hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A company policy requires that all web traffic…
A company policy requires that all web traffic from employee computers be filtered to block known malicious sites. You need to implement this without installing client software on each machine. Which approach should you use?
⚠ Common exam trap
The 220-1202 exam often tests the distinction between client-side and network-level security controls, and the trap here is assuming that proxy settings or browser extensions are acceptable when the question explicitly prohibits installing client software.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a DNS-based content filtering service on the network's DNS server.
DNS-based content filtering operates at the network level, blocking resolution of domains known to host malicious content. This approach requires no client software, as all DNS queries from employee computers are intercepted and filtered by the network's DNS server, enforcing the policy transparently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure each browser's proxy settings to use a filtering proxy server.
Why it's wrong here
Configuring each browser’s proxy settings requires per-machine configuration and does not enforce filtering for all applications, only for browsers that honour system proxy settings; the policy demands filtering all web traffic without client software, but proxy settings are a client-side change that can be bypassed by other applications or browsers ignoring the proxy. This approach is tempting because a filtering proxy server can block malicious sites effectively when every device is forced to use it via a central gateway, which would be correct if the company could deploy a proxy auto-configuration script or enforce proxy settings through Group Policy.
- ✗
Enable Windows Defender SmartScreen on each computer via Group Policy.
Why it's wrong here
Windows Defender SmartScreen is a client-side protection feature integrated into the operating system and Microsoft browsers, analyzing websites and downloads locally on each machine. While Group Policy can centrally enable or configure SmartScreen settings across an organization, its enforcement mechanism remains client-based. This means the actual filtering and blocking decisions occur on individual endpoints, not at a central network choke point, and it primarily protects browser activity and file downloads, not necessarily all web traffic from every application.
- ✓
Implement a DNS-based content filtering service on the network's DNS server.
Why this is correct
A DNS-based content filtering service intercepts and evaluates all DNS queries originating from devices on the network at the DNS server level. If a query attempts to resolve a domain categorized as malicious or undesirable, the DNS server can block the resolution or redirect it to a safe page, effectively preventing access to the site. This method operates transparently at the network infrastructure layer, requiring no client-side software installation or configuration on individual user devices to enforce its policies across all web traffic.
- ✗
Install a third-party browser extension on all browsers to block malicious sites.
Why it's wrong here
Installing a third-party browser extension on each browser directly violates the requirement of implementing a solution "without installing client software," as extensions are client-side software components that must be deployed and managed on each endpoint. Furthermore, browser extensions only provide protection within the specific browser they are installed on, leaving other applications that generate web traffic (e.g., email clients, standalone applications) completely unprotected and failing to address "all web traffic" comprehensively.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.