Security practice questions

The script file was deleted by Windows Defender.

Why wrong: While Windows Defender is designed to protect against malicious software, it typically does not silently delete legitimate logon scripts without specific user interaction or a definitive malware detection. If a script were deemed suspicious, Defender would more likely quarantine it, notify the user, or block its execution rather than outright deleting a file that is part of a standard logon process within an enterprise environment. Such an action would usually generate an alert in the Windows Security log or Defender's history.

The update changed the default script host to PowerShell.

Why wrong: Windows maintains specific file associations for different script types, and VBScript files (.vbs) are inherently associated with either `wscript.exe` (for GUI interaction) or `cscript.exe` (for command-line execution). A standard Windows update does not fundamentally alter these core system associations by reassigning the default script host for VBScript to PowerShell. PowerShell uses its own execution engine (`powershell.exe`) for .ps1 scripts, and these distinct script environments are not interchangeable by default through system updates.

The network share requires SMB 2.0, which is no longer supported.

Why wrong: SMB 2.0 is a robust and widely supported network file sharing protocol that has been a standard in Windows environments for many years, succeeding the deprecated SMB 1.0. Therefore, the assertion that SMB 2.0 is no longer supported is incorrect; it remains fully functional and commonly used. Furthermore, if there were an issue with SMB connectivity, it would manifest as a general inability to access network shares and resources, affecting all network-dependent operations, not just the execution of a VBScript logon script specifically.

Increased bandwidth usage

Why wrong: Increased bandwidth usage primarily indicates a performance or operational issue, such as inefficient data transfer, large file synchronization, or even legitimate high-volume network traffic. While a sudden, unexplained spike in bandwidth could be a symptom of a security breach, like data exfiltration or botnet activity, the usage itself is not a direct security risk. It does not inherently compromise data confidentiality, integrity, or availability; rather, it's an indicator that warrants further investigation into potential underlying causes, which could be security-related.

Compatibility issues with the operating system

Why wrong: Compatibility issues with the operating system typically manifest as software malfunctions, system instability, or inability for an application to run correctly. These are operational and technical challenges that hinder functionality and productivity, requiring troubleshooting or alternative solutions. While an incompatible application might fail to receive security updates or create system instability that could indirectly lead to a vulnerability if not addressed, the incompatibility itself is not a direct security risk that actively compromises data or system integrity.

Increased licensing costs

Why wrong: Increased licensing costs represent a financial and budgetary concern for an organization, impacting operational expenses and resource allocation. This issue pertains to the economic management of software assets and compliance with vendor agreements, rather than the security posture of the system or data. While unauthorized software might bypass licensing, leading to legal or financial penalties, the cost itself does not directly introduce vulnerabilities, facilitate attacks, or compromise the confidentiality, integrity, or availability of information.

Use a smart card reader on the door

Why wrong: Using a smart card reader on a door implements an access control mechanism, restricting entry to a physical space based on authentication credentials. While this enhances perimeter security by limiting who can enter the room where the laptop is located, it does not provide any direct physical security for the laptop itself once an authorized or unauthorized individual gains entry. The device remains physically unsecured and vulnerable to removal.

Install a security camera in the hallway

Why wrong: Installing a security camera in the hallway serves primarily as a deterrent and a forensic tool, recording events for later review. Although cameras might discourage some opportunistic thieves due to the risk of identification, they do not physically prevent the act of theft or impede the removal of the laptop from the premises. Its utility is largely post-incident, aiding in investigation rather than prevention.

Enable BitLocker on the laptop

Why wrong: Enabling BitLocker on the laptop is a logical security control focused on data encryption, protecting the confidentiality and integrity of information stored on the device's hard drive. While crucial for preventing unauthorized access to sensitive data if the laptop is lost or stolen, it offers no physical barrier or deterrent against the actual theft of the hardware itself. The laptop can still be physically removed, even if its data is encrypted.

Pay the ransom to regain access quickly.

