220-1102 Windows Security Settings — Timed 15 Questions

Question 1

After a security incident, a forensic analyst needs to review the event logs on a Windows 10 system to determine when a specific user account was created. The logs are intact. Which Windows security setting must be enabled to ensure that account creation events are recorded?

Accepted Answer

Enable 'Audit Account Management' in Advanced Audit Policy.. Audit Account Management policy must be enabled to log events like user account creation. This is configured in Local Security Policy or Group Policy under Advanced Audit Policy Configuration. Without this audit setting, account creation events are not recorded in the Security log.

Answer

Enable 'Audit Logon Events' in Local Security Policy.

Answer

Turn on 'File and Printer Sharing' in Network and Sharing Center.

Answer

Configure Windows Defender to scan for new accounts.

Question 2

A technician is configuring a Windows 10 kiosk machine that will run a single web application in full-screen mode. The machine must not allow users to access the desktop, taskbar, or other apps. Which Windows security feature should be used to accomplish this?

Accepted Answer

Assigned Access (Kiosk Mode). Assigned Access (formerly Kiosk Mode) in Windows 10/11 allows a device to run a single app in full-screen, locking down the system. It can be configured via Settings > Accounts > Other users > Set up a kiosk. This ensures users cannot exit the app or access other parts of the OS.

Answer

Local Group Policy to hide the taskbar.

Answer

User Account Control set to 'Always notify.'

Answer

Windows Defender Application Guard

Question 3

During a security audit, you discover that a Windows 10 workstation has a weak local administrator password. The company policy requires all local admin passwords to be at least 12 characters with complexity. Which tool can enforce this policy for all future password changes on that workstation?

Accepted Answer

Local Security Policy (secpol.msc). Local Security Policy (secpol.msc) allows configuring password policies like minimum length and complexity for local accounts. This is applied via Account Policies > Password Policy. It ensures that any new password meets the requirements.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Registry Editor (regedit)

Answer

Windows Defender Firewall with Advanced Security

Question 4

A small business owner wants to prevent employees from changing system time, installing printers, and modifying power settings on their Windows 10 workstations. They do not want to remove local admin rights entirely. Which Windows security tool should be used to apply these restrictions?

Accepted Answer

Local Group Policy Editor (gpedit.msc). Local Group Policy Editor (gpedit.msc) allows granular control over user permissions and system settings without removing admin rights. It can restrict specific actions like changing time or installing printers via Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

Answer

Windows Defender Security Center

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Registry Editor (regedit)

Question 5

A company uses AppLocker to control which applications can run on Windows 10 workstations. A user needs to run a portable application from a USB drive for a presentation, but it is blocked by AppLocker. The user has local admin rights. What is the best way to allow this specific application while maintaining security?

Accepted Answer

Create a new AppLocker path rule for the USB drive.. AppLocker can be configured with rules based on file path, publisher, or hash. Creating a path rule for the USB drive or a hash rule for the specific executable allows the app while still blocking others. This is more secure than disabling AppLocker or giving the user permanent exceptions.

Answer

Temporarily disable AppLocker service.

Answer

Add the user to the 'Power Users' group.

Answer

Run the application as Administrator.

Question 6

A user reports that their Windows 10 laptop shows a blue screen with an error message about 'Driver IRQL not less or equal' after connecting a new external hard drive. They need to use the drive for work. Which security setting should you check to ensure driver installation is not blocked?

Accepted Answer

Disable Driver Signature Enforcement temporarily.. Driver Signature Enforcement ensures that only drivers with a valid digital signature can be installed. If a driver is unsigned or has an invalid signature, Windows may block it, causing errors. This setting is part of Windows security and can be temporarily disabled for troubleshooting.

Answer

Check if Secure Boot is enabled in UEFI.

Answer

Verify that User Account Control is set to 'Notify me only when apps try to make changes.'

Answer

Run Windows Update to find a signed driver.

Question 7

A Windows 11 workstation is infected with ransomware that encrypted user files. The IT security team wants to prevent future infections by restricting which processes can modify files in user profile folders. Which Windows security feature can enforce such restrictions without third-party software?

Accepted Answer

Controlled Folder Access. Controlled Folder Access (part of Windows Defender Exploit Guard) allows only trusted apps to access protected folders like Documents, Pictures, etc. It can be configured via Windows Security > Virus & threat protection > Ransomware protection. This effectively blocks ransomware from encrypting files.

Answer

NTFS permissions set to 'Read-only' for all users.

Answer

AppLocker with a deny rule for unknown executables.

Answer

BitLocker with TPM protection

Question 8

A user wants to encrypt a USB flash drive so that if it is lost, the data cannot be read on another computer. The USB drive will be used on both Windows 10 and Windows 11 devices. Which Windows feature should be used?

Accepted Answer

BitLocker To Go. BitLocker To Go allows encryption of removable drives like USB flash drives. It is available in Pro and Enterprise editions of Windows and provides strong protection. The encrypted drive can be accessed on other Windows systems with the password or recovery key.

