220-1102 exam dumps: questions 401 to 500 of 828

Correct answer: A

• A. Correct.

  Correct. Kerberos authentication is time-sensitive and depends on the client and domain controller having closely synchronized clocks. In Active Directory environments, a time difference greater than the allowed skew can cause ticket requests or ticket validation to fail, even when the user's credentials are correct. Correcting the laptop's time and syncing it with the domain time source is the most likely fix.

• B. Incorrect.

  Incorrect. NTFS and share permissions control authorization, not the Kerberos authentication process itself. If the problem is caused by clock skew, changing file permissions will not resolve the underlying ticketing failure and would create an unnecessary security risk.

• C. Incorrect.

  Incorrect. A bad network adapter driver might cause connectivity problems, but the scenario indicates the laptop is joined to the domain and the user can sign in, which suggests general network communication is working. The specific clue is the 12-minute clock difference, which points to Kerberos time synchronization rather than a driver issue.

• D. Incorrect.

  Incorrect. LDAP is a directory access protocol, not a replacement for Kerberos authentication in this scenario. In a Windows domain, Kerberos is the default authentication protocol for domain logons and access to domain resources. Changing authentication methods on the server would not be the proper first-line fix for a client clock skew issue.

Correct answer: C

• A. Incorrect.

  This is incorrect because a password alone is single-factor authentication, not multifactor authentication. Even if the password is complex and rotated regularly, it does not satisfy the requirement for a second factor. This reflects a common misconception that stronger passwords can replace MFA.

• B. Incorrect.

  This is incorrect because, although SMS codes can be used as a second factor, the scenario specifically states that the office manager does not want to rely on SMS delivery or personal mobile devices. In addition, SMS is generally considered weaker than app-based or hardware-token-based methods due to risks such as SIM swapping and message interception.

• C. Correct.

  This is correct because a hardware token provides a separate authentication factor based on something the user has. Time-based one-time password (TOTP) tokens are practical in shared-workstation environments and do not depend on employees having company phones, personal phones, or cellular service. Assigning each employee an individual token preserves accountability and supports stronger authentication practices.

• D. Incorrect.

  This is incorrect because a shared recovery code defeats individual accountability and creates a serious security risk. Recovery codes are intended for exceptional account recovery, not routine sign-ins, and should be protected carefully. Leaving one in a desk drawer would allow unauthorized access and undermine the purpose of MFA.

Correct answers: A, C

• A. Correct.

  Correct. Booting into Safe Mode can prevent many nonessential startup items and malware processes from loading, making malicious software easier to detect and remove. Running updated anti-malware tools in this reduced environment is a standard best practice when malware is actively resisting removal or interfering with tools such as Task Manager.

• B. Incorrect.

  Incorrect. Although restore points can sometimes contain infected files, disabling System Restore permanently is not an appropriate first action. In many standard malware-removal workflows, a technician focuses first on containment and scanning. System Restore may be addressed later as part of remediation, but removing a recovery option before assessment is not the best initial step.

• C. Correct.

  Correct. Disconnecting the device from the network helps contain the threat by preventing further command-and-control communication, data exfiltration, malicious downloads, or spread to other systems. Isolation is one of the first steps in handling suspected malware on an endpoint.

• D. Incorrect.

  Incorrect. Deleting temporary files may remove some nuisance files and can slightly speed up later scans, but it does not address active malware processes or containment. It is not one of the best first actions when the system shows signs of rogue security software or browser hijacking.

• E. Incorrect.

  Incorrect. Reinstalling the browser may not remove the underlying malware, especially if the issue is caused by adware, a trojan, malicious startup entries, or system-level persistence. This action treats a symptom rather than the likely root cause.

Correct answer: B

• A. Incorrect.

  System Restore may be useful later in remediation, but it is not the first step. CompTIA malware-removal best practices emphasize identifying symptoms and quarantining or isolating the affected system before attempting changes. Restoring too early could fail, spread the infection further if the machine remains connected, or leave active malware in place.

• B. Correct.

  This is correct. When malware is actively affecting system behavior and the device remains connected to the company network, the first priority is containment. Disconnecting the system from the network helps prevent lateral movement, data exfiltration, command-and-control communication, or infection of shared resources. This aligns with standard incident response and CompTIA's malware-removal methodology to identify and isolate the infected system before remediation.

• C. Incorrect.

  Changing browsers does not address the underlying malware. The pop-ups, homepage changes, and disabled tools indicate system-level compromise, not just a browser issue. A technician might pick this if they assume the problem is limited to adware in one browser, but the broader symptoms show the infection is affecting the operating system.

• D. Incorrect.

  Removing a suspicious program can be part of cleanup, but it is not the first action while the system is still connected to the network and actively compromised. Also, some malware does not appear cleanly in Programs and Features, and attempting removal before isolating the device may trigger additional malicious activity or fail because the malware is still running.

Correct answer: A

• A. Correct.

  Correct. A Trojan often opens backdoors, downloads additional malware, or communicates with command-and-control systems. The first priority is containment: isolate the infected system from the network to reduce data exfiltration, lateral movement, and further downloads. After isolation, the technician can proceed with standard malware-removal steps such as updating antimalware tools if possible, scanning, quarantining, and validating system integrity.

• B. Incorrect.

  Incorrect. Clearing browser data may remove some nuisance artifacts, but it does not address the underlying Trojan infection. The scenario includes suspicious outbound connections when the browser is closed, which indicates malware activity beyond normal browser behavior.

• C. Incorrect.

  Incorrect. Disabling UAC reduces system security and can make the situation worse by allowing malware or tools to run with fewer prompts. Best practice is to keep security controls enabled and use proper administrative procedures during remediation.

• D. Incorrect.

  Incorrect. Temporary-file cleanup can be useful later in a malware-removal process, but it is not the first action when a Trojan is actively communicating externally. Containment takes priority over general system maintenance.