Security

442 questions

Question 81Question

A security technician is preparing training materials to help staff recognize different security risks. Match each threat type on the left with its correct description on the right.

Click a left item, then click its matching right item

Items

Watering Hole Attack
Whaling
Dumpster Diving
Logic Bomb

Matches

Show answer & explanation

Answer

Watering Hole Attack matches compromising a frequently visited website. Whaling matches targeted phishing against high-profile executives. Dumpster Diving matches physically searching trash bins for sensitive documents. Logic Bomb matches dormant malicious code triggered by specified logical conditions.
Watering Hole Attack pairs with compromising a trusted website used by a target group. Whaling pairs with phishing aimed directly at high-level executives. Dumpster Diving pairs with looking through paper trash for confidential data. Logic Bomb pairs with malicious code designed to execute when specific criteria are met.

Step-by-Step Solution

1
Analyze the web-based attack targeting specific industry sites.
Watering Hole attack infects a third-party site frequented by employees of the target group.
Attackers exploit trust in a third-party site to compromise visitors automatically.
2
Identify the high-profile targeted social engineering email scam.
Whaling targets senior executives such as CEOs and CFOs.
Whaling is a specific category of spear phishing aimed exclusively at high-level leadership.
3
Identify the physical security threat vector.
Dumpster Diving involves looking through physical waste containers for sensitive documents.
Attackers search municipal trash for unredacted passwords, internal directories, or proprietary documents.
4
Identify the dormant condition-triggered malware.
Logic Bomb triggers malicious commands when specific events or dates occur.
Logic bombs lie dormant until predetermined parameters are met.

Key Concept

Social Engineering and Threat Vector Classification
Question 82Question

A desktop technician needs to increase the User Account Control (UAC) notification level on a Windows workstation to 'Always notify' using the classic interface. What is the correct sequence of steps to complete this configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with opening Control Panel and selecting User Accounts, followed by clicking Change User Account Control settings, moving the slider to 'Always notify' and clicking OK, and concluding by confirming the UAC prompt with Yes.
The correct order follows standard Windows management workflow: opening the User Accounts Control Panel applet, opening the UAC settings dialog, adjusting the slider to the highest security setting and clicking OK, and finally confirming the UAC prompt to apply the system policy change.

Step-by-Step Solution

1
Open Control Panel and choose User Accounts
Accesses the Windows user management applet containing account security settings
Control Panel serves as the central administrative hub for legacy account settings
2
Select Change User Account Control settings link
Launches the User Account Control Settings dialog
This link provides direct access to the UAC slider interface
3
Adjust the slider to 'Always notify' and click OK
Configures the desired security baseline level
Moving the slider alters the security threshold before saving
4
Accept the UAC elevation warning by clicking Yes
Applies the new UAC configuration to the operating system
Modifying UAC behavior is a system-wide administrative action that requires privilege elevation confirmation

Key Concept

Windows User Account Control (UAC) configuration steps
Estimated Time:1m 0s
Question 83Question

A tier 2 helpdesk technician receives multiple incident reports from accounting personnel stating that when navigating to an industry-specific news and regulatory updates website they visit daily, their web browsers display certificate warnings and attempt to redirect them to a fake single sign-on portal. Upon investigation, the technician confirms that internal corporate DNS server records and local workstation hosts files are unmodified and accurate. Further forensic analysis reveals that malicious code was injected directly into the external news site to target visitors originating from the company's public IP address range. Which of the following security threat types is demonstrated in this scenario?

Show answer & explanation

Answer: Watering hole attack

Answer

Watering hole attack
The correct answer identifies a watering hole attack. In this attack vector, adversaries compromise a third-party website known to be regularly visited by employees of a targeted organization. Because internal DNS and local host settings remain untouched, the malicious redirection originates directly from the compromised external site targeting visitors from specific corporate IP blocks.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario.
The target website is a legitimate, trusted external site frequently visited by the specific group of users (accounting department).
Threat actors strategically identify websites commonly trusted and frequented by their target organization.
2
Evaluate the technical findings and delivery mechanism.
DNS resolution and local host configurations are intact, proving the redirection originates from malicious code injected into the compromised third-party site targeting specific public IP addresses.
Watering hole attacks selectively serve malicious payloads or redirects based on the visitor's IP range or enterprise profile.
3
Identify the matching social engineering/threat classification.
Compromising a common trusted resource to ambush specific organization members matches the definition of a watering hole attack.
This strategy bypasses traditional perimeter defenses by exploiting trust in an external resource.

