220-1102 Practice Question: A technician is supporting a service-desk jump box

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Local Users and Groups

  Local user management does not directly address the stated issue.

• ✗

  Event Viewer

  Event Viewer is useful for logs, but this scenario requires a different primary tool or control.

• ✗

  System Restore

  System Restore is useful for reversing certain Windows changes but is not the best fit for this specific goal.

Technical deep dive

How to think about this question

When dealing with suspected malware, such as browser hijacking or other infections on a critical system like a service-desk jump box, the immediate and most critical step is to isolate the infected machine. A malware isolation procedure involves disconnecting the affected system from the network to prevent the malware from spreading to other systems or exfiltrating data. This is a foundational security practice that prioritizes containment over immediate remediation, as remediation efforts on a connected, infected machine could inadvertently allow the malware to cause further damage or spread. The jump box's role as a shared access point makes isolation even more critical to protect the broader network infrastructure and user accounts it might access. While other tools might be used in subsequent steps, isolation is the primary and most urgent response to contain the threat. Local Users and Groups is for managing user accounts and permissions, which has no direct bearing on an active malware infection. Event Viewer is a diagnostic tool for reviewing system logs, useful for post-incident analysis or identifying symptoms, but it doesn't actively mitigate a live threat. System Restore is a recovery option that reverts system files and registry settings to a previous state. While it *could* potentially remove some malware, it's not guaranteed to remove all types, especially rootkits or advanced persistent threats, and more importantly, it doesn't address the immediate need to prevent spread. Furthermore, performing a System Restore on a live, connected infected machine before isolation risks the malware interfering with the process or continuing to operate. Therefore, the malware isolation procedure is the best initial response to contain the threat.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…