Review: Device Security (Applied)

A salesperson connects a corporate laptop to a hotel Wi-Fi network. Which network profile should Windows apply to maximize firewall protection?

• Home network

• Domain network

• Private network

• Public network

Answer explanation

Hotel and other untrusted Wi-Fi should be set to Public, which applies the strictest firewall rules and blocks discovery.

A standard user sees a UAC credential prompt while installing accounting software. What should the user do?

• Restart the PC in Safe Mode to bypass the prompt

• Disable UAC temporarily to allow the installation

• Move the installer to the Public folder and retry

• Enter an administrator username and password to elevate

Answer explanation

Supplying admin credentials at the UAC prompt grants the elevated privileges needed for the install. Disabling UAC weakens system security and does not properly grant the necessary rights.

Which mobile device security method allows IT to push policies, apps, and configuration to enrolled phones from a central console?

• Local Security Policy

• Group Policy Objects

• Windows Defender Firewall

• Mobile Device Management

Answer explanation

MDM platforms centrally manage enrolled mobile devices, pushing policies and apps remotely. Group Policy Objects target Windows domain PCs, not mobile phones.

A pop-up claims a user's PC is infected and shows a phone number to call for help. What type of attack is this?

• A keylogger silently capturing typed input

• Social engineering using scareware tactics

• A Trojan horse concealed inside a game file

• A worm propagating itself through the browser

Answer explanation

Fake infection pop-ups use fear to manipulate users into calling fraudulent support lines, a classic scareware tactic. A keylogger silently records keystrokes rather than displaying warnings.

Which TWO controls best protect a traveling laptop if it is lost or stolen? (Select all that apply.)

• Disabling UAC to speed up logins

• Setting the network profile to Private

• Allowing all inbound firewall rules

• Full-disk encryption such as BitLocker

• Multifactor authentication on sign-in

Answer explanation

Full-disk encryption protects data at rest if the device is taken, and MFA prevents a thief from signing in with a stolen password alone. The other options either weaken security or do not address theft scenarios.

Sign-in requires users to insert a physical token and enter a PIN. Which authentication method is this?

• Smart card authentication

• Security question verification

• Password manager auto-fill

• Biometric fingerprint scan

Answer explanation

Smart cards combine a physical card (something you have) with a PIN (something you know). Biometrics use a body trait such as a fingerprint rather than a physical token.

A user's antivirus dashboard shows definitions last updated 21 days ago. What is the most appropriate next action?

• Disable the firewall during the update process

• Switch the network profile to Public

• Reinstall Windows to remove stale definitions

• Force a definition update and run a full scan

Answer explanation

Outdated signatures miss new threats, so updating definitions and running a full scan catches anything that slipped through during the gap. Reinstalling Windows is unnecessary and disruptive.

Why does biometric sign-in improve security compared to passwords alone?

• It eliminates the need for antivirus software entirely

• A stolen password alone cannot replicate the biometric factor

• It removes the requirement for any account lockout policy

• It allows the network firewall to be safely disabled

Answer explanation

Biometrics tie sign-in to the person, so a stolen password alone cannot unlock the device. Other controls such as firewalls and antivirus are still required.

Under a BYOD policy allowing personal phones to access corporate email, which password rule is most appropriate?

• Require a passcode of at least 6 characters with auto-lock

• Allow swipe-only unlock with no passcode required

• Use one shared PIN across all employees for simplicity

• Require no passcode to keep personal use convenient

Answer explanation

A strong passcode with auto-lock protects corporate data on personal devices. Shared PINs and no-passcode options leave corporate data exposed to unauthorized access.

A technician suspects Windows Defender Firewall is blocking a legitimate app during testing. What is the safest approach?

• Switch the network profile to Public during the test

• Remove the user from the local Administrators group

• Turn off the firewall on all profiles permanently

• Create an inbound rule allowing only that specific app

Answer explanation

A targeted inbound rule allows the app while keeping all other traffic protected. Turning the firewall off entirely exposes the whole machine to unnecessary risk.