Why wrong: Paying the ransom is generally discouraged by cybersecurity experts and law enforcement for several critical reasons. There is no guarantee that the attackers will provide a working decryption key, and even if they do, the decryption process can be complex, incomplete, or introduce further vulnerabilities. Furthermore, paying directly funds criminal enterprises, encouraging more attacks and validating their illicit business model, which ultimately makes other potential victims more vulnerable.

Run a full antivirus scan to remove the malware.

Why wrong: While running a full antivirus scan is a necessary step for malware eradication, it does not address the immediate problem of already encrypted files. An antivirus program can detect and remove the ransomware executable, but it lacks the capability to reverse the cryptographic process that has rendered the user's data inaccessible. The primary concern in this scenario is data recovery, which an antivirus scan alone cannot achieve for data that has already been scrambled by encryption.

Restart the computer in Safe Mode and attempt file recovery.

Why wrong: Restarting the computer in Safe Mode does not provide any inherent mechanism to decrypt files that have been locked by ransomware. Safe Mode is designed to troubleshoot system issues by loading a minimal set of drivers and services, which can be useful for removing persistent malware or resolving driver conflicts. However, it does not magically restore access to cryptographically scrambled data, as the encryption key remains with the attacker, making the files unreadable regardless of the operating mode.

Set the execution policy to Restricted

Why wrong: Setting the execution policy to `Restricted` completely prevents any PowerShell script from running, regardless of its origin or digital signature status. While this would block the unauthorized unsigned script, it simultaneously disables all legitimate administrative scripts and automation, severely impacting system functionality and manageability. This approach is overly restrictive and does not meet the implied requirement of allowing legitimate, signed scripts to execute.

Set the execution policy to RemoteSigned

Why wrong: The `RemoteSigned` execution policy requires scripts downloaded from the internet to be digitally signed by a trusted publisher to run. However, it permits locally created scripts to execute without requiring a digital signature. Since the unauthorized PowerShell script could have been created or modified directly on the system, this policy would not reliably prevent its execution, failing to address the core security incident of an unauthorized script running.

Disable PowerShell using Group Policy

Why wrong: Completely disabling PowerShell via Group Policy would prevent all PowerShell operations, including legitimate administrative tasks, diagnostic tools, and automation scripts that rely on it. This drastic measure is not a targeted solution for managing script execution based on digital signatures or preventing specific unauthorized scripts. It would severely hinder system administration and is disproportionate to the requirement of blocking only unsigned scripts while allowing signed ones.

It is a rootkit; use a rootkit removal tool from within Windows.

Why wrong: This scenario describes a browser-based alert or scareware, not a rootkit. Rootkits are stealthy malware designed to hide their presence and provide persistent, privileged access to an attacker, often operating at the kernel level. Attempting to remove a sophisticated rootkit from within a compromised Windows environment is generally ineffective, as the rootkit itself can subvert security tools and hide its components.

It is ransomware; pay the fee to remove the alert.

Why wrong: This is not ransomware because the user's files are not encrypted, nor is the system locked down by the malware itself. Ransomware specifically encrypts data or locks the operating system, demanding payment for decryption keys or system access restoration. Paying the fee in a tech support scam merely validates the scammer's business model and provides no guarantee of resolution, often leading to further demands or installation of more malicious software.

It is a worm; disconnect the network and reinstall the operating system.

Why wrong: This scenario does not describe a worm, which is a self-replicating malware designed to spread autonomously across networks to infect other systems without user intervention. A tech support scam is typically confined to a single workstation, often initiated by user interaction with a malicious link or pop-up. Disconnecting the network and immediately reinstalling the operating system is an overly drastic and unnecessary measure for a tech support scam, which can usually be resolved through targeted malware removal.

The router's SSID is hidden.

Why wrong: A hidden SSID would prevent the network from appearing in the list, but the laptops can still connect manually; this is not specific to the security protocol version.

The router is broadcasting on a 5 GHz band only.

Why wrong: While older laptops may lack 5 GHz support, this is a band compatibility issue, not a security protocol issue; the scenario specifically points to the security upgrade.

The laptops have incorrect DNS settings.

Why wrong: Incorrect DNS would cause browsing issues after connection, but would not prevent the initial Wi-Fi association and authentication.