Key Concept

Watering Hole Attack Identification
Question 84Question

An IT support technician is reviewing user tickets regarding security concerns at a regional office. One ticket details an email sent specifically to the chief financial officer requesting an urgent transfer of funds to a fraudulent supplier account. Another ticket reports an unknown individual wearing high-visibility work attire who gained entry to the server room by carrying a heavy box and asking an employee to hold the secure door open. Which of the following social engineering attack types are demonstrated in these scenarios? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Whaling; Piggybacking

Answer

The correct social engineering attack types are Whaling and Piggybacking.
Whaling correctly identifies the high-level targeted email attack directed at an executive (CFO) to initiate unauthorized wire transfers. Piggybacking correctly identifies the physical security breach where an unauthorized individual convinces an employee to assist them by holding open a badge-restricted door.

Step-by-Step Solution

1
Analyze the first incident regarding the CFO receiving a targeted fund transfer request.
Identify that spear phishing targeted specifically at executive leadership (such as a CFO) is categorized as Whaling.
Whaling focuses exclusively on high-level personnel with significant administrative or financial authority.
2
Analyze the second incident regarding an unknown individual gaining entry to a physical secure room.
Identify that entering a secure location by asking an authorized user to hold open the door with their consent/assistance is Piggybacking.
Unlike tailgating (where the attacker follows unnoticed), piggybacking involves tricking an authorized employee into intentionally holding the door open due to social courtesy.

Key Concept

Identifying Social Engineering Threat Types and Physical Access Vectors
Question 85Question

An IT infrastructure team is designing physical security measures for a sensitive server room inside a corporate headquarters. The design must specifically prevent unauthorized individuals from tailgating authorized staff into the room and prevent electromagnetic signals from leaking outside the facility to mitigate physical signal eavesdropping. Which of the following physical security controls should be implemented to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Access control vestibule; Faraday cage enclosure

Answer

The correct physical security controls are an access control vestibule and a Faraday cage enclosure.
An access control vestibule features a dual-door interlocking mechanism that prevents more than one person from entering simultaneously, effectively stopping tailgating. A Faraday cage enclosure provides electromagnetic shielding to contain electronic emissions and block RF signals from being intercepted outside the facility.

Step-by-Step Solution

1
Analyze the tailgating requirement
Tailgating occurs when an unauthorized person follows an authorized person through a secure doorway. An access control vestibule (mantrap) enforces interlocked entry, allowing only one person through at a time.
Single-person interlocked access controls directly eliminate piggybacking and tailgating threats.
2
Analyze the electromagnetic emissions leakage requirement
Faraday cages (or Faraday shielding) consist of conductive mesh or enclosures that shield equipment from emitting or receiving external radio frequency (RF) signals.
Shielding electromagnetic emissions prevents eavesdropping on wireless signals or unintentional RF radiation.

Key Concept

Physical Security Controls
Question 86Question

A system administrator at a software development firm receives reports that remote employees received branded promotional USB flash drives in the mail labeled 'Q3 Firmware Update'. Simultaneously, physical security audit logs show an unauthorized individual entered the facility by presenting a fake service contractor badge and bringing coffee for the reception staff. Which of the following social engineering threat types are demonstrated in these scenarios? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Baiting; Impersonation

Answer

The threat vectors demonstrated are baiting (sending physical media lures to entice users) and impersonation (assuming a false identity to bypass security controls).
Baiting involves providing a physical medium (such as malicious USB flash drives disguised as updates) to trick victims into plugging it into their computers. Impersonation involves fraudulently creating a false identity (such as a fake contractor badge) to trick personnel into granting physical access.

