220-1102 Windows Security Settings Practice Test 2 — 15 Questions

Question 1

A small business owner wants to ensure that only authorized USB storage devices can be used on company laptops running Windows 10 Pro. They have a list of approved device hardware IDs. Which security policy should be configured to enforce this restriction?

Accepted Answer

Configure the 'Allow installation of devices that match any of these device IDs' policy under Device Installation Restrictions. This question covers device installation restrictions via Group Policy or Local Security Policy. The 'Allow installation of devices that match any of these device IDs' policy can be configured with a list of approved hardware IDs, blocking all others. This is a common method for controlling USB device usage in enterprise environments.

Answer

Enable the 'Removable Storage Access' policy under Windows Components

Answer

Configure the 'Devices: Restrict CD-ROM access to locally logged-on user only' policy

Answer

Set the 'Deny all devices' policy under Device Installation Restrictions

Question 2

After a security incident, a forensic analyst needs to ensure that Windows 10 audit logs capture all successful and failed attempts to access the 'Confidential' folder on a file server. Which audit policy configuration is required?

Accepted Answer

Enable 'Audit object access' and configure the SACL on the folder. This question tests understanding of advanced audit policies. To log file access, you need to enable 'Audit File Share' or 'Audit Detailed File Share' under Advanced Audit Policy. The 'Object Access' subcategory must be configured to log both success and failure events for file share access.

Answer

Enable 'Audit account logon events' for success and failure

Answer

Enable 'Audit privilege use' for success and failure

Answer

Enable 'Audit process tracking' for success and failure

Question 3

A user calls the help desk complaining that they cannot change their Windows 10 password even though they know the current password. The user is a member of the 'Users' group on a domain-joined computer. What is the most likely cause?

Accepted Answer

The 'Password must meet complexity requirements' policy is preventing the new password from being accepted.. This question tests knowledge of password policies and user permissions. In a domain environment, password policies are typically enforced by the domain controller, not the local machine. The 'Password must meet complexity requirements' policy may be enabled, and the user's new password might not meet those requirements, even though they know the current password.

Answer

The user does not have 'Change Password' permission on their own account.

Answer

The 'User must change password at next logon' flag is set.

Answer

The local Security Accounts Manager (SAM) database is corrupted.

Question 4

A company is migrating from Workgroup to Domain. After joining a Windows 10 computer to the domain, users report that they can no longer log on using their local user accounts. What setting in Local Security Policy is most likely causing this behavior?

Accepted Answer

The 'Deny log on locally' user rights assignment includes the 'Users' group. This question tests understanding of the 'Deny log on locally' user rights assignment. When a computer joins a domain, domain policies may override local settings, and the 'Deny log on locally' policy can be configured to block local accounts. This is a common security measure to enforce domain-only authentication.

Answer

The 'Network access: Do not allow anonymous enumeration of SAM accounts' policy

Answer

The 'Deny log on locally' user rights assignment includes the 'Guests' group

Answer

The 'Interactive logon: Do not display last user name' policy is enabled

Question 5

During a security audit, you discover that a Windows 10 workstation has the 'Store passwords and credentials using reversible encryption' policy enabled. What is the primary security risk associated with this setting?

Accepted Answer

It stores passwords in a format that can be easily decrypted, making them vulnerable if the database is compromised.. This question tests understanding of password storage policies. Reversible encryption means passwords are stored in a format that can be decrypted back to plaintext, which is a significant security risk if an attacker gains access to the SAM database. This setting should only be enabled when required by specific applications, such as those using CHAP authentication.

Answer

It increases the time required to log on to the system.

Answer

It allows users to bypass the password complexity requirement.

Answer

It prevents the use of biometric authentication methods.

Question 6

A company policy requires that all USB flash drives be automatically scanned for malware when inserted. Which Windows security setting should be configured to enforce this?

Accepted Answer

Enable Windows Defender Real-time Protection. Windows Defender Antivirus can be configured to scan removable drives upon insertion via Group Policy or the Windows Security app. This ensures automatic malware scanning without user intervention.

Answer

Configure BitLocker To Go

Answer

Enable Windows Firewall

Answer

Set User Account Control to Always Notify

Question 7

A small business wants to ensure that all employees use strong passwords that include uppercase, lowercase, numbers, and special characters, and that passwords expire every 60 days. Which tool should be used to enforce these settings on a standalone Windows 10 workstation?