PCI DSS

Why wrong: The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations handling branded credit cards from the major card schemes. While PCI DSS does include requirements for secure disposal of media containing cardholder data, it is a specific standard focused solely on payment card information. The question describes a general security audit and data disposal issue, making NIST SP 800-88 the universally applicable and direct standard for media sanitization procedures, regardless of the data type involved.

HIPAA

Why wrong: The Health Insurance Portability and Accountability Act (HIPAA) mandates the protection and secure handling of Protected Health Information (PHI). While HIPAA requires covered entities to implement appropriate safeguards for PHI, including secure disposal, it does not specify the technical methods or procedures for data sanitization. Instead, organizations are expected to adopt industry best practices and standards, such as NIST SP 800-88, to meet HIPAA's general security requirements for data destruction.

ISO 27001

Why wrong: ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a framework for managing information security risks and requires organizations to have policies and procedures for secure disposal of information. However, ISO 27001 is a management standard that outlines *what* needs to be done, not *how* to technically perform data sanitization; the specific technical guidelines for media sanitization are found in documents like NIST SP 800-88.

The router's firewall is blocking the older laptops' MAC addresses.

Why wrong: This option is incorrect. MAC address filtering operates at Layer 2 (Data Link Layer) and is a basic access control mechanism that either permits or denies a device's connection based on its unique hardware address. If the router's firewall were configured to block specific MAC addresses, the laptops would be unable to associate with the access point at all, regardless of the security protocol. The described issue, however, is related to authentication failure after a security protocol upgrade, not a blanket block on physical addresses.

The laptops are using an incompatible encryption cipher like TKIP.

Why wrong: This option is incorrect. WPA3 exclusively utilizes robust encryption ciphers like CCMP (based on AES) and GCM, completely deprecating older, weaker ciphers such as TKIP. While TKIP was used in some WPA and early WPA2 implementations, a WPA3-only network would not offer it as a negotiation option. The fundamental problem is not that the laptops are attempting to use an incompatible cipher, but rather their inability to perform the WPA3 handshake and establish a connection using the required modern cryptographic standards.

The router's SSID is hidden, and the laptops cannot discover it.

Why wrong: This option is incorrect. A hidden SSID prevents the network name from being broadcast, requiring clients to manually enter the SSID to connect. While this can certainly cause connection difficulties, it affects all devices equally, regardless of their age or WPA3 support capabilities. The problem described specifically arises after a security protocol upgrade and targets older laptops, making a hidden SSID an irrelevant factor in this scenario, as it does not differentiate between device types based on security protocol support.

Samsung DeX

Why wrong: Samsung DeX is a software platform designed to extend the functionality of a single Samsung smartphone or tablet into a desktop-like computing experience when connected to an external display. While it enhances individual user productivity by enabling multitasking with a keyboard and mouse, it offers no capabilities for centralized bulk configuration, remote policy deployment, or application management across multiple devices. Therefore, it is unsuitable for deploying 50 Android tablets with consistent corporate settings.

Google Backup

Why wrong: Google Backup is a personal data recovery service that automatically saves user data, app data, and device settings associated with a specific Google account to Google Drive. Its primary function is to facilitate the restoration of an individual user's personal environment onto a new or reset device. This service lacks the enterprise-level features required for scalable, centralized deployment of corporate policies, security configurations, or mandatory applications across 50 distinct tablets, making it inappropriate for IT administration.

Developer Options > OEM Unlocking

Why wrong: OEM Unlocking is a specific setting found within a device's Developer Options, primarily intended for advanced users or developers to unlock the bootloader. Unlocking the bootloader allows for the installation of custom recovery images or alternative operating systems (custom ROMs), which fundamentally alters the device's security posture and voids manufacturer warranties. This feature is a security risk in an enterprise environment and provides no mechanism whatsoever for bulk configuration, centralized policy management, or secure application deployment across multiple corporate devices.

"I can install it, but you'll have to sign a waiver accepting all risks."

