5.1. Describe Security Threats to the End User, Perform Basic Investigation, and Escalate to the Appropriate Team. 100-140 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A user reports a phishing email to the IT help desk. What information is most important to document before escalating?

   • AThe user's computer's IP address
   • BThe user's job title
   • CThe user's favorite color
   • DThe sender's email address and the time the email was received
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A small business has 50 employees, each with a company laptop. The IT manager wants to reduce the risk of malware infections from email attachments. The company already has a spam filter and antivirus software on each laptop, but users frequently disable the antivirus to improve performance. The manager is considering two options: (1) enforce antivirus settings via group policy so users cannot disable them, or (2) provide training to teach users how to recognize malicious attachments. The manager has a limited budget and needs a solution that addresses the root cause of infections. What is the most effective approach?

   • AProvide training to teach users how to recognize malicious attachments, because user awareness is the best defense against social engineering.
   • BEnforce antivirus settings via group policy, because this prevents users from disabling protection and is a technical control that works automatically.
   • CImplement both group policy enforcement and user training, because this combines technical controls with user awareness to address multiple layers of defense.
   • DReplace the antivirus software with a more expensive enterprise solution, because better technology alone will solve the problem.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A user reports that they received multiple 'failed sign-in' notifications from their email provider, and one notification shows a successful sign-in from a location they have never visited. The user is still able to access their account. What should the user do first?

   • AReply to the notifications to ask the provider to block the unknown location.
   • BChange the account password to a new, strong, unique password and enable multi-factor authentication.
   • CIgnore the notifications because the user can still access the account, so no harm was done.
   • DDelete the notifications and continue using the account, since the failed attempts were probably typos.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A user receives a call from 'Microsoft Support' saying their computer has a virus. The caller asks the user to install a remote-access tool so they can fix it. The user is unsure if the call is legitimate. What is the best course of action?

   • AHang up and report the call to the company's IT security team.
   • BInstall the remote-access tool to let the caller check the computer.
   • CAsk the caller for their Microsoft employee ID to verify.
   • DRun a malware scan while on the call to see if the computer is infected.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the purpose of DNS spoofing?

   • ATo forge the sender address of an email
   • BTo encrypt network traffic
   • CTo make a phone call appear to come from a different number
   • DTo redirect users to a malicious website without their knowledge
   Reveal Solution Discussion Select an answer first