Answer

EFS (Encrypting File System)

Answer

Windows Defender Encryption

Answer

Secure Boot

Question 9

After deploying a new Windows 11 update, several users complain that they can no longer access shared folders on the network. You verify that network discovery and file sharing are enabled. Which Windows security setting should you check first to resolve this issue?

Accepted Answer

Review Windows Defender Firewall rules for 'File and Printer Sharing.'. Windows Defender Firewall can block file and printer sharing even if sharing settings are enabled. The 'File and Printer Sharing' inbound rule must be allowed for the appropriate network profile (e.g., Private). This is a common issue after updates that reset firewall rules.

Answer

Check if the users are in the 'Remote Desktop Users' group.

Answer

Verify that the 'Password Protected Sharing' option is turned off.

Answer

Run Windows Update to install additional patches.

Question 10

A user reports that after a recent Windows update, they can no longer install software on their company-issued laptop. When they try to run an installer, they get a message: 'Your system administrator has blocked this program.' The user has local administrator rights on the laptop. Which Windows security setting is most likely causing this issue?

Accepted Answer

User Account Control (UAC) is set to 'Always notify.'. Windows User Account Control (UAC) can be configured to prompt for consent or credentials when software installation is attempted, even for local admins. If UAC is set to 'Always notify,' it will block installations that don't receive explicit approval. The 'blocked by administrator' message often points to UAC or AppLocker, but with local admin rights, UAC is the primary control.

Answer

Windows Defender Firewall is blocking the installer.

Answer

BitLocker Drive Encryption is preventing write access.

Answer

The user's account is not part of the local Administrators group.

Question 11

A user reports that their Windows 10 computer is displaying a 'Your IT department has limited access to some features of this app' message when trying to run a legacy application. The application worked before the latest Windows update. Which security feature is most likely causing this issue?

Accepted Answer

Windows Defender Application Guard. This question tests knowledge of Windows Defender Application Guard and Windows Sandbox features. The message indicates that Application Guard is blocking the app from accessing certain resources. Application Guard uses hardware isolation to run untrusted applications in a container, and updates may change its default behavior or policies.

Answer

Windows Defender Firewall with Advanced Security

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 12

A security administrator needs to prevent users from running unauthorized software on Windows 10 Enterprise workstations. They want to allow only applications that are signed by approved publishers. Which Windows security feature should be configured?

Accepted Answer

Windows Defender Application Control (WDAC). This question tests knowledge of Windows Defender Application Control (WDAC) and AppLocker. WDAC is a more modern and secure solution that can enforce code integrity policies based on publisher signatures, while AppLocker is a legacy feature. WDAC can be configured to allow only signed apps from trusted publishers, providing strong application control.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker Drive Encryption

Answer

User Account Control (UAC)

Question 13

A user reports that after a recent Windows update, their standard user account can no longer install certain applications that previously installed without issue. The update changed the default User Account Control (UAC) behavior. Which UAC setting would most likely restore the previous behavior while still prompting for consent?

Accepted Answer

Notify me only when apps try to make changes to my computer (do not dim my desktop). This question tests knowledge of User Account Control (UAC) levels and their impact on standard users. The 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' setting allows standard users to be prompted for credentials without the secure desktop, which is the default behavior that was likely changed. Understanding the four UAC notification levels is essential for troubleshooting permission-related issues after updates.

Answer

Always notify me (dim my desktop)

Answer

Notify me only when apps try to make changes to my computer (dim my desktop)

Answer

Never notify me

Question 14

A technician is configuring a Windows 10 kiosk system that will run a single application in a public library. The kiosk must automatically log on and start the app without any user interaction. Which security setting combination is required?

Accepted Answer

Configure 'Automatic logon' in the registry and enable 'Assigned Access' for the kiosk account. This question tests knowledge of kiosk mode configuration. Windows 10 supports 'Assigned Access' which can be configured to automatically log on a specified user account and launch a single app. This requires enabling the 'Automatic logon' setting in the registry or via the 'netplwiz' tool, and then configuring Assigned Access for that account.

Answer

Enable 'Sticky Keys' and configure the 'Ease of Access' settings

Answer

Set the 'Shutdown: Allow system to be shut down without having to log on' policy

Answer

Enable 'User Account Control: Run all administrators in Admin Approval Mode'

Question 15

A company's security policy requires that all Windows 10 workstations automatically lock the screen after 5 minutes of inactivity. However, users in the sales department often leave their desks for extended periods. A technician configures the 'Interactive logon: Machine inactivity limit' policy to 300 seconds. Despite this, the screensaver does not activate. What is the most likely reason?

Accepted Answer

The screensaver is not enabled or configured on the workstations. This question tests understanding of the relationship between the 'Interactive logon: Machine inactivity limit' policy and screensaver settings. The policy locks the workstation after the specified idle time, but it does not automatically enable the screensaver. The screensaver must be separately configured and enabled, or the lock screen will appear without a screensaver.

Answer

The 'Screen saver timeout' policy is set to a longer duration

Answer

The 'Password protect the screensaver' setting is disabled

Answer

The 'Turn off the display' power setting is set to 'Never'