Why wrong: Installing company software on an unauthorized personal device, even with a signed waiver, directly violates established IT security policies and software licensing agreements. This action introduces significant security risks, such as potential data breaches, malware infections, and intellectual property theft, as personal devices typically lack the robust security controls of corporate assets. Furthermore, a waiver does not absolve the company of liability for security incidents stemming from non-compliant installations, making this an unprofessional and high-risk proposition.

"That's against policy. Please use a company laptop."

Why wrong: While correctly identifying that the request is against policy, this response is unhelpful and dismissive, failing to provide a constructive solution or alternative for the user. It lacks the professional communication necessary for effective IT support, potentially frustrating the user and hindering their ability to perform their job functions. A technician should aim to understand the user's underlying need and offer compliant solutions rather than simply stating policy without further assistance.

"I'll need to get approval from IT management first. Can you email the request?"

Why wrong: This response, while seemingly following a process, unnecessarily delays a resolution and implies that a policy violation might be permissible with management approval, which is often not the case for fundamental security policies. It shifts the burden of finding a solution entirely to the user and management, rather than the technician proactively offering a standard, policy-compliant alternative. A more effective approach would be to immediately offer a standard, policy-compliant solution, such as remote access, without involving unnecessary bureaucratic steps.

WPA2-PSK with a long passphrase.

Why wrong: WPA2-PSK (Pre-Shared Key) relies on a single, shared passphrase for all users to authenticate to the wireless network. While a long passphrase enhances resistance against brute-force attacks, this method inherently lacks individual user accountability and makes key management cumbersome and insecure for larger deployments. It does not provide the per-user authentication and authorization capabilities essential for robust enterprise or educational environments.

WPA2-Enterprise with 802.1X and RADIUS.

Why wrong: WPA2-Enterprise, leveraging 802.1X and a RADIUS server, provides robust individual user authentication and authorization, addressing the security limitations of shared keys. However, for a new wireless network deployment, WPA3-Enterprise is the superior and recommended choice. WPA3 offers significant cryptographic enhancements, including more resilient key establishment and protection against offline dictionary attacks, making WPA2-Enterprise a less optimal selection for future-proofing and maximum security.

WPA3-Personal with SAE.

Why wrong: WPA3-Personal, while introducing Simultaneous Authentication of Equals (SAE) for enhanced security over WPA2-Personal, still operates on the principle of a single, shared passphrase for network access. This fundamental design choice means it cannot provide the individual user authentication, authorization, and accountability required for enterprise or educational networks. It is primarily designed for home or small office environments where per-user security policies are not a critical requirement.

Continue deploying to the remaining workstations and troubleshoot the failures later

Why wrong: Continuing deployment despite initial failures is a critical error in change management and incident response. This approach risks propagating a faulty patch across the entire environment, potentially causing widespread system instability, data corruption, or introducing new security vulnerabilities that are far more difficult and costly to remediate. It disregards early warning signs and violates the principle of minimizing the blast radius of a problem.

Force the patch to install using administrative tools

Why wrong: Forcing a patch installation using administrative tools is highly ill-advised and bypasses crucial testing and validation processes designed to ensure compatibility and stability. This action can lead to unpredictable system behavior, render operating systems unbootable, or introduce severe security vulnerabilities by overriding dependency checks or compatibility safeguards. It demonstrates a disregard for proper change control and problem-solving methodologies, potentially exacerbating the initial issue.

Submit a new change request for the failed workstations

Why wrong: Submitting a new change request solely for the failed workstations is an inefficient and unnecessary bureaucratic step that delays immediate resolution. A well-designed change management plan should already include contingency procedures, such as a rollback, to address deployment failures without requiring a completely new approval cycle. This approach fails to leverage existing incident response and recovery protocols, prolonging system downtime and risk.

Scarcity

Why wrong: Scarcity, in the context of social engineering, exploits a victim's fear of missing out or the perception of limited availability to pressure them into immediate action. Attackers might create a sense of urgency around a fake offer or a perceived limited resource to bypass critical thinking and induce a hasty decision. This technique relies on psychological manipulation related to supply and demand, which is distinct from the passive temptation presented by a found physical object like a USB drive.