Step-by-Step Solution

1
Analyze the mailed USB flash drive incident.
Recognize that sending physical hardware with enticing labels leverages curiosity to compromise systems, which defines baiting.
Baiting uses physical lures to trick users into executing malicious code.
2
Analyze the unauthorized facility access incident.
Recognize that using a fake contractor badge and bringing gifts to gain trust constitutes pretending to be an authorized entity.
Impersonation relies on assuming a fake persona to bypass physical access controls.

Key Concept

Identifying Social Engineering Vectors and Threat Types
Question 87Question

An IT technician is setting up a wireless network for a branch office. To prevent unauthorized devices from connecting, the technician configures the access point to require a shared passphrase that all staff members enter on their devices to gain access. Which of the following wireless security modes is being implemented?

Show answer & explanation

Answer: WPA2-Personal

Answer

WPA2-Personal is the wireless security mode that uses a pre-shared key (PSK) or shared passphrase for authenticating all connecting devices.
WPA2-Personal (Pre-Shared Key mode) is designed for small office or home environments where all devices connect using the same shared passphrase configured on the wireless access point.

Step-by-Step Solution

1
Identify the authentication requirement in the scenario.
The requirement specifies a single shared password/passphrase entered by all users on the network.
Determining whether authentication is shared or individual distinguishes SOHO/Personal modes from Enterprise modes.
2
Match the requirement to the corresponding wireless security mode.
WPA2-Personal (PSK mode) uses a static pre-shared key for authentication across all devices.
Enterprise solutions rely on individual user credentials verified by a backend server rather than a single shared passphrase.

Key Concept

Wireless Authentication Modes (Personal/PSK vs Enterprise/802.1X)
Estimated Time:45s
Question 88Question

A security engineer is configuring an 802.1X wireless infrastructure for a company's mobile workforce. Organization policy mandates strong server authentication and encrypted credential transmission, but explicitly prohibits deploying client-side digital certificates onto user devices to minimize administrative overhead. Employees must authenticate using their existing domain password credentials. Which authentication protocol best satisfies all of these criteria?

Show answer & explanation

Answer: EAP-TTLS

Answer

EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security) is the correct protocol because it requires a digital certificate only on the authentication server while tunneling password authentication for clients.
EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security) sets up a secure, encrypted TLS tunnel using a certificate installed on the authentication (RADIUS) server. Clients can then authenticate within this encrypted tunnel using standard domain passwords (e.g., via MS-CHAPv2 or PAP), eliminating the administrative burden of issuing and managing client-side digital certificates.

Step-by-Step Solution

1
Analyze the authentication requirements
Identified the need for 802.1X individual domain user authentication, server verification, and no client-side digital certificates.
Administrative constraints explicitly restrict deploying client certificates across mobile endpoints.
2
Compare 802.1X EAP authentication types
EAP-TLS requires certificates on both server and client. EAP-TTLS (and PEAP) requires a certificate only on the RADIUS server to create an encrypted TLS tunnel.
EAP-TTLS allows client credentials (such as MS-CHAPv2 or PAP) to be safely passed inside the server-authenticated TLS tunnel.
3
Select the compliant protocol option
EAP-TTLS matches all security and operational criteria without introducing client certificate management overhead.
It fulfills the requirement for secure domain credential transmission without violating the client certificate restriction.

Key Concept

Distinction between EAP-TLS (requires client and server certificates) and tunneled EAP methods like EAP-TTLS (requires server certificate only).
Question 89Question

A systems administrator needs to restrict administrative elevation behavior on a standalone Windows 11 Pro workstation so that administrators are required to enter credentials on a secure desktop whenever a program requests elevated privileges. What is the correct sequence of steps to configure this policy using the Local Security Policy snap-in?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with launching the snap-in via secpol.msc, navigating to Local Policies -> Security Options, opening the policy 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode', and selecting 'Prompt for credentials on the secure desktop'.
To modify detailed UAC prompt requirements for administrator accounts on Windows Pro, a technician must open the Local Security Policy console using secpol.msc, navigate through Local Policies to Security Options, edit 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode', and select 'Prompt for credentials on the secure desktop'.

