Question 1hardmultiple choice
Full question →Question 181 of 1,000
hardmultiple choiceObjective-mapped
220-1102 Practice Question: A security audit reveals that a legacy…
This 220-1102 practice question tests your understanding of a security audit reveals that a legacy…. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security audit reveals that a legacy application running on a Windows 10 workstation transmits sensitive data over an unencrypted protocol. The application is critical for business operations and cannot be updated or replaced. The workstation is located in a secured server room with restricted physical access. Which of the following would BEST mitigate the risk of data interception for this legacy application?
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Best answer
Implement an IPsec policy on the workstation to encrypt all network traffic.
IPsec provides end-to-end encryption at the network layer, securing all communications from the workstation regardless of application protocol. It can be enforced via Group Policy or local settings.
B
Distractor review
Install a VPN client on the workstation and connect to a corporate VPN server.
A VPN only encrypts traffic that goes through the VPN tunnel. If the legacy application uses a non-VPN route or the VPN disconnects, data could be exposed. Also, it may not encrypt local network traffic.
C
Distractor review
Change the application configuration to use HTTPS for communication.
The scenario explicitly states the application cannot be updated or replaced. Modifying its protocol is not an option.
D
Distractor review
Place the workstation on an isolated VLAN that has no access to external networks.
VLAN isolation can reduce the attack surface, but it does not encrypt the data still transmitted over the network. Data on the isolated VLAN could still be intercepted by an attacker with access to that VLAN.
Answer analysis
Why the other options are wrong
Understanding why incorrect options are tempting is as important as knowing the correct answer.
- ✗
Install a VPN client on the workstation and connect to a corporate VPN server.
A VPN only encrypts traffic that goes through the VPN tunnel. If the legacy application uses a non-VPN route or the VPN disconnects, data could be exposed. Also, it may not encrypt local network traffic.
- ✗
Change the application configuration to use HTTPS for communication.
The scenario explicitly states the application cannot be updated or replaced. Modifying its protocol is not an option.
- ✗
Place the workstation on an isolated VLAN that has no access to external networks.
VLAN isolation can reduce the attack surface, but it does not encrypt the data still transmitted over the network. Data on the isolated VLAN could still be intercepted by an attacker with access to that VLAN.
Common exam trap
Common exam trap: an active trunk can still block the VLAN you need
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Technical deep dive
How to think about this question
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
KKey Concepts to Remember
- Access ports place end devices into a single VLAN.
- Trunk ports carry multiple VLANs between switches.
- Allowed VLAN lists decide which VLANs can cross a trunk.
- Native VLAN mismatch can create confusing symptoms.
TExam Day Tips
- Use show vlan brief to verify access VLANs.
- Use show interfaces trunk to verify trunk state and allowed VLANs.
- Do not treat every same-VLAN issue as a routing problem.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Related practice questions
Related 220-1102 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
CompTIA A+ hardware practice questions
Practise 220-1102 questions linked to CompTIA A+ hardware.
CompTIA A+ mobile devices practice questions
Practise 220-1102 questions linked to CompTIA A+ mobile devices.
CompTIA A+ networking practice questions
Practise 220-1102 questions linked to CompTIA A+ networking.
CompTIA A+ operating systems practice questions
Practise 220-1102 questions linked to CompTIA A+ operating systems.
CompTIA A+ security practice questions
Practise 220-1102 questions linked to CompTIA A+ security.
CompTIA A+ software troubleshooting questions
Practise 220-1102 questions linked to CompTIA A+ software troubleshooting questions.
CompTIA A+ operational procedures questions
Practise 220-1102 questions linked to CompTIA A+ operational procedures questions.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician completes the update on a file server and verifies the server is functioning normally. According to change management best practices, what documentation should the technician complete?
Question 2
A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A technician discovers that a critical database server's operating system needs a security patch to comply with a new regulatory requirement that takes effect in one week. The patch has a known risk of causing service downtime. The next scheduled CAB meeting is in two weeks. What should the technician do FIRST?
Question 3
A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobile devices is protected. Which of the following is the MOST important technical control to implement?
Question 4
A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication principle is being implemented?
Question 5
A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 10 must be installed on these workstations?
Question 6
A company wants to allow employees to securely access internal resources from home via the internet. Which method provides the highest level of security for remote desktop connections?
Practice this exam
Start a free 220-1102 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 220-1102 question test?
Access ports place end devices into a single VLAN.
What is the correct answer to this question?
The correct answer is: Implement an IPsec policy on the workstation to encrypt all network traffic. — IPsec (Internet Protocol Security) can be configured on the workstation to encrypt all outbound traffic at the network layer, protecting data in transit without modifying the application. A VPN client may be an alternative but typically only encrypts traffic to the VPN gateway, not all network traffic, and may not be persistent. Placing the workstation on an isolated VLAN reduces exposure but does not encrypt the data. Modifying the application is not possible per the scenario.
What should I do if I get this 220-1102 question wrong?
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related 220-1102 questions on switching, trunking, and access-port configuration.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More 220-1102 practice questions
- A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
- A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
- A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
- A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
- A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
- A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Loading comments…
Sign in to join the discussion.
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.