220-1102 Security Practice Test 1 — 15 Questions

Question 1

A security analyst is reviewing a Windows 10 workstation that is suspected of being infected with malware. The analyst notices unusual network traffic and wants to identify the malware's persistence mechanism. Which of the following Windows locations should the analyst check? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Startup folder for the current user and all users. The Registry Run key and the Startup folders are two of the most common autostart locations that malware uses to maintain persistence. The Run key causes programs to execute at user logon, and the Startup folders contain shortcuts that launch at logon. Both are frequently checked during malware removal to identify and disable malicious autostart entries.

Answer

The Event Viewer Security log

Answer

The Task Scheduler library

Answer

The folder C:\Windows\System32\drivers\etc\hosts

Question 2

A small office has a Windows 11 Pro workstation that is not joined to a domain. The office manager wants to ensure that files containing customer credit card numbers are encrypted at rest so that if the drive is removed, the data cannot be read. The workstation does not have a TPM chip. Which Windows feature should be enabled to meet this requirement?

Accepted Answer

BitLocker with a startup PIN. BitLocker with a startup PIN is the correct answer because it provides full volume encryption and can be enabled without a TPM by requiring a pre-boot PIN. This ensures that if the drive is removed, the data remains encrypted and inaccessible. EFS only encrypts individual files, Device Encryption requires a TPM, and Storage Spaces does not provide encryption.

Answer

Encrypting File System (EFS)

Answer

Storage Spaces with parity

Answer

Device Encryption

Question 3

A technician is hardening a Windows 11 workstation that will be used by a remote employee. The goal is to reduce the attack surface against malware delivered through email attachments and malicious websites. Which two of the following built-in Windows features should the technician enable to meet this goal? (Choose two.)

Accepted Answer

Controlled folder access. The goal is to reduce the attack surface against malware arriving through email attachments and malicious websites. SmartScreen evaluates downloaded files and sites against reputation and blocks suspicious content, while Controlled folder access stops unauthorized applications from modifying protected user folders, limiting ransomware impact. RDP hardening, Windows Sandbox, and BitLocker address different risks and do not directly counter the named delivery vectors.

Answer

Remote Desktop Protocol with Network Level Authentication

Answer

BitLocker Drive Encryption

Answer

Windows Sandbox

Question 4

A security analyst is reviewing a Windows 10 workstation that is suspected of being infected with malware. The analyst notices unusual network traffic and wants to identify the malware's persistence mechanism. Which of the following Windows locations should the analyst check? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the source IP addresses and block them at the firewall. The analyst should block the source IP addresses at the firewall to stop the brute-force attack. The built-in Administrator account is disabled, so the attack is unsuccessful, but blocking the IPs prevents further attempts. Enabling the account or resetting its password is unnecessary and risky, and disabling auditing would remove valuable evidence. Blocking the source IPs is the most effective immediate response.

Answer

Disable auditing for logon events to reduce log noise

Answer

Reset the password for the built-in Administrator account

Answer

Enable the built-in Administrator account to monitor its usage

Question 5

A user's Windows 11 computer is infected with malware that encrypts files and demands payment. The user has a recent full system image backup stored on an external drive that was connected during the infection. Which of the following is the best course of action?

Accepted Answer

Disconnect the external drive and scan it with antivirus software. The external drive was connected during the infection, so it may also be infected. Disconnecting it and scanning it with antivirus ensures that the backup is clean before restoration. Paying the ransom is not recommended, and restoring immediately or scanning only the system could reintroduce malware. The best course is to secure and scan the backup first.

Answer

Run a full system scan and then restore the backup

Answer

Restore the system image from the external drive immediately

Answer

Pay the ransom to get the decryption key

Question 6

A user reports that when they connect to the corporate Wi-Fi at a coffee shop, a browser warning appears stating the site's certificate is not trusted. The user is able to browse the internet but sees the warning on every HTTPS site. A technician suspects an on-path attack. Which of the following should the technician check FIRST to confirm the presence of an on-path attack?

Accepted Answer

The certificate chain presented by the browser to see if it is issued by an unknown or self-signed certificate authority.. The certificate chain is the most direct evidence of an on-path attack because the attacker must present a certificate to intercept TLS traffic. If the certificate is self-signed or issued by an untrusted CA, the browser will warn the user. DNS or ARP checks might reveal other attack vectors, but the certificate warning specifically indicates TLS interception, so examining the certificate chain confirms the attack.

Answer

The DNS server settings on the user's device and compare them to the corporate DNS servers.

Answer

The ARP cache on the user's device to look for duplicate MAC addresses.

Answer

The Wi-Fi encryption type configured on the user's device to ensure it is using WPA3.

Question 7

A technician is configuring a Windows 11 workstation for a small business that handles credit card payments. The owner wants to ensure that stored cardholder data cannot be read if the drive is removed and attached to another computer. Which Windows feature should the technician enable?

Accepted Answer

BitLocker. BitLocker encrypts the entire volume, so if the drive is removed and connected to another computer, the data remains unreadable without the recovery key or the original TPM. EFS, firewall rules, and UAC do not provide full-volume encryption, so they fail the physical-theft requirement. BitLocker is the correct built-in Windows feature for protecting data at rest.

Answer

Encrypting File System (EFS)

Answer

Windows Defender Firewall

Answer

User Account Control (UAC)

Question 8

A user reports that when visiting a banking website, the browser displays a warning that the site's certificate is not trusted, even though the site worked yesterday. The technician verifies the system clock is correct and the network is functioning. Which of the following is the MOST likely cause?