Step-by-Step Solution

1
Launch the MMC Management Snap-in
The Local Security Policy window opens.
Administrative security policies for standalone Windows workstations are managed through secpol.msc.
2
Navigate to the Security Options Policy Node
The right panel populates with granular UAC and account security policies.
UAC security settings are located under Local Policies -> Security Options.
3
Open the Administrative Elevation Behavior Policy
The policy properties dialog box opens.
This specific policy targets administrator elevation prompts specifically.
4
Configure the Security Setting and Apply
The policy is updated to require credentials on the secure desktop.
Configuring 'Prompt for credentials on the secure desktop' ensures credentials must be entered explicitly when privilege escalation occurs.

Key Concept

Configuring User Account Control (UAC) administrative prompt behavior via Windows Local Security Policy (secpol.msc)
Question 90Question

A desktop technician is configuring User Account Control (UAC) settings on a Windows workstation for a user whose display driver glitches whenever the screen dims during privilege elevation prompts. The technician needs to ensure the user is still alerted when programs attempt to make system changes, but without triggering the Secure Desktop dimming effect. Which UAC notification setting should the technician select?

Show answer & explanation

Answer: Notify me only when apps try to make changes to my computer (do not dim my desktop)

Answer

The setting 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' fulfills the requirement by displaying UAC prompts without switching to the Secure Desktop.
Selecting 'Notify me only when apps try to make changes to my computer (do not dim my desktop)' allows UAC notifications to remain active while disabling Secure Desktop integration, which prevents the screen from dimming during elevation requests.

Step-by-Step Solution

1
Identify the core issue in the scenario.
The screen dimming effect caused by Secure Desktop creates display glitches during UAC prompts.
Secure Desktop isolates the UAC dialog by creating a protected desktop mode that dims background graphics.
2
Evaluate Windows UAC slider levels.
The second option from the top ('Notify me only when apps try to make changes to my computer (do not dim my desktop)') turns off Secure Desktop dimming while retaining prompt alerts.
This allows standard user account elevation prompts to appear over the standard active desktop.

Key Concept

User Account Control (UAC) notification levels and Secure Desktop configuration
Question 91Question

A systems administrator is configuring a workstation in a high-traffic customer service area. The administrator must prevent unauthorized bystanders standing at side angles from viewing sensitive personal data displayed on the screen. Which of the following physical security controls is best suited for this requirement?

Show answer & explanation

Answer: Privacy filter

Answer

Installing a privacy filter narrows the display viewing angle so only the person directly in front of the screen can read the contents.
A privacy filter attaches directly to a monitor to restrict side-angle viewing, making the screen appear dark or blurred to individuals standing to the side while keeping it legible for the primary user.

Step-by-Step Solution

1
Identify the primary physical threat presented in the scenario.
The threat is shoulder surfing or visual observation of sensitive display information from unauthorized angles by nearby individuals.
The workstation is located in a high-traffic customer service area where visitors frequently walk past.
2
Evaluate physical security controls designed specifically for display security.
A privacy filter limits light transmission to narrow viewing angles, darkening the screen content when viewed from the side.
This mitigates visual eavesdropping while allowing the user facing the screen directly to work normally.

Key Concept

Physical Security Controls - Privacy Filters
Question 92Question

A technician is upgrading a wireless access point in a small office to enhance authentication security and migrate away from legacy pre-shared keys. The technician selects WPA3-Personal mode. Which of the following features and requirements are introduced by WPA3-Personal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Mandatory requirement for Protected Management Frames (PMF); Simultaneous Authentication of Equals (SAE) key exchange

Answer

The correct responses are the mandatory requirement for Protected Management Frames (PMF) and the use of Simultaneous Authentication of Equals (SAE) key exchange.
WPA3-Personal improves SOHO wireless security by replacing WPA2 Pre-Shared Key (PSK) with Simultaneous Authentication of Equals (SAE) (Dragonfly handshake) to resist offline dictionary attacks. Additionally, WPA3 strictly mandates Protected Management Frames (PMF) to shield management traffic from interception and spoofed disconnect commands.

Step-by-Step Solution

1
Identify the authentication and key exchange enhancement in WPA3-Personal.
WPA3-Personal replaces standard Pre-Shared Key (PSK) passphrase exchanges with Simultaneous Authentication of Equals (SAE), preventing brute-force and offline dictionary attacks.
SAE provides resistant key exchange even when passwords are simple.
2
Identify mandatory security features required by the WPA3 specification.
Protected Management Frames (PMF) are compulsory in WPA3 networks.
PMF prevents spoofed deauthentication frames and eavesdropping on wireless management messaging.

Key Concept

WPA3-Personal Security Enhancements (SAE and PMF)
Estimated Time:1m 0s
Question 93Question

A receptionist at a legal firm receives a phone call from an individual claiming to be a third-party IT compliance auditor. The caller states that an urgent system audit requires immediate verification of workstation access and asks the receptionist to read aloud the one-time passcode displayed on their authentication application. Which of the following social engineering threat types is being attempted?

Show answer & explanation

Answer: Voice phishing (Vishing)

Answer

Voice phishing (Vishing)
The correct answer identifies voice phishing (vishing), which occurs when an attacker uses phone calls and social engineering tactics to manipulate victims into revealing confidential information such as login credentials or authentication codes.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario
The attack occurs entirely over an interactive voice phone call.
Identifying the medium of communication is key to distinguishing social engineering threat types.
2
Evaluate the attacker's objective and tactic
The attacker impersonates an auditor over the phone to coax multi-factor authentication passcodes from the user.
Impersonation over voice calls to steal credentials specifically defines vishing (voice phishing).

Key Concept

Vishing (Voice Phishing)
Question 94Question

During a security incident investigation at a healthcare facility, a systems administrator reviews badge logs and phone records following an unauthorized network intrusion. The report identifies two related occurrences:

1. An unauthorized individual entered a restricted server room by closely following behind a credentialed facility engineer who had swiped an access card to unlock the door.
2. Shortly after physical access was gained, several department managers received urgent telephone calls from an attacker posing as the Chief Information Officer (CIO). The caller created a fake emergency scenario regarding a network outage and persuaded the managers to dictate their active multi-factor authentication (MFA) verification codes over the call.

Which of the following social engineering threat vectors and physical security violations occurred during this incident? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Tailgating, by closely following an authorized employee into a secured physical area without presenting proper authentication; Vishing, by using phone communications and impersonation to trick victims into revealing sensitive authentication codes

Answer

The threat vectors executed during the security incident are tailgating and vishing.
Tailgating is demonstrated when the unauthorized actor gains physical server room entry by following closely behind a credentialed engineer without swiping their own badge. Vishing is demonstrated when the attacker utilizes interactive phone calls, impersonation (pretexting as the CIO), and an urgent scenario to solicit sensitive MFA codes from staff.

Step-by-Step Solution

1
Analyze the physical access portion of the scenario.
The intruder gained entry to a restricted area by following behind an authorized engineer holding open a door without authenticating independently.
This physical access breach method is explicitly defined as tailgating (or piggybacking).
2
Analyze the digital/social interaction portion of the scenario.
The attacker placed phone calls while impersonating an executive to convince managers to disclose MFA codes verbally.
Social engineering conducted over telephone calls is classified as vishing (voice phishing).

Key Concept

Social Engineering Attacks and Physical Entry Exploitation
Estimated Time:2m 0s
Question 95Question

A helpdesk technician is preparing end-user security awareness training materials covering non-technical threat vectors. Which TWO of the following security threats rely primarily on physical actions or physical access rather than digital network communication? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Tailgating into a restricted corporate facility by following an authorized employee; Dumpster diving to recover confidential papers from disposal bins

Answer

Tailgating into a restricted corporate facility by following an authorized employee and Dumpster diving to recover confidential papers from disposal bins are physical social engineering threats.
Tailgating and dumpster diving both require physical presence and direct real-world interaction—either following personnel through physical security barriers or searching through physical waste receptacles.

Step-by-Step Solution

1
Analyze each option to determine if it requires physical proximity/access or electronic/digital communications.
Tailgating requires walking through physical doors; dumpster diving requires physical handling of waste receptacles.
Both methods exploit physical security boundaries rather than digital computing systems.
2
Evaluate the remaining choices to identify digital attack vectors.
Spear phishing (email), vishing (phone calls), and watering hole attacks (compromised websites) all operate over digital or telecommunication channels.
These threat types target network protocols and end-user digital interactions.

Key Concept

Physical Social Engineering Threat Vectors
Question 96Question

A network technician is deploying a secure wireless network for a company's financial department. Organization security policy mandates individual user authentication using centralized domain accounts and high-strength data encryption. Which TWO of the following security protocols or standards should the technician implement to fulfill these security requirements?

Select all that apply

Show answer & explanation

Answer: WPA3-Enterprise operation mode; RADIUS authentication server supporting 802.1X

Answer

The technician should implement WPA3-Enterprise operation mode and a RADIUS authentication server supporting 802.1X.
Implementing WPA3-Enterprise and an 802.1X RADIUS server satisfies the requirements for strong encryption and centralized individual user authentication against domain accounts.

Step-by-Step Solution

1
Analyze the requirement for centralized, individual user authentication using domain credentials.
Identify that the 802.1X framework connected to a RADIUS server integrated with directory services (such as Active Directory) is required.
Personal modes (PSK) utilize a single shared static key and cannot validate distinct user credentials.
2
Analyze the requirement for strong enterprise wireless security and encryption.
Select WPA3-Enterprise mode to enforce 802.1X authentication and modern cryptographic suites.
WPA3-Enterprise ensures compliance with modern security mandates while TKIP and PSK modes introduce security risks and lack individual accounting.

Key Concept

WPA Enterprise vs. Personal modes and 802.1X RADIUS authentication
Estimated Time:1m 30s
Question 97Question

A tier 1 helpdesk technician receives an urgent telephone call from an individual claiming to be an executive assistant from corporate headquarters. The caller explains that their supervisor is currently presenting at an off-site conference and urgently needs their multi-factor authentication (MFA) token reset to access financial reports. To establish trust, the caller references internal project codenames and recent organizational changes, leveraging high pressure to convince the technician to bypass standard identity verification protocols. Which of the following social engineering threat types is being executed in this scenario?

Show answer & explanation

Answer: Pretexting

Answer

Pretexting is the correct social engineering attack vector because the attacker invented a scenario and persona to trick the technician into granting unauthorized access.
Pretexting occurs when an attacker constructs a fabricated story and impersonates a person in authority (such as an executive assistant) to build trust and persuade the target to violate standard security protocols. The presence of a detailed backstory, voice communication, and insistence on bypassing identity verification are classic indicators of a pretexting attack.

Step-by-Step Solution

1
Analyze the communication channel and attack method in the scenario.
The attack occurs via a voice phone call where an attacker uses a detailed fake identity and backstory.
Identifying the medium (voice phone call) and technique (crafted scenario) isolates the social engineering category.
2
Evaluate the specific tactics used (building trust with insider information, pressuring the technician to bypass procedures).
The attacker established a elaborate backstory (pretext) to convince the technician that bypassing verification was justified.
Pretexting specifically involves inventing a plausible scenario and fake authority role to manipulate victims into unauthorized actions.
3
Differentiate pretexting from digital or physical threat vectors like spear phishing, tailgating, and pharming.
Spear phishing relies on email, tailgating is physical entry, and pharming relies on DNS/traffic redirection.
Eliminating non-matching vectors confirms pretexting as the accurate classification.

Key Concept

Pretexting and Social Engineering Indicators
Question 98Question

An IT technician is explaining User Account Control (UAC) behavior in Windows 11 to a newly hired helpdesk intern. Which TWO of the following actions performed while logged in as a standard user account will require entering administrator credentials at a UAC prompt? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modifying security settings within the Local Security Policy snap-in (secpol.msc); Installing a system-wide hardware device driver

Answer

The actions requiring administrator credentials at a UAC prompt are modifying security settings within the Local Security Policy snap-in (secpol.msc) and installing a system-wide hardware device driver.
User Account Control (UAC) safeguards Windows by requiring standard users to supply administrator credentials whenever an operation attempts system-wide changes. Modifying settings in Local Security Policy (secpol.msc) and installing system hardware drivers both alter system configurations and protected core operating system files, which triggers a UAC elevation prompt.

Step-by-Step Solution

1
Identify which user actions affect system-wide settings or protected core system files.
Changing policies via secpol.msc and installing system drivers affect global security and system files.
Windows protects global system configurations from standard user modification by requiring UAC administrative elevation.
2
Evaluate standard user rights regarding local profile files and read-only system utilities.
Managing NTFS permissions on user-owned documents and viewing hardware specs in Settings do not modify system-level protection.
Standard user accounts already possess sufficient rights for personal files and read-only system checks, so UAC does not trigger.

Key Concept

User Account Control Credential Triggers for Standard Users
Question 99Question

An IT administrator is configuring Windows 11 Pro workstations located in a computer lab to prevent standard user accounts from generating credential prompts or asking for administrative credentials when running setup programs. The objective is to automatically reject elevation requests from standard users without user intervention. Which User Account Control (UAC) security option in Local Security Policy should be configured to meet this requirement?

Show answer & explanation

Answer: User Account Control: Behavior of the elevation prompt for standard users set to Automatically deny elevation requests

Answer

Configure 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' in Local Security Policy (secpol.msc).
Setting 'User Account Control: Behavior of the elevation prompt for standard users' to 'Automatically deny elevation requests' prevents Windows from displaying an administrative credential prompt to non-admin users, immediately returning an access denied message whenever privilege elevation is requested.

Step-by-Step Solution

1
Identify the goal of suppressing credential prompts for standard users.
Recognize that standard users should be automatically denied privilege elevation rather than prompting for administrator credentials.
By default, UAC prompts standard users for an administrator password (Prompt for credentials).
2
Locate the relevant security policy setting under Security Options in secpol.msc.
Identify 'User Account Control: Behavior of the elevation prompt for standard users'.
This specific policy explicitly controls how UAC responds when a standard user account attempts an action requiring administrative privileges.
3
Select the policy value that automatically rejects requests.
Set the value to 'Automatically deny elevation requests'.
This setting directly blocks elevation attempts without presenting a credential entry window to the standard user.

Key Concept

User Account Control (UAC) Local Security Policy Settings
Estimated Time:1m 15s
Question 100Question

A helpdesk technician is reviewing a security ticket submitted by a finance manager. The manager received a text message on her mobile phone appearing to come from the company's banking vendor, warning that the organization's payroll account would be locked within 30 minutes due to unverified compliance documentation. The message contained a hyperlink prompting her to log in immediately. Which of the following social engineering attack vectors describes this initial contact method?

Show answer & explanation

Answer: Smishing

Answer

The correct attack vector is smishing, as it specifically utilizes SMS text messaging on mobile devices to deliver deceptive phishing links.
Smishing refers specifically to phishing attacks conducted over Short Message Service (SMS) text messages. The scenario describes an urgent text message sent to a cellular device containing a fraudulent link designed to harvest banking credentials.

Step-by-Step Solution

1
Analyze the delivery medium described in the scenario.
The initial contact occurred via a text message sent to a mobile phone.
Identifying the transmission channel is necessary to distinguish between social engineering classifications.
2
Evaluate threat classification terminology based on delivery medium.
Phishing over Short Message Service (SMS) is classified as smishing.
Standard security taxonomy distinguishes SMS-based attacks (smishing) from voice-based (vishing) and email-based (phishing/spear phishing) attacks.

Key Concept

Social Engineering Delivery Vectors (Smishing vs. Vishing vs. Phishing)
PreviousPage 5 / 23Next