off the display after 5 minutes.

Answer

Enable the 'Require password on wakeup' setting in the power plan only.

Answer

Set the computer to sleep after 5 minutes and require a password on wake.

Question 3

A small business owner wants to ensure that all company laptops have their hard drives encrypted in case of theft. The laptops run Windows 10 Pro. Which technology should the technician enable to meet this requirement?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption (option C) is the correct technology because it provides full-disk encryption for Windows 10 Pro, ensuring that all data on the laptop's hard drive is encrypted at rest. This protects against data exposure if the device is stolen, as the drive cannot be accessed without the decryption key (e.g., a PIN, USB key, or TPM-based authentication). BitLocker is built into Windows 10 Pro and is specifically designed for whole-drive encryption, meeting the requirement for all company laptops.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Antivirus

Answer

TPM (Trusted Platform Module)

Question 4

A customer reports that their Windows 10 laptop is displaying pop-up ads even when no browser is open. They suspect a malware infection. Which of the following should you do first to remediate this issue?

Accepted Answer

Disconnect the network cable, boot into Safe Mode, then run a full antivirus scan.. The first step in malware remediation is to disconnect from the network to prevent further communication with command-and-control servers. Then boot into Safe Mode to prevent malicious processes from loading, and run a full antivirus scan. This isolates the threat before attempting removal.

Answer

Run a full antivirus scan while the system is connected to the internet.

Answer

Perform a System Restore to a point before the pop-ups started.

Answer

Immediately reinstall Windows 10 to ensure complete removal.

Question 5

A user reports that their Windows 10 PC is infected with a virus that keeps reappearing after removal. The technician boots into Safe Mode, runs a full antivirus scan, and removes the threat. However, after rebooting normally, the virus returns. What is the most likely reason?

Accepted Answer

The virus has a persistence mechanism, such as a scheduled task or registry run key.. Option B is correct because the virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.

Answer

The antivirus definitions are outdated.

Answer

The user is re-downloading the virus from the same source.

Answer

The virus is a polymorphic variant that changes its signature.

Question 6

A user calls the help desk saying their PC suddenly displays a ransom note demanding payment in Bitcoin to unlock their files. They cannot open any documents or images. What is the first action you should take?

Accepted Answer

Disconnect the PC from the network.. The correct first action is to disconnect the PC from the network (Option C). This immediately isolates the infected system, preventing the ransomware from communicating with its command-and-control (C2) server to exfiltrate data or encrypt additional network shares. It also stops the ransomware from spreading laterally to other devices on the same LAN, which is critical for containment before any remediation steps are taken.

Answer

Pay the ransom to get the decryption key.

Answer

Run a full antivirus scan immediately.

Answer

Restore files from a recent backup without disconnecting.

Question 7

During a routine security audit, you find that several workstations have the same local administrator password. The company policy requires unique passwords for each machine. Which tool or method should you use to enforce unique local administrator passwords across the domain?

Accepted Answer

Deploy Microsoft LAPS (Local Administrator Password Solution).. Microsoft LAPS (Local Administrator Password Solution) is the correct tool because it automatically manages local administrator passwords on domain-joined computers, storing them in Active Directory and rotating them to unique values per machine. This directly enforces the policy of unique local admin passwords without manual intervention, using the `AdmPwd` extension and Group Policy to configure password complexity and rotation intervals.

Answer

Use Group Policy to set a standard local admin password.

Answer

Enable BitLocker on each workstation.

Answer

Disable the local administrator account on all workstations.

Question 8

A company's network was breached, and forensic analysis reveals that an attacker used a pass-the-hash attack to move laterally. Which security measure would most effectively prevent this type of attack in the future?

Accepted Answer

Enable Windows Defender Credential Guard.. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate and protect NTLM password hashes and Kerberos tickets in a secure container, preventing attackers from extracting them from LSASS memory even if they have administrative access. This directly stops pass-the-hash attacks because the hashes are never accessible to the operating system or tools like Mimikatz.

Answer

Require all users to change passwords every 30 days.

Answer

Implement network segmentation and firewall rules.

Answer

Disable NTLM authentication entirely.

Question 9

A security analyst discovers that a user's workstation has been compromised by a rootkit that hides its processes from Task Manager. The rootkit is not detected by the installed antivirus. Which step is most effective for remediation?

Accepted Answer

Boot from a rescue disk and perform an offline antivirus scan.. Option C is correct because a rootkit that hides its processes from Task Manager and evades the installed antivirus operates at a deep level within the operating system, often in kernel mode. Booting from a rescue disk (e.g., a live CD/USB with an offline scanner) loads a clean operating system environment, preventing the rootkit from loading and allowing the antivirus to scan the infected system's files without interference. This offline approach is the most effective remediation step when the rootkit is actively hiding from the installed AV in the normal OS context.