Accepted Answer

The root certificate for the issuing CA was removed from the Trusted Root Certification Authorities store.. A browser trusts a TLS certificate only if it can chain it to a root CA in the Trusted Root Certification Authorities store. If that root was removed, the chain breaks and the browser warns that the certificate is not trusted. An expired certificate or DNS problem could also cause warnings, but the sudden failure with a correct clock points to a missing root certificate.

Answer

The user's account password has expired.

Answer

The website's TLS certificate has expired.

Answer

The DNS server is resolving the banking site to an incorrect IP address.

Question 9

A security analyst notices that several workstations on the same subnet are resolving popular banking domains to an IP address that belongs to an unknown server. The analyst confirms the DHCP server is legitimate and the DNS server settings have not been changed by Group Policy. Which of the following attacks is MOST likely occurring?

Accepted Answer

DNS poisoning. DNS poisoning inserts false records into a DNS resolver's cache, so clients receive attacker-controlled IP addresses for legitimate names. Because DHCP and Group Policy are intact, the misdirection must come from the DNS layer. Evil twin, ARP poisoning, and domain hijacking do not match the specific symptom of multiple clients resolving banking domains to an unknown server.

Answer

Evil twin

Answer

Domain hijacking

Answer

ARP poisoning

Question 10

A technician is asked to dispose of several old company laptops that contain sensitive customer data. The company wants to ensure the data cannot be recovered while still allowing the laptops to be donated. Which of the following should the technician perform?

Accepted Answer

Perform a secure erase or overwrite the drives.. Secure erase or overwriting renders the original data unrecoverable while keeping the drive usable, so the laptops can be donated. Physical destruction prevents donation, and formatting or repartitioning leaves recoverable data. The technician should choose a sanitization method that meets both the security and reuse goals.

Answer

Run a standard format on the drives.

Answer

Delete all partitions and create a new one.

Answer

Physically destroy the hard drives.

Question 11

A user at a small office reports that whenever they connect to the corporate Wi-Fi in the break room, their laptop warns that the network is unsecured and other devices on the same network can see their traffic. The access point in the break room broadcasts an open SSID with no password. Which of the following should a technician configure on the access point to protect wireless traffic while keeping the SSID available to employees?

Accepted Answer

Enable WPA3-Personal with SAE. The reported problem is an open wireless network where traffic is visible to other devices. The fix must add authentication and encryption to the wireless link. WPA3-Personal with SAE provides strong per-session encryption using a shared passphrase, which fits a small office that wants employees to connect with one password while keeping the SSID broadcast for easy discovery.

Answer

Change the access point to operate on the 5 GHz band only

Answer

Disable SSID broadcast on the access point

Answer

Enable MAC address filtering for known employee devices

Question 12

An administrator receives an alert that a workstation is repeatedly making DNS queries for random-looking domain names and sending small amounts of data to external IP addresses every few minutes. The endpoint protection agent is installed and up to date, and no user is logged in. Which of the following is the MOST likely explanation for this behavior?

Accepted Answer

The workstation is infected with malware that uses DNS tunneling for command and control.. Malware that has established a foothold often uses DNS tunneling to evade egress filtering, encoding command-and-control traffic in DNS queries and responses. The combination of randomized domain names, a repeating short interval, small outbound data, and no interactive user strongly indicates a compromised endpoint rather than any normal update, reputation, or time-sync process.

Answer

The workstation is receiving a legitimate software update from the vendor.

Answer

The workstation is synchronizing its clock with an external NTP server.

Answer

The endpoint protection agent is performing a cloud reputation lookup for each file.

Question 13

A security administrator is reviewing authentication methods for a company that wants to reduce the risk of credential theft while allowing employees to log in from personal mobile devices. Which two of the following should the administrator implement? (Choose two.)

Accepted Answer

Biometric authentication. MFA and biometric authentication both add factors that a stolen password alone cannot satisfy, directly reducing the risk of credential theft. SSO, password managers, and RBAC are useful but do not prevent an attacker with stolen credentials from logging in. The administrator should implement MFA and biometric authentication to strengthen login security for personal mobile devices.

Answer

Role-based access control (RBAC)

Answer

Single sign-on (SSO)

Answer

Password manager

Question 14

A technician is asked to dispose of several old company laptops that contain customer records on their internal drives. The drives are traditional spinning magnetic disks, and the company wants to reuse the laptops internally after the data is removed. Which of the following is the BEST method to ensure the customer data cannot be recovered?

Accepted Answer

Perform a low-level wipe by overwriting the entire drive with multiple passes of random data. The laptops will be reused internally, so the storage must remain functional while the customer data becomes unrecoverable. Overwriting every sector of a magnetic hard disk with random data removes the original bit patterns and defeats forensic recovery. Partition deletion and quick formatting leave recoverable remnants, and degaussing renders the drive unusable.

Answer

Run a standard format of the drive from the operating system installer

Answer

Degauss the drive and then reinstall the operating system

Answer

Delete all partitions and leave the drive unallocated

Question 15

A security analyst notices that an employee's account is logging in successfully from two different countries within a five-minute window. The account uses a complex password, and the employee confirms they did not travel. The organization already requires multifactor authentication for all users. Which of the following is the MOST likely cause of the suspicious logins?

Accepted Answer

The employee's session cookie was stolen and reused by an attacker. MFA blocks credential replay, so an attacker who obtains a valid session token can continue using the already-authenticated session without triggering another challenge. Two successful logins from distant countries within minutes, with a complex password and no travel, point to stolen session cookies rather than password guessing, time-zone display issues, or a single VPN exit node.

Answer

The employee is using a corporate VPN that assigns an exit node in another country

Answer

The employee's password was guessed by a brute-force attack

Answer

The multifactor authentication provider is synchronizing time zones incorrectly