Accepted Answer

Local Security Policy (secpol.msc). Local Group Policy Editor (gpedit.msc) allows configuration of password policies on standalone systems. Password must meet complexity requirements and maximum password age can be set to 60 days.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Windows Defender Firewall with Advanced Security

Answer

Device Manager

Question 8

A user reports that their Windows 10 computer is displaying a message that 'Windows Defender Antivirus is turned off' even though they have not disabled it. They have also noticed that they cannot open the Windows Security app. What is the most likely cause?

Accepted Answer

The computer is infected with malware. Malware often disables antivirus software and blocks access to security tools to avoid detection. This is a common sign of infection, and a boot-time scan or offline scan should be performed.

Answer

Windows Defender is disabled via Group Policy

Answer

Windows needs a critical update

Answer

User Account Control is blocking the app

Question 9

A technician is configuring a new Windows 10 kiosk computer that will run a single application for public use. They need to prevent users from accessing the desktop, taskbar, or other system functions. Which Windows security feature should be used?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (Kiosk Mode) locks down the device to run only one app and restricts access to other system features. It is designed for public or kiosk scenarios.

Answer

User Account Control (UAC) set to highest level

Answer

Local Group Policy – Software Restriction Policies

Answer

Windows Defender Application Guard

Question 10

A company laptop was stolen, and the IT department needs to ensure that the data on the device cannot be accessed. The laptop had BitLocker enabled, but the drive was unlocked when stolen. What additional security measure could have prevented data access in this scenario?

Accepted Answer

Configure BitLocker with a startup PIN. BitLocker protects data when the system is off. If the laptop was unlocked, data is accessible. A pre-boot authentication PIN or password ensures that even if the device is powered on, the drive remains locked until the PIN is entered.

Answer

Enable Windows Defender Firewall

Answer

Use a strong user password

Answer

Enable System Restore

Question 11

A user reports that after a recent Windows update, they can no longer install a legacy application that requires write access to the Program Files folder. The user is a local administrator. What Windows security setting is most likely blocking the installation?

Accepted Answer

User Account Control (UAC). User Account Control (UAC) prompts for consent or credentials even for administrators when changes require elevated permissions, such as writing to protected folders like Program Files. Disabling UAC or running the installer as administrator can resolve this.

Answer

BitLocker Drive Encryption

Answer

Windows Defender Firewall

Answer

Group Policy Software Restrictions

Question 12

A user complains that their Windows 10 computer is running slowly and they see frequent pop-ups from an unknown program. After running a full antivirus scan, nothing is detected. Which Windows security feature should you use to investigate and remove potentially unwanted software?

Accepted Answer

Windows Defender Offline Scan. Windows Defender Offline Scan boots from a trusted environment to detect and remove persistent malware that standard scans miss. It is ideal for rootkits or stubborn infections that hide from a live OS.

Answer

Windows Defender Firewall

Answer

System Restore

Answer

User Account Control (UAC)

Question 13

An organization uses Windows 10 and wants to prevent users from installing unauthorized software. They have configured Software Restriction Policies via Group Policy. However, a user bypassed the policy by renaming the executable. What additional measure should be taken to enforce the restriction?

Accepted Answer

Use AppLocker with publisher rules. Software Restriction Policies can be bypassed by renaming executables. Using AppLocker with publisher rules (based on digital signatures) prevents this because it identifies software by its certificate, not file name.

Answer

Enable Windows Defender Real-time Protection

Answer

Set User Account Control to Always Notify

Answer

Enable BitLocker

Question 14

A user reports that they cannot access a shared folder on the network, but other users can. The folder is on a Windows 10 Pro workstation. What should you check first to resolve this issue?

Accepted Answer

Check the NTFS permissions on the folder. NTFS permissions control access at the file system level, while share permissions control network access. A user-specific deny entry on the NTFS permissions can block an individual user while allowing others.

Answer

Check the Windows Defender Firewall settings

Answer

Check the user’s password expiration status

Answer

Check the User Account Control settings

Question 15

During a security audit, you discover that a user’s Windows 10 device has allowed multiple failed login attempts without locking the account. Which policy should you adjust to enforce account lockout after 5 failed attempts?

Accepted Answer

Account Lockout Policy – Account lockout threshold. Account lockout policies are configured in the Local Security Policy under Account Policies. Setting 'Account lockout threshold' to 5 will lock the account after that many failed attempts, preventing brute-force attacks.

Answer

Password Policy – Minimum password length

Answer

User Rights Assignment – Deny log on locally

Answer

Security Options – Interactive logon: Message text for users attempting to log on