Pretexting

Why wrong: Pretexting is a social engineering technique where an attacker invents a believable, often urgent, scenario or "pretext" to manipulate a victim into divulging sensitive information or performing an action. This typically involves direct, targeted interaction, such as a phone call or email, where the attacker impersonates a trusted authority figure (e.g., IT support, law enforcement, a colleague) to establish credibility and extract specific data. This method relies on a fabricated narrative and direct communication, which is distinct from a passive physical lure.

Tailgating

Why wrong: Tailgating, also known as piggybacking, is a physical security breach where an unauthorized individual gains entry into a restricted area by closely following an authorized person. This typically occurs when the authorized person holds a door open or grants access, allowing the attacker to slip in without proper authentication or credential verification. This method is focused on bypassing physical access controls to gain unauthorized entry into a building or secure zone, which is unrelated to the digital compromise initiated by a malicious USB device.

Configure BitLocker To Go

Why wrong: BitLocker To Go is a data encryption feature designed to protect the confidentiality of information stored on removable drives by encrypting their contents. While it secures data against unauthorized access if the drive is lost or stolen, it does not perform any malware detection or scanning functions. Therefore, configuring BitLocker To Go fails to address the policy requirement of scanning USB drives for potential threats.

Enable Windows Firewall

Why wrong: The Windows Firewall operates primarily at the network layer, controlling inbound and outbound network traffic based on predefined rules. Its function is to prevent unauthorized network connections and protect against network-based attacks, not to inspect or scan local storage devices for malware. Consequently, enabling the firewall would not fulfill a policy requiring the scanning of USB flash drives for malicious content upon insertion.

Set User Account Control to Always Notify

Why wrong: User Account Control (UAC) is a security feature that helps prevent unauthorized changes to the operating system by requiring administrative consent for actions that could affect system security. Setting UAC to 'Always Notify' prompts the user for permission before administrative tasks are performed, but it does not initiate or manage antivirus scans of removable media. UAC's role is distinct from active threat detection on local storage devices.

The browser will run slower and may crash frequently.

Why wrong: Outdated plugins can sometimes introduce performance issues, such as slower browser response times or occasional crashes, due to compatibility conflicts with newer browser versions or operating systems. However, while these are potential consequences, the primary and most significant risk associated with an outdated plugin, especially in the context of a security audit, is not performance degradation but the severe security vulnerabilities it presents to the system.

The user will be unable to view some web content.

Why wrong: An outdated plugin might indeed cause compatibility problems, leading to situations where a user cannot properly view or interact with specific web content that requires a more current version of the plugin or relies on different rendering technologies. While this is a legitimate usability concern that affects the user experience, the most critical issue identified during a security audit of an outdated plugin is not content display failure, but rather the unpatched security holes that could be exploited.

The browser will automatically disable the plugin.

Why wrong: While many modern web browsers have implemented features to detect and warn users about outdated or insecure plugins, and some may even block their execution by default, this is not a universal or guaranteed automatic action. The browser's behavior depends on its specific security policies, the plugin type, and the severity of the known vulnerabilities. Even if a browser attempts to disable it, the plugin files still reside on the system, and there might be ways to bypass the browser's block or exploit the plugin through other applications, meaning the underlying security risk persists until it's properly updated or uninstalled.

PPTP

Why wrong: PPTP (Point-to-Point Tunneling Protocol) is an older VPN protocol that operates at Layer 2 of the OSI model and encapsulates PPP frames over IP. While simple to set up, it utilizes weak encryption methods, often relying on MS-CHAPv2 for authentication, which has been demonstrated to be vulnerable to brute-force attacks. Due to these significant security flaws, PPTP is considered obsolete and should never be used for secure remote access, making it an unsuitable choice for a modern VPN configuration.

L2TP/IPsec

Why wrong: L2TP/IPsec combines the tunneling capabilities of L2TP with the robust security features of IPsec, providing strong encryption and authentication. However, L2TP/IPsec often encounters difficulties traversing Network Address Translation (NAT) devices, particularly when multiple NAT layers are involved, because IPsec uses UDP port 500 for IKE and ESP protocol 50, which can be problematic for NAT routers to correctly forward. This can necessitate complex firewall rule adjustments or specific router configurations, making it less straightforward for universal deployment in varied network environments.

