easyMultiple ChoiceObjective-mapped
220-1102 Practice Question: A company policy requires that all USB flash…
A company policy requires that all USB flash drives be automatically scanned for malware when inserted. Which Windows security setting should be configured to enforce this?
⚠ Common exam trap
Many candidates confuse encryption (BitLocker To Go) with malware scanning, or assume that network firewalls or UAC can protect against threats introduced via removable media, when only real-time antimalware scanning directly addresses the policy requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Windows Defender Real-time Protection
Windows Defender Real-time Protection (now part of Microsoft Defender Antivirus) automatically scans removable media, including USB flash drives, for malware upon insertion. This setting enforces the company policy by ensuring that any file accessed or executed from the drive is checked against known threat signatures in real time, without requiring manual scans.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Windows Defender Real-time Protection
Why this is correct
Windows Defender Real-time Protection actively monitors file system activity, including the insertion of removable media like USB flash drives. Upon detection of a new drive or file access, it automatically scans for known malware signatures and suspicious behaviors using heuristic analysis. This immediate scanning capability is crucial for preventing the introduction of malicious software from external sources into the company's systems, directly addressing the policy requirement.
- ✗
Configure BitLocker To Go
Why it's wrong here
BitLocker To Go is a data encryption feature designed to protect the confidentiality of information stored on removable drives by encrypting their contents. While it secures data against unauthorized access if the drive is lost or stolen, it does not perform any malware detection or scanning functions. Therefore, configuring BitLocker To Go fails to address the policy requirement of scanning USB drives for potential threats.
- ✗
Enable Windows Firewall
Why it's wrong here
The Windows Firewall operates primarily at the network layer, controlling inbound and outbound network traffic based on predefined rules. Its function is to prevent unauthorized network connections and protect against network-based attacks, not to inspect or scan local storage devices for malware. Consequently, enabling the firewall would not fulfill a policy requiring the scanning of USB flash drives for malicious content upon insertion.
- ✗
Set User Account Control to Always Notify
Why it's wrong here
User Account Control (UAC) is a security feature that helps prevent unauthorized changes to the operating system by requiring administrative consent for actions that could affect system security. Setting UAC to 'Always Notify' prompts the user for permission before administrative tasks are performed, but it does not initiate or manage antivirus scans of removable media. UAC's role is distinct from active threat detection on local storage devices.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Universal Serial Bus
A Universal Serial Bus (USB) is a standard interface that allows you to connect devices like keyboards, mice, storage drives, and printers to a computer for data transfer and power delivery.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.