Answer

Run a full antivirus scan in Safe Mode.

Answer

Use System Restore to revert to a previous state.

Answer

Reinstall the operating system from the recovery partition.

Question 10

A company's security policy mandates that all USB flash drives must be encrypted before use. A user inserts a new USB drive and wants to encrypt it on a Windows 10 Pro workstation. Which built-in tool should be used?

Accepted Answer

Enable BitLocker To Go on the USB drive.. BitLocker To Go is the built-in Windows 10 Pro feature specifically designed to encrypt removable drives such as USB flash drives. It uses AES encryption to protect the entire volume, and the drive can be accessed only with a password, smart card, or recovery key. This directly satisfies the company's mandate for encrypting USB drives before use.

Answer

Use EFS (Encrypting File System) on the USB drive.

Answer

Format the drive as exFAT and set a password.

Answer

Use the cipher command to encrypt the drive.

Question 11

A technician is configuring a new Windows 10 workstation for a remote employee. The employee will use the laptop to access company resources via VPN. Which security setting should be configured to ensure the VPN connection is always used when accessing the internet?

Accepted Answer

Disable split tunneling to force all traffic through the VPN.. Disabling split tunneling ensures that all network traffic, including internet-bound traffic, is routed through the VPN tunnel. This forces the VPN connection to be always used when accessing the internet, which is essential for enforcing security policies and ensuring that company resources are protected even when the remote employee accesses external websites.

Answer

Enable split tunneling to improve performance.

Answer

Configure the VPN to use PPTP protocol.

Answer

Set the VPN to connect only when accessing internal websites.

Question 12

A customer reports that their Windows 10 PC is slow and displays pop-up ads even when no browser is open. They suspect malware. After running a full antivirus scan, the symptoms persist. Which step should you take next to remediate the issue?

Accepted Answer

Run a scan with a dedicated anti-malware tool like Malwarebytes.. Option B is correct because standard antivirus software often misses potentially unwanted programs (PUPs) and adware that inject pop-ups into the system. A dedicated anti-malware tool like Malwarebytes uses heuristic analysis and signature databases specifically tuned to detect and remove adware, browser hijackers, and other low-level threats that traditional AV engines may overlook.

Answer

Reinstall the operating system.

Answer

Disable Windows Defender permanently.

Answer

Clear the browser cache and cookies.

Question 13

A small business owner wants to ensure that all company laptops are protected in case of theft. They need a solution that encrypts the entire hard drive and requires a pre-boot PIN. Which security feature should you implement?

Accepted Answer

Enable BitLocker with a TPM + startup PIN.. BitLocker with a TPM + startup PIN provides full-disk encryption and requires a pre-boot authentication PIN, meeting the requirement to protect the entire hard drive in case of theft. The TPM validates system integrity, and the PIN must be entered before the OS loads, preventing unauthorized access even if the drive is removed.

Answer

Enable EFS (Encrypting File System) on the Documents folder.

Answer

Set a BIOS password.

Answer

Install a third-party antivirus with encryption.

Question 14

A user reports that their Windows 10 PC is infected with a virus that changes the desktop background to a ransom note. After removing the virus with antivirus software, the desktop background remains unchanged. What should you do to restore the original background?

Accepted Answer

Check Group Policy settings for desktop wallpaper enforcement and reset them.. Option C is correct because the virus likely modified the Group Policy setting that enforces a specific desktop wallpaper. Even after the virus is removed, the Group Policy setting persists and overrides any user attempts to change the background. Resetting the Group Policy wallpaper enforcement restores the user's ability to change the background normally.

Answer

Reinstall the graphics driver.

Answer

Run System File Checker (sfc /scannow).

Answer

Perform a system restore to a point before the infection.

Question 15

A user reports that their external hard drive is no longer recognized by Windows. They suspect it might be infected with malware from a previous connection. You run a security scan and find no threats. What is the most likely cause of the drive not being recognized?

Accepted Answer

The USB controller driver is corrupted or outdated.. When a drive is not recognized after a suspected malware incident, the issue is often driver-related or due to a corrupted file system, not necessarily malware. Reinstalling or updating the USB controller driver in Device Manager can resolve recognition issues. The correct answer is to check Device Manager for driver issues.

Answer

The drive is permanently damaged by malware.

Answer

The user needs to format the drive to remove malware.

Answer

Windows Firewall is blocking the external drive.