SSTP

Why wrong: SSTP (Secure Socket Tunneling Protocol) is a Microsoft-developed VPN protocol that encapsulates PPP traffic over an SSL/TLS channel, utilizing TCP port 443, similar to HTTPS. While this allows it to bypass most firewalls and NAT devices effectively, its primary drawback is its proprietary nature and strong ties to the Windows ecosystem. This makes client support and server implementations less ubiquitous across non-Windows operating systems and network devices, limiting its universal compatibility and making it a less flexible choice for diverse environments compared to open-source alternatives.

Standard change

Why wrong: A standard change is a pre-authorized, low-risk, and frequently performed change, typically following a documented procedure. While efficient for routine tasks like adding a user account or installing a standard application, it is entirely unsuitable for an urgent security patch. Security patches address critical vulnerabilities that are often unforeseen and carry high potential impact, demanding a more immediate and specific response than a pre-approved, generic process allows.

Normal change

Why wrong: A normal change follows the full change management process, including detailed planning, impact assessment, formal approval from multiple stakeholders, and scheduled implementation. This comprehensive approach is ideal for planned upgrades, new service deployments, or significant configuration changes where thorough risk analysis and coordination are paramount. However, the inherent delays introduced by this structured approval and scheduling cycle make it impractical and dangerously slow for deploying an urgent security patch.

Service request

Why wrong: A service request is a formal request from a user for a standard service or information, such as a password reset, access to a shared drive, or installation of approved software. It is a user-initiated transaction for existing services, not a procedure for implementing changes to the underlying IT infrastructure or addressing critical system vulnerabilities. Therefore, it is fundamentally the wrong category for deploying an urgent, company-wide security patch.

Install a privacy screen on each POS terminal.

Why wrong: Installing a privacy screen on a POS terminal is a visual security measure designed to prevent "shoulder surfing" or unauthorized viewing of sensitive information displayed on the screen. However, it offers no protection against physical tampering with the device itself. A privacy screen does not deter or detect attempts to open the terminal casing, access internal components, or connect unauthorized devices to its ports, which are common methods of physical compromise.

Require a smart card to power on the terminal.

Why wrong: Requiring a smart card to power on a POS terminal is a strong logical access control, ensuring that only authorized personnel can boot and operate the system. While it prevents unauthorized users from accessing the operating system or applications, it does not provide any physical security for the hardware itself. An attacker could still physically open the terminal, access internal components, or connect malicious devices to external ports without ever powering on the system or needing the smart card.

Enable a screensaver with a password.

Why wrong: Enabling a screensaver with a password is a logical security control intended to protect an active user session from unauthorized access when the terminal is left unattended. It locks the software interface, requiring re-authentication to resume work. However, this measure provides no physical protection for the POS hardware. It does not prevent an attacker from physically manipulating the device, accessing its ports, or opening the casing to install unauthorized hardware or modify internal components.

System File Checker (sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows)

Why wrong: System File Checker (SFC) is designed to scan for and restore corrupted Windows system files by comparing them against known good versions stored in the component store. While it can be run offline using the specified parameters, SFC lacks any malware detection capabilities, signature databases, or heuristic analysis engines required to identify and remove malicious software. Its function is strictly system file integrity, not antivirus protection.

Windows Memory Diagnostic

Why wrong: Windows Memory Diagnostic is a utility specifically engineered to test the physical Random Access Memory (RAM) modules for hardware defects or errors. It performs a series of intensive tests to identify issues that could lead to system crashes or data corruption. This tool is entirely focused on hardware diagnostics and possesses no functionality whatsoever for detecting, scanning for, or removing software-based threats like malware, rendering it irrelevant to a security incident.

Diskpart

Why wrong: Diskpart is a command-line utility used for managing disk partitions, volumes, and storage devices. Its primary functions include creating, deleting, formatting, and resizing partitions, as well as assigning drive letters and managing storage pools. While crucial for disk management tasks, Diskpart operates at a low level of disk organization and possesses no features for detecting, analyzing, or removing malicious software, making it unsuitable for addressing a security incident.