Mod 16 Security Strategies

A coworker asks your opinion about how to minimize ActiveX attacks while they browse the Internet using Internet Explorer. The coworker recalls there is a setting in the Internet Options dialog box to prompt the user before downloading ActiveX controls but can't remember which tab to use. What tab would suggest the coworker look in for the ActiveX controls?

• Security tab

• Privacy tab

• General tab

• Programs tab

Answer explanation

The Security tab in Internet Options is where you can manage ActiveX controls. It allows you to set permissions and prompt users before downloading these controls, helping to minimize ActiveX attacks.

You need to secure your Windows 7 computer in a way that prevents access to the entire HDD even if the drive is moved to another system. What solution should you implement?

• BitLocker To Go

• BitLocker

• Encrypting File System

• VPN using IPSec

Answer explanation

BitLocker encrypts the entire hard drive, ensuring that data remains secure even if the drive is moved to another system. This makes it the best choice for preventing unauthorized access to the HDD.

A technician, who was signed in to a Windows 10 computer as a local administrator, accessed the Local Security Policy console and changed the Lock Screen timeout from 10 minutes to 60 minutes. After the technician completed the change, the user signed in to AD and discovered that the setting had reverted to 10 minutes. What can the technician do to keep the setting from reverting from 60 minutes to 10 minutes?

• The Lock Screen timeout of 60 minutes is not within the allowable range.

• The technician should run the gpupdate /f command on the local computer.

• The Lock Screen timeout setting needs to be made in the AD OU GPO.

• The Lock Screen timeout policy does not apply to Windows 10.

Answer explanation

The setting reverted because Group Policy from Active Directory (AD) overrides local settings. To maintain the 60-minute timeout, the technician must configure this setting in the AD Organizational Unit (OU) Group Policy Object (GPO).

A company asked you to help mitigate the brute force attacks carried out against its users' Windows account passwords. You successfully removed the malware responsible for the attacks and need to better secure the passwords assigned to the user accounts without limiting the system's usability. What options can be included when securing user accounts?

• Change each account type to Administrator.

• Set failed logon restrictions.

• Require user account passwords.

• Require strong passwords.

• Add each user to the Guests group.

Answer explanation

Setting failed logon restrictions helps limit the number of login attempts, while requiring user account passwords and strong passwords enhances security without hindering usability. Changing account types or adding to Guests is not secure.

A Windows 10 Home user is attempting to encrypt the contents of a folder on a volume formatted with NTFS. The user contacted you to ask why the option to encrypt the folder is disabled. What is the most likely reason?

• The NTFS volume is corrupted.

• Windows 10 Home does not support file encryption using EFS.

• The folder is set to read-only.

• The user does not have administrator privileges.

Answer explanation

The option to encrypt the folder is disabled because Windows 10 Home does not support file encryption using EFS (Encrypting File System). This feature is only available in Windows 10 Pro and higher editions.

What is the most likely reason the encryption option is disabled?

• The user account is not a member of the Administrators group.

• The NTFS file system is corrupt.

• Windows Home editions do not support EFS.

• A volume formatted with NTFS does not support EFS.

Answer explanation

The encryption option is disabled because Windows Home editions do not support the Encrypting File System (EFS), which is necessary for file encryption.

Your computer has a single HDD formatted with NTFS with the following data folders: C:\Documents C:\Pictures You create a new child folder under the C:\Documents folder. What term describes the permissions the new folder automatically attains from the C:\Documents folder?

• Inherited permissions

• Explicit permissions

• Allow permissions

• Deny permissions

Answer explanation

The new folder under C:\Documents automatically inherits permissions from its parent folder. This is known as inherited permissions, which allow the new folder to have the same access rights as C:\Documents.

Which of the following best meets the requirements of a strong password?

• t*M8&.zY7

• qwerty1234567890

• p@ssw0rd

• johndoe123

Answer explanation

The password 't*M8&.zY7' is strong because it includes a mix of uppercase and lowercase letters, numbers, and special characters. In contrast, the other options are either too simple or predictable, making them less secure.

You have received several trouble tickets from the employees in the warehouse for the stand-alone computers used to control various shipping machines because the computers are not booting when powered. Each time a technician resolves the booting issue the boot order is changed in the firmware. Each computer is required to have the USB ports disabled in the firmware to keep employees from connecting rogue devices. Which of the following steps should be taken to eliminate these trouble tickets?

• Set a firmware password to prevent unauthorized changes to the boot order and USB port settings.

• Disable the USB ports in the operating system settings.

• Increase the boot priority of the hard drive in the firmware settings.

• Regularly update the firmware to the latest version.

Answer explanation

Setting a firmware password prevents unauthorized changes to the boot order and USB port settings, addressing the root cause of the booting issues and ensuring compliance with security protocols.

Which of the following is the first step in securing the USB ports on a computer?

• Disconnect the USB ports from the motherboard.

• Enable the supervisor password in the BIOS/UEFI setup.

• Require all employees to use a unique Windows user account and password.

• Install a lock on the computer case to prevent the removal of the covers.

Answer explanation

Enabling the supervisor password in the BIOS/UEFI setup is the first step to secure USB ports, as it restricts unauthorized access to BIOS settings, preventing changes that could compromise security.