Operating Systems practice questions

Continue upgrading the remaining workstations since the change was approved.

Why wrong: Continuing despite a known failure would multiply the impact and violate the change management principle of risk assessment.

Restore the first workstation to the previous OS and complete the rest without changes.

Why wrong: Restoring without documenting the issue ignores the need for root cause analysis and proper change control.

Research a hotfix for the application and apply it to all workstations.

Why wrong: Applying a hotfix without CAB approval bypasses change management and could introduce new issues.

Disable two-factor authentication for the user's account temporarily.

Why wrong: Disabling 2FA reduces security and should only be done as a last resort; temporary codes are designed for this exact situation.

Instruct the user to reset their password and try again.

Why wrong: Resetting the password does not bypass the 2FA prompt; the user still needs a code.

Ask the user to connect from a different network location.

Why wrong: The network location is irrelevant; the 2FA prompt is based on the user account, not the IP address.

Use a combination lock

Why wrong: Combinations can be shared or forgotten, and if compromised, must be changed and re-communicated to all users.

Install a smart card system

Why wrong: Smart cards can be lost, requiring deactivation and reissuance, which does not meet the requirement.

Use a keypad with a PIN code

Why wrong: PINs can be forgotten or shared, and if compromised, must be reset, which is similar to key management issues.

Perform a clean installation of Windows.

Why wrong: Reinstalling Windows is a last resort; a boot-time scan should be attempted first.

Disable System Restore and run the antivirus again.

Why wrong: Disabling System Restore helps but does not address rootkit persistence.

Run the antivirus in Safe Mode.

Why wrong: Some rootkits can still load in Safe Mode; a rescue disk is more reliable.

Phishing

Why wrong: Phishing typically uses email or text messages, not a direct phone call. The attack vector here was a voice call, making vishing the more precise term.

Smishing

Why wrong: Smishing uses SMS text messages, not phone calls. The attack here was initiated via a phone call, not a text.

Shoulder surfing

Why wrong: Shoulder surfing involves looking over someone's shoulder to obtain information, such as passwords. This scenario involves a phone call and remote access, not direct observation.

Windows System Image Manager (Windows SIM)

Why wrong: Windows SIM is used to create and modify answer files (unattend.xml), but it does not perform the actual deployment; it is a tool to prepare for deployment.

Microsoft Deployment Toolkit (MDT)

Why wrong: MDT can also automate deployments, but it is a more comprehensive tool that often integrates with WDS; for a simple automated deployment with domain join, WDS alone is sufficient and more direct.

Sysprep

Why wrong: Sysprep is used to generalize a Windows installation for imaging, but it does not handle the deployment or automation of computer names and domain join; it prepares the image for use with deployment tools.

Install a biometric fingerprint scanner on the door.

Why wrong: Biometric scanners are generally more expensive and complex to manage than key fobs, making them less suitable for a limited budget.

Implement a strong password policy for all user accounts.

Why wrong: Password policies are for digital access, not physical door entry. They do not control who can physically enter the server room.

Hire a security guard to check IDs at the entrance.

Why wrong: A security guard is a physical security control and is typically more expensive over time than an electronic access system, not a logical control.

File-level encryption using EFS

Why wrong: EFS encrypts individual files but can leave system files and metadata exposed, offering less comprehensive protection than FDE.

TPM chip only

Why wrong: A TPM chip stores encryption keys but does not encrypt data by itself; it must be used with FDE software.

Secure Boot

Why wrong: Secure Boot ensures only trusted OS components load but does not encrypt stored data.

Reply to the email asking for more details to confirm the request.

Why wrong: Replying to the attacker confirms the email address is valid and may lead to further social engineering. Verification should be done through a separate channel.

Provide the list as requested, since the CEO has authority.

Why wrong: Sharing passwords is never acceptable, even from a legitimate source. This would be a massive security breach.

Call the CEO immediately to verify the request.

Why wrong: While verification is good, the technician should not take any action that could compromise security without first consulting the security team. Forwarding to security is the priority.

Require all users to change passwords every 30 days.

Why wrong: Frequent password changes do not prevent pass-the-hash; attackers can still capture and reuse hashes within the validity period.

Implement network segmentation and firewall rules.

Why wrong: Segmentation limits lateral movement but does not prevent the hash from being captured and reused on accessible systems.

Disable NTLM authentication entirely.

Why wrong: Disabling NTLM may break legacy applications and does not protect against pass-the-hash using Kerberos tickets or other methods.

Pay the ransom to get the decryption key

Why wrong: Paying does not guarantee decryption and supports criminal activity; it is not recommended.

Reboot into Safe Mode and run a malware scan

Why wrong: While scanning may remove the ransomware, it will not decrypt already-encrypted files; backup restoration is needed.

Run System Restore to a point before the attack

Why wrong: System Restore may not recover encrypted user files and could be ineffective if the ransomware has disabled it.

Deploy the application to all laptops and disable the VPN client on each.

Why wrong: Disabling the VPN client without approval could disrupt business operations and violates the change management process.

Continue with the deployment and note the conflict in the change log.

Why wrong: Continuing deployment without resolving the conflict risks widespread issues and bypasses the pilot’s purpose.

Uninstall the VPN client from all laptops and reinstall after the deployment.

Why wrong: Uninstalling the VPN client without a change request is unauthorized and could cause connectivity loss for users.

Ignore the missing setting since the SOP was followed.

Why wrong: Ignoring a critical security setting leaves the server vulnerable and is not acceptable, even if the SOP was followed.

Submit a change request to update the SOP without applying the setting.

Why wrong: Submitting a change request without fixing the current server leaves it exposed; the setting should be applied immediately.

Revert the server configuration and wait for an updated SOP.

Why wrong: Reverting the configuration is unnecessary and delays the server deployment; the technician can apply the setting and update the SOP concurrently.

Run a full antivirus scan on the affected workstation.

Why wrong: Running a scan without isolating the system first could allow the ransomware to continue encrypting files and communicating with its command server.

Back up all files to an external drive before taking action.

Why wrong: Backing up during an active ransomware infection could result in backing up encrypted files, and the ransomware may also infect the external drive.

Restart the computer and boot into Safe Mode.

Why wrong: While Safe Mode is useful later, the first step must be to disconnect from the network to prevent further spread.

The SSD is formatted as NTFS

Why wrong: While macOS cannot boot from NTFS, the installer would not show the prohibitory symbol; it would show a folder with a question mark.

The user’s home folder is corrupted

Why wrong: Home folder corruption affects user login, not the kernel boot process.

The Mac’s NVRAM needs resetting

Why wrong: NVRAM reset can fix some boot issues, but the prohibitory symbol usually indicates a deeper hardware or driver problem.

Type 1 hypervisor

Why wrong: Type 1 hypervisors provide strong isolation but often require additional configuration for USB passthrough, and they are typically used for server virtualization, not for a client needing easy USB access.

Container-based virtualization

Why wrong: Containers share the host OS kernel and do not provide the same level of isolation as a VM, and USB passthrough is not a standard feature.

Desktop virtualization (VDI)

Why wrong: VDI provides remote desktops but does not directly address the need for USB passthrough to a local VM on the technician's machine.

Run a system restore to a point before the infection.

Why wrong: System restore may not remove rootkits as they can persist in the MBR or system files.

Use an antivirus boot disk to scan and remove the rootkit.

Why wrong: Boot disks can sometimes detect rootkits, but removal is not guaranteed due to deep integration.

Delete the rootkit's files manually in Safe Mode.

Why wrong: Rootkits hide their files and processes, making manual deletion nearly impossible.

Set a strong BIOS password

Why wrong: A BIOS password prevents booting but the drive can still be removed and read in another machine.

Install an antivirus with anti-theft features

Why wrong: Antivirus software does not encrypt the drive; it may have tracking features but does not protect data if the drive is removed.

Use a cloud backup service

Why wrong: Cloud backup ensures data recovery but does not prevent access to data on the stolen drive.

Run a full antivirus scan in normal mode.

Why wrong: Fileless malware often evades traditional signature-based scans because it does not write files to disk; scanning in normal mode may miss it.

Use the Windows Malicious Software Removal Tool (MSRT) in Safe Mode.

Why wrong: MSRT is a basic tool that may not detect advanced fileless threats; it also runs within Windows, where the malware can hide.

Restore the system from a backup taken before the infection.

Why wrong: Restoring from backup may reintroduce the malware if the backup is infected, and it does not address the root cause of the infection.

RDP

Why wrong: RDP is a Windows protocol and is not natively available on Linux without additional software like xrdp.

VNC

Why wrong: VNC can be encrypted with SSH tunneling, but by itself it is not encrypted and is less secure.

Telnet

Why wrong: Telnet is unencrypted and insecure, making it unsuitable